Establishing Trust Through Standards, Governance And Legislation

Thank you Oric and hi, well thank you for inviting me to this event everybody. My name is John Peart, I am the Assistant Director for Market Oversight and Integrity in the UK Government's Office for Digital Identities and Attributes, which is a part of the Department for Science, Innovation and Technology. I'm delighted to be able to speak at this conference after a year's delay, Establishing Trust Through Standards, Governance And Legislation.

In the UK, as with many countries around the world, proving who you are and things about yourself is difficult. The UK doesn't have a national identity register and we don't have a system of identity cards as many countries do and rely upon, so to prove our identities we use a patchwork of documentation from both the private and the public sector. Things like passports, benefits letters, bank statements, utility bills, you'll know the drill and in this audience you don't need me to tell you that this is a bad experience for individuals and it's also costly for businesses.

It's repetitive and time-consuming, individuals have to prove their identity every time they interact with a service across the economy and they often have to do that face-to-face and those identity checks themselves cannot be reused when interacting with different services or different businesses and it's also fraught with risk.

For individuals it creates privacy and identity theft risks because we're disclosing huge amounts of data to prove who we are and for the businesses that rely upon that data they're carrying the risk of holding on to that data and often need to establish whether the documents they're looking at are even genuine in the first place. And we know there's a better way than this. Digital identities offer a solution to those issues and more.

Digital identities can give individuals and organizations more choice about how they prove things about themselves without the need for any physical documentation whatsoever and they have the ability to make people's lives simpler, save businesses time and money and unlock economic growth. And not only that, they're not only good for individuals and businesses but they're also good for the economy as a whole. Digital identity products and services enable wholly digital transactions, create huge efficiencies for businesses and for individuals and open up new opportunities for innovation.

In the UK we estimate that the use of digital identities across our economy could equate to around 701 million pounds of economic benefit. 701 million pounds of economic benefits every single year and that analysis is based on only four use cases including international travel and employment. There are likely to be dozens if not hundreds of more use cases and so the potential benefits are much much larger. But these are not new arguments.

We've known about the benefits of digital identity products for years and so the question that we were confronted with is if they're so good why doesn't everybody already have one? Why do countries including the UK historically have struggles with getting people to trust and adopt those products and in the UK we think the problem that's fundamental to all of this is trust. In Britain we see that our population want to be online and they want to use digital tools to make their daily lives easier. In the public sector our answer to that problem has been to develop the gov.uk one login system.

The UK government's rolling out this service now as a secure way to prove who you are when accessing central government public services. But what about beyond public services? Most people, unless they're unfortunate enough to be a public servant like me, most of the time spend most of their lives interacting with private sector services and they need to prove who they are to those services repeatedly in order to access them. And as I mentioned before the UK doesn't have a national centralised system that it can rely on to do that.

A significant proportion of the UK's population have historically had concerns about the introduction of a system like that and so we are clear we're not introducing one. But if we don't have one, if we don't have that national identity system, how do we support businesses across the whole economy to check identity?

How do you make it possible to use digital identity services for relatively simple transactions like proving your age when buying age-restricted products like alcohol or tobacco or for more complex transactions like proving that you have the right to work, the right to rent a property, to open a bank account or to buy a home? Well, we want to create a trusted ecosystem that everyone can rely on. That means giving people a choice about how they prove their identity and it means that we have to develop a system that has privacy and security at its heart.

And so we're building a trusted ecosystem of digital identity services, some provided in the public sector and some provided in the private sector. We've recently committed to giving every British citizen access to a secure government-backed app in which they can store digital credentials, the gov.uk wallet. The first credentials, a mobile driving licence and a veteran's card will start coming online during the course of this year and there are plans to digitise further credentials through to 2027.

The gov.uk wallet will be securely bound to each individual that uses it through the gov.uk one login system that I mentioned a few moments ago. And for those who want to have the option to use a digital identity but not the government solution, we are enabling a market of trustworthy private sector providers to give people the choice to find an identity service that best meets their needs. Regardless of which solution you choose, those products will be standards-based and those services will be independently assured and underpinned by government legislation.

But with all of that choice comes complexity. When there are so many digital identity products on the market that you could use, how does an individual or a business know which digital identity products to use? Trust. What is the UK government doing to build trust in those services across both the public and the private sector? For the past four years in the UK, we've been doing extensive engagement and public consultation and we've been actively testing an approach to building trust in these services with individuals and businesses across the UK economy.

And we've established that to build trust, you need four things. First, you need consistent rules for everyone to follow. So that digital identity products and services are good enough and that they can interoperate safely and reliably.

Second, you need a process to provide assurance that those rules are actually being followed. Third, you shouldn't have to understand the complexity of those rules. You need easy ways for businesses to know that a digital identity product has been assessed against those rules in the first place. And finally, you need to make it possible for the private sector to back up its services using government-held data to turbocharge the market and make it inclusive.

So the four things, consistent standards, assurance that the rules are being followed, ways to check that those rules are being followed and to grow the market. If we can fix those four things, you can build a scalable, interoperable, trusted ecosystem without any need for a centralised government identity database. And as I say, for the past four years, we've been working to address those challenges. We've created consistent rules for the digital identity services that are built and used in the UK.

The UK Digital Identity and Attributes Trust Framework is a technology agnostic set of rules that define what a good quality identity service looks like. For the first time in the UK, digital identity providers have consistent vocabulary to describe a consistent minimum standard to work towards. Those standards enable safe, secure, privacy-protecting and interoperable services. And where the Trust Framework sets a general standard for the creation of a digital identity, sometimes that's not enough.

