I attended the recent EPG Identity Special Interest Group (more on which in another post, once I re-digest all the slides), and one of the topics discussed was the UK’s ID card proposal.
It strikes me, based on the discussion and the number of different suggestions made (not all of which were specifically about the UK ID Card mind) that what we need isn’t a national ID card. What we need is lots of them.
The big issue with the ID card seems to be a combination of overly intrusive recording of information about citizens combined with a lack of surety about what information to store (or even where to store it!) combined with a requirement that the card be a card that a third party can rely on (i.e. the Government must take liability for the veracity of the card). Without these issues being addressed, the card is almost certainly destined for failure. As one person put it: “The Government is trying to sell something it doesn’t understand to a public who don’t understand it (and therefore don’t want it.)”
I would like to propose an alternative model to the single ID card. I’d like to propose we have lots of ID cards, and we be allowed to choose the one (or more!) that we carry, obtaining each ID card from an authorised ID provider. This would place the Government in the position of regulating ID cards instead of legislating them. By allowing private corporations to become Identity Card providers, consumers will be free to choose their preferred provider of an ID card. The Government’s role in this is to ensure that the company’s that are authorised to provide nationally recognised ID cards are properly regulated, authorised and otherwise monitored to avoid abuses.
And the Government would need to ensure that any ID card provided by an authorised ID card provider would be accepted at any Government department as full and final proof of Identity.
Of course, we already have a similar system in place now - the banking industry. It’s relatively simple to set up a bank (yes, I know there are very high barriers to entry, but if you can meet these barriers then the process itself is fairly simple), and the industry as a whole is regulated.
(It’s been commented that one of the key sticking points with ID cards is whether or not the banking industry will accept a national ID card as final proof of identity. If the banks continue to require additional information, then the value of the national card is devalued, as it becomes nothing more than another card citizens have to pay for, which doesn’t provide any tangible value or benefit except when dealing with one particular industry - government. In which case it’s not a national ID card, it’s a government ID card, which is something different.)
So we have wide competition for banking services, even though the primary services provided are all pretty much the same. And of the process of accepting a debit or credit card as proof of payment for goods and services is well documented and widely available.
Why not apply the same principles to the issue of an ID card? This would serve a number of purposes, including introducing competition, ensuring consistency of data transfer, providing transparency of costs in obtaining a card, and would allow consumers to choose whether or not to use a particular ID card.
It also fits in quite nicely with the concept of transient identity, as the consumer is not forced to use a particular ID card, with information stored in a central register with little or no control over accuracy or re-use of said data. With competing ID card providers, the onus is on the ID provider to ensure accuracy of data, transparency of data release and security of operation - after all, with many ID card providers, the incentive to move to a more secure one is higher than if there is no competition at all.
And this also allows the consumer to ensure that the information held about themselves is accurate, and it also allows the consumer the freedom to move all of their personal information to another provider, as well as controlling the release of information to third parties, the Government included.
This leaves citizens in control, provides a regulated environment for ID cards (and therefore provides for the acceptance of liability on the part of the ID card provider), still manages to provide the type of authentication that seems to be required of the national ID card scheme, as well as promoting competition amongst ID providers. After all, who wants an ID card accepted at 1,000 places when a competitor can offer 2,000?