Enabling the use of digital identities in the UK

Overview

TheIn the Department for Science, Innovation and Technology (DSIT), iswe’re enablingworking theto usehelp of trusted digital identity services in the UK. Digital identities give people another way to securely prove things about themselves, such as who they are or what their age is, without having to repeatedly present physical documents.  documents.

The government is alsonot rollingmaking outdigital GOV.UKidentities Onemandatory. Login,This is not a morestep straightforwardtowards ID cards. Instead, we’re setting robust standards to make sure innovative private-sector solutions protect privacy, boost security, and secureenable waygreater foraccessibility, all while growing the economy by saving people toand provebusinesses theirtime and money.

To maintain trust in digital identity products and accessservices governmentas servicesuptake online.increases and technology develops, we are setting up a governance structure, underpinned by legislation, to ensure standards are being followed and to keep them up to date.

TheThis governmentpage collects digital identity guidance published to date and is notprimarily makingaimed at 4 groups:

• Providers, who provide digital identitiesidentity mandatoryor attribute services
• Certifying bodies, who will certify services against the standards we set
• Overlay schemes, which build on our standards in particular use cases or introducingindustries
• Employers, IDbusinesses cards.
  or other bodies, sometimes known as relying parties, who want to use digital identity services

Story justso likefar

1. In physicalSeptember documents.2020, Thewe Departmentpublished our response to a call for Science,evidence Innovationgathering andviews Technologyon hashow developedgovernment acan setsupport the development of rulessecure calleddigital identities in the UK

2. In February 2021, we published the first version of the UK digital identity and attributes trust framework, towhich helphas achievebeen this.in development since

   What

3. In isMarch 2022, we published a response to a public consultation on our proposed approach to enabling secure digital identities in the trustUK framework?  economy

4. TheIn April 2022, employers and landlords became able to use providers with certified services for pre-employment, rental eligibility and criminal record checks

5. In June 2022, we published the current ‘beta’ version of the trust framework isand astarted setour ofbeta government-backedtesting rules,programme

6. In guidanceMarch 2023, the Data Protection and standardsDigital forInformation trustworthy(No.2) Bill had its first reading in Parliament. The Bill will underpin the trust framework and secureits digitalgovernance and allow identity services.and eligibility checks to be made against trusted, government-held data

Useful information for providers

OrganisationsThere are three types of providers that offerfall directly under the scope of the rules found in the UK digital identity servicesand attributes trust framework:

• identity service providers
• attribute service providers
• orchestration service providers

The rules applying to each can choosebe found in sections 11 to follow15 of the trust framework.

Providers looking to become certified against the trust framework are already able to do so with government-approved certifying bodies who are undergoing accreditation with the UK’s national accreditation body, UKAS, who has a list of approved certification bodies.

Organisations interested in getting certified should read the guidance on becoming certified against the trust framework.

There Theyare maylive use cases with pre-employment, rent eligibility and criminal record checks. The government has also choosepublished guidance on how to become certified to perform these checks, which require additional rules to be independentlyfollowed. certifiedHome asOffice doingrequirements so.for Wherethese achecks servicecan isbe certified,found usersat the guidance pages for right to work, right to rent and businessesDisclosure alikeand Barring Service (DBS) checks.

The certification process for the trust framework and any other digital identity overlay schemes is modular: you can certify your services against the trust framework and other overlay scheme guidance which builds on it for particular use cases (such as the right to bework, private,right secureto rent and reliable.DBS Theyschemes).

You cando benot confidentneed thatto itrecertify meetsagainst highthe standardstrust inframework areasevery includingtime privacy,you dataseek protection,certification fraudagainst management,an cyberadditional security,overlay scheme.

Useful information for certifying bodies

The UK digital identity and inclusivity. attributes trust framework is now in its beta version. Guidance for providers on becoming certified against the trust framework has been published for those wishing to participate.

The trust framework draws on other government guidance for proving and verifying someone’s identity (GPG 45) and for using authenticators to protect an online service (GPG 44). ).

