Public Accounts Committee
Monday 19th October 2026
Skip to latest contribution
This debate has concluded
(began 16 hours, 50 minutes ago)
Watch LiveSkip to latest contribution
This debate has concluded
15:44
15:44
Geoffrey Clifton-Brown
-
-
Geoffrey Clifton-Brown
Order, order! Welcome to this session of the Public Accounts Committee on Monday the 19th of October 2026. Digital identity and underpins how people prove who they are, demonstrate their eligibility and access to public and private services securely. Since this committee announced our inquiry onto digital ID, the government has dropped its plans. International digital ID scheme. But the underlying issue remains as more services move online, questions about how public can prove who they are are conveniently and securely remain highly relevant, and they are certainly not going to go away. The National Audit Office report found that the UK already has many of the components associated with digital ID, but the responsibility has fragmented across government.
More than a dozen organisations and there are no coherent strategy for how they should work together. So today the committee will examine how DCMs is organising its new responsibilities in this area, whether the government has a clear long term approach and accountability arrangements, and how it will address the practical challenges around legacy systems, fragmented data privacy, security and public trust. So we are very pleased to have with us the Permanent Secretary and her team. So what I'm going to do is my usual practice and ask you, please, permanent Secretary, if you will introduce yourself. And I'm a little bit quirky today.
I want everybody to please tell us what professional digital training they have had in the past. Please. Permanent secretary.
More than a dozen organisations and there are no coherent strategy for how they should work together. So today the committee will examine how DCMs is organising its new responsibilities in this area, whether the government has a clear long term approach and accountability arrangements, and how it will address the practical challenges around legacy systems, fragmented data privacy, security and public trust. So we are very pleased to have with us the Permanent Secretary and her team. So what I'm going to do is my usual practice and ask you, please, permanent Secretary, if you will introduce yourself. And I'm a little bit quirky today.
I want everybody to please tell us what professional digital training they have had in the past. Please. Permanent secretary.
15:46
15:46
Speaker 2
-
Speaker 2
Hello, I'm Christine Bellamy, I'm the interim director general in government digital services, specifically on the product side. So looking after digital products that we run for government, which is fundamentally around the sort of UK proposition at its core, I'm a four year civil servant. But before that I was at the BBC for ten years where I ran digital and tech for news, sport and for their education portfolio. Before that, I was at Johnston Media, where my job was to transform one of the people to transform the organisation to a digital organisation.
15:47
15:47
15:47
Speaker 4
-
Speaker 4
Good afternoon. I'm Rod Latham, I'm the director for cyber security and digital identity in DCMs. Like Suzanne, I don't have any professional digital qualification, but I've worked in technology policy in the civil service in a number of roles, including this one for several years and before that in the Cabinet Office.
15:47
15:47
Speaker 5
-
Speaker 5
Thank you. Good. Good afternoon. So I'm Phillipa Rose. I am currently the director for gov.uk connect within Government Digital service. From February to July, I was the programme director for the Digital Identity Task Force. I don't have a digital qualifications. I'm an analyst by background and I spent 7 or 8 years leading tech enabled transformation for the Home Office in the migration and border space.
15:48
15:48
Geoffrey Clifton-Brown
-
-
Geoffrey Clifton-Brown
Thank you very much. So I'm going to start please. I think I'm going to start with you, Permanent Secretary, but I'm very happy if you pass it over to one of your team, because it's pretty sort of standard technical stuff. We've now had two machinery of government changes in fairly short order, moving digital policy of one form or another from Cabinet Office to Dcit, which has been now abolished. Part of it seems to have been now transferred to DCMs. Other bits going to other departments. Could you sort of fairly simply explain what the current state of play with digital policy in its totality, including AI, is?
Please?
Please?
15:48
Speaker 1
-
Speaker 1
Absolutely, yes. So this Prime Minister, at the end of July announced a machinery of government change which set up a taskforce for AI in the office of Prime Minister and Cabinet. And then the rest of it has been split between DCMs and the Business Department. So DCMs is responsible for policy around telecoms, cyber , tech and digital, and also for the government digital service, as well as a number of other things that came in that Mog and the business department is responsible for science and innovation alongside its previous responsibilities. So that's that's a quick version, but happy to double click on anything that would be helpful.
15:49
15:49
15:50
Speaker 1
-
Speaker 1
Yeah, I mean, the way I see it is that it's a mainstreaming of digital responsibilities. So the business department is going to be doing a lot more on innovation science, thinking about things like data centres and some of the business sides of this whole agenda in DCMs. We've got the kind of tech stack. So we're thinking about cyber, and there are a lot of AI questions there, of course, and telecoms and mainstream digital policy. And in practice, we, the task force and the business department are going to be working incredibly closely together. And luckily, because all of these teams knew each other well when they were in sit, we've got all of those relationships.
And so I think so far there are positive signs of really good joint working. Obviously, on the ministerial side, Kanishka in the opmc, my Secretary of State and Jonny Reynolds are also very close on this whole agenda, alongside some of our junior ministers who are involved as well.
And so I think so far there are positive signs of really good joint working. Obviously, on the ministerial side, Kanishka in the opmc, my Secretary of State and Jonny Reynolds are also very close on this whole agenda, alongside some of our junior ministers who are involved as well.
15:51
Geoffrey Clifton-Brown
-
-
Geoffrey Clifton-Brown
So the next question is, I'm interested in how your department is going to influence the rest of government, because I've likened AI as a tsunami that's going to hit the government, and I'm not sure the government is yet prepared for that. So I have a Treasury minute in front of me responding to our recommendations on the Bank of England. This was was was from the Treasury, I think. No, it and it says this a response, and I think it's out of date. But I'd like you to respond to this, because it's a theme that this Committee has had for some.
While the response of of a government chief digital officers are delivered by the Permanent Secretary for Dcit, supported by deputy heads of function, to drive wider change, including government digital services directors general with responsibility for supporting digital transformation across government and digital products. GDS builds and runs. So is that out of date and if so, how is it now being modified?
While the response of of a government chief digital officers are delivered by the Permanent Secretary for Dcit, supported by deputy heads of function, to drive wider change, including government digital services directors general with responsibility for supporting digital transformation across government and digital products. GDS builds and runs. So is that out of date and if so, how is it now being modified?
15:52
Speaker 1
-
Speaker 1
Yeah. So when the machinery of government change happened, my predecessor, Emran Mian, was clear that the arrangements that Dcit had were that he was head of profession for digital. And then he has five deputy heads of profession from the main digital departments, plus GDS. So Chris to my right, and Emily, who are the two DGS in GDS. And then we also have Daljit at HMRC, Helen at DWP and Megan at MoJ. And so basically we fi five DGS and me form the executive committee. So I stepped into his shoes because I wanted to make sure we had continuity of approach.
And then obviously what we're doing while getting up to speed. And I think I said this in the response to you, we will just look at it, see how it works, and if we make any further changes, we'll let you know. But I do think across the broad waterfront of digital, and I know that this committee and also the science and tech committee have put forward.
And then obviously what we're doing while getting up to speed. And I think I said this in the response to you, we will just look at it, see how it works, and if we make any further changes, we'll let you know. But I do think across the broad waterfront of digital, and I know that this committee and also the science and tech committee have put forward.
15:53
Geoffrey Clifton-Brown
-
-
Geoffrey Clifton-Brown
Right order, order. I think what I'm going to do come back. We're going we're going to come back. And I will ask that question again, and I'll give you the the politeness of being able to answer it. So I'm going to suspend. Now it's. Order. Welcome back everybody. And we were just I was just asking a question on the new government's policy on the chief digital Officer and how that will work.
And you, Permanent Secretary, were going to answer that question for me. Please, if you could just sort of start afresh from that.
And you, Permanent Secretary, were going to answer that question for me. Please, if you could just sort of start afresh from that.
16:10
Speaker 1
-
Speaker 1
Yeah. So since the machinery of government change in the summer, we've been working at pace to integrate the new department, and we are taking our responsibilities for digital, obviously very seriously. The the main approach to policy comes through the departmental governance, my executive committee and up to the board and then for the government digital service that comes through that DCMs route as well for the cross Whitehall digital work, which I think is what you were asking about. I stepped into the shoes of my predecessor, Emran Mian, as head of profession, and we run that approach with deputy heads of profession, which is five director generals from across Whitehall.
Two of them are in my department in GDS, Chris and her colleague Emily, and then three of them are from other leading digital transformation departments. So Daljit at HMRC, Helen at DWP and Megan at MoJ. And through that structure, we meet regularly for a digital XCO and some of the other things we do. I'm having regular digital business reviews with the big departments. So since I've been in this role responsible for digital, I've already seen the Home Office and HMRC, so we use that as a way to get that cross-cutting view from across the piece.
And just one other thing, if you don't mind, I might mention chair that also I chair the technology risk group, and that is a place where we look at some of the many risks on the digital from a digital perspective, and I report back to the heads of department on that. So that's probably the other piece of governance that it's worth mentioning.
Two of them are in my department in GDS, Chris and her colleague Emily, and then three of them are from other leading digital transformation departments. So Daljit at HMRC, Helen at DWP and Megan at MoJ. And through that structure, we meet regularly for a digital XCO and some of the other things we do. I'm having regular digital business reviews with the big departments. So since I've been in this role responsible for digital, I've already seen the Home Office and HMRC, so we use that as a way to get that cross-cutting view from across the piece.
And just one other thing, if you don't mind, I might mention chair that also I chair the technology risk group, and that is a place where we look at some of the many risks on the digital from a digital perspective, and I report back to the heads of department on that. So that's probably the other piece of governance that it's worth mentioning.
16:12
Geoffrey Clifton-Brown
-
-
Geoffrey Clifton-Brown
So what has happened to the recommendation this committee has often made, and I think, been accepted by government, that every single department and next steps agency should have a very senior chief digital information officer, preferably at director level, and at least one, preferably more members of the Non-exec board who has real digital experience. So we can start to get your digital policy really promulgated across government.
16:12
Speaker 1
-
Speaker 1
Yeah, I think that's a really important point that you've made. And from what I can see, my colleagues are making progress. I mean, it is certainly the case, I think, right across the public sector, but also in the private sector, people are very seized of these many digital issues, and there's quite regular conversations with my peers about cyber risk. And across the department, people are implementing that recommendation by the end of December. And I think there's been good progress.
And yeah, happy to come back with any further detail on that, if helpful.
And yeah, happy to come back with any further detail on that, if helpful.
16:13
Geoffrey Clifton-Brown
-
-
Geoffrey Clifton-Brown
So it's you, your department that is responsible for coherent policy across government and who is responsible for. You mentioned cyber risks. We had been told many times on this committee that at least 30% of digital hardware is legacy systems, which is much more prone to cyber attacks and doesn't necessarily support large language models like AI, who is responsible for maintaining a register in each department, and actually the timetable to replace all those obsolete bits of kit.
16:13
Speaker 1
-
Speaker 1
Yeah, well, I mean, when I've been doing my preparation for this committee, I've been really interested to read so much of what you have said in this committee and also the science and tech committee. And I think you're rightly identifying the very real risks of legacy it. And I know you've said before that you want a register. There is a 2024 number, which is 28%, as you say, but we're not satisfied with that. So my colleague in GDS has been leading a programme of work called Firmer Foundations. I've written to all my colleagues, all of the permanent secretaries, asking them to nominate somebody who's their responsible person, who can give us the data on their legacy systems.
