Economists have estimated the cost of manual offline identity proofing could be as high as £3.3 billion per year. The UK government has published draft rules governing the future use of digital identities. Digital identity products allow people to prove who they are, where they live or how old they are. The government says that they ”are set to revolutionise transactions such as buying a house, when people are often required to prove their identity multiple times to a bank, conveyancer or estate agent, and buying age-restricted goods online or in person”.
The draft framework forms part of the government’s plans to make it quicker and easier for people to verify themselves using modern technology and create a process “as trusted as using passports or bank statements”. It sets out rules organisations should follow, including the principles, policies, procedures and standards governing the use of digital identity. The framework, once finalised, is expected to be brought into law. It has specific standards and requirements for organisations which provide or use digital identity services including:
- Having a data management policy which explains how they create, obtain, disclose, protect, and delete data;
- Following industry standards and best practice for information security and encryption;
- Telling the user if any changes, for example an update to their address, have been made to their digital identity;
- Where appropriate, having a detailed account recovery process and notifying users if organisations suspect someone has fraudulently accessed their account or used their digital identity;
- Following guidance on how to choose secure authenticators for their service.
Organisations will be required to publish a yearly report explaining which demographics have been, or are likely to have been, excluded from their service and why. The move will help make firms aware if there are inclusivity problems in their products while also boosting transparency.
The framework will also help promote the use of ‘vouching’, where trusted people within the community such as doctors or teachers ‘vouch for’ or confirm a person’s identity, as a useful alternative for those without traditional documents, such as passports and driving licences.
The trust framework forms part of the government’s commitment to taking a leading role in developing the digital identity market without the need for national identity cards. The Department for Digital, Culture, Media and Sport will work with the digital identity community to develop the framework and aims to publish the next iteration in the summer. DCMS continues its work on proposals on laws that will underpin the digital identity market and will consult on these later this year. It says that it has more work to do on the governance structure to protect consumers and make sure the trust framework delivers on its intended benefits. It also plans to clarify how liability is managed throughout the process.
The government says that the trust framework approach is gaining traction globally – Canada, Australia, Sweden and New Zealand are taking this route. As a result it says that it will work with international partners to make sure UK standards are interoperable with those adopted abroad, so in the future people can use their digital identity around the world and UK businesses can trust digital identities created elsewhere.
The consultation ends on 11 March 2021.