So we've created something that we're calling Supplementary Codes to build on top of that Trust Framework and apply its general rules to specific and often regulated use cases. We have three Supplementary Codes and use cases live in the UK already, and I'll come back to those in a minute. But for now, live in the UK already, and I'll come back to that later on. To address the second challenge around giving assurance that the rules are being followed, we've created a certification process.

We've worked with the UK's national accreditation body, the UK Accreditation Service, to create a process that leverages the same international quality systems that we all rely on already every day. Conformity assessment bodies, some of which are in this room, are able to independently evaluate the quality of digital identity products against those rules that we've created. We're making it easy for individuals and businesses to know that a service has been independently certified. The UK government hosts a register of services that have been through the certification process that we've created.

The register's available today on gov.uk as a digital service, and at the moment, it's just a simple set of webpages. But over the course of the next year, we will be developing a public API to enable real-time checking of who is and who is not trusted as a service provider within the UK's ecosystem. Later this year, services on that register will also be granted a new government-issued trust mark.

Together, we think that the register and the trust mark will make it easy for anyone, whether an individual or a business, to check whether a service is trustworthy within seconds. To answer that final challenge, we're supporting the market to grow more widely through secure access to government-held data. Through a tightly regulated legal framework, service providers on that new register and with that trust mark will be authorized to receive data from government departments to support their identity services if the person about who the data is has requested it.

Our intention is that this new information gateway will make it easier for individuals who don't have driving licences or passports to verify their identity by combining authoritative data across both the public and the private sector. And we're also supporting growth by developing new use cases so citizens can use their digital identity service in more places across the UK economy as a whole. And so those are the building blocks of the UK's trusted ecosystem and market.

These activities obviously require robust governance and oversight mechanisms, and the UK government has introduced the Data Use and Access Bill, which has almost finished its journey through the UK Parliament, and will place all of this on a legislative footing. We've also established the new Office for Digital Identities and Attributes, which is where I work, within the UK government's Science, Innovation and Technology department to operate everything effectively. And this is not just some grand vision for something that hasn't happened yet.

As I mentioned, this has been something that we've been actively doing for the past four years. We've already published four versions of the trust framework, with our latest gamma version ready to come into effect shortly. We've already created three supplementary codes for the regulatory use cases that I have mentioned. Right to work, right to rent, and criminal records checks.

Conformity assessment bodies are already certifying against these rules in parallel to obtaining accreditation from the UK Accreditation Service, and we already know that all of that works because we're actually doing it. There are now 57 certified services operational in the UK that have been evaluated against those rules and through that framework, and those services have already been used to conduct millions of digital identity checks across the UK.

We haven't taken anything away from people that don't want to use digital identities, but hundreds of thousands, if not millions, of people in the UK are now using these services, and many of them are choosing to use those services rather than the manual alternatives. Earlier in this presentation, I asked if digital identities were so great, why don't we already all have them? And I proposed that the problem was trust.

Whilst we still have a long way to go before we have truly widespread adoption, both in the UK and elsewhere, people are choosing to use digital identity products in the UK at a scale that has previously never been achieved. And when we finish the process of passing our domestic legislation and commence its provisions later this year, we'll be enabling that ecosystem to start to scale up. The problem was trust. I propose that through a framework of standards, governance and legislation, it is possible to build digital identities that people do trust and prefer to use.

The problem was trust, and we think we've found a way to build it and keep it. There's my email address, if you'd like to get in touch to talk about any of that, but thank you very much. Fantastic.

Thanks, John, for being on time. Good presentation.

Oh, I love presenters who are on time. You mentioned your outreach programmes. I was just wondering, how is the government communicating the value of digital identity, not only to individual citizens and everyday users, but to small businesses?

So, the ecosystem that we've created at the moment relies upon that register and that trust mark that we're going to be putting on a legislative footing over the course of the next year. It's already been available for the past two or three years, so we've been able to drive people's attention towards that register as a mechanism of them finding a trustworthy service. We know from the organisations that have gone through the certification process and have appeared on that register, it is driving purchasing decisions across the UK's market.

So, that's been really critical to starting to achieve the scale that we have seen. We're also very focused on a process of public consultation as we go about building this ecosystem as well, in particular with respect to open policymaking.

Often, with government initiatives, those things are done behind closed doors and with ivory tower views on the world. In this instance, we've actually gone out and spoken to real humans in the real world to see what they think about these products and face the policy around that.

So, that's at the heart of everything we've done, is an open policymaking approach to building trust in these digital identities. Obviously, being in Europe, we're getting some questions around EIDAS.

So, are you cooperating with the EU? It sounds like you're re-implementing EIDAS. A lot of what you do looks similar to the EU framework. Are you getting inspiration or future cooperation there?

Obviously, there are commonalities between the approaches that we've got with lots of countries around the world, including the EU as our closest physical partners. We are taking an approach at the moment that is very much focused on trying to make sure that the UK's domestic ecosystem is safe, inclusive, secure, and privacy-protecting. Once we've figured that out, we will then start to talk to other countries and other international groups like the EU to try and figure out how we can interoperate.

That's certainly our objective, is to have UK identities that work abroad, and vice versa, to have EU identities that work in the UK. We're not quite ready yet to start implementation conversations, but when the EU is ready to talk to us, we will obviously be talking to them.

Okay, great. In the interest of time, let's move on. Thanks very much, Jean-Pierre.