And we're just collating that information. We're also looking at how we can get more automated updates on it so that we actually know the picture on a more regular basis. And we're looking at using coding tools to try and spot some of these vulnerabilities, to try and make sure even when there are legacy systems, that we can address some of the issues. So I am very clear that we will not have all of the many benefits of AI, except if we can address some of these legacy issues. And it's also something that I want to work closely with the Treasury on as we go into the next spending review.
And we're just collating that information. We're also looking at how we can get more automated updates on it so that we actually know the picture on a more regular basis. And we're looking at using coding tools to try and spot some of these vulnerabilities, to try and make sure even when there are legacy systems, that we can address some of the issues. So I am very clear that we will not have all of the many benefits of AI, except if we can address some of these legacy issues. And it's also something that I want to work closely with the Treasury on as we go into the next spending review.
16:14
Geoffrey Clifton-Brown
-
-
Geoffrey Clifton-Brown
So my final question is on people, people within the civil service, because you can have all these policies, but if you don't have the people properly trained and qualified to operate them, they won't. And the Prime Minister has set out a, I think, a timetable for 10% of the civil service to be properly digitally trained by 2030. Can you set out how, how and the expectation. This is in my Treasury minute, again on the Bank of England's day settlements, and the expectation for digital leaders across government will be sitting in executive committee board level by the end of 2026.
So that comes back to my previous question. So two things there, the executive Board and how you're going to move to that 20 target as announced by the Prime Minister. It's a big target 10% of the civil service to be properly trained digitally by 2030.
So that comes back to my previous question. So two things there, the executive Board and how you're going to move to that 20 target as announced by the Prime Minister. It's a big target 10% of the civil service to be properly trained digitally by 2030.
16:15
Speaker 1
-
Speaker 1
That's right. And so at the moment, I have a rather spuriously accurate number of 31,361 civil servants. But I mean, given the numerator and the denominator are moving, I think we're at about 5.5%, which is not where we need to be. So it's a focus, I think, for all of us across the digital area and from GDS, we're going to publish a digital workforce plan, because what we want to do is try and give a better sense of where we are. It's helpful to you Parliament holding us to account, but it's also helpful to us, the leaders of these departments who are responsible.
So we're in progress, but we're not where we need to be yet for that 2030 target.
So we're in progress, but we're not where we need to be yet for that 2030 target.
16:16
Geoffrey Clifton-Brown
-
-
Geoffrey Clifton-Brown
I think given that these are such important matters, how government digitizes matters, because it will matter in terms of the productivity and the speed at doing things and communicating across government and communicating to the public. Can we get an undertaking from you that you publish some of this data on a yearly basis? How are you doing on staff and how you're doing on chief information officers and non-exec boards? All the things that we've just been discussing. I mean, it would be really helpful if we could have a number maybe once a year, not just in the annual report and accounts, because that's always out of date with respect to, to everybody.
But we really want to sort of some fairly up to date numbers each year. Can we have that?
But we really want to sort of some fairly up to date numbers each year. Can we have that?
16:18
Speaker 1
-
Speaker 1
Yeah. I mean, we are getting better, as the Na knows, at publishing our report and accounts and was pleased to get ours out pre recess. But I do take the point. Let me take that away. I mean, I think the Cabinet Secretary has been very clear that in the context of civil service reform, she wants to see our work on technology right at the top of the agenda. And there's a lot of things that we're doing as a group. So I'm very happy to take that away and I absolutely understand why you want it.
16:18
16:18
Speaker 7
-
Speaker 7
Thank you. And thank you to Jeffrey, Jeffrey and the committee for inviting me. My question is initially addressed to Philippa Rose, but if. Let me know if you're not if anyone else needs to come in on it. So could you describe for me the government's long term approach to digital identity? And as part of your description, could you set out how you what you understand by digital identity and specifically how that amongst other things, how that differs from one login.
16:19
16:20
Speaker 1
-
Speaker 1
Yeah, it's a huge question. And we try to sort of specialize on particular areas. So just to be really clear, the policy for digital identity has come to DCMs as part of the machinery of government changes announced in July. But the National Digital Identity programme is closed. So we are working with our ministers on the policy approach they would like to take as part of this government digital.
16:21
16:21
Speaker 1
-
Speaker 1
I mean, I think in simple terms, it's how people can demonstrate things about themselves safely and securely and digitally. And as you know, at the moment in the Nao report, I think was really helpful in this regard. We have an ecosystem in the UK that has both private sector and digital verification services and a trust framework, and we have all of the work that colleagues here are responsible for on gov.uk, one login and the wallet. So those are the principal ways at this stage.
I don't know if you want to add anything.
I don't know if you want to add anything.
16:22
Speaker 2
-
Speaker 2
Chris. Yeah, I'm really happy to come in. So one login is making it possible for you to log in to services in government and to do it that through one, one approach. So at the moment we had about 44 different ways of logging in. The one logging programme is now doing well. We've got 245 services on board, and we expect all the relevant services within that need to have one login in them to be on board in the next couple of years, and we're just in the middle of the HMRC work to move to one login.
But that's a sort of foundational step. Another foundation which does is set out really well in the Nao report is what we do with digital credentials and wallets, and the work on the strategy at the moment that is now being worked through. Two, two things on that ourselves in government, we are doing a digital wallet where we'll start. We've started already with the veterans card, and we'll move to the digital driving license, which we're building now, but we are working with the private sector to make sure that we're not just duplicating what's there already. So we're we're now in conversation post the digital ID scheme closing to make sure we've got a strategy for credentials for the country.
So that's the sort of second pillar, the sorry, I'm happy to take questions. The third pillar is around joined up services. And so the work here is around how we make it possible to see an individual across government as one person, and that bit doesn't exist yet in government. We've got some good examples of where we are sharing data, but that work is the work that we're getting into now is almost like the third pillar. And then fourth is the work on inclusion. So we have about 9% of the population who find it can't prove who they are because they don't have a driving licence or a, or a passport.
And the inclusion programme will be one of the also one of the pillars that we work on.
But that's a sort of foundational step. Another foundation which does is set out really well in the Nao report is what we do with digital credentials and wallets, and the work on the strategy at the moment that is now being worked through. Two, two things on that ourselves in government, we are doing a digital wallet where we'll start. We've started already with the veterans card, and we'll move to the digital driving license, which we're building now, but we are working with the private sector to make sure that we're not just duplicating what's there already. So we're we're now in conversation post the digital ID scheme closing to make sure we've got a strategy for credentials for the country.
So that's the sort of second pillar, the sorry, I'm happy to take questions. The third pillar is around joined up services. And so the work here is around how we make it possible to see an individual across government as one person, and that bit doesn't exist yet in government. We've got some good examples of where we are sharing data, but that work is the work that we're getting into now is almost like the third pillar. And then fourth is the work on inclusion. So we have about 9% of the population who find it can't prove who they are because they don't have a driving licence or a, or a passport.
And the inclusion programme will be one of the also one of the pillars that we work on.
16:26
Speaker 7
-
Speaker 7
Thank you. I do think that's helpful. Just let me read that back to you to make sure I've understood it. So digital ID is the ability of people, British people presumably to identify themselves digitally to have a digital identity. The National Digital ID programme, which was one digital ID for everyone, is closed down. But the work that you are doing on enabling British citizens to identify themselves digitally continues and involves the private sector, as well as the public sector and digital wallets and and credentials, etc. and as part of that, you are wanting to be you are.
So you have a you have an approach that or an objective that government should be able to identify people, individuals across all services.
So you have a you have an approach that or an objective that government should be able to identify people, individuals across all services.
16:27
16:28
16:28
16:28
16:28
16:28
16:28
Speaker 2
-
Speaker 2
But also what it wants to do is make sure that people can go about their daily lives and be able to buy homes, rent flats, etc. so we want to make it possible that it's not hard for them to prove who they are. And so they can go on to perform the tasks they need to do. So it should always be need based. We should only be doing it if it's if it helps citizens go about their daily lives.
16:29
16:29
Speaker 2
-
Speaker 2
Yeah. So the work on that we're underway now, and the appointment of Philippa into GDS is going to be helpful in that space and what our team go on to do. What we're doing across government is making sure that we build on what's there already. So we have some good examples of data sharing. You've probably used it yourself. Some people around the room where you apply for a driving licence, for example, and it will bring in your passport picture if you say yes. So there are some good examples of where we share data already, and we want to make sure that we're doing it with purpose.
And so we're working with departments at the moment to make sure we're thinking about the problems that need to be solved. But the individual is is in control of who they decide to share that data with.
And so we're working with departments at the moment to make sure we're thinking about the problems that need to be solved. But the individual is is in control of who they decide to share that data with.
16:30
Speaker 7
-
Speaker 7
Just, I mean, I know I know a lot of people want to come on this, but is that always the case? Because, for example, if DWP, the Department for Work and Pensions can share data on an individual with, as I understand it, Treasury or other government departments without the citizen giving explicit consent. And there are gateways, I think, as I remember, which are which are allowed to do that. So. So does government strategy for digital ID always involve consent for sharing across government?
16:32
Speaker 2
-
Speaker 2
I'll just I'll define the answer if I can. In the context of digital services, then we are. That is a consent model. There are many ways that departments think about sharing data which sit within departments regulated by the Department. They sit in the way. I'm bringing the question forward and answering the question is around. Someone is within a service. They are. They are proving their identity. They want to prove who they are, and therefore they want to go on to perform a task. So in the confines of digital ID used in digital services, then consent is the model.
But that doesn't mean that across government, there aren't other ways that that data is shared.
But that doesn't mean that across government, there aren't other ways that that data is shared.
16:33
16:33
Speaker 2
-
Speaker 2
Yeah, well, the strategy needs to be fully finished, but but the work and it needs to be signed off, obviously by the Secretary of State. But in essence, what we're trying to do here is make sure that the the identity we go on to do is purposeful for the individual using it. And so with that in mind, with a, with a services perspective, that's why we're using the consent model. But we may be may be different if we use it in different contexts.
16:34
16:34
16:34
Geoffrey Clifton-Brown
-
-
Geoffrey Clifton-Brown
Could I follow that question? I mean, I probably know the answer to this, but I don't if you were obtaining a certain benefit from DWP or even HMRC in the private sector, you would probably sign a consent form for that information to be shared with another department. And given that this is a pretty serious It would probably sign a consent form for that information to be shared with another department. And given that this is a pretty serious matter, if you're claiming certain benefits, you're giving permission for HMRC or DWP to actually take money from your bank account.
Is there any clause has to be signed at the moment you apply for that benefit? It should say you are giving your consent for another government department .
Is there any clause has to be signed at the moment you apply for that benefit? It should say you are giving your consent for another government department .
16:36
16:36
16:36
Sarah Olney
-
-
Sarah Olney
To add to Dame. Chee's question, I'm very happy to take it. So my my role as Chris has set out from here on in is to help to to work with colleagues across GDS and. government to build that capability to enable some of that data sharing. So kind of. absolutely will be working through and building on the kind of questions that the committee are asking and the report that very kind of helpfully, helpfully sets out and certainly working through some of those knotty questions and issues around and what circumstances is, is consent required and. appropriate versus some of the other powers that government has to share data, for .
16:38
16:38
16:38
16:38
16:39
16:39
16:39
16:39
16:39
Catherine McKinnell
-
-
Catherine McKinnell
And this is repeated across a number of countries, is that digital? You know, using a digital identity service has to be integrated or it has to has to provide users with a quicker and more convenient way of accessing an. existing service. And that's where you see the, the greatest take up. So I'm interested to know the practical benefits that could be provided by a new digital identity. services that cannot already be achieved using existing services.
So where people are happily, happily using existing services without the need for digital.
