Government to create market for personal identity data

The government is preparing to create a marketplace for citizens' personal data to be used for accessing online public services, according to documents that were issued to industry in preparation for the coalition's next-generation identity scheme.

The plan, obtained by Computer Weekly, may prove highly controversial, as it offers only limited assurances over how much control people would have over how their data is used.

The coalition intends to "create the commercial, legislative and regulatory environment" in which a private sector ID industry may thrive, it said in briefing papers sent to industry in April.

The proposals would create a personal data marketplace populated by banks, phone companies, the Post Office and others that may involve government departments selling access to their own citizen databases. The government has proposed that it may join the market by selling data services to private ID companies and data agents.

Download draft government plans for a private sector identity services market here (registration required):

• Identity Assurance Service Description
• Identity Assurance (IDA) - Technical Infrastructure Services

The creation of a private data market would allow the government to dismantle its own data sharing networks, said a draft technical blueprint for the proposal, a paper called Identity Assurance (IDA) Technical Infrastructure Services. Current data sharing arrangements include links between departments such as HM Revenue & Customs (HMRC) and the UK Border Agency.

The detailed proposal describes how the coalition intends to act as a "catalyst" on the nascent online ID industry that grew in the shadows while the Labour government was trying to build a public ID card system. The new plan would support the industry by defining universal ID standards and mandating that all government agencies must verify people using approved private sector ID agencies.

Data sharing and identity protection

The government is aiming for a system of "citizen-centric data sharing" of the sort it has been trialling with East London start-up Mydex. It proposes to better protect people's privacy by allowing them to choose their identity agent and giving them a say in when and what items of their personal data is shared.

The draft Identity Assurance Service Description, also sent out to industry in April, suggested citizens must be able to "view an audit...describing how identity data has been used", and that the personal data market should operate transparently.

But while the Cabinet Office is drafting rules that will give people power to "view and control the personal data that is held about them by public sector", it has stopped shy of proposing those powers should have a hold over the private sector. The plans also ignored a principle laid down last year by the Council of Europe that people should have a right over the algorithms companies use to process their personal data.

Citizens' rights to personal data

Guy Herbert, general secretary of privacy campaign group No2ID, after being invited into the Cabinet Office to review the plan, said there was "absolute obscurity" over its legal framework. He was concerned people would not be given rights over their own personal data.

The Cabinet Office plan said personal data agents - known as attribute providers - will "exchange...data (attributes)" in the market "potentially/usually under the citizen's control". It gave no further assurances of any controls people would be given over the use of their personal data attributes by the market.

The documents did attempt to allay fears associated with the last government's data sharing regime by promising that it will not lead to the creation of a dedicated public sector database and that the government will create "no database of databases" or master index of citizens operating within the private ID ecosystem.

William Heath, chairman of Mydex, was sceptical about the Cabinet Office's promise to create a "customer-centric" ID marketplace. If the market was operated by large companies aiming to make money from their customer's personal data, it might still be customer-centric without actually giving people control over their own personal data, he said.

Personal data stock exchange

The government is weighing up whether its proposal should include building an ID and data hub, which will act like a stock exchange, brokering transactions in the personal data marketplace. The government would own the hub and the Cabinet Office is preparing to issue a call for tender for someone to build such a system in the autumn.

The Cabinet Office plans for people to be able to register to vote using private sector ID providers in time for the next General Election, in 2014.

HMRC has meanwhile been tasked with giving businesses a one-click registration using private ID providers by the end of the year, said the draft proposals.

Sign up to Computer Weekly to download draft government ID services plans:

• Identity Assurance Service Description
• Identity Assurance (IDA) - Technical Infrastructure Services