Consultation outcome

Data ethics assessment of the draft data sharing legislation

Updated 26 June 2023

This was published under the 2022 to 2024 Sunak Conservative government

The Data Ethics Framework is used to guide public sector organisations on how to use data appropriately and responsibly when planning, implementing and evaluating a new policy or service. An assessment against the Data Ethics Framework was conducted in relation to the  draft Digital Government (Disclosure of Information) (Identity Verification Services) Regulation 2023.

This document summaries the key insights derived from the data ethics framework exercise. We are exploring the option of publishing the assessment in full at a suitable time to be agreed.

Introduction: the GOV.UK One Login programme and proposed data-sharing secondary legislation

The Government Digital Service (GDS) is developing an authentication and digital identity verification service - known as GOV.UK One Login - which will allow people to create and reuse digital identities to access government services. This service will make it easier for people to prove their identity online and use government services, while protecting their privacy and reducing identity fraud and theft.

In order to achieve this, participating public authorities need to be able to check and share several types of government-held personal data with the identity verification service to allow users to prove their identity. Therefore, the Government is proposing to create a new objective under Chapter 1 of Part 5 of the Digital Economy Act 2017.

Define and understand the public benefit and user need

GOV.UK One Login, and the proposed secondary legislation that will underpin it, will generate significant benefits to individuals, including:

• Saved user time and energy: users will be able to access multiple government services through one account and will only be asked for their information once.
• Improved inclusion: the proposed legislation will open up more data sources that users can use to validate their identity digitally, allowing more people to access government services online.

GOV.UK One Login and the draft regulations will also provide a myriad of positive social outcomes for the wider public, including:

• Improved service up-take: where more accessible digital services will increase the number of users who get access to the services they need, leading to socioeconomic benefits and positive outcomes.
• Reduced failure demand: more accessible, simple-to-use information and services that make it easier to transact with government will reduce users’ need to revert to alternative, more expensive channels (e.g. call centre contacts, face-to-face checks), and reduce the volume and impact of defaults (e.g. payments not collected, registrations not completed).

We will monitor and report publicly the effects of GOV.UK One Login over time, including by measuring the number of people able to access government services through the system, and by continually improving the system based on user research and feedback. The programme has developed a communications plan which includes a multitude of press releases, blog posts and social media posts.

Involve diverse expertise

The GOV.UK One Login programme consists of diverse, multidisciplinary teams with a wide range of skills. This is also representative of the team progressing the legislative proposal. This team meets regularly with legal advisors and data protection officers, and utilises expertise across the programme to deliver essential enablers such as a communications and engagement plan and a robust Public Sector Equality Duty exercise to assess the impact of GOV.UK One Login and underpinning legislation on protected groups.

We are also actively engaging with external domain experts, including the Privacy and Inclusion Advisory Forum (PIAF), Privacy and Consumer Advisory Group (PCAG), and the Information Commissioner’s Office (ICO), to help shape the development of GOV.UK One Login. During our public consultation on our legislative proposals we will consult further with external experts involved in privacy and security and public service delivery.

Furthermore, key government departments have been involved in developing the legislation through attending regular working group and steering group meetings, to ensure GOV.UK One Login, and the data sharing legislation, will meet the needs of both data-holding departments and departments whose services will be integrated into the system. We will seek additional views from departments during our formal cross-government write-round exercise on the legislative proposals.

Comply with the law

GOV.UK One Login is compliant with the Data Protection Act 2018 and UK General Data Protection Regulation (GDPR). Throughout the development of our programme, we have engaged with legal advisors and the relevant data protection officer to ensure we understand the relevant laws and data protection issues, and apply them to our programme.

The data sharing within the proposed legislation will comply with the relevant data protection requirements, including that data will be processed lawfully, fairly, in a transparent manner, and only for specified and legitimate purposes. Furthermore, a Data Protection Impact Assessment (DPIA) has been completed and will be kept up-to-date to include additional service aspects as the programme develops.

Review the quality and limitations of the data

GOV.UK One Login, underpinned by the legislation, will process the minimum number of data items, known as attributes, necessary for verifying the identity of an individual. Examples of attributes include:

• user’s full name;
• date of birth;
• home address;
• email address;
• photographic images;
• various identifiers such as passport number or driving licence number;
• attributes held by government departments necessary for verifying the identity of an individual;
• the outcome of identity checks previously performed on a user; and
• transactional data, for example, income

Other data items may be processed as identity verification services develop. This may include special category data and processing will only take place in line with the relevant guidance. However, any additional information to be shared will comply with the ‘data minimisation’ principles so that only the minimum amount of data is disclosed as is necessary for any identity check.

Different government services have unique identity verification criteria depending on the level of confidence required in an identity. An individual using the identity verification service to access a government service would present data to be validated against data already held by specified public authorities. This should confirm that the information submitted by the individual matches that information held by a public authority and increases the confidence that the individual is the claimed identity. Only the minimum necessary amount of data will be requested from the individual to validate the match.

The data returned to the government service that initiated the identity verification check on the individual will include the result of the identity check, and a minimum set of attributes required to identify the individual whose identity was checked. For example, this might include the individual’s name, date of birth, and any additional data attributes that the government service requested were collected from the individual, such as the individual’s address.

The proposed legislation will enable a wider variety of government-held data sources to be used to verify a user’s identity and subsequently provide access to government services.

Organisations providing the data will draft detailed data-sharing agreements in the form of Memorandums of Understanding (MoUs) with the Cabinet Office. The MoUs will detail specifically how the data will be used, the DPIA considerations, and the legal basis for processing data, and other information relating to the data sharing and GOV.UK One Login. Data sharing will only commence once both parties have signed the MoU agreement.

The system’s core features are focused on handling data and decision making at the individual level, rather than an aggregate. As such there is no dependency on machine learning or AI models in the system.

The data used by GOV.UK One Login will not be open data.

Evaluate and consider wider policy implications

GOV.UK One Login will be continually evaluated throughout its development, including internal audits and accessibility audits, threat modelling and penetration testing with the National Cyber Security Centre (NCSC), as well as Infrastructure and Projects Authority (IPA) assessments.

The Programme Governance Framework will ensure that the scope of the programme is developed and agreed collectively across government, with appropriate focus on the needs of departments with large user volumes, including the Department for Work and Pensions (DWP), the Home Office (HO), and Her Majesty’s Revenues and Customs (HMRC). Departmental and service representatives are included at all levels of proposal generation and decision-making, and work will proceed only in line with collectively approved plans.

We are furthermore developing a long list of Key Performance Indicators (KPI’s) / metrics to enable us to realistically track benefits over the life of the programme and onwards. These metrics will be agreed with HM Treasury and will be used to monitor the impact of the GOV.UK One Login programme.

We will also be conducting a public consultation for the proposed legislation. This will publicise the plans for secondary legislation and will invite feedback from stakeholders and citizens so that they can input into the policy design and decision-making, with a view to identifying further wider policy implications.

When the legislation is signed into force, we will monitor whether the desired data sharing between government departments and other public sector bodies takes place. All data sharing agreements enabled by the legislation will be added to the Register of Information Sharing Agreements under chapters 1, 2, 3 and 4 of part 5 of the Digital Economy Act 2017.