So where people are happily, happily using existing services without the need for digital.
16:40
16:40
16:41
Speaker 1
-
Speaker 1
Ask Miss Bellamy first, since you are nodding quite vigorously, I'll just start, first of all, with the the problem with the 9% who can't prove identity already. And so they don't have a driving licence or a passport, and so they find it difficult to even start the journey. So that's one of the reasons that any advances on digital identity we could help to one of the ways we could help solve that problem. I think when people come to services now, you have to present a lot of information many times. So one logging gets you through the front door, but then you are starting to sort of have to fill in forms more than once.
You're having to give information more than once. So there is an opportunity there to think about how we may solve that. What we've seen from other international comparisons is that when you do that, you can make decisions quicker. You can see that in the Australian model recently, where you're able to get people to services with much less toil because you're able to prove who they are across departments. So I think that's one thing to, to pull out. And, and fundamentally what it's doing is the. individual gets to see their data across different places so they can see where they are in a system.
So some of the. benefits come through that way. Then also when we move out into the private.
You're having to give information more than once. So there is an opportunity there to think about how we may solve that. What we've seen from other international comparisons is that when you do that, you can make decisions quicker. You can see that in the Australian model recently, where you're able to get people to services with much less toil because you're able to prove who they are across departments. So I think that's one thing to, to pull out. And, and fundamentally what it's doing is the. individual gets to see their data across different places so they can see where they are in a system.
So some of the. benefits come through that way. Then also when we move out into the private.
16:43
16:43
Speaker 1
-
Speaker 1
What we can see with the work on the digital driving license, for example, a good. example in, in the feedback from users when we've been testing it is that if you're a young woman, for example, and you need to prove your age, you're only 18 and you want to, you know, buy alcohol in a pub at the minute, you show all of your.
16:44
16:44
Speaker 1
-
Speaker 1
You show everything your photo, your address, and moving to sort of digital credentials and digital wallet, that individual is able just to show that piece of information that says they can buy, buy the beer. And so in doing that, we're able just to give more to the sort of the service that they already have through that credential. So we can see there's quite a few benefits. There's more to do to make sure that there's value for money in .
16:45
16:45
Speaker 1
-
Speaker 1
Where it's going to be a new part of the of the process? And I think from our perspective, and we've really found the report very helpful, including the annex two, which runs through 12 things that are important. And it's one of the things we want to look at in any future. strategy when ministers make their policy decision. But I think we know that any service needs to be convenient to get take up. I think, Natalie, it's fair to say, isn't it, in the work you've done on gov UK, one login that some of the benefits have been from reducing fraud.
16:46
16:46
16:47
16:47
Speaker 1
-
Speaker 1
It's always been a requirement for people to prove who they are for certain things. But actually a lot of those processes were inconsistent. They weren't designed necessarily with a full understanding about where they would find people. So people without Chris has already mentioned people. without photo ID. One login is focused on creating a simple front door to access all government services on the basis you do it once and then you reuse it. So up until one login, there was a sort of 1 to 1. relationship between having a username and password and proving who you are, so you would prove who you are to DVLA, and then you would prove who you are again to DWP, and then you would prove who you are again to HMRC.
And what one login enables you to do is prove your identity .
And what one login enables you to do is prove your identity .
16:48
16:48
Speaker 1
-
Speaker 1
I'm not accessing all of those services continually. So one login the first time. So not all government services require you to prove your identity. It's based on the sensitivity of the data or whether the thing is particularly tied to you. So obviously for a driving licence, it's really important that you are who you say you are. But if you're paying your car tax, it actually doesn't matter who you are, you just need to have the means to pay. So the first time you as a user, create a one login and you access a service that requires you to prove your identity.
One login takes you through an identity verification process using things that you already have. So if you've got photo ID, you can use that. But if you don't, there are ways for you to prove who you are using other means. And then once you've done that, that. verification of your identity is stored in one login. So that if you go to another service that requires identity, you don't need to do it again. So once and for all, I would say there are some caveats around that. One of the things we've. discovered as we've worked through one login and with the bigger.
departments is it's not ideal to identify somebody and not look at that account for a decade or two, because actually accounts can be compromised. It's hard to know then when the person behind the keyboard is who they were originally. So one login creates an account for you and it curates that account and it looks out for signs of attack or fraud. So for example, if we could see your credentials accessing eight services in the same minute, we might think that's a bit weird. Is it really them? And so we have fraud analysts who would look at the telemetry that comes off the back related to fraud and investigate for you.
So in an ideal world, you would prove your identity once your account would stay within a normal parameters of activity. And therefore you would need to prove your identity again. But in some scenarios, if perhaps we thought your account had been compromised, we might ask you to prove your identity at that point. But it's not expected .
One login takes you through an identity verification process using things that you already have. So if you've got photo ID, you can use that. But if you don't, there are ways for you to prove who you are using other means. And then once you've done that, that. verification of your identity is stored in one login. So that if you go to another service that requires identity, you don't need to do it again. So once and for all, I would say there are some caveats around that. One of the things we've. discovered as we've worked through one login and with the bigger.
departments is it's not ideal to identify somebody and not look at that account for a decade or two, because actually accounts can be compromised. It's hard to know then when the person behind the keyboard is who they were originally. So one login creates an account for you and it curates that account and it looks out for signs of attack or fraud. So for example, if we could see your credentials accessing eight services in the same minute, we might think that's a bit weird. Is it really them? And so we have fraud analysts who would look at the telemetry that comes off the back related to fraud and investigate for you.
So in an ideal world, you would prove your identity once your account would stay within a normal parameters of activity. And therefore you would need to prove your identity again. But in some scenarios, if perhaps we thought your account had been compromised, we might ask you to prove your identity at that point. But it's not expected .
16:52
16:52
16:52
16:52
16:53
16:53
Speaker 1
-
Speaker 1
To be a you know, is going to be part of one login as well. So we've been working with HMRC in partnership for about four years. There are huge organisation with complex fraud and user needs. HMRC is now fully onboarded to one login as part of its first phase. So if you are a new user and you don't have an existing government gateway, you will now never need to get one. If, however, you're one of the 32 odd million people who've still got Government Gateway, you'll be in wave two and we'll be migrating you over.
And we're expecting that to start next year. And then there's a third set of people that use HMRC services, and that's those that interact with HMRC as part of their professional lives. HMRC referred to them as agents and orgs. I think a large number of accountants, for.
And we're expecting that to start next year. And then there's a third set of people that use HMRC services, and that's those that interact with HMRC as part of their professional lives. HMRC referred to them as agents and orgs. I think a large number of accountants, for.
16:54
16:54
Speaker 1
-
Speaker 1
And their wave three, and we're currently in the design phase with HMRC about when they will onboard in terms of yeah, sorry and NHS in terms of health, there is always being a separation. So there are no current plans for one login to sit on the front of health services or for the health service to sit on the front of government.
16:55
16:55
16:55
16:55
Geoffrey Clifton-Brown
-
-
Geoffrey Clifton-Brown
Are kind of separate. Maybe the point to ask you, Natalie, but maybe Susanna wants to come in on this. There's one word I think is very, very important in all of that, and that is trust. I think trust is the one thing because of dramatic stories of hacking and one thing and another, the public are very concerned about the rollout of digital and the government holding more and more data on them.
16:56
Speaker 1
-
Speaker 1
What is the government going to overcome that? So if I if I could talk about a sort of practical example with one login, I can talk you through sort of security model. But at a principle level, one login holds the bare minimum of data it needs in order to operate. So it is not a big data lake. The amount of information it holds about individuals is a very small number of data items. So the first thing to say is it's not a big target in that respect. That data is also kept in. disaggregated places. So again, if you wanted to get hold of that data, you need to break into a number of different places in the system before it would be of any use to you.
It's also built with privacy enhancing. principles in mind. So one login effectively works a bit like a security guard on a building. So when you want to access a service it says have you got the right pass? And then it checks that the pass has got your face on it and it'll let you in. But that security guard doesn't know that you go in the building or what conversations you have or what data you access, and neither does one login. And that's a conscious design choice. So one login does not know what you do when you get into a service.
It knows what time you access the service and what time you left. And that's it. And it checks your credentials as you go in to be sure that it's you. And that's useful for things like fraud. So like I said, if you're accessing eight services in the same minute, we'd be like, hang on, that's weird. And it would trigger an alert because we might think your account had been hijacked and we'd send you a message to that effect.
So similarly with verified.
It's also built with privacy enhancing. principles in mind. So one login effectively works a bit like a security guard on a building. So when you want to access a service it says have you got the right pass? And then it checks that the pass has got your face on it and it'll let you in. But that security guard doesn't know that you go in the building or what conversations you have or what data you access, and neither does one login. And that's a conscious design choice. So one login does not know what you do when you get into a service.
It knows what time you access the service and what time you left. And that's it. And it checks your credentials as you go in to be sure that it's you. And that's useful for things like fraud. So like I said, if you're accessing eight services in the same minute, we'd be like, hang on, that's weird. And it would trigger an alert because we might think your account had been hijacked and we'd send you a message to that effect.
So similarly with verified.
16:59
16:59
16:59
16:59
Speaker 1
-
Speaker 1
It doesn't know the contents of that credential. So when we roll out the mobile driving licence, it will know that you downloaded a driving licence, but it won't know whether you've got any points or whether you can tow a caravan. So it it, it just holds the minimum amount of information it needs to perform its job as that security layer. It's not, it's not, it doesn't hold or track any further data than that. And actually just to there's a thing in the report that's quite helpful on page 20. paragraph one, two, two, and one, two, one.
There's a thing about identifiers. So one login does not issue a single identifier to people. And in fact it does make use of. tokenization which .
There's a thing about identifiers. So one login does not issue a single identifier to people. And in fact it does make use of. tokenization which .
17:01
Speaker 2
-
Speaker 2
Is a privacy. enhancing security based protocol as well. I think we do really agree with you that it's absolutely critical to have trust. And that's something obviously across the wider digital system. And I think the other point just to flag in the Nao report is when you talk about transparency and accountability.
17:01
Speaker 4
-
Speaker 4
Important as well. Of course. Clive. Yes. Understanding is that only which has built a very. comprehensive system of putting people's various information together in, in one place. They, I think, have a. privacy enhancer, if you call it, where if anyone else goes in the system, the person whose system it is, the person whose data is there can .
17:02
17:03
17:03
Speaker 2
-
Speaker 2
But what it has done really. successfully is, is made sure that the. individual is is in control. And so if somebody access your account, you see. everybody's access it, whether it's your doctor, whether it's someone who's just you've rented a flat, you see all of those interactions. So when we look through the proposals going forward, we want to make sure that when we're working both with the private sector and locally, we want to make sure that we've got we think about those going forward. And so as we design the strategy that we will, we will make sure that we consider it.
And if .
And if .
17:04
17:04
17:04
17:04
17:04
17:04
17:04
Speaker 2
-
Speaker 2
We'll be able to tell us whether you are going to do that. So the strategy is now being worked through and will go to Secretary of State for approval. Now we've moved to. DCMs and so that work is in flight. Now. We're just a few weeks post the ID scheme being scrapped, so we're working hard and fast to make sure that we've got the right strategy for the UK. That also works in conjunction with the private sector, but trust is at the right in the in the heart of it. And absolutely we'll be thinking about that.
17:05
17:05
17:06
17:06
17:06
17:06
17:06
17:06
17:07
Matt Turmaine
-
-
Matt Turmaine
Thank you. Matt Domain please. Thank you. Chair. Hi. I'd like to ask a few questions, if I may, about the cost of. developing and operating and integration services. So do you think that there is or do you have the understanding of what those costs are likely to be for future services that you're looking to roll out?
