The government may have dropped its plans for a single government-issued digital identity, but significant challenges remain around how people securely and conveniently prove who they are when accessing public services, according to the National Audit Office (NAO).
In a new Lessons Learned report, the spending watchdog said the UK already has legislation, standards and digital identity services that provide a foundation on which government can build.
However, implementing digital identity at scale across fragmented public services remains a complex integration challenge, with legacy technology, inconsistent data and different approaches across government creating significant obstacles.
The report comes after the government announced in July that it would not proceed with its proposals for digital identity. The NAO said much of its work had been completed before that decision, and the report has subsequently been repurposed to inform wider work on digital access to public services.
Identity is only part of the problem
A key message from the NAO is that digital identity shouldn’t be viewed simply as a technology product. Instead, it describes an ecosystem encompassing services, credentials, standards, providers and governance arrangements across government and the private sector.
One of the biggest challenges is the fragmented nature of government data and systems. Different services use different identifiers, including National Insurance numbers, Unique Taxpayer References and NHS numbers. This means that verifying somebody’s identity is only one part of providing seamless access to services.
Government must also be able to link that person to the correct record held by an individual service, while connecting records relating to the same person across different organisations presents a further challenge.
Differences in systems, standards and data quality make that task harder, said the NAO.
The watchdog warned that digital identity is less likely to deliver its intended benefits if technology is developed before objectives, business processes, data constraints and integration challenges have been properly understood.
Implementing digital identity at scale will also require realistic assumptions about timescales and costs, alongside clear decisions over funding, ownership and accountability.
Trust and usefulness will determine adoption
The NAO also examined international experience, finding there is no single model that governments can follow.
However, evidence from countries without a history of mandatory identity systems suggests that adoption depends heavily on whether citizens see a practical reason to use digital identity.
Trust will also depend on governments clearly explaining the different elements of digital identity and providing effective security and privacy protections.
“Despite government’s recent announcement that it will not be going ahead with its digital identity plans, questions about how people can conveniently and securely prove who they are or something about themselves in a digital world remain relevant,” said Gareth Davies, head of the NAO.
He added that international experience suggested digital identity works best when people find it useful in everyday life, alongside effective security and privacy protections.
Government faces choices over future model
The NAO noted that other countries are increasingly moving towards phone-based digital wallets, reusable credentials and identity systems that work across multiple sectors.
For any future initiative, the watchdog said government will need to establish clear objectives and priority use cases, as well as determining how they will be funded, delivered and integrated across public services.
It will also need to decide the respective roles of government and industry – including how far the public sector should develop capabilities such as a digital wallet and supporting infrastructure, and how far it should rely on private sector providers operating within the UK’s trust framework.
The NAO concluded that improving digital access will ultimately require government to address some of the deeper problems that have complicated previous transformation programmes: fragmented data, legacy technology and the difficulty of integrating services across organisational boundaries.