ThisThere ‘betaare version’further ofrules, thestandards, trustguidance frameworkand haslegislation beenin publishedthe followingtrust extensiveframework, feedbackwhich anda testing.provider’s Itservices hasmust beenor developedshould infollow anto openbecome andcertified.

As iterativethe way,certification withprocess inputfor fromthe overtrust 250framework organisationsis acrossmodular, civila society,provider’s industry,services standardscan bodies,be andcertified academia.against Thisother approachstandards hason helpedtop ensureof thatthe trust framework rulesas arepart appropriateof andan proportionate. overlay scheme.

TheThere Departmentare currently public-sector overlay schemes open for Science,right Innovationto work, right to rent and TechnologyDBS ischecks. responsibleAdditional Home Office requirements for preparingthese checks can be found at the trustguidance frameworkpages andfor ensuringright itto remainswork, upright to date.rent Previousand versionsDBS ofchecks. theThe trustgovernment frameworkhas arepublished availableguidance on gov.uk.how to become certified to perform these checks.

List

If ofyou want to know which providers have already been certified digitalto identitycarry out right to work, right to rent and attributeDBS services checks, you can refer to the list of providers with certified services.

Useful information about overlay schemes

The registerUK of digital identity and attributeattributes servicestrust framework isprovides a listbaseline ofstandard organisationsfor whothe providesecure digitaluse identityof servicesdigital whichidentities, areand currentlyis certifiednot againstuse thecase trust framework.   specific.

EachSome organisationuse oncases themay registerhave hasadditional passedrequirements, independentfor certificationexample andfor governmentproviders checksrunning topre-employment, makerent sureeligibility they’re trustworthy and suitablecriminal torecord join the register. checks.

ByThese accessingadditional therequirements register,may yoube cancodified findby up-to-datean organisation andor contactgroup detailsof fororganisations certifiedas providerspart andof downloadan theiroverlay certificatesscheme. toThe checkoverlay scheme can then use the detailstrust offramework theircertification certification.process to certify against these extra requirements.

ReadAn theoverlay guidancescheme pageis forany organisationsorganisation onor howgroup toof joinorganisations the register.that:

Certification

• Creates againstadditional rules on top of those in the trust framework 

Organisationsframework interestedthat reflect the requirements in gettinga particular use case

Wants participating providers to be certified against those rules.

The certification process for the trust framework mustis engagemodular, meaning providers can ‘top up’ trust framework certification with onecertification ofagainst the approvedrules conformityof assessmentone bodies. or more overlay schemes.

OrganisationsIf areyou’re assessedinterested byin alearning combinationmore ofabout desksetting reviewsup andan on-siteoverlay auditsscheme, dependingplease onsend thean scopeemail to bedigitalidentity-certification@dcms.gov.uk.

Useful assessed.information Certificationfor isemployers, abusinesses, time-limitedand process,other andbodies

Employers, certifiedbusinesses organisationsor needother bodies, who are often referred to undertakeas anrelying annualparties surveillancein auditthe anddigital recertificationidentity everymarket, twoare yearsalready able to remaincontract onwith theproviders registerwho ofhave undergone certification to conduct digital identitypre-employment, rent eligibility and attributecriminal services.

Supplementaryrecord schemes 

Achecks supplementaryusing schemedigital isidentity atechnologies.

Digital setDisclosure ofand extraBarring rulesService which(DBS) identity checks can be addedundertaken onby topproviders ofwhose theservices ruleshave inbeen thecertified, UKas can digital identityright andto attributeswork trustand frameworkright to showrent howchecks servicesfor canBritish meetand anyIrish additionalpassport-holders.

If needsyou inare specificlooking to use casescertified orservices sectors.to Thecarry scheme’sout extradigital rulesright areto integratedwork, intoright theto trustrent framework’sand certificationDBS system,checks, soyou servicesshould canrefer certifyto againstthe themlist as part of theproviders samewith robustcertified process.services.

ThereHome areOffice threerequirements existingfor supplementarycertification schemesto whichcarry setout additionalthese ruleschecks forcan digitalbe verificationfound serviceat providersthe conductingguidance digitalpages for right to work, right to rent and DisclosureDBS andchecks.

Latest Barringnews