Act to Introduce Electronic Identification

Act to Introduce Electronic Identification
Name	Act to Introduce Electronic Identification
Enacted by	Parliament of the United Kingdom
Long title	An Act to establish a framework for electronic identification and trust services
Territorial extent	United Kingdom
Enacted	2019
Introduced by	Secretary of State for Digital, Culture, Media and Sport
Status	Current

Act to Introduce Electronic Identification

The Act to Introduce Electronic Identification is primary legislation establishing a statutory framework for national electronic identification and related trust services in the United Kingdom, aligning domestic law with international instruments and regional standards. It creates mechanisms for certifying electronic identities, authorizing trust service providers, and setting technical interoperability rules among public authorities, private enterprises, and international partners. The Act interfaces with established institutions and treaties and prompted debate among stakeholders including regulatory agencies, industry consortia, and civil society organizations.

Background and legislative context

The Act was drafted amid policy debates involving Department for Digital, Culture, Media and Sport, Home Office, and Cabinet Office officials following initiatives by the European Union such as the eIDAS Regulation and comparative models from Estonia, Finland, and France. Legislative interest drew contributions from parliaments including the House of Commons and the House of Lords, with expert testimony from representatives of National Cyber Security Centre, Information Commissioner's Office, and industry groups like TechUK and UK Finance. Internationally, negotiations referenced standards from International Organization for Standardization, European Telecommunications Standards Institute, and practice in jurisdictions like Germany and Sweden. The Act’s passage involved coordination with the Crown Commercial Service and consultation with private platforms such as GOV.UK Verify stakeholders and identity providers collaborating with Amazon Web Services and Microsoft.

Provisions of the Act

Key provisions establish a legal definition of electronic identification means, a licensing regime for accredited identity providers, and statutory recognition of electronic signatures and seals for use in contracts and regulatory filings. The Act mandates roles for the Secretary of State for Digital, Culture, Media and Sport, empowers regulators including the Information Commissioner's Office and Ofcom to issue guidance, and creates offences under statutes comparable to those enforced by Serious Fraud Office and National Crime Agency when identity fraud occurs. It sets legal effect for qualified electronic signatures paralleling instruments like the Electronic Communications Act 2000 and aligns admissibility rules with precedents from the Supreme Court of the United Kingdom and decisions influenced by European Court of Justice jurisprudence. The Act includes transitional provisions referencing existing programs such as GOV.UK Verify and procurement frameworks used by Crown Commercial Service.

Technical standards and implementation

The Act mandates interoperable technical standards derived from recommendations by International Organization for Standardization, World Wide Web Consortium, and European Committee for Standardization. Specifications address authentication protocols (e.g., federated identity, public key infrastructure), cryptographic baselines endorsed by National Cyber Security Centre and implementations compatible with services from NIST guidance and commercial platforms like Google and Apple identity solutions. It requires accredited providers to meet conformance testing similar to criteria used by FIDO Alliance, OpenID Foundation, and OAuth ecosystems, and encourages adoption of secure hardware attestation akin to Trusted Platform Module deployments. Interoperability testing frameworks involve institutions such as British Standards Institution and labs used by ENISA.

Privacy, security, and legal safeguards

Privacy and data protection safeguards reference obligations under UK General Data Protection Regulation and oversight by the Information Commissioner's Office, with particular attention to data minimization, purpose limitation, and user consent processes influenced by rulings from the European Court of Human Rights and the Supreme Court of the United Kingdom. Security requirements incorporate threat models used by National Cyber Security Centre and coordinated vulnerability disclosure practices resembling those promoted by CERT Coordination Center and FIRST. Legal safeguards include appeal routes to tribunals such as the Tribunal Procedure Committee and criminal penalties comparable to provisions enforced by Crown Prosecution Service for identity-related offences. Special measures address biometric processing with reference to case law from European Court of Justice and advisory opinions from bodies like Biometrics Commissioner.

Adoption, deployment, and administration

Administration is assigned to a designated authority under the Secretary of State for Digital, Culture, Media and Sport with oversight by regulators including Information Commissioner's Office and Ofcom, and operational support from entities such as the National Cyber Security Centre and Crown Commercial Service. Rollout plans prioritized integration with public services including HM Revenue and Customs, Driver and Vehicle Licensing Agency, and Department for Work and Pensions, and coordination with private sector platforms like Barclays, HSBC, and cloud providers. Pilot deployments referenced models from Estonia's e-Identity scheme, municipal pilots in Barcelona, and cross-border pilots under eIDAS cooperation frameworks involving Germany and Netherlands authorities.

Impact and reception

Reactions varied: technology firms and financial institutions such as Visa and Mastercard largely welcomed clearer legal frameworks, while civil liberties groups including Liberty (UK civil liberties organization) and Big Brother Watch raised concerns about surveillance and scope creep. Academic commentary from scholars at University of Oxford, London School of Economics, and University College London examined trade-offs between usability and security, referencing comparative research from Harvard University and Stanford University. Trade associations like TechUK and advocacy groups such as Which? influenced implementation guidance. Media coverage in outlets including BBC, The Guardian, and Financial Times highlighted disputes over biometrics, costs, and interoperability.

Amendments and related legislation

Subsequent amendments amended cross-references to statutes such as the Electronic Communications Act 2000, updated data protection alignment with post-Brexit instruments, and coordinated enforcement with the Investigatory Powers Act 2016 and provisions in the Digital Economy Act 2017. Related legislation and policy instruments included regulatory guidance by the Information Commissioner's Office, standards adoption via British Standards Institution publications, and international cooperation under eIDAS. Legislative reviews were undertaken by committees including the House of Commons Science and Technology Committee and inquiries involving the Public Accounts Committee.

Category:United Kingdom legislation