17:08
17:08
17:08
17:08
Speaker 1
-
Speaker 1
Running for a few years, and we can tell you about the costs and benefits, if that's helpful. Yes, yes, certainly. So one login benefits from being on the government major projects portfolio. So it has a fully. approved business case. So far it's realised. 752 million in net benefits from. April 2022 to the end of August 26th. And those benefits are driven by reduce identity related fraud.
396 million reduced duplication and cheaper digital access to services. 218 million and time saving for end users at 138 million. The current business case runs out to.
396 million reduced duplication and cheaper digital access to services. 218 million and time saving for end users at 138 million. The current business case runs out to.
17:09
17:09
Speaker 1
-
Speaker 1
With a total net. benefits figure of. 2.83 billion by then. So. And that's against a total cost of. 702.94 through to March 2028. So Onelogin has a mature benefits. realization plan. We had a model on how much fraud it would stop, which we worked through with the Public Sector Fraud Authority. We started with a conceptual model.
We've just gone back for the second iteration with some actual data from DVLA to show how. effective our .
We've just gone back for the second iteration with some actual data from DVLA to show how. effective our .
17:11
17:11
17:11
17:11
17:11
Speaker 5
-
Speaker 5
Of being able to, to launch other services that would I mean, I think the way we've looked at it and this is consistent also with what the Nao saying is there's kind of costs of building and. maintaining whatever the service is. If it isn't something that we have already. And obviously the benefit of gov.uk Onelogin is it exists, it's built and it can be scaled. And then the costs of any kind of connecting of services and kind of ongoing hosting, including things like cyber security. And I think we're all conscious that at the moment, you know, the need to have really good cyber protection is going up the agenda.
So that's a sort of general answer. But I think it would be better when we .
So that's a sort of general answer. But I think it would be better when we .
17:13
17:13
Matt Turmaine
-
-
Matt Turmaine
To do that, that would be really helpful, of course, because if we have a strategy, we'll we'll publish it. I'll just do it. Understood. I mean, obviously it's sort of, I guess, within a context that IT infrastructure costs often balloon and become very much more expensive than anticipated. But as a committee, we have seen reports in examples where such projects have been delivered lower than the cost .
17:13
17:13
17:14
17:14
17:14
17:14
17:14
17:14
17:14
17:14
17:14
Sarah Green
-
-
Sarah Green
We come to Sarah Green, please. Thank you. Chair. I'd like to revisit some of the conversation we were having earlier. So back in July, the government announced that it was no longer pursuing a government issued digital identity. And you've confirmed that the national program has closed, but is it not the case, based on the answers you've given us this.
17:14
17:15
17:15
17:15
Speaker 5
-
Speaker 5
Philippa was in it and some others, and that work was looking at the specific. policy intentions they had for a national programme. And as you know, and I think various select committees have had evidence from some of the people involved, they were going through the. consultation and it was stopped in July. There are within the work that we do, identity. attributes and the trust. framework that Rod's team are responsible for. That's all about having DBS. providers who meet that. And then one gov.uk. One login also has ways of identifying people, but that is not the same as a national digital identity strategy, which, as you know before .
17:17
17:17
17:17
17:17
17:17
Speaker 5
-
Speaker 5
It's having through gov.uk one login. services where people can identify themselves, but they can use other means if they want. If they're getting DWP services, they could go to post office. They might never be digital at all. So we're trying to provide services that work and enable people to use them digitally, but they .
17:17
17:18
17:18
Speaker 7
-
Speaker 7
Which tries to provide a level playing field for public and private sector. So you've got kind of clear rules of the road on what it is that is underpinned by the Data Act that was passed before, passed by Parliament before the announcement about the National Digital ID programme. And so what we're doing with that is sort of continuing on that that same trajectory that that that we're on before. And Parliament has put various statutory functions on us that we're now kind of in the process of implementing. I would add on what Susannah said. There's having been involved with the National Digital ID programme early on.
So so we've got we already had one login and the gov wallet, which were sort of existing plans. We already had the work we were doing with the trust. framework to try and provide that sort of clarity and rules of the road. And I'm very happy to kind of get into that in more detail. What the national programme was principally about was in. ensuring a kind of extra, a new product that could be made available to everyone who wants it. That is no longer something that we are looking at doing. The big thing that we we therefore need to kind of do on the back of that is inclusion.
So for those who who don't have passport and driving licence and some of those.
So so we've got we already had one login and the gov wallet, which were sort of existing plans. We already had the work we were doing with the trust. framework to try and provide that sort of clarity and rules of the road. And I'm very happy to kind of get into that in more detail. What the national programme was principally about was in. ensuring a kind of extra, a new product that could be made available to everyone who wants it. That is no longer something that we are looking at doing. The big thing that we we therefore need to kind of do on the back of that is inclusion.
So for those who who don't have passport and driving licence and some of those.
17:21
17:21
Speaker 7
-
Speaker 7
How can you prove your. identity without them? So I think Chris has already spoken to a number of things that, that they're doing through the trust framework we have. We kind of embed inclusion as a, as a, as a part of how we're trying to encourage everyone who's operating under the trust framework to be thinking about inclusion and accessibility.
17:21
Sarah Green
-
-
Sarah Green
And I think there's probably more we can we can kind of do in that space. Thank you for that. So my final question before I hand over, because I know other colleagues will have. questions for you, is how you how you address the privacy. concerns that members of the public have. You can see that some of my questions are driving at that. How do you. We were talking about trust earlier with the chair. How do you. Because from where I'm sitting, it does sound like the infrastructure is still being put in place. How would you address someone like me or .
17:22
Speaker 7
-
Speaker 7
Someone watching and allay their privacy concerns? I'm happy to start off on on sort of the wider piece that we do, and then others might want to come in as well, chair, if that's all right. So the purpose of what the trust framework does is to try to set rules of the road and standards for for every operator, whether that's a private sector or public sector, and sort of security and privacy are absolutely at the heart of that. It's designed to give people the confidence that if you're using something that is on our we have a transparent register of who's sort of past the accredited checks to get there so people can see who that is.
We're recently rolled out a trust Mark, so people can kind of see that to try and make it easier for people to understand what's on their. So in order to be on that, that means you've gone through those checks around privacy, security and. security .
We're recently rolled out a trust Mark, so people can kind of see that to try and make it easier for people to understand what's on their. So in order to be on that, that means you've gone through those checks around privacy, security and. security .
17:24
17:24
17:24
17:24
Speaker 7
-
Speaker 7
Providing that service, a user can be confident seeing that. So my, my team in, in. DCMs sort of look after this ecosystem. So we publish the, the trust framework. We're required under the Data act to update that on at least an annual. basis in order to get on our register to say, you've kind of met those.
17:25
17:25
Speaker 7
-
Speaker 7
You have to be accredited by a separate and independent body. We have two at the moment that do that. We're looking to try and encourage more into that market. And those conformity assessment bodies are themselves then accredited by the UK. Accreditation Service. So we have sort of multiple checks in , in the. process to make sure that we have the rules that are being followed. People can see that they're .
17:26
17:26
Speaker 1
-
Speaker 1
System as a whole. Do you want to just touch on. gov.uk one login? If I can just say, building on the things I've already said about data minimization principles. So the privacy notice for one login is already public. Yeah. And we've agreed to publish the data privacy impact assessment by the end of the year despite having no obligation to do so in pursuit of transparency. That's actually been with the ICO once we've got some updates because we've got new routes. So every time you add a new piece of functionality, you have to then update it.
So the latest version is with the Information Commissioner's Office. They've signed off the previous one. We'll be publishing that as well. And one login is also certified against the trust framework to make sure that we're meeting those standards around .
So the latest version is with the Information Commissioner's Office. They've signed off the previous one. We'll be publishing that as well. And one login is also certified against the trust framework to make sure that we're meeting those standards around .
17:27
17:27
Rupert Lowe
-
-
Rupert Lowe
Come back, Sarah. Anyway. Rupert, please. Thank you. Chairman. Yes, I should disclose that as a sitting MP, I'm implacably opposed to digital ID in any form, and I'm eternally grateful to Silkie Carlo at Big Brother Watch for all the work she does on identifying state intrusion into the electorates lives. Listening to you, I'm nervous about the business of convenience. The government always sells things to people on the basis of convenience, a bit like they tried to sell the euro to us on the basis of convenience. So I don't like being sold things on the basis of convenience, so I'm immediately suspicious.
I think, you know, thanks to the now, as you say, they've produced another fantastic report. And I thought the key bit in that to me was in the summary, which it says to deliver value for money. Digital identity will need to be both usable and trusted across both public and private.
I think, you know, thanks to the now, as you say, they've produced another fantastic report. And I thought the key bit in that to me was in the summary, which it says to deliver value for money. Digital identity will need to be both usable and trusted across both public and private.
17:29
17:29
Rupert Lowe
-
-
Rupert Lowe
With individuals being able to use it easily. securely and. consistently across services. That's to me, the key statement. And then I look at the trust in the UK government from the electorate, and I see that trust in government in the UK is regularly closer to. Colombia than it is to either Estonia, which Clive used, or indeed Denmark, and usually about 10% lower than it is in France, which is pretty amazing given what's happening in France at the moment. So I think my question to you is, how are you going to convince the. electorate to trust you?
Because, as the Nao says, you're not going to be able to make this work unless people trust the state and failing states, which I consider us to be, have a history of clipping coinage and generally robbing their electorate. So how .
Because, as the Nao says, you're not going to be able to make this work unless people trust the state and failing states, which I consider us to be, have a history of clipping coinage and generally robbing their electorate. So how .
17:31
Speaker 5
-
Speaker 5
Are you going? How are you going to get the British people to buy into this? Shall I start and then I might hand over. I'm not going to answer all the points in there because there was a lot. But I think in the heart of it, you're making the same point as the chair about trust. And we very much agree with that. And I think what we're trying to do, firstly, is deliver any policy that ministers might have in this space. And then for the services we already have. So gov.uk one login and the trust.
17:32
17:32
Speaker 5
-
Speaker 5
Make sure they're as clear and transparent as possible. And then hopefully as the AOC, people will want to adopt them because they will understand how to use them, they'll know what they're trying to do, and then they will be more they'll be greater adoption. So I think our job is to do these services well, clearly.
17:33
17:33
17:33
Speaker 2
-
Speaker 2
Lessons from the news report. I don't know if any of you want to add really, really happily. I think it's a real fair challenge. I think in the UK, the the products and services that people come to to access government services is UK. And the trust number for UK is about 82%. So it should be more than that, but it's. 82% and holds firm at that number. And it sits when you look at all the research, it sits sort of to the side of the government of the day. It's very much about service in its own right, and people use it when they need it.
And so one login, the reason one login is one login is because it builds on the credibility of the. gov.uk work that people use in their daily lives. And so it builds from a foundation of trust. But absolutely, we. cannot break that trust of making sure that service works for them. And I think it ties to the question before. The point then, is that we're making sure that we that people come to services and they they access them in their daily lives and they're able to be in control. And we've talked about consent before, probably controls a better word.
And we need to make sure we do that when it comes to identity. So what we published in the Digital Blueprint was that the. identity credentials we would do were ones that people had already. So as an example, the veterans card, we do have a digital credential for.
