Digital ID: Public Consultation

Debate between Lord Clement-Jones and Lord Collins of Highbury

Wednesday 18th March 2026 Lords Chamber

[Lord Clement-Jones (LD)]

My Lords, I thank the Minister for this opportunity to respond to last week’s Statement and, indeed, for his personal engagement with us at that time.

The Chief Secretary told the Commons on Tuesday that he was continuing the proud Labour tradition of building public services for the many. He invoked the NHS, the Open University and Sure Start. It was a stirring lineage. But there is history he omitted: Verify, which wasted over £220 million; GOV.UK One Login, for which the Cabinet Office sought up to £400 million; and now this national digital ID, which the OBR estimates will cost £1.8 billion over three years. This, indeed, is Verify 4.0.

The Government have confirmed that possession of a digital identity will not be compulsory. We on these Benches opposed mandatory digital ID at every turn, and I am pleased to say that the Government have listened. My honourable friend Lisa Smart MP pressed the Chief Secretary directly in the Commons last week and received his wholehearted assurance. He continued to claim that using digital ID will be entirely optional. So, I ask the Minister in this House, will the voluntary character of this scheme be placed in the Bill the Government intend to bring forward later this year? How can we trust any Government on how personal data, once surrendered to the state, will actually be used?

Earlier this month, this House considered an amendment to the Crime and Policing Bill, tabled by my noble friend Lady Doocey, which sought to prohibit police from using DVLA driving licence images for facial recognition searches. The DVLA holds over 55 million records. Every driver provided their photograph for one purpose only: to hold a driving licence. They did not consent to their image becoming part of what Liberty has rightly described as the largest biometric database for police access ever created in the United Kingdom. Yet the noble Lord, Lord Hanson of Flint, the Home Office Minister, did not accept the amendment and confirmed at all stages that the express purpose of Clause 138 of the Bill is precisely to permit facial recognition searches of DVLA records. So, within a single parliamentary week, we have a Government launching a national digital identity consultation on the basis of assurances about data use, while declining to place in statute the very protections that would make such assurances meaningful. The question is not whether the Government intend that digital ID will become an instrument of surveillance, but whether a future Government could.

The Chief Secretary said that he wants security at least as strong as online banking. That is the right aspiration, but, as mentioned by the noble Earl, GOV.UK One Login, the umbrella infrastructure for this system, reportedly satisfied only 21 out of 39 security outcomes required by the National Cyber Security Centre. Whistleblowers have described vulnerabilities that allow unauthorised access to sensitive functions without triggering any alert. How can the Government justify launching a national identity solution on a platform that fails to meet nearly half the NCSC’s mandatory security outcomes?

In part two of the Fisher review, published in January, Jonathan Fisher KC warned that AI-driven impersonation at scale is now a defining crime of our age and that we must implement upstream measures—stopping fraud at the point of identity issuance, not reacting after a digital identity has been stolen. If our foundations currently satisfy barely half the required security outcomes, how do we deliver the upstream protection Mr Fisher demands?

Will the Government commission and publish a full NCSC security audit before a single citizen is enrolled? Will they introduce an offence of digital identity theft that they, along with the previous Conservative Government, have so far resisted? The consultation proposes a universal unique identifier to link citizens across every departmental silo. Without strict legal guardrails, that identifier is the functional infrastructure of the national identity register that Parliament voted to abolish in 2011, and it is precisely the centralised data honeypot that hostile state actors would most wish to compromise. We need not mere parliamentary approval for services added to the app, but a statutory prohibition on bulk data matching across departments.

In summary, I put four questions to the Minister. First, will the voluntary character of this scheme be placed in primary legislation, with an explicit prohibition on any future mandatory requirement without a further Act of Parliament? In that context, and as the noble Earl has mentioned, how mindful are the Government of the possible consequences for digital inclusion? Secondly, the Home Office’s assurances on DVLA facial recognition mirrored word for word those given by the previous Government. Before the Minister can confirm the opposite, what statutory purpose limitation on digital identity data will be placed beyond the reach of secondary legislation? Thirdly, will the Government provide a statutory guarantee that the universal unique identifier cannot be used for bulk data matching across departments without primary legislation? Finally, will the Government publish an independently verified cost-benefit analysis before the Bill is introduced, and explain why £1.8 billion would not deliver greater public benefit directed to the NHS and front-line policing, for instance?

The Chief Secretary asked what it is that critics fear from a public consultation. We do not fear the consultation; what we fear is a fourth cycle of the same expensive failure, grand ambitions and insecure foundations—a creeping identifier that becomes the digital spine of state surveillance. But what we fear above all is a system whose data acquires uses never publicly intended by its creators. We have just watched that happen in this very Chamber with the DVLA database of images. We on these Benches will support voluntary, secure, properly costed modernisation of public services, but we will not accept warm ministerial words as a substitute for hard legislative limits. We need a state that is not merely digital by choice today but constitutionally prohibited from becoming compulsory tomorrow. On the evidence of this and last week’s proceedings, we are very far from that guarantee.

