GDS reveals details of digital identity pilot for passport data checks

The Government Digital Service (GDS) has published details of the planned pilot project for opening up passport data to companies that wish to offer digital identity services.

GDS recently held a briefing for organisations that wish to participate in the forthcoming private sector trial of the Document Checking Service (DCS) that was first developed to support Gov.uk Verify, the government’s troubled digital identity scheme.

The briefing was attended by a variety of identity providers, standards bodies and suppliers, along with private sector firms – including IAG, the parent company of British Airways, according to sources.

The details of the pilot have caused a degree of consternation among some of those present, although GDS has asked for feedback on its proposals, so the plans may yet be revised.

The stated objectives for the pilot are:

• To test the industry demand for checking information given by a user against government data sources;
• To understand the different ways that organisations could use digital passport checks;
• To test the technical design that would make these checks possible;
• To capture consumer interest and experience of these checks, and perception of this use of passport data;
• To understand if this is commercially viable, for the government and the organisations taking part.

The pilot is intended to operate as follows:

The service offered is for a simple yes/no digital check as to whether a passport is valid, through an API request. Participants are told that they “must only check passport data to prevent or detect crime” and must obtain explicit consent from users for their passport data to be processed in this way.

The passport data check can only be used as part of a wider service – participants are not allowed to develop a service solely for checking passport validity.

That lack of service flexibility will be a concern for some interested parties.

The pilot will begin in April 2020 – after the time when GDS hands over Gov.uk Verify to the dwindling number of identity providers (IDPs) still supporting the service – and will last for up to 12 months.

The trial will be limited to a maximum of six million passport data checks, and the number of simultaneous checks will be throttled, presumably to prevent overloading ageing IT systems at the Passport Office. Companies must submit applications to take part, and specify the minimum and maximum number of passport checks they will make during the pilot.

The six million checks threshold may be too limiting for some. In Australia, a country of about 25 million people, a similar passport checking service attracts over 80 million checks per year.

Participants must conform to a series of legal, technical, security, data protection, records management and personnel checks by GDS, accept audits and demonstrate compliance to GDS’s satisfaction.

Perhaps controversially, participants will have to pay £15,000 up front as a one-off fee for access to the DCS. Each passport check will cost 50p.

It’s worth remembering that GDS has been told by HM Treasury it cannot spend any further money on Verify after March 2020, so it seems that, effectively, the pilot will be funded by the companies that take part.

I’m told there are mixed feelings about the up-front cost – some think it will deter smaller companies or startups, others think it’s not unreasonable but it would be a problem if it became an annual fee for DCS access after the pilot.

One source described the pilot details as a “starter for 10” at best – not awful, but not great. Others feel the limits on volume and data use are too restrictive – hardly an example of opening up a digital identity market that would grow the UK’s digital economy.

There is also no guarantee that the pilot will be taken forward into a live service – which makes developing a business case difficult.

There are also grumblings about the fact that existing Verify IDPs that already have access to DCS for online public services, had their development costs funded by GDS – but everyone else has to stump up £15,000 just to be in the game.

The pilot will only offer passport data checks – and not driving licence checks which are available through DCS for Verify IDPs. DVLA is believed to have refused to take part in the pilot.

Perhaps the most telling observation though, is that the information pack about the pilot that is being sent to interested parties – a detailed 15-page document that outlines the requirements for taking part – does not mention Verify even once.