Guide: Respond to the consultation on the government’s digital ID verification system

TEMPLATE LETTER

I am a [member of the public/profession] writing to provide my response to the consultation on draft legislation to support digital identity verification services. The proposed data-sharing legislation specifically enables a new government identity verification system, GOV.UK One Login, for people to prove who they are online when accessing government services. I feel strongly that digital identity systems should always be optional and privacy-protecting. I value the importance of security, privacy and accessibility when it comes to digital verification options. As such, I believe that:

• 1. The proposed digital government identity verification system and draft regulations are not fit for purpose. They do not reassure me that my privacy would be protected and I believe further consultation is required. It would mean that my name, date of birth, home address, email address, photographs (which are increasingly converted into biometric data), “various identifiers” such as passport number or driving license number, transactional data such as income, and other fields of my data may be shared between government departments and possibly contractors. Whether intentionally or not, it appears that under the broad mandate of identity verification, a giant, centralised database and data-sharing system of population-level identity information is being constructed with next to no limitations on its use.
  2. If and when revised regulations are published, they should safeguard people’s rights not to use digital identity methods. Digital identity systems should always be optional, for inclusion, accessibility, user empowerment and privacy. I would be more reassured if any regulations on digital verification include a legal assurance that offline/conventional verification methods will always be available as an alternative to digital government identity verification, and that those methods and services will be made no harder to access than online methods and services.
  3. If and when revised regulations are published, they should provide clear and specific limitations on the purposes and substance of data sharing, and prioritise personal control over how and when such data is shared. Guarding against function creep is vital, particularly in the context of such sensitive personal data and where there is the risk of a giant state identity database being built with vast amounts of our personal data. Such limitations should reflect data protection principles, agreed-on identity principles (e.g. the 9 Identity Assurance Principles developed by the Privacy and Consumer Advisory Group), and should protect and promote the right to privacy protected by the Human Rights Act 1998.

I wholly oppose the current regulations, which give me no reassurance that my privacy would be protected at all. I urge the government to withdraw them and resume consultation with privacy groups.

Yours faithfully,

[NAME]