Sir James Crosby offers advice to UK's identity card scheme
The long-awaited publication of Sir James Crosby report into the establishment of a universal identity assurance system has come up with a list of 10 recommendations, many of which fly in the face of the current ID card proposals being tabled by the UK Government. In particular Crosby recommends that any ID card should be provided for free, it should be operated independently of government and full biometric images should not be kept.
The report was originally commissioned in July 2006 by the UK’s Chancellor to consider how the public and private sectors might work together in identity (ID) management for their mutual benefit and that of citizens and consumers. Crosby strongly believes that to realise the greatest economic and social benefits every aspect of an ID card scheme should be designed from the consumer’s perspective. Bearing this in mind, he criticised the UK’s ID card plans as published in the Government’s Strategic Action Plan (2006).
He said: “I have no remit to comment on the desirability or otherwise of this plan. However, in my opinion, the Strategic Action Plan (2006) will not be the catalyst for the emergence of the consumer-driven universal ID assurance system envisaged by this report.”
Crosby argues that the design of any ID card scheme would need to be based on ten broad principles:
- The purpose of any scheme should be restricted to that of enabling citizens to assert their identity with ease and confidence. The scheme should set targets for the quality of assurance achieved at enrolment and verification, which should generally exceed those achieved elsewhere, and it should regularly report its performance against those targets.
- The scheme’s governance should be designed to inspire the highest level of trust among citizens. It should be operated independently of Government (say, accountable directly to Parliament) and in principle its processes and security arrangements should be subject to the approval of the Information Commissioner, who should have the power periodically to review delivery.
- As a matter of principle, the amount of data stored should be minimised. Full biometric images (other than photographs) should not be kept. Only non-unique digital representations of biometric images should be stored. Additional data accessed during enrolment and records of verification enquiries should not be retained. All data and systems should be protected by “state of the art” encryption technology.
- Citizens should “own” their entry on any register in the sense that it should not be possible, other than for the purposes of national security, for any such data (to include digital representations of biometrics) to leave the register without their informed consent. Verification of identity should be performed without the release of data.
- Enrolment processes should be different for individuals with different circumstances, and change over time so as to minimise costs and give citizens the simplest and most hassle-free experience consistent with the achievement of the published assurance targets.
- In order to respond to consumer demand and achieve early realisation of economic and social benefits, the scheme should be capable of being rolled out at pace.
- Citizens who lose cards or whose identity is compromised should be able to rely on their cards being replaced or their identity being repaired quickly and efficiently and in accordance with published service standards.
Technically the scheme’s systems should be closely aligned to those of the banks (both initially and in the future) so as to utilise their investment, de-risk the scheme’s development, and assist convergence to common standards across the ID assurance systems and processes deployed internationally by banks and other national ID card schemes.
To engage consumers’ hearts and minds on the scale required, enrolment and any tokens should be provided free of charge.
The market should play a role in delivering a universal ID assurance scheme. This will improve the ease with which consumers can use the scheme and minimise costs.
Crosby commented that the Government may not regard its ID cards scheme as the best way to stimulate the creation of the universal ID assurance system as envisaged in his report. However, even if this is the case, Crosby strongly recommended:
• Working with the private sector, Government should take all necessary action to ensure that, as soon as possible, consumers have access to a “one stop” agency for the swift repair of compromised identities across the public and private sectors; and
• Government should commit to the development work across public sector databases necessary to ensure that all employers can quickly and confidently satisfy “right to work” and related regulations for all their employees.
To conclude Crosby said: “In the absence of a universal ID assurance system, I believe consumers will have to grapple with an increasingly complex array of identity assurance processes of uncertain quality. As a result, the UK will fail to secure the economic and social advantage achievable at the forefront of ID assurance systems and processes. In a competitive world, any failure to secure advantage quickly becomes tantamount to locking in disadvantage. In other words, the opportunities inherent in ID assurance will not have been grasped but the challenges will remain.”
|