And so one login, the reason one login is one login is because it builds on the credibility of the. gov.uk work that people use in their daily lives. And so it builds from a foundation of trust. But absolutely, we. cannot break that trust of making sure that service works for them. And I think it ties to the question before. The point then, is that we're making sure that we that people come to services and they they access them in their daily lives and they're able to be in control. And we've talked about consent before, probably controls a better word.
And we need to make sure we do that when it comes to identity. So what we published in the Digital Blueprint was that the. identity credentials we would do were ones that people had already. So as an example, the veterans card, we do have a digital credential for.
17:35
17:35
17:36
Speaker 1
-
Speaker 1
Museums at lower cost, etc. and we were finding from veterans that they didn't have it with them. They didn't get the benefits of it. So the benefit there was making sure that you could prove you're a veteran at point of need and you could go about and have access to it. The driving licence is the same. DVLA are telling us that people are asking for them to have that credential on their phones, because it will make it easier for them to hire a car in this country and abroad. So. So I think it has to be secure, it has to be.
17:37
17:37
17:37
Rupert Lowe
-
-
Rupert Lowe
We need to make sure always that, that that stands the test of time and is trusted again. That sounds more like. convenience than, than than trust. So again I look and the British people look, they're not stupid. And they see that the current Secretary of State for DCMs, she was heavily. involved in Think Labour when it was known as Labour together. It was rebadged after a series of scandals. Now they were pretty. implacably supportive of digital ID. So I think again, if we're not careful, we will end up getting digital ID by the back door rather than the front door.
And although you tell us that's not the case, again, I think this comes to the trust point. People don't. necessarily trust and believe that what they're being told is true. Now, that may be because of Covid. It may be because they watch what Trudeau did in Canada with the truckers. It may be they look in China and government there starts to make judgments about whether they're living a good life. So I think I think we have a question. You've got a big problem. Unless you can win the trust of the British people. And I that that's what the now I think very elegantly stated.
So .
And although you tell us that's not the case, again, I think this comes to the trust point. People don't. necessarily trust and believe that what they're being told is true. Now, that may be because of Covid. It may be because they watch what Trudeau did in Canada with the truckers. It may be they look in China and government there starts to make judgments about whether they're living a good life. So I think I think we have a question. You've got a big problem. Unless you can win the trust of the British people. And I that that's what the now I think very elegantly stated.
So .
17:40
17:40
17:40
17:40
17:40
Speaker 3
-
Speaker 3
It was a broad. You need to do the political bit. Okay. Well, yeah, I wasn't I wasn't proposing to do that except to say I think that as and when we do have a policy decision around this from our ministers, I'm sure my Secretary of State will be happy to come and talk about it. I mean, I think I think one of the things that's interesting is we know in a world of the AI tsunami chair that you were talking about earlier, there will increasingly be need for. people to be able to prove who they are, and they're not a bot or an agent.
And I think we're going to see a lot more questions in these spaces, whether it's the private sector or the public sector. So again, what we're trying to do here is make sure for the services we've got, they're clear, transparent. convenient so that we can hopefully people will want to use them, but there will be other routes if they do not. And then with the trust framework, it makes sure that for those certified bodies, they're meeting a certain set of criteria,
And I think we're going to see a lot more questions in these spaces, whether it's the private sector or the public sector. So again, what we're trying to do here is make sure for the services we've got, they're clear, transparent. convenient so that we can hopefully people will want to use them, but there will be other routes if they do not. And then with the trust framework, it makes sure that for those certified bodies, they're meeting a certain set of criteria,
17:42
17:42
17:42
17:42
Blake Stephenson
-
-
Blake Stephenson
Think I've got another question. Good. Hi. Please. Without being controversial, I'll just say to Rupert, look, I was born in the last century, but I still got to have regard as an elected. representative to the fact that life has changed in this century and people expect to see things done differently, particularly younger generations. And therefore, we've got to adapt what we do as a parliament, as a government, to ensure we take account of that.
I mean, I my phone is looking. I've got various apps for.
I mean, I my phone is looking. I've got various apps for.
17:43
17:43
17:43
17:44
17:44
Blake Stephenson
-
-
Blake Stephenson
To ask the question then. This is a question. When looking at whether you do things anew or go and build on what's already there, particularly in the private sector, how do you make those judgments? Because building something new, all singing, all dancing seems great, but actually what's there in the .
17:44
Speaker 3
-
Speaker 3
Private sector may make it quicker to do it. What's the balance and how? Well, first, just to say, in terms of the app, there is a. gov.uk one login app. So hopefully if you want to, you can download that on your phone. The things that we will be doing and I think already do is really use the now's report to think about how are we clear about the roadmap? Are we.
17:45
17:45
17:46
17:46
Speaker 3
-
Speaker 3
Right. And the future. How are you going to make those judgments? Well, I think it comes from the policy decision ministers make. So if they decide they want to do something different, something more, something new, then obviously we'll look at what do we think is deliverable? What's the. vfm and also the useful 12 points in the now's annex two, where they're helping,
17:47
17:47
17:47
17:47
Speaker 5
-
Speaker 5
They can contribute. And how do you want to talk about that? Can I talk about that? So, so one of the one of the things we're doing, I think in response to the first part of your question as well, is working with departments across, across government, because just the way the kind of the legislation and everything works at the moment, there's different acts that put different requirements on things. So we've recently worked with the Home Office, say, to change some of the legislation. around proving your age for buying alcohol, which is which is quite a big kind of use case.
So in terms of where we're looking at the kind of public private sector.
So in terms of where we're looking at the kind of public private sector.
17:48
17:48
17:48
Speaker 5
-
Speaker 5
But that then can enable public or private sector solutions. And when we look at things like right to work checks, you know, there are already private sector organisations who are doing millions of those every, every year. So, so it sort of often we're trying to kind of, you know, do what government only government can do. And then and then sort of enabling the private sector to then kind of find and build on, build on those .
17:49
17:49
17:49
17:50
Speaker 5
-
Speaker 5
But also then what we call relying party. So those parts of the private sector, you know, it's not just about those who provide the. technology to check digital identity. You need someone in the pubs, the clubs who's who are also then have got the technology to receive it, the supermarkets. So we do engage with sort of lots of different parts of business to try and understand what would work. Is there something that is that we don't have in, say, the trust framework at the moment that would be useful? And I say we're required to update that trust framework every year so we can we can kind of work out what needs to change.
We've recently put it up on GitHub. It's open there for people to make comments and say what they disagree with, what they think we should be changing. So we're trying to do this in a way that opens up to the private sector to be able to say, you know, what their views are and .
We've recently put it up on GitHub. It's open there for people to make comments and say what they disagree with, what they think we should be changing. So we're trying to do this in a way that opens up to the private sector to be able to say, you know, what their views are and .
17:51
Speaker 3
-
Speaker 3
What would be most useful. So we can kind of build a system that works for them. Is it okay if Natalie comes in as well? So building on what rod said as a practical. example with the digital driving licence. So we've been clear from the off, the strategy has been that the digital driving licence you'll be able to use in all the same ways as your physical one. So primarily it's about your right to operate a car, but people use it to pick up parcels to buy beer if they're under under.
17:52
17:52
Speaker 3
-
Speaker 3
To place a bet on the Grand National. And so I think of it as building two halves of a bridge. So government owns that data. We have it. We can offer people the opportunity to put it in a wallet much the same. People now use digital boarding passes and gig tickets. You know, you can have a digital driving licence, but it only really works. As rod said, if somebody at the other end is going to check it and enable you to actually buy the beer. So we've got a bit of a chicken and egg situation.
So we've been working really closely in the government digital service with industry. And just last week we opened up a sandbox. And what I mean by that is it's a testing. environment that enables the private sector who are certified against the trust framework to actually. integrate with the wallet technology that we've got. So we've got a test version to check that it all hangs together so that an individual can go to DVLA, download a driving.
So we've been working really closely in the government digital service with industry. And just last week we opened up a sandbox. And what I mean by that is it's a testing. environment that enables the private sector who are certified against the trust framework to actually. integrate with the wallet technology that we've got. So we've got a test version to check that it all hangs together so that an individual can go to DVLA, download a driving.
17:54
17:54
Speaker 3
-
Speaker 3
They can show it in their wallet, it can be checked by the private sector, and then that can cascade all the way to a pub or an online business that's got some sort of regulated use case. So when we talk about working in partnership with the private sector, it's true. We've been partnering all the way through the sandbox opened last week. We're planning an event in December where we invite those private sector providers into the Whitechapel building, so we can do some live, end to end testing to check that all the technical protocols, because we're all building to the same technical interfaces.
But there's always, you know, sometimes when you put things together, they don't work absolutely perfectly. So we're fine tuning that. And the next phase of that testing will be in December, when they come to the Whitechapel building with a view to starting a national rollout next year. And we can only do that at a digital driving license is only useful if there are people ready in shops and businesses ready to receive it. So we really do have to make sure that our our comms and our technical planning and our kind of stakeholder management and partnership with.
industry all come together at the same pace so that we can put out something that's. comprehensively useful as opposed to academically interesting,
But there's always, you know, sometimes when you put things together, they don't work absolutely perfectly. So we're fine tuning that. And the next phase of that testing will be in December, when they come to the Whitechapel building with a view to starting a national rollout next year. And we can only do that at a digital driving license is only useful if there are people ready in shops and businesses ready to receive it. So we really do have to make sure that our our comms and our technical planning and our kind of stakeholder management and partnership with.
industry all come together at the same pace so that we can put out something that's. comprehensively useful as opposed to academically interesting,
17:56
17:56
17:56
17:57
17:57
17:57
Blake Stephenson
-
-
Blake Stephenson
And so they're all in a in a roadmap to go into the wallet. Just one follow up, what Rob was talking about with the the fact that there are certain parts of the private sector that need to find people's identity and prove it in order to comply with government legislation. It could be landlords letting property or an employer employing someone to make sure they have the right to work the right to rent. One of the complaints you get sometimes is, will we get to show them this piece of paper? We're not sure whether it's actually true.
Yeah. You know, someone can come along and say, well, that's my proof that I can be in this country and can work. Is it? So how are you going to make sure that the .
Yeah. You know, someone can come along and say, well, that's my proof that I can be in this country and can work. Is it? So how are you going to make sure that the .
17:59
Speaker 3
-
Speaker 3
Robustness of the data there is sufficient to comply with those requirements? So one of the really big. advantages to digital versions of documents is exactly that. So so long as they are. programmatically checked, they are much harder to fake than their physical counterparts. So when you show your ticket or your boarding pass, somebody scans it. And when they scan it, they are. checking that it came from the right source, that it hasn't been tampered with, that it meets all the security protocols. So the credentials that go in the wallet that will be read by the private sector will meet all of these things so that a retailer will get a green tick and it bakes in that selective disclosure as well.
So there was the example earlier about the. person only disclosing the fact that they're over 18. The person in the the pub or the business will scan the thing. They will see a green tick that says over 18, but it's also checking that it hasn't been tampered with. It came from the right source. And all of those security boxes have been ticked, so it's much harder to fake when. programmatically checked than a physical driving .
So there was the example earlier about the. person only disclosing the fact that they're over 18. The person in the the pub or the business will scan the thing. They will see a green tick that says over 18, but it's also checking that it hasn't been tampered with. It came from the right source. And all of those security boxes have been ticked, so it's much harder to fake when. programmatically checked than a physical driving .
18:00
18:01
18:01
18:01
18:01
Speaker 3
-
Speaker 3
When the digital ID can't. So in the first instance, the. The offer of a digital driving licence is entirely in addition to the physical driving licence. So it will be an optional extra. And we need to see what, what what adoption rates are like. And there will always be people for whom the physical. alternative remains the better choice. So I think it's a little bit organic. We need to make it useful. The market needs to mature. And over time I would expect more transactions to move towards the very convenient. You don't have to carry your driving license or your passport with you, because you've always got your phone.
