Yoti—written evidence (DRG0012)

House of Lords Communications and Digital Committee inquiry into Digital Regulation

Introduction

Yoti is a global identity, verification and biometric technology company. We provide identity and verification solutions to organisations (businesses, governments, charities) and individuals. Yoti is also the name of our flagship consumer app: the Yoti app.

The Yoti identity verification platform allows organisations to verify who people are, online and in person. We count circa 10 million installs of the Yoti app, following our launch in November 2017.

We have five core Yoti solutions[1]

1)    Identity verification;

2)    Age verification;

3)    E-signatures;

4)    Authentication; and

5)    Digital ID via the Yoti app

The CEO and Co-Founder of Yoti is Robin Tombs.

Our consumer-focused products

The Yoti app[2] helps consumers prove who they are and confirm the identities of others. We distinguish ourselves with our approach to privacy and security: Yoti’s system has been architected so that it's impossible for us to monetise users’ personal data. Set-up involves a four-minute process, where you link your facial biometrics to your phone and validate against your driving license/passport. Identities are verified using NIST-approved facial recognition technology, government issued identity documents and where possible, biometric passport chips.

Once you've completed set-up, your Yoti wallet securely holds the verified attributes of your identity, such as Date Of Birth, gender, nationality. You can then use the app to scan QR codes to pass specific attributes to other people/organisations/websites.

Our platform solution allows consumers to create a reusable digital identity profile that they can use anywhere across mobile and web services that have integrated Yoti into their systems. Yoti enables businesses to verify consumers’ identities using biometrics and government-issued IDs. Yoti also offers an embedded Yoti Doc Scan service within the organisation’s app and website flows, to allow consumers to present their ID document, which can be digitised and the document checked for authenticity.

Our business-focused products

Yoti’s business model is very transparent. It is free for consumers and for eligible non profit organisations.

Businesses can use Yoti age verification when selling age-restricted goods or services. Yoti’s multi-factor authentication keeps websites and personal information secure and GDPR-compliant.

Our age estimation technology[3] securely estimates a person’s age by looking at their face; we have performed over 550 million age estimates since we began this in 2019.

Yoti has also launched Yoti Sign[4] which offers the convenience and simplicity of e-signing platforms, but with the added security of biometric verification.

Yoti is working with a range of commercial companies (NCR,[5] national retailers, online dating,[6] social media,[7] airports[8] and e-commerce players). We are the strategic partner of the Post Office[9] for digital identity, the eID provider for the States of Jersey,[10] and the Improvement Service Scotland[11] and are working with a number of national charities[12] such as the NSPCC.[13] We are supporting a range of cryptocurrencies[14] to onboard customers and are a part of the FCA Regtech sandbox.[15]

1. How well co-ordinated is digital regulation? How effective is the Digital Regulation Co-operation Forum?

Yoti has, in previous consultations, argued in favour of measures similar to those put forward by the Digital Regulation Cooperation Forum for a potential additional duty for digital regulators to consult and cooperate with each other. We would encourage the House to consider a duty on digital regulators, to more regularly consult with peer regulators, industry members and groups. This could be a duty to consult with a number of firms representing all types of digital technologies and sizes, or relevant industry associations and professional bodies.

We also believe the UK requires a healthy market of competent audit bodies. It has been refreshing to see the creation of the Age Check Certification Scheme,[16] for instance, which is the first UKAS accredited auditor for the Age Appropriate Design Scheme, based in the North West of England. The UK is also home to experts such as Dr Allison Gardner, Keele University and IEEE expert in algorithmic bias. We would welcome the development of more such bodies. In addition, we believe that a benchmarking and review capability within the UK would be a valuable resource for regulators and industry members alike.

We have been highly encouraged by the open stance of the DRCF and its proactive engagement with tech companies via techUK. In addition, we would welcome the opportunity to understand in more granular detail the activities of the DRCF; to be able to read the terms of minutes, agendas and minutes from its sessions for instance.

2. Do regulators have the powers and capabilities, including expertise, to keep pace with developments? What is the appropriate balance between giving regulators flexibility and providing clarity in legislation?

Yoti is at the cutting edge of digital identity technology, which is set to be a large growth area of the UK technology sector. Other than the FCA, regulators and government departments in the UK have at times been slow to appreciate the power of Yoti's technology. Yoti's experience has been that regulators and government departments are often constrained by outdated laws and by a lack of internal technology expertise.

Yoti has been consistent in asking that legislation be amended to be technologically neutral and instead be outcomes focussed. Then, innovative companies would be able to adopt new technologies if their own assessment is that those technologies meet the outcomes. In the current UK system sadly many companies do not adopt new technologies until the law and regulators catch up, which is often many years later. This is seriously slowing down the adoption of beneficial technology in the UK.

