This project follows the publication in February 2019 of a techUK white paper: The Case for Digital IDs. The paper argues that “a coherent strategy is urgently required, with leadership and governance which can link up the public and private sectors to enable strong, secure and trusted methods of digital identity to be widely available to citizens and businesses”.

The objectives of this project are to provide a lead on how trust can be established between all parties in an emerging interoperable digital identity ecosystem within the UK.

In the UK, where there is no appetite for a national digital identity scheme, it is envisaged that several schemes will emerge servicing sector and cross-sector opportunities. A market where a consumer can have more than one digital identity, with more than one IdP exists today. In future, each IdP may belong to more than one scheme and relying parties may wish to accept digital identities from more than one IdP and, indeed, more than one scheme, reflecting their individual risk appetites, and range of uses.

This leads to the conclusion that a model will need to be developed to allow schemes to interoperate and to ensure an orderly, transparent market emerges. This can, in turn, help stimulate investment in the market and maximise the value of digital identity to all parties in the digital identity ecosystem. In the absence of such a model, the ability to scale and deliver cost-effective schemes becomes questionable and, for the citizen/consumer/user, delivers marginal benefit over the status quo today.

An interoperable model may seemingly come about in one of three ways.

1.     Government policy backed by action

2.     An industry or industries-led approach

3.     Through the collaboration and collective efforts of all parties in a digital identity ecosystem.

As far as the UK is concerned, the Government (through GDS) has indicated on numerous occasions in the past 6 months that it sees the private sector taking the lead, supported by Government. At an industry level, there is no compelling reason or forcing action (such as legislation or regulation). This leaves the third way as the most realistic approach to developing the model.

An interoperable model can only be successful if confidence and trust can be established across the whole ecosystem.

Confidence and trust are built on many factors.

• Standards. In a multi-scheme, interoperable model, a consistent and open approach to standards for identity assurance is required.
• Schemes. Different industries and sector will have differing requirements that not only need to be accommodated within standards but need to be reflected in how the schemes have been implemented.
• Ethics. The ecosystem is viewed as socially just and no one party is allowed to dominate (and potentially abuse) through its market position.
• Certification. The ultimate seal that will enable businesses and organisations to accept a scheme as fit-for-purpose and have in place the necessary safeguards for all parties including the citizen or consumer
• Regulatory approval. In regulated industries, such as those impacted by the UK Money Laundering Regulations, clear guidance needs to be provided to build company confidence.

This project will bring together representation from parties who might be part of a future digital identity ecosystem, to explore how that trust can be established and how the integrity of such an ecosystem can be sustained and governed over its life.

The project will test the following hypothesis:

In an emerging market of interoperable digital identity schemes, relying parties, IdPs and citizens/consumers/users will need assurances that any one scheme conforms to a known level of trust.

That level of trust can only be assured through appropriate signals and certification, encapsulating such matters as legal and regulatory compliance, consumer protection, dispute resolution, recompense, approved standards, and certification processes.

The acts of determining signals and issuing certification is best governed by an independent authority.

The Whitepaper has been written and circulated to the project team for approval.