And a lot of the cases are related to proving your age. And the youth are seldom seen without their phone in their hands, versus taking their driving licence in the back of their phone case. So from a sort of fraud and theft and loss.
And a lot of the cases are related to proving your age. And the youth are seldom seen without their phone in their hands, versus taking their driving licence in the back of their phone case. So from a sort of fraud and theft and loss.
18:03
18:03
18:03
18:04
18:04
Speaker 5
-
Speaker 5
You have to use a digital verification service provider that's on the register that we run. So, so all businesses will be able to have the. confidence that, you know, who they're using has the kind of is able to do that programmatic check and has the kind of right secure and trusted. It is not the only way to do it. You can do non, non digital.
18:04
18:04
Speaker 5
-
Speaker 5
But if you're then doing that digital check through a someone on the register, you then have a kind of statutory. defence to be able to say, you know, I follow this process, this, you know, I had reason to believe that this was something that I could rely on. And if something goes wrong and you've ended up employing someone that you should not have been, that a business then has a statutory defence on that. So, so I think what we're trying to do in, in that particular case of right to work is to be able to businesses to have confidence that there is a way of doing this to a really high degree of confidence and security and transparency.
But as Natalie said, it is not the only way to do it. This is a difference to the national ID program.
But as Natalie said, it is not the only way to do it. This is a difference to the national ID program.
18:05
18:05
Sarah Olney
-
-
Sarah Olney
Thank you very much, Clive. Sarah Olney, please. Thank you. Chair, just coming back to you, Mr. Latham, just to sort of take that a little bit further. I mean, there are and Miss Bellamy mentioned earlier the point that was just raised about only needing to prove your age when you're wanting to buy an age restricted .
18:06
18:06
Sarah Olney
-
-
Sarah Olney
Do you think? And so obviously there's an advantage of digital identity there, only having to prove the thing that you need to prove. Do you think that there are gaps in terms of either the the current in terms of what digital identity can currently prove about you? Does that match up with the things that, you know, retailers is, is an example for age. restricted goods, but also, I suppose right to work, right to be in this country.
Does digital identity currently provide that? And if not,
Does digital identity currently provide that? And if not,
18:07
18:07
Speaker 5
-
Speaker 5
Are you doing rather to, to fill those gaps if I, if I, so I think this gets to the how we have it is it is a slightly sort of mixed picture across across different cases at the moment, which as I said, it just reflects that there's lots of historically lots of different pieces of legislation. And one of the things that we're trying to do in, in my team is kind of go systematically round to work with the government departments and through them with different.
sectors to try and.
sectors to try and.
18:08
18:08
Speaker 5
-
Speaker 5
How can we get this into the best shape that it could possibly be? So that's why we worked with the Home Office on alcohol and and age. And as Chris mentioned, as you mentioned, one of the bits of feedback we had was around trying to minimise how much data an individual is giving out about themselves. Another piece of feedback we had from. supermarkets was around trying to avoid their staff being put in a position where you have to ID someone who's maybe in a an aggressive 17 year old, you know, so they don't have the right to buy it.
But they, you know, it can be quite difficult for their staff. Whereas if you've got a programmatic check, digital ID, it's all sort of being able to done with that effectively without a kind of a human having to do that proactive check. So we've done that work, the Treasury on money laundering. So what we're now trying to do is, is kind of move on to other things. Tobacco and vapes, knives, knives and.
But they, you know, it can be quite difficult for their staff. Whereas if you've got a programmatic check, digital ID, it's all sort of being able to done with that effectively without a kind of a human having to do that proactive check. So we've done that work, the Treasury on money laundering. So what we're now trying to do is, is kind of move on to other things. Tobacco and vapes, knives, knives and.
18:08
18:08
Speaker 5
-
Speaker 5
So, so we're kind of working, working through with departments to work out what are some of those gaps and then trying to work with them around what needs to kind of be be changed to, to, to address it. And so we try and open this up and engage with different sector bodies. So we're getting that feedback around where do people see that .
18:08
18:08
18:08
18:08
18:08
18:08
Speaker 5
-
Speaker 5
Where we can see opportunity in trying to bring people into the the system that we're running to, to ensure that those are secure and trusted. I think there's other gaps that we're looking at more broadly around how the system that the office for Digital Identity and Attributes runs. So we're we might consider at the moment we did a call for evidence on trust services, which is things like.
18:08
18:08
Speaker 5
-
Speaker 5
Which is slightly different, but kind of adjacent to this. And so we're probably going to do a little bit more work looking at that. We've mentioned. inclusion a number of times. And again, we've got things in the trust framework that try and encourage people to think, be thinking about inclusion and inclusion is, is quite broad in this sense because as we've touched on, you can get the digitally excluded, the identity excluded and kind of core accessibility. So I think we'll be looking as well around, around some of the things we can do to try and promote greater inclusion.
So I think there's a, there's something around adoption supporting, and hopefully I've given some sense of some of the use cases. There's something around kind of continuing to hone the system, which, you know, will have to keep going because the technology changes and the circumstances change. And then I think longer term. We've got a desire to be interoperable. Kind of, you know, with international partners. But that is something that is a, you know,
So I think there's a, there's something around adoption supporting, and hopefully I've given some sense of some of the use cases. There's something around kind of continuing to hone the system, which, you know, will have to keep going because the technology changes and the circumstances change. And then I think longer term. We've got a desire to be interoperable. Kind of, you know, with international partners. But that is something that is a, you know,
18:08
18:08
18:08
18:08
Rupert Lowe
-
-
Rupert Lowe
Thank you chair. Thank you, sir Rupert, please. Well, thank you chairman. Yes, I think the committee's quite keen to know why it is that it's been so difficult for you to connect all this data across various platforms. I mean, you you collect a lot of. data through the passport office, through the driving licence, through.
18:08
18:08
18:08
18:08
Speaker 6
-
Speaker 6
Why is it so. difficult to. So a so clearly over over the years, lots of different. departments have built their systems separately. And again, I think the report figure. Figure seven on page 18 sets it out really well. The kind of history as to why these legacy systems have built up. So they have been different departments have built their systems for different. purposes to different.
18:08
18:08
Speaker 6
-
Speaker 6
As Natalie's already touched on. Actually, different departments will have different identity and security standards depending on the service and the interaction between the service user and the department. And then as you've highlighted, different different identifiers, National insurance numbers, unique tax reference numbers, passport numbers, and the like departments will have built their. systems differently for often for good reason. So departments have had responsibility to ensure they're only. capturing and processing the information they need to be able to make the decisions they need to make to deliver good value for money. And departments will have been on this committee will have reflected on their different.
18:08
18:08
18:08
Speaker 6
-
Speaker 6
Disparate records that have been recorded to different standards. And so therefore, joining up records across government when we are doing it needs to be done really carefully through mapping, testing, checking. And so really where we kind of where that takes us to now. And again, the recommendations from the Nao report is how do we work on moving government to common standards to be able to move to a world where our systems are more.
18:08
18:08
18:08
18:08
18:08
18:08
18:08
Rupert Lowe
-
-
Rupert Lowe
Organic, organic growth in different places. And now we're trying to be more systematic. I'm quite intrigued. If you're successful in your plan to. effectively bring everything together, you're going to be collecting what's known as. metadata so on, which will give you a huge amount of power over the citizens. So once you've connected them, do you plan to collect collect this metadata? Do you already collect the metadata? And if you do, I guess the questions are who owns it, who retains it, who controls it, and who can access it. Because again, I think this comes to the trust point because people will be.
concerned that the secondary use of this data may not be in their interest. So how are you going to are you .
concerned that the secondary use of this data may not be in their interest. So how are you going to are you .
18:08
Speaker 6
-
Speaker 6
Intending to do that? Have you had any discussions about this? What what is your plan? So the intention of the plan is, is, is definitely not to bring all this data into a single place, but. instead very much building on the work that Onelogin have done to create the frameworks and. mechanisms for the information to be shared, but in secure and well managed ways that mean that if two departments are sharing information about an individual, then it can be absolutely confident that it's the right individual, that the. department is sharing the data with the right.
18:08
18:08
Speaker 6
-
Speaker 6
And with all the kind of cybersecurity and controls in place. So this is about building the frameworks and mechanisms to do that data sharing safely and. securely . , without the need to create big, big pools of data, which then, you know, for all the reasons that committee are concerned about, then risk being a target for all .
18:08
18:08
18:08
18:08
Rupert Lowe
-
-
Rupert Lowe
Natalie, did you want to build on any of that? No. Not really. No. I guess the question we all want to know the answer to is whether this is in the interests of the government or the citizens that that's. And I think as governments insert itself into our lives to a greater extent, you could argue that this is more in the interests of the government than it is in the interests of .
18:08
18:08
18:08
18:08
18:08
18:08
18:08
Speaker 8
-
Speaker 8
Yeah. Anyway. Yeah. Do you want to come in just to, just to sort of really sort of. clarification that, you know, it is really important and I totally support the ambition to create good, convenient services. And I know that lots of my constituents want that. I think the point that's been made about. metadata is that whereas the the data about, you know, your driving licence, your age, your address, we've agreed is the citizens data, and they should have control over it, the metadata, which would be, you know, when did they apply for a driving licence or did they apply for a driving licence at the same time as their, as their son was, you know, in another part of the country or, you know, that the data around that, you know, who, you know, are there plans in terms of, you know, whether that will be stored with the underlying data?
And .
And .
18:08
18:08
18:08
18:08
Speaker 1
-
Speaker 1
Associated with it? Retrospective metadata? I it's it's absolutely the right question. And we will we will make sure that as we, we define the strategy and policy, that we share everything with Committee. And just to back up what Suzanne has said, fundamentally, the connections we are making in government digital. services is around, is around. convenience and is around people getting what they need quicker and easier. And context is really important, but it's the context of the. individual in that process. And fundamentally, it's where they are now and what they want to do next. And so the way we are approaching it is if you, for example, have just had a baby, you are deciding what to do next and what you might need to do on the journey going forward, whether that's you've just found out and you're going to get your maternity rights all the way through to deciding you're going back to work at the moment, that's quite tricky.
And, and you need to decide as you go and you need to ask many, many questions. The what we are doing is thinking about journeys like that where we can say, if we, if the individual was in control and the individual could ask more questions, we could make decisions quickly, and that may.
And, and you need to decide as you go and you need to ask many, many questions. The what we are doing is thinking about journeys like that where we can say, if we, if the individual was in control and the individual could ask more questions, we could make decisions quickly, and that may.
18:08
18:08
Speaker 1
-
Speaker 1
Parts of. They may know something and that DWP may know something else, but the individual is in the middle of that and is saying, right, okay, I need to proceed to the next step, I may. Therefore, I'm allowing DWP, for example, to see. HMRC data and that is the approach we are taking and that, you know, the people you've got in front of you today, that's our day job is to is to make sure .
18:08
18:08
Matt Turmaine
-
-
Matt Turmaine
Yeah. 11 yeah. So, hello. I wanted to talk a little bit more about digital wallets. So I was just having a little look through mine to see what information I had stored in it. And it's mostly tickets. It's flight paths. Yeah, it's bank details obviously, so I can pay for things and stuff like that. I just wondered if you could tell us a little bit about what the digital wallet credentials can do.