Examples of legislation that could be technologically neutral and outcomes-focussed include:

1. The Mandatory Licensing Conditions for the purchase of alcohol which mandate an in person identity document check, even though facial age estimation and reusable digital IDs have been capable of doing this for over three years now. Only now is a limited Home Office pilot about to take place when leading supermarkets have been keen to roll out this technology for several years.

2. The Home Office Right to Work and Right to Rent guidance still mandate physical checks on passports and visas even though there are multiple instances of remote ID checks being acceptable for the Right to Remain and across the financial sector.

3. How effective is digital regulators’ horizon scanning? How could this be improved?

Yoti welcomes the continued reliance on regulators to safeguard citizens’ rights and intention to ensure that regulators have the capabilities they need to respond quickly to the latest innovations and developments in digital technologies and markets.

As previously detailed, the fast-moving nature and complexities of digital technologies mean it is vital that expertise be drawn from across the tech sector. In addition to a duty for digital regulators to consult with key actors of the UK digital industry, Yoti would suggest an increase in public-private collaboration and consultations between all actors of digital policy-making and the private sector. Policy-makers at every level could be encouraged to hold more frequent meetings with key firms and groups so that regulations are designed with systematic input from external experts and tech leaders.

We see the involvement of trade bodies in horizon scanning exercises as very useful. Bodies such as techUK, Coadec, AVPA, OSTIA, Carnegie Trust, OIX can act as constructively critical friends and play a valuable convening role.

4. How effective is parliamentary oversight of digital regulation?

We believe that in order to drive adoption of new and innovative digital technologies such as digital identity and age verification, citizens must be made to feel they can trust firms with their personal data.

Yoti strongly believes in the power of parliamentary scrutiny in building trust between citizens and firms, and therefore would recommend that Parliament continue to keep a close eye on the development of digital regulation in the UK and overseas. We would also recommend it also continue to thoroughly engage with industry members and previously mentioned industry bodies to make sure it can keep abreast of latest developments.

Trust, which can easily be broken, remains the key factor in an individual’s thought process when deciding whether to share or upload their personal information. We would also recommend a review of Hilary Sutcliffe’s excellent research into building trust[17] and encouraging more companies to embrace the above mentioned recommendations.

5. What is your view of the Committee’s proposal in Regulating in a digital world for a ‘Digital Authority’, overseen by a joint committee of Parliament?

We would agree that the proposed funding, expertise and resources in the Select Committee on Communications’ ‘Regulating in a digital world’ report be assigned to a joint committee of Parliament. It will be imperative that the committee directly engages with stakeholders across the whole economy, including experts from across the public and private sectors, and looks to best practise domestically and internationally.

6. How effectively do UK regulators co-operate with international partners? How could such co-operation be improved?

Yoti would encourage a joined-up response to digital regulatory challenges with the UK’s international partners. We would also welcome cross border sandboxing and the extension of international bridges from existing sandboxes to co-operative countries.

We have also been ably supported by the excellent work of the Department for International Trade (DIT); may we suggest they could be invited to support the creation of more international sandbox partnerships with like-minded, forward thinking jurisdictions.

We would encourage regulators to continue to demonstrate leadership and further engage and coordinate with other like-minded democratic states and organisations who also wish to develop digital industries that empower citizens and affirm their data protection rights. This was previously facilitated by the British Presidency of G7 and chairing of G7 ministers meetings. We believe this should also be the case with European Union member states and institutions.

This would help make sure that the UK’s regulatory direction of travel remains similar to and coherent with that of larger neighbouring trading partners, thus preventing additional costs and burdens which may hinder the export of British technology. This would allow UK tech firms to continue to support economic growth and drive job creation.

7. Are there any examples of strategic approaches to digital regulation in other countries from which the UK could learn?

The format of the EU Consent Project[18] provides an interesting case study, in terms of cost effective use of public funds to create conditions similar to a sandbox. In this instance organisations were invited to create consortia to bid for €1.4m to create an interoperable architecture for age verification and parental consent. The winning consortia spans academics, technology companies and child safety experts from several countries, including a disproportionate number from the UK. The project is well under way and its progress and newsletter[19] is worth following.

We would suggest that the House review counterpart organisations in other countries such as the FSM[20] and KJM[21] in Germany, where they work with private sector organisations to understand and assess emerging technologies and publish an equivalent of a register of approved technologies for specific purposes, akin to a trust services registry. We would argue that this registry both puts a guardrail in place, and gives clarity and certainty to businesses and consumers.

The current ‘outcomes based’ approach where each relying party has to perform its own risk based due diligence places an especially heavy burden on lower capacity SMEs and also lengthens the time span for innovators to achieve regulatory certainty. This creates a positive reinforcing circle and also gives confidence to investors.

22 October 2021

6