Report - Guardian

The LSE Identity Project Report: June 2005 151SecurityThe Bill proposes that the ID card and National Register will provide for an individualto establish his identity and obtain the services to which they are entitled. It is quiteclear therefore that the ID card and Register will become a target for identity fraudsters;protecting against unauthorized access, use and disclosure as required by the 7 th DataProtection Principle will present huge technical and logistical challenges which are notaddressed within the Bill apart from the expected criminalization of certain behaviours.Given the potential damage and risk to an individual whose information and identity isunlawfully obtained and used, the Bill is worryingly silent on how the infrastructurewill be kept secure and how individuals whose identities are stolen will be dealt with.Recent failures of existing governmental computer systems such as those at the ChildSupport Agency, Department for Work and Pensions and even the police fingerprintdatabase, illustrate the need for a robust, secure and foolproof technology.The Bill anticipates that various public bodies will be able to access the ‘registrableparticulars’ of the individual in question. A comprehensive set of standards ofprocessing and procedures are going to be necessary in order to protect the integrity ofthe National Register and the information held by those public bodies.The 7 th Data Protection Principle also requires data controllers to ensure their supplierstake steps to keep the information they process on behalf of the data controller safe fromloss and disclosure. If any of the functions of the ID card and Register are outsourced,the government will have to ensure the contractual arrangements are sufficientlyrigorous to protect the data and provide for the independent auditing of those outsourcedfunctions. Clearly if any outsourcing were to be overseas the 8 th Data ProtectionPrinciple would also be engaged.Data sharingOne of the main results of the provisions of the National Identity Register will be that agreat deal of information will be shared between public bodies. The governmentundertook a large exercise several years ago via the Performance and Innovation Unitwhich considered the obstacles to data sharing between public bodies. Some of thoseobstacles were overcome by legislation which established lawful gateways for datasharing but also required memoranda of understanding to ensure data was only sharedwhere necessary and that all the information held by various public sector bodies did notend up being pooled. This approach recognized that public bodies’ powers onlyextended to the extent of their enabling legislation and that there were also publicconcerns about their information being shared widely across the public sector. 368The proposals in the present Bill will undermine those protections and at the same timemake data sharing much less visible and transparent. Cl. 19(4)f gives the Secretary ofState powers to specify when the information contained in the Register may bedisclosed on top of those crime prevention, customs and tax purposes alreadyenumerated in the clause.368 Cabinet Office, Privacy and Data sharing – The way forward for Public Service, PIU, 2002.