Skip to content

Report of the Digital Government Review


3. Personal Data and Identity Assurance

So far, there are no comments on this section. Jump to comments

“Data that relate to a living individual who can be identified from that data”; a secure, convenient way for you to prove you are who you say you are when using government services.

Identity assurance is important for many reasons. An identity assurance solution that works for people and government needs to allow people to interact with government in a confident and secure manner. It should be a reusable component that could be used to confirm people’s identity when logging onto multiple services – benefits payments, pensions, driving licence renewal, voter registration, planning applications, or to view and edit their personal data.

The current government has launched an Identity Assurance Programme [76] branded GOV.UK Verify. Billed as “the new way for you to prove who you are online, so you can use government services safely,” it takes a federated approach to identity assurance. Rather than a single database a federated approach allows multiple distinct identity providers that each conform to common standards providing both greater choice to the person who is assuring their identity and increased privacy. Individuals can even choose to use different identity providers for different transactions.

In the case of GOV.UK Verify this means that a list of certified organisations – from which people can pick their preferred organisations – are used to verify people’s identity to government. With the exception of the Post Office all of the current choices are outside the public sector.

The federated approach to identity assurance seems a good long-term technological approach to this area, it provides privacy and choice to those who want it. While the principles behind the federated model [77] will provide future-proofing in line with expectations of changing needs of the future.

Unfortunately the programme is running significantly behind the initially committed schedule of a launch in Autumn 2012 [78]. At the time of writing the service is being used with only one digital service (Defra CAP Payments) and one identity provider (Experian). The people using the service are suffering issues [79] and there do not appear to be alternative or Assisted Digital routes. Government has announced rollouts plans for the next 6 months [80] and the absence of any service outside of those provided by central government is noticeable.

Even if all central government services are switched to GOV.UK Verify people will still have to retain multiple identities for those public services that are provided by other public sector organisations or by public sector delivery partners. As a simple, but significant, example it is unclear whether GOV.UK Verify will replace or integrate with the mygovscot service that launched in Scotland in April 2014; or even if identity assurance is a devolved service [81].

Meanwhile some potential flaws with the chosen model are coming to light. It is estimated that at most 75% of the population can be served by the current solution due to the need for people to have either a UK driving licence or a credit history [82]. In the absence of traditional or assisted digital routes [83] for these services then some citizens will be excluded. Meanwhile the privacy experts that advised Cabinet Office on the service have written a letter to the Cabinet Office highlighting their own concerns: [84]

‘We have recommended that all existing powers of data access or disclosure should be re-approved by Parliament as these powers have themselves been transformed by modern technology. We also call for effective forms of redress, and for an effective regulatory and judicial oversight over the use of such powers.

‘Public support for virtual identity will depend on trust and understanding. Our Nine Principles are designed to build that, but will only do so if members of the public know what they are, and that the authorities will obey them. That is why we have asked that, after the testing phase, the principles are written into law to ensure their general application.’

There has been no public response to this letter and its call for both greater awareness and legislation. It is noticeable that the strong privacy principles and federated approach are only being applied to the identity assurance service, whilst other departments and services continue to progress with centralised approaches [85]. This is something that our review into “Data and Society” would address.

As well as the impact to people caused by the failure to implement identity assurance we do not doubt that these delays have had a knock-on effect and cost in both central and local government due to changing release plans and delayed savings. It will cost public sector organisations time, money and effort to revisit services to align them with GOV.UK Verify when it is launched and stable.

Given the continuing delays and the significance of this component of the digital strategy, we have to recommend that if the identity assurance programme is not in a more stable position before the next government takes office that it investigate and publicize the reason for the delays before committing to how to proceed.

It is possible that the reason is the need to stimulate the market for identity providers by committing to integrate the new identity assurance approach into new government services. It is possible that the complexity of the proposed solution is simply too high. There is insufficient public information to form an opinion at this time, but the continued delays do cause concern.

Secondly, we were extremely surprised to observe that all of the identity providers were from the private sector [86].

Considering both the predicted economic value of identity in the future [87] and the fact that government is currently the identity provider for most public services it seems that many people would actively prefer that a public sector or not-for-profit organisation act as their identity provider.

