Report - Guardian

The LSE Identity Project Report: June 2005 147Data Protection Act“I want to make it very clear to the public that this draft Bill is not justabout an ID card, but an extensive national identity register and thecreation of a national identity registration number. Each of these raisesubstantial data protection and personal privacy concerns in their ownright. The introduction of a national identity register will lead to thecreation of the most detailed population register in the UK.” - RichardThomas, Information Commissioner, Press Release July 2004.This section will seek to identify some of the data protection and privacy concernsreferred to by the Information Commissioner.The Data Protection Act (DPA) provides a range of safeguards over the use of personaldata and would be relevant to the creation of a national identity system. The InformationCommissioner has expressed concerns that the scheme, as set out in the Bill, couldjeopardise some elements of data protection.The Act contains eight Data Protection Principles (DPP’s) that establish rights andsafeguards relating to the collection, processing, access, disclosure, storage and securityof personal information. These are all central to the design and operation of an identitycard system.The National Identity RegisterAlthough the Register forms a substantial part of the Bill its existence is notacknowledged in the title of the Bill. The problems in the development and maintenanceof such a database are well known with difficulties including the identification of theappropriate technology and running systems. The DPA requires any personalinformation held in a database to be accurate, up to date, relevant, adequate and notexcessive for the stated purposes; standards which provide sufficient challenges to datacontrollers. However, should compulsion for the whole nation become fact, the scope ofthe Register, the amount of information to be held and the necessary complexity of theinfrastructure will present additional problems in terms of compliance with the DPA.The Bill states that the Register is to be a convenient method for individuals to proveregistrable facts about themselves to others and to allow those facts to be ascertained byothers where it is in the public interest; only one of those ‘registrable’ facts is a person’sidentity. Identity per se is listed in Cl. 1(6) of the Bill as being a person’s full name,other names by which they have been known, place and date of birth and identifyingphysical characteristics.The Bill lists another 15 classes of information that may to be included on the Register.It is difficult to see how the requirement for all of this information can satisfy the 3 rdData Protection Principle by being relevant, adequate and not excessive for theproposed purposes. A person will be required to provide their present main address,alternative addresses and previous addresses; a great deal of historical information willbe collected that will not contribute to a person’s ‘identity’.