18:08
Speaker 3
-
Speaker 3
That traditional sign in systems are not able to do? Certainly. So your the gov.uk wallet will work an awful lot like the one that's got your club card in and your passes. So government credentials going in a government wallet again secured by one login. The advantage is that often government gives you a piece of information somewhere that you need somewhere else. So take a disclosure and barring certificate. You might do it because it's part of your job. But you might also coach a grassroots football team at the weekend. And actually being able to demonstrate that.
18:08
18:08
18:08
18:08
Speaker 3
-
Speaker 3
It enables you to get free prescriptions. It enables you to access a food bank. So being able to demonstrate that in a really secure way. And the other advantage with verified credentials, aside from they're harder to fake, is that actually on the flip side, when they're out of date, they can be revoked. So if you're entitled to benefits on a Monday, but not by a Friday, your benefits credential will move into the expired section. And that's what happens with your old train tickets. It's still there. You can see it, but you can no longer use it.
So it provides those. mechanisms that enable government to make it really, really up to date.
So it provides those. mechanisms that enable government to make it really, really up to date.
18:08
18:08
Speaker 3
-
Speaker 3
There's no lag time between being granted a benefit and the credential arriving. It can be literally minutes. So one of the things that the veterans have said about the veterans card, which is the only credential that's currently live and has been a really great learning experience for us, is that it takes six weeks for their physical veterans card to arrive through the post, but their digital version they can download five minutes after they complete the application form and start using. So again, it's it's quicker and they don't have to remember to take it with them because generally speaking, they've got their phone at the point in which they realise there's none of that.
Oh no, I've left the letter at home or a drawer full of important documents, as we call them in my household, things that you might need to refer to later. Actually, it can all be on your phone completely within your control, so nobody else can .
Oh no, I've left the letter at home or a drawer full of important documents, as we call them in my household, things that you might need to refer to later. Actually, it can all be on your phone completely within your control, so nobody else can .
18:08
18:08
18:08
18:08
18:08
18:08
18:08
Blake Stephenson
-
-
Blake Stephenson
So the EU is. developing probably quite ahead of the game compared with most parts of the world. They're their own identity wallet, digital identity wallet. What talks are we having with them given that, you know, many people from this country go to the EU on holiday, I'm probably going to be required to produce things like their driving licence that. So are we looking at something that's going to be compatible?
18:08
18:08
18:08
18:08
18:08
Speaker 5
-
Speaker 5
And I'll get rod to explain why not. Thank you Natalie. So it is definitely something that we are keen to do is to have international interoperability. That would be good for that again, to give choice to, to, to to the citizen. At the moment, we're still sort of. relatively early in the journey, both for ourselves and and for the EU. And, you know, they've got kind of deadlines coming by the end of this year for what they'll be rolling out. So it's, it's still sort of quite an early stage to be able to kind of work out exactly the timeframe and how, how the process might, might run on, on interoperability, specifically with the EU, we have lots of connections into the EU.
So we talk we talk to them about what, what they're doing and explain what we're doing. We go to various different kind of events and things that they they have, one of which is coming up later this month. International standards is the sort of the route to getting that technical kind of degree of interoperability. And so the fact that international standards underpin what we're putting into the into the trust framework and, and into the gov.uk wallet and what the EU will be doing on their side.
So we talk we talk to them about what, what they're doing and explain what we're doing. We go to various different kind of events and things that they they have, one of which is coming up later this month. International standards is the sort of the route to getting that technical kind of degree of interoperability. And so the fact that international standards underpin what we're putting into the into the trust framework and, and into the gov.uk wallet and what the EU will be doing on their side.
18:08
18:08
Speaker 5
-
Speaker 5
Won't be just about the technical challenge of, of it. There's also then that kind of wider wrapper that we need to look at on privacy, security and governance and controls. And so there will be further, further work that we'll have to do to be able to be assured and to assure the EU, if that they can have confidence in the system that we've got, or we can have the confidence in the system that that they've got. So it's a it's a it's an end point that we want to get to. We're having those conversations and we're trying to work on international standards to make sure that we're kind of going down the right path.
18:08
18:08
18:08
18:08
18:08
18:08
Speaker 5
-
Speaker 5
Spain or Canary Islands or whatever, and have it recognised? That is the that is where we I'd like to to get us to. And that is what interoperability would would mean. And then that means again, you don't, you know, if you are on holiday in, you know, European country, you don't have to take your passport out with you. There'll be ways, you know, there'll be lots of advantages in being able to, to, to do that digitally. I say we're not. It will just it will take a period of time to be able to get there because it is going to be quite complicated.
And we're we and the .
And we're we and the .
18:08
18:08
18:08
18:08
18:08
18:08
18:08
18:08
18:08
18:08
18:08
18:08
Tristan Osborne
-
-
Tristan Osborne
So, I think, I think I've been told somebody else. Just a serious question, if I may. So I know you've answered some of these questions in the round, but how long do you think it will take to actually. create a digital ID strategy? Have you got any sort of dates, either principally in the diary, in terms of when you expect to publish? Are you at the stage now where you're engaging with the ministers?
18:08
18:08
18:08
18:08
18:08
18:08
18:08
18:08
Tristan Osborne
-
-
Tristan Osborne
How will you prioritise? What are you seeking to do first? Obviously we don't have that in front of us. So but there's clearly competing demands here. From a volume perspective, it would be DWP from and that that would also pose questions from a digital accessibility perspective, because many of those people are probably the ones that might require support getting access. Young people, obviously, we've mentioned driver's licenses.
That's not exclusively young people, but but also other services. How would we balance the.
That's not exclusively young people, but but also other services. How would we balance the.
18:08
18:08
Speaker 7
-
Speaker 7
Would that be within the strategy in terms of what you seek to do? First, I think I think it's helpful if we differentiate, as we've been trying to do earlier, between the work that's already in train on gov.uk, one login, and I'm sure the team can talk a bit about that and what they're prioritising because they're already in those conversations. And I think the same on the trust framework where they've done the work already on alcohol, as rod was saying.
And then there are other things in train.
And then there are other things in train.
18:08
18:08
18:08
Speaker 3
-
Speaker 3
We should we do a bit of that in case that gives you a sense. Yes, that would be helpful. Great. So I can start with one login. So one login has been rolling five years, one on the front of. 264 services out of a total universe of what we estimate to be 500. So digital services, the number of digital services the government runs isn't a static number.
And so our priority is to get to the point where one login enables you to access all.
And so our priority is to get to the point where one login enables you to access all.
18:08
18:08
Speaker 3
-
Speaker 3
Which we think will be within the next. 18 to 24 months. So that's the. priority for one login, is to get to the point where genuinely to access any central service, you have one username and one password. And from a wallet perspective, our next priority is the digital driving license. And we're in.
18:08
18:08
18:08
18:08
18:08
18:08
18:08
18:08
18:08
18:08
18:08
18:08
Speaker 5
-
Speaker 5
Already have that will continue. And Rob, do you want to say. Yeah. Thank you. To add on my side. So we've we've already got the data act that sets out a number of different requirements that we have to kind of do. And we're in the process of rolling those out. So I think that's a kind of like in terms of the near term and what we're going to do. So we need to issue a code of practice to turn on the information gateway, which allows sharing between public authorities and the digital verification services. And that will be coming shortly.
And as I set out in answer to a previous question, there's things around working out who we can best partner with around driving adoption in different use cases, and tobacco and vapes and knives and crossbows and property are some of the ones that are on the on the horizon. And then looking at how we can get this system, which is still very you know, we've only just done the first.
And as I set out in answer to a previous question, there's things around working out who we can best partner with around driving adoption in different use cases, and tobacco and vapes and knives and crossbows and property are some of the ones that are on the on the horizon. And then looking at how we can get this system, which is still very you know, we've only just done the first.
18:08
18:08
Speaker 5
-
Speaker 5
Full version, one of the trust framework. So we're required to update that every year. So we'll be kind of engaging with stakeholders, working out what do we need to change? What's working, what's the, what are the areas. So I think we've got some things from the Data Act that tell us what we have to do next. And .
18:08
18:08
Tristan Osborne
-
-
Tristan Osborne
Us a little bit of a roadmap, I think, through just my last question, if I may. Thank you very much for those responses. Government IT services are very. decentralised into each department. Clearly there's a I understand it has been moved into DCMs and this. functionality is there is there a. In terms of the wiring of government.
18:08
18:08
18:08
18:08
Tristan Osborne
-
-
Tristan Osborne
In the sense it's being passed to your department? I appreciate this might be a loaded question, but do we think that's a do we think that model of management is is right, or do we think that perhaps it should have its own. The government. It perhaps should be more. centralized into into one function rather than having it in each department. I know that's a probably an open again, it's a very open ended question, but my worry is, is in a business, this would be a function of a program within an I.t team which would fall.
It would put it into a head of operations, say. Whereas in government, it seems to me it's handed to a .
It would put it into a head of operations, say. Whereas in government, it seems to me it's handed to a .
18:08
Speaker 7
-
Speaker 7
Department who's managing this and trying to link in with other departments who've got other priorities. No, I do appreciate the point you're making. So the when the machinery of government change happened, DCMs has absorbed the government digital service, but it keeps all of its approach to working with all the other departments that it had before. And that's why, as I was saying earlier, it's really important that we have this ability through the digital zko to work with all of the others, because it does need to be coherent. I think there is some benefit that we've seen already, actually, of having the government digital service in DCMs, because with our wider work on digital and tech, for example, last week we I was with the Secretary of State when we met, I think it was.
Microsoft and.
Microsoft and.
18:08
18:08
Speaker 7
-
Speaker 7
And we were able to talk about some of the policy things, but also some of the operational work around things like cloud. So there is a kind of benefit of being in the digital department, but it's really vital that we continue this close working with all of the relevant departments so that we can make sure, as colleagues have been saying, on the common areas, we can .
18:08
18:08
Speaker 8
-
Speaker 8
About 3 or 4 quick fire questions. Yes. Go on then. Just on this point particularly, and thank you very much for your indulgence. So the the science, Innovation and Technology Committee last summer, I think it was looked at the the big data leak from the Ministry of Defence and which was horrendous. And as part of that, we took a look at some of the. practices across government when it came to digital and data hygiene. And what we found was that there's no each. department effectively can do what it wants. You know, when it comes. You talked about building systems for their own reasons, etc.
but each department, you know, they can do what it wants when it comes to what digital or data guidelines, you know, how big files it allows to be forwarded or, or, you know, all the different aspects of data hygiene. So, so I'm just trying to. understand how you can. ensure a high level of data. quality and talk about. interoperability and all the great things you talked, you were talking about in your response to Tristan, if .
but each department, you know, they can do what it wants when it comes to what digital or data guidelines, you know, how big files it allows to be forwarded or, or, you know, all the different aspects of data hygiene. So, so I'm just trying to. understand how you can. ensure a high level of data. quality and talk about. interoperability and all the great things you talked, you were talking about in your response to Tristan, if .
18:08
18:08
18:08
Speaker 7
-
Speaker 7
I mean, I think there are obviously legal standards. And then I know in your really helpful report that we've responded to, there were 33 different recommendations. And you've got as one of your building blocks, haven't you information and data. And we have set out some of the things that we're seeking to do there. So our government chief data officer who sits in GDS is doing various bits of work about a strategic data roadmap and making sure that we've got, you know, the various information we need. So we are seeking to make sure that there's a clear framework within which all the departments work.
But you're right, there is a .
But you're right, there is a .
