Government to introduce digital ID legislation
But there is no plan to introduce mandatory ID cards, DCMS says
The government has announced that it intends to introduce new legislation that will improve the security of people's digital identity while making them more trusted.
The proposed identification system, according to the government, will lessen dependence on traditional physical documents such as driving licences and passports and make it simpler for individuals to prove their identity through digital ways.
The announcement was made by the Department for Digital, Culture, Media and Sport (DCMS) last week, following a public consultation process.
The DCMS received around 270 responses from various parties with interest in the digital identity sector, including industry organisations, identity and attribute suppliers, regulators and civil society.
As part of the plan, the government intends to create a new Office for Digital Identities and Attributes (ODIA) within the DCMS to serve as an interim governing body for digital identities.
The ODIA will have the authority to issue an easily recognised trustmark to certified digital identity organisations. This will help organisations prove they meet the security and privacy standards needed to handle people's data in a safe and consistent way.
The new law would also provide a legal framework that will enable trustworthy organisations to conduct identity verification checks against official data maintained by government agencies.
The government says it is not proposing a system that could lead to the introduction of mandatory ID cards. Many people who responded to the public consultation said they were opposed to the roll-out of a mandatory ID card.
The government has taken note of this and says it is committed to ensuring that digital identities are not made compulsory and that individuals may continue to utilise their existing paper documentation.
"The government also understands that there is no public support for ID cards in the UK and has no plans to introduce ID cards," it added.
The DCMS believes the digital identities will be helpful in combating the record high levels of online frauds in the UK.
Last year, an annual tracking survey (Information Rights Strategic Plan: Trust and Confidence) commissioned by the Information Commissioner's Office (ICO) revealed that people in the UK are struggling to control the use of their personal information, despite being aware that protecting their personal data is important.
The survey found that the use of peoples' personal information for scams or fraud is a major concern. Less than a third of respondents (28 per cent) said they had high trust and confidence in organisations and firms storing and using their personal information. A similar proportion (29 per cent) said they had low confidence.
Last year, the National Cyber Security Centre (NCSC) said it took down more online scams in 2020 than in the previous three years combined. The agency recorded a massive 15-fold increase in the removal of online frauds in 2020 compared with 2019.
Commenting on the DCMS' latest announcement, Sue Daley, Director for Technology and Innovation, techUK said: "Today' announcements are a positive step forward in the UK's implementation of digital identity. techUK has welcomed DCMS's efforts in working with industry to get us to where we are today.
"Given the next steps now being taken, continued cooperation between industry and government remains the best chance for a successful implementation of a digital identity ecosystem in the UK. However, we must also ensure we bring citizens on this journey with us: building public trust and confidence in Digital ID must be a key priority as we move forward."
The current proposals rely on certified trusted authorities to manage citizens' identity, in the manner of the failed Verify scheme, rather than a decentralised scheme advocated by some identity experts and tech companies including Microsoft.
Nick Lambert, CEO of blockchain-based digital ID company Dock, welcomed the fact that the government is addressing the topic of digital ID "as this technology is moving quickly and will have a huge impact on all our lives moving forward. However, the announcement is very high level at this stage and as ever the devil will be in the detail."
He questioned the type of access that will be given to the approved verifiers, which will include private companies, whether the data they can see will be entire records or just specific details, and how they will secure such highly sensitive data from hackers and leaks. Ultimately it's a question of who's in control, Lambert said.
"What the government must provide, in partnership with private companies and individuals, is that the individuals themselves be given control of their own identity data, potentially stored in digital wallets that they control access to. This will ensure that data is private and is stored on the individual's device, rather than in a huge centralised government data store that will surely be an irresistible honey pot for hackers."
Computing says:
The GOV.UK Verify platform was an expensive failure that was undermined by different departments within Whitehall itself, and failed to excite the interest of the public. On the face of it the proposed scheme looks similar in its use of trusted bodies as guardians of identity, although few details have yet been made public. Given the complexity and lack of joined up thinking around identity, and the onward march of technology, it is to be hoped the new solution will learn from past mistakes.