The UK Government sets out plans for governing digital identities and launches a consultation on a UK digital identity and attributes trust framework

UK - ONLINE PROTECTION AND EDUCATION

The UK Government has set out its plans for, and opened a consultation on, governing digital identities and attributes as well as an early working prototype of the trust framework. This is intended to lead to a legal regime where digital identities and attributes can be created and used in an interoperable manner while respecting the privacy of data subjects.

Key date(s)

• 15 September 2019 – The UK Government publishes a call for evidence to support the development and secure use of digital identities closed (having run for two months) (the “Digital Identity Call for Evidence”).
• 11 February 2021 – Following the UK Government’s response to the Digital Identity Call for Evidence (which developed principles on framing the UK’s digital identity policy on 8 September 2021) (the “Response”), the Government publishes the policy paper ‘The UK Digital Identity and attributes trust framework’ and sought feedback on it.
• 19 July 2021 – A consultation on digital identity and the governing body which will oversee the rules on digital identity opens (the “Consultation”).
• 2 August 2021 – The Government publishes a second iteration of the policy paper ‘The UK Digital Identity and attributes trust framework - alpha version 2’ (the “Policy Paper”).
• 13 September 2021 – The Consultation will close, following which draft legislation is expected to bring the framework into law.

Status

• In 2019, the Government began considering action in relation to how individuals can provide identities, and in so doing prevent fraud and crime, in the digital environment. In an increasingly digital world, such proof is required for a range of online activities from purchasing goods and services, to accessing age-restricted products, to other verified transactions.
• The Government therefore considered that the development of a trusted digital identity which is simple, protects personal data, and is secure would support innovation, reduce fraud and cost, streamline online services, and enable people to prove who they are, where they live or how old they are. By leveraging the use of digital identities the Government hopes to encourage growth in the UK’s £149 billion digital economy.
• The Digital Identity Call for Evidence garnered views on these aspects and the Response indicated an intention to create a clear framework of rules on ‘good’ digital identities, establishing a governance and oversight function on these rules, and developing proposals to remove legislative and regulatory obstacles, amongst other things.
• The Government published the Policy Paper setting out draft rules for governing the future use of digital identities. The proposed ‘trust framework’ is a set of rules and standards which organisations would agree to follow. If an organisation is part of the digital identity trust framework then they signal that they follow agreed requirements which safeguard data and protect privacy. This forms part of the Government’s commitment to taking a leading role in developing the digital identity market without the need for national identity cards.
• The trust framework envisioned by the Policy Paper is an industry prototype (or an ‘alpha’) to facilitate a collaborative approach and testing with services, industries, organisations and potential users.
• The Consultation will cover the legislative and governance arrangements which are needed to make sure the trust framework is ready for use in the economy.

 What it hopes to achieve 

• The Policy Paper lays out the draft rules organisations would be expected to follow. It includes principles, policies, procedures and standards governing and the use of digital identity to allow for the sharing of information to check people’s identities or personal details, such as a user’s address or age, in a trusted and consistent way.
• The intention is that this will enable interoperability and increase public confidence in digital goods and services provision. One reason why this does not happen currently is that individual organisations do not know others creates digital identities or attributes.
• A system by which individuals have, and feel confident in using and sharing, pieces of trusted information with organisations is intended to reduce the risks of physical processes (e.g. the loss of documents) and accelerate activities where verification of data is required.

Who does it impact? 

• The current prototype of the UK digital identity and attributes trust framework envisioned by the Policy Paper will impact organisations that want to provide or consume a digital identity in order to provide products and services to individuals on the basis of such digital identity.
• Individuals who interact and undertake transactions online and in person would be able to use their digital identity (i.e. a digital representation of that person made up of ‘attributes’ (pieces of information which describe the person such as a bank account number, NHS number etc.)) to do this.

Key points 

1. Standards for organisations providing digital identity services

• • The framework proposed by the Policy Paper sets out a range of specific standards to be followed by organisations providing digital identity services such as ensuring interoperability with other services, strong information management processes (e.g. disposal schedule or data management and archiving policies), risk management and fraud prevention procedures, effective security (e.g. encryption, detailed account recovery processes, and notifying users of changes made to their digital identity), and an approach to protecting personal data which is by design and by default.
  • Such standards are intended to follow current industry best practice standards for the handling of information.

2. Yearly report on diversity and inclusion

• • Under the framework, organisations will have to publish a yearly report explaining which demographics have been or are likely to have been excluded from their services and why in order to make firms aware of inclusivity problems in their products while boosting transparency.

3. Use of ‘vouching’ promoted

• • The framework encourages the use of ‘vouching’ where a designated list of trusted people (which includes individuals such as doctors, teachers etc.) can ‘vouch for’ or confirm a person’s identity.
  • The intention is that this could be a useful alternative where traditional documents such as passports and driving licences may not be available.

This blog post provides an overview of a key recent or upcoming development in digital regulation in the UK or EU as part of our horizon scanning timeline which can be found below.

Contacts

VIEW DIGITAL AND REGULATION TIMELINE  +