Written evidence submitted by Dr Louise Bennett, Information Assurance Advisory Council (IAAC) and Dr Edgar A Whitley, London School of Economics and Political Science (DIG0017)

Executive Summary

1. We are contributing to this consultation in a personal capacity but drawing on our experiences as co–chairs of the Privacy and Consumer Advisory Group (PCAG) to the Government Digital Service and GOV.UK.  In this role we are also participating in the data sharing review boards created as a consequence of the Digital Economy Act (2017).
2. We will highlight what we see are the key characteristics of GOV.UK Verify that relate to the scope of the inquiry, as well as the distinctive and innovative role that PCAG plays in the governance of Digital Government in the United Kingdom.  We also discuss a number of additional items specified in the inquiry’s terms of reference.

GOV.UK Verify

3. In a recent report about GOV.UK Verify[1], we identify the four distinctive features of GOV.UK Verify (the “Verify model”):

• A risk– and standards–based approach to identity verification and authentication;
• A federated architecture involving multiple identity providers that encourages innovation in both verification and authentication activities;
• A privacy–by–design approach that embeds privacy principles in contracts, memoranda of understanding and norms and includes expert oversight of privacy and consumer issues; and
• A user focussed service delivery approach that includes an emphasis on transparency and engagement with all relevant stakeholders and diverse users.

4. Each of these features exemplifies the distinctive approach to digital government adopted by the UK Government and Government Digital Service (GDS).  Moreover, these approaches are increasingly being adopted by other governments internationally and ties in with recognised good practice in systems development and identity assurance[2].

The role of the Privacy and Consumer Advisory Group (PCAG)

5. Privacy concerns were a significant factor affecting the government’s previous identity proposals[3].  As a consequence, in 2011 the Cabinet Office created the Privacy and Consumer Advisory Group (PCAG) which held its first meeting on 2 August 2011[4].
6. According to its terms of reference[5], “PCAG is a forum that provides an independent view on issues involving privacy and wider consumer concerns” on a “variety of initiatives with implications for individuals regarding the use of their personal data and their privacy”. These range from “the identity assurance programme to the use of patient records in the NHS, to interdepartmental data sharing and anti–fraud initiatives”. Membership of the group includes academics, privacy advocates, consumer groups and others with specialist expertise in the area. It meets monthly and the minutes of its meeting are published by GDS.
7. Alongside regular engagement with the programme, it developed the “Identity Assurance principles”[6].  These set out, in detail, how GOV.UK Verify should be configured to meet the privacy and consumer expectations of its users.
8. The GOV.UK certified identity providers are obliged to offer “a privacy policy (the “Provider Privacy Policy”) which is clear and easily comprehensible and which outlines (i) the steps the Provider, its Affiliates and Provider Personnel have taken to comply with the provisions in the Identity Assurance Principles which are applicable to such parties; and (ii) any measures they plan to implement in future”.  The identity assurance principles have also been reviewed as part of the privacy assessment for GOV.UK Verify[7].
9. PCAG has a distinctive relationship with GDS and the GOV.UK Verify team.  Formally it is an independent body but it meets regularly with and is consulted on all key decisions relating to the development of GOV.UK Verify.
10. Additionally, its role as a “critical friend” has enabled engagement across digital government more widely.  For example, it was closely involved in the discussions around data sharing arrangements under the Digital Economy Act and PCAG is now a member of the review boards set up to consider data sharing proposals for public service delivery and fraud and debt.
11. PCAG has also worked closely with the NHS Citizen Identity programme, the Home Office and the Office for National Statistics, amongst others.
12. In 2017 PCAG became one of the signatories to the World Bank Principles on Identification for Sustainable Development[8].  These principles echo many of the PCAG Identity Assurance principles including protecting user privacy and control (principles 6 and 8) and independent oversight and adjudication of grievances (principle 10).

Value for money

13. One of the challenges for any government technology projects, particularly in the UK, is obtaining value for money[9].  The privacy–friendly federated approach adopted by GOV.UK Verify coupled with the use of standards results in a system where consumers have a choice of identity providers that they can use to obtain a Verify’d identity.  This means that the government is not dependent on a single supplier and the effects of an individual identity provider withdrawing from the scheme are limited.
14. The procurement framework agreement includes additional features to ensure healthy competition in the marketplace of identity providers, which also helps to encourage innovation.  For example, the (second round) framework agreement sought to restrict the number of organisations that “material sub–contractors” (who assess and analyse identity evidence and data for the identity proofing and verification process) could work for, so that Verify didn’t end up with a situation whereby all the certified companies were relying on a small number of “material sub–contractors” to do all the work involved in verifying a person’s identity[10].

Digital Government and BREXIT

15. In August 2018 GOV.UK Verify was “pre–notified” as part of the eIDAS arrangements.  This means that UK citizens living in other EU countries will be able to use their GOV.UK Verify identity to access digital government services in those other countries and EU citizens living in the UK will be able to use their own (notified) national identity credentials to access the same services in the UK that are set up to use GOV.UK Verify.
16. Many of the attributes required to determine the “settled status” for EU citizens living in the UK after BREXIT are likely to be held / known to the GOV.UK certified identity providers.  However, the government has chosen to build a bespoke system to achieve this goal, arguably resulting in unnecessary duplication and costs[11].

Data policy and DCMS

17. As noted above, PCAG provided critical feedback on the data sharing proposals under the Digital Economy Act (2017) including careful reading and feedback on various drafts of the associated codes of practice put before Parliament in June 2018.
18. Representatives from PCAG are members of the Public Service Delivery and Fraud and Debt Boards that review data sharing proposals under the Act.  The first meetings of these boards have only just been held so at this time we can simply note that having data policy move to DCMS has had no detrimental effect on the working relationships between PCAG and the data team.

September 2018