18:08
18:08
18:08
Speaker 7
-
Speaker 7
Impose high standards or require high standards. I mean, I think there's an appetite to there's an appetite from departments to have high standards. And certainly when I talk to my colleagues, you know, they're really focused, as we were saying earlier on, they're worrying about cyber risks. They want to address their legacy problems. They want to make sure they're adhering to the data obligations. So there's a kind of a pull from the departments for wanting to adopt best practice.
And then we're trying .
And then we're trying .
18:08
Speaker 6
-
Speaker 6
To ensure we're setting out that best practice. But you might want to add on data. Philippa. Yes. I mean, I think I think you've covered it all, Secretary. I mean, the Data Standards Authority that sits within the Chief Data Officers remit has recently worked with a whole range of. departments which I could list. But anyway, to produce things like standards for how information about people are stored and captured.
They've also been doing a lot of work on a data asset management .
They've also been doing a lot of work on a data asset management .
18:08
18:08
18:08
18:08
18:08
18:08
18:08
Geoffrey Clifton-Brown
-
-
Geoffrey Clifton-Brown
Any other questions? Thank you. Slightly. I want to follow that question as one of my questions. It does seem to me that government departments are buying systems almost on a daily basis. And unless you start. I'm not advocating a digital ID system, but unless you start somewhere on common standards, it's going to take you years to get proper interoperability. So it could be from the simplest thing you. Philip arrays . Figure seven on page 18 of the Naas report. That is a brilliant table of illustrating a complicated problem, very simply. So unless you started to introduce common standards of inputting into all government systems, you're never going to get a total operational interoperability.
And it seems to me that what you need is even if you allow departments autonomy in buying their systems, you need to have compatible software so that one part of the system can talk to another part of the system. I was with a GP practice the other day that was tearing its hand, head, hands, hairs out because the GPS couldn't communicate through their systems with the specialists in the hospitals. They were having to email each other, and then the poor GPS at the end were having to manually summarize that particular episode for the patient records, which it should be done digitally, and then it can be summarized by AI.
So there's got to be .
And it seems to me that what you need is even if you allow departments autonomy in buying their systems, you need to have compatible software so that one part of the system can talk to another part of the system. I was with a GP practice the other day that was tearing its hand, head, hands, hairs out because the GPS couldn't communicate through their systems with the specialists in the hospitals. They were having to email each other, and then the poor GPS at the end were having to manually summarize that particular episode for the patient records, which it should be done digitally, and then it can be summarized by AI.
So there's got to be .
18:08
Speaker 7
-
Speaker 7
Some form of government mandated non standard surely. I mean, I think we want to improve the. coordination and the standardisation. And that is why our chief Data officer is doing this work, as Philippa says, looking at the standards for data, but separately also we are doing work on the digital commercial centre of Excellence to think about things like cloud procurement and not getting vendor lock in. And then we're also thinking about the work on legacy. So we're trying on each of these. areas where we know there are common. problems to work on the best practice solutions, where we can.
18:08
18:08
Speaker 7
-
Speaker 7
Where is it helpful for government to act as one big customer, even if there's then a call off to different departments so we can use our purchasing power, because, I mean, some of the numbers that I've read in the blueprint, they're absolutely enormous in terms of obviously, the government spend across these areas. And I know that this committee .
18:08
Geoffrey Clifton-Brown
-
-
Geoffrey Clifton-Brown
And the science and tech committee has been very front foot on wanting more clarity on that. Well, great respect. Quite a lot of thought is being given to cyber attacks, and quite a lot of thought has been given to data lock in, lock in, in relation to the the cloud, but not so much, at least government sort of mandates in departments like the Department of Health, so that one department at least can procure .
18:08
18:08
18:08
18:08
18:08
Geoffrey Clifton-Brown
-
-
Geoffrey Clifton-Brown
Our team on these various areas across legacy IT cyber. Leave that for now. I then want to come on to I've talked about efficiency gains and just to see where we are on efficiency gains, where you are from it now, Dame Kyi has helpfully put a WhatsApp on our system, saying that they received a Minister of Government brief published in January, which found that over £45 billion a year, representing 4 to 7% of public sector spend in unrealized savings. Now that proved to be unrealistic, but the 2025 spending review did expect departments to deliver almost 14.5 billion of efficiency gains by 2829.
Now, I imagine a lot of these efficiency gains are going to come from digital improvements. Can you enlighten us on what the government's efficiency targets are, gains are, and .
Now, I imagine a lot of these efficiency gains are going to come from digital improvements. Can you enlighten us on what the government's efficiency targets are, gains are, and .
18:08
18:08
18:08
18:08
18:08
18:08
18:08
18:08
18:08
18:08
18:08
18:08
18:08
18:08
18:08
Speaker 1
-
Speaker 1
Really importantly, they may be acting on behalf of somebody else. And so they can't get through the barriers, whether they're acting on behalf of a loved one or parent or child. And so it's quite an amorphous mass of folks that all need help. And we look at this in a few ways. There's an there's an inclusion programme that has moved into DCMs, and we can happily bring forward the recommendations that they're working on at the moment. We then think about it as inclusion for digital products. So what we can do within GDS to help it make it easier for people to get what they need from the state.
And then we're thinking what we can do with routes that aren't digital. And so as an example, if you want a one login account, you can get that from a post office in the country. You can present yourself a post office and you'll get help from somebody there. And so what we want to try and do is think about inclusion at all levels. And we're trying to sort of bring up, make it possible for everybody to get what they need from a, from a point of view of access to digital services. And if they can't, what are the other routes that they may need in order to get what they need from the state?
So that's the broad view of what we're doing on it. And each of those has a sort of detailed plan that we can happily share with, with,
And then we're thinking what we can do with routes that aren't digital. And so as an example, if you want a one login account, you can get that from a post office in the country. You can present yourself a post office and you'll get help from somebody there. And so what we want to try and do is think about inclusion at all levels. And we're trying to sort of bring up, make it possible for everybody to get what they need from a, from a point of view of access to digital services. And if they can't, what are the other routes that they may need in order to get what they need from the state?
So that's the broad view of what we're doing on it. And each of those has a sort of detailed plan that we can happily share with, with,
18:08
18:08
18:08
Speaker 1
-
Speaker 1
Route that they can obtain the government service that they want? The current. You can always go to a service and get it. We can make a phone call if you needed to get a one login so you could access digital services, you can do that at the post offices. If you want to apply for something, you could call a call centre.
18:08
Geoffrey Clifton-Brown
-
-
Geoffrey Clifton-Brown
So there are always alternative routes. Finally, I hope the call centres are not going to be like the Civil Service Pension scheme, which took people at the height of the disunity, an hour and a half, and even the HMRC who's got considerably better. We've had hearings on this committee where there have been far too long and unacceptable waits. Will you make sure that when you are designing these phone systems as an alternative to the digital .
18:08
18:08
Speaker 3
-
Speaker 3
How that centres performing. Natalie haven't we, which we could share with committee. Would you like me to explain a little bit more about the specifics of how one login caters for people without so, so one login works. tirelessly to improve our levels of inclusion year on year on year. And we measure that. So we run a number of different channels. So the most popular way to prove your identity is exactly as set out in the report. You use a phone, you check your passport or your driving licence and people, you know, digitally literate people with photo ID tend to sail straight through that route.
But if you haven't got a mobile phone or you don't have photo ID, we have alternatives. So
But if you haven't got a mobile phone or you don't have photo ID, we have alternatives. So
18:08
Speaker 1
-
Speaker 1
But if you haven't got a mobile phone or you don't have photo ID, we have alternatives. So if you haven't got any photo ID, we've got a web channel where we the original route enabled you to check your National Insurance number with. HMRC and then answer knowledge based verification questions. So they're questions that only you should know the answer to. And the. data set was a commercial data set. The challenge with that is that people who don't have cars and take foreign holiday quite often don't have a financial footprint. So we introduced knowledge based verification questions using DWP benefits data, because those people do tend to have a data footprint there.
And next year we're bringing in open banking. So we estimate that about. 85% plus of the 9% of people without photo ID do have a bank account. And so the open banking model will hoping will increase the inclusion from that angle. For people who don't have mobile phones, there's a web route for people who have low digital literacy. You start the journey on one login and as Chris says, you then go to the post office and they will support you through the process. And we also have specific guidance written for helpers. So if you are elderly and you've nipped next door to their neighbour or you're a.
grandparent with a child, actually there's specific instructions like hold the phone like this. This is how it works, you know, check these documents. And then we have more traditional user support. So we have frequently asked.
And next year we're bringing in open banking. So we estimate that about. 85% plus of the 9% of people without photo ID do have a bank account. And so the open banking model will hoping will increase the inclusion from that angle. For people who don't have mobile phones, there's a web route for people who have low digital literacy. You start the journey on one login and as Chris says, you then go to the post office and they will support you through the process. And we also have specific guidance written for helpers. So if you are elderly and you've nipped next door to their neighbour or you're a.
grandparent with a child, actually there's specific instructions like hold the phone like this. This is how it works, you know, check these documents. And then we have more traditional user support. So we have frequently asked.
18:08
18:08
Speaker 1
-
Speaker 1
Chat bots. And then we have a call centre. And it's the only call centre that I'm aware of in government that's designed to help you exactly the moment you need it. So they don't have access to all your personal data. So there's no privacy impact. But they've got a mock up of the text. So if you say to them, I can see this button, I'm pressing here, it's not working. Somebody can talk you through the process. And if all of that doesn't work, we have a specialist casework function for people who get truly stuck for one reason or another.
So we try and make it as sort of multi-channel as. possible to interact with people with different forms of exclusion that sometimes can be overlapping. And we will continue to build on that. So every module we put live, we. evaluate in terms of, is this actually moving the needle on the thing we intended it to do, and how can we move the needle further. And so we will continue to iterate the service in subsequent years to push that inclusion further and further. And as a prerequisite for going live with one login services must maintain an alternative channel.
So no identity verification service can ever be 100%. Because if you're 100%, you're letting the fraudsters in as well. So there's always going to be a set of people for whom either it's not the right channel or they can't make it through, and they need to be able to access services as well. So before they're allowed to go live with one login, they have to demonstrate that they've got an .
So we try and make it as sort of multi-channel as. possible to interact with people with different forms of exclusion that sometimes can be overlapping. And we will continue to build on that. So every module we put live, we. evaluate in terms of, is this actually moving the needle on the thing we intended it to do, and how can we move the needle further. And so we will continue to iterate the service in subsequent years to push that inclusion further and further. And as a prerequisite for going live with one login services must maintain an alternative channel.
So no identity verification service can ever be 100%. Because if you're 100%, you're letting the fraudsters in as well. So there's always going to be a set of people for whom either it's not the right channel or they can't make it through, and they need to be able to access services as well. So before they're allowed to go live with one login, they have to demonstrate that they've got an .
18:08
Geoffrey Clifton-Brown
-
-
Geoffrey Clifton-Brown
Alternative route. And so we will maintain those over time. It sounds as though you're doing things that perhaps other parts of government might want to look at what you're doing. So yeah, that sounds very good. Can I thank you all very much today? And I'm sorry about the slightly disjointed hearing, which was slightly partly due to parliamentary votes and partly due to technical problems, believe it or not. But thank you all very much. It's much appreciated you giving us evidence on this subject. I am sure that digital and AI is something we are going to return many times to on this committee, because we attach a great deal of importance to it.
So an uncorrected version of the transcript will be available in the coming days. Thereafter, we will produce a report, no doubt with recommendations. And we hope you will study those very carefully. And we .
So an uncorrected version of the transcript will be available in the coming days. Thereafter, we will produce a report, no doubt with recommendations. And we hope you will study those very carefully. And we .
18:08
18:08
18:08
18:08