There are other reasons why people might a non-private sector provider. It could be as people have the greater trust in the public sector than the private sector [88] to protect their personal information and would see any data transfer as an extra risk with an unnecessary cost.

It could be because people realise that their ‘root’ identity provider is the government, after all as with the Know Your Customer (KYC) rules used in areas such as financial sector the best source of identity is often government-issued documents such as driving licences and passports [89].

Given this, the insertion of private sector organisations into the identity assurance path will seem unnecessarily circular to many people. The value being added seems hard to identify when it would be technically feasible for a public sector or not-for-profit identity provider to exist within the framework whilst still adhering to the same privacy and confidentiality rules as the private sector providers.

Such an identity provider seems to be a choice that many people would choose to take [90]. A public sector provider would also provide an easier support path for people in need of assisted digital services to receive crucial public services, for example pensions or benefits payments, as all of the responsibility for delivering the service will remain within the public sector.

Technology fails sometimes. In a federated model with external identity providers the cause of failure could be with the person (maybe they are mistyping their password?); it could be with the identity provider (maybe one of their IT systems has failed?); it could be with the public sector (maybe one of their IT systems has failed instead?). Resolving a failure might require the person requesting the service to work through the help functions of each of these organisations with their differing motivations and support structures before they can reach the public service that they are trying to use.

The impact of the failure could be severe: for example the inability to receive the money needed to pay for heating or to buy food. Who will step in in this situation? How will people be both compensated and supported through any crisis that may occur?

Government must ensure that there are appropriate support and dispute resolution paths in place for these failures.

Recommendation 13

Priority: High

That government urgently deliver on the Identity Assurance programme.

Investigating the reason for ongoing delays; the potential need for legislation, the dispute resolution and support structures in place in case of failure; the audit structures to ensure that data is kept secure; and the potential demand for non-private sector identity providers before committing how to proceed. Any report on these items should be openly published.

“It should be policy that the citizen will have an opt out wherever possible, rather than only when government is grudgingly compelled to admit that it was necessary.” – Civil Society Organisation

[76] https://gds.blog.gov.uk/category/id-assurance/
[77] The Privacy and Consumer Advisory Group (PCAG) developed the principles. The members of this group are unnamed. https://www.gov.uk/government/consultations/draft-identity-assurance-principles/privacy-and-consumer-advisory-group-draft-identity-assurance-principles
[78] The earliest date that we could find is Autumn 2012 http://www.computerweekly.com/news/2240105591/Identity-assurance-how-it-will-affect-public-services-and-your-personal-data
[79] See comments in this blogpost https://capreform.blog.gov.uk/2014/10/17/introducing-gov-uk-verify-replacing-government-gateway/
[80] https://identityassurance.blog.gov.uk/2014/10/29/the-next-6-months-services-that-plan-to-start-using-gov-uk-verify/
[81] https://signin.mygovscot.org/home/
[82] https://gdsdata.blog.gov.uk/gov-uk-verify-service-assessment/
[83] As this blog states it is the responsibility of the individual services to put in place assisted digital support. As the Defra CAP Reform blog shows some services will fail in this task https://identityassurance.blog.gov.uk/2014/10/21/assisted-digital-support-for-people-using-gov-uk-verify-to-access-government-services/
[84] http://dooooooom.blogspot.co.uk/2014/11/protecting-privacy-in-govuk-verify.html
[85] http://central-government.governmentcomputing.com/news/hmrc-plans-to-create-single-data-hub-4440010
[86] Other than the Post Office that, unfortunately, anecdotal evidence shows that many people incorrectly assume to have been privatized along with the rest of the Royal Mail.
[87] http://www.libertyglobal.com/PDF/public-policy/The-Value-of-Our-Digital-Identity.pdf
[88] See questions 2_1 and 2_2 in http://www.jrrt.org.uk/sites/jrrt.org.uk/files/documents/IpsosJRRTprivacypollMay2014full.pdf
[89] http://www.hmrc.gov.uk/mlr/your-role/resposibilities.htm “The best way to do this is to ask for a government issued document like a passport, along with utility bills, bank statements and other official documents”
[90] We suspect that a co-operative or mutual provider would be a good option

This page reformats automatically when printed. Print this section

Please note that comments left here are public - you can also make a private submission.

Your email address will not be published. Name, email address and comment are required fields. Please note we may moderate comments.