[The Deputy Leader of the House of Lords (Lord Collins of Highbury) (Lab)]

I thank the noble Earl and the noble Lord for their contributions. The noble Lord, Lord Clement-Jones, is asking me questions to which, as he very well knows, I am not going to give the answer. That is the whole point of the consultation, and across the Chamber, everyone knows this in reality. We want to ensure that the public can access public services in the same secure way as they access many things in today’s society, including banking. Most members of the public assume that there is this great big database; they assume that their data is being used. The reality is that there are these silos. This consultation is not proposing what the noble Lord, Lord Clement-Jones, and the noble Earl were suggesting. It is not saying, “Let’s create this huge database, which could be vulnerable”. Instead, let us make it easier for the public to access the services that they need.

On the questions about inclusion and accessibility, I met with the noble Lord, Lord Holmes, and his group, and I said that what we want to ensure through this consultation and digital ID system is a much more accessible system. We want a system that is more open to people who have been excluded because they have to produce or send a certain form, ring a certain number, or go through a certain call centre. What we are trying to achieve is greater accessibility.

The question of inclusion also relates to people’s access to the internet. I am sorry that the noble Lord, Lord Arbuthnot, is not here, because I also had a meeting with him. There are strong, legitimate concerns, which is why we are conducting this consultation and why we want everyone in this House to participate in and make a contribution to it. The noble Lord made the same point: where there is exclusion, we can use community-based organisations—including post offices and sub-post offices—in a way that will ensure that people can maximise their opportunities to access public services.

The noble Earl asked me about cost, but there is no cost associated with this yet, because the system has not been designed. The system will be designed following the results of the consultation.

The consultation will not be limited to a certain number; it will be open across the board. We also want to establish a panel. Carnegie UK pointed out, in a letter to the Guardian, that a deliberative exercise in democracy—namely, selecting people randomly through postcodes—can produce a much more effective consultation. However, both approaches will be in what we end up designing.

I come back to this fundamental point. This is not only about how people access public services but about how they can determine the use of their data, so that they can set out when they want their data to be used for a particular purpose. For example, there are times when I might need to establish my ID. As I mentioned to the noble Lord, I occasionally go to a club—a dance club, by the way. If I am asked to produce an ID, I do not want to produce my driving licence because it has my name and address as well as my age—believe it or not, they sometimes do ask me my age. If they want to know my age, I am happy to release that data—but not my address or other things. So this is about how we establish that sort of process and about accessing public services.

In this day and age, for every private sector service we use, we expect to be able to access things. Tesco has more data on me than most government departments do, because it knows what time I go shopping, what I buy and what I favour, and it then sends me emails and messages about that. We have to try to turn away from the view that this is a rigid identity card system that will be on a national database. This is about public services, how people access and use them, and how they can control their data more effectively. I reassure the noble Lord on that.

There will be an initial consultation of 12 weeks, but that could be extended with the deliberative process. At the end of that, we will look at the results, and Parliament will be heavily engaged in that. No legislation has been drafted yet, because we want to see the results of the consultation and the scale of the project. I understand everyone’s concerns about cost, as well as some of the problems we have had in the past, but this is an opportunity to respond to people’s needs and to create more effective public services. Most people expect that from the private sector and we should expect it from the public sector too.

Digital ID

Debate between Lord Clement-Jones and Lord Collins of Highbury

Monday 19th January 2026 Lords Chamber

[The Deputy Leader of the House of Lords (Lord Collins of Highbury) (Lab)]

I thank the noble Baroness for those questions. On costs, the Government do not recognise what the OBR reported as an accurate cost for the programme, because the scope of the scheme, and therefore its cost, has not yet been decided. The design and delivery will be subject to a public consultation, following which we will have a clearer idea.

The noble Baroness asked about the GOV.UK One Login, a subject she has previously raised with my noble friend. It follows the high standards of security for government and private sector services, and about 9 million to 10 million people have been using it. The programme adheres to the National Cyber Security Centre’s advice to ensure that its data is protected, fraud is detected and threats are monitored and responded to. More specifically, we are aware—I think this is the point that the noble Baroness is making—that the nature of cyber threats is changing and that there is an increase in the number of attacks against the United Kingdom. The Government are committed to improving resilience among operators of essential services, including through legislation currently before the Commons that will update the UK’s regulatory framework.

[Lord Clement-Jones (LD)]

My Lords, the Liberal Democrats strongly opposed the previous proposal as a serious threat to privacy, civil liberties and social inclusion, so we welcome the Prime Minister’s U-turn in saying that digital ID, after all, will be voluntary. Can the Minister therefore confirm that no citizen will face any disadvantage, delay or reduced access to public services if they choose not to adopt it? Further, given that GOV.UK, which is the foundation of this system, has met only 21 of the 39 NCSC cyber assessment framework outcomes—the noble Baroness referred to that, and I was assured by Ministers that the outcomes will be met by this April—will the Minister halt expansion until independent assurance confirms that it meets all mandatory security standards?

[Lord Collins of Highbury (Lab)]

I do not want to repeat what I said to the noble Baroness, but I assure the noble Lord that we are absolutely focused on those standards and on better understanding new threats, which is why legislation is being considered by the other place. After all, we are talking about how people can access government services properly without complicated hurdles to go through constantly. Having one access is important, so the scheme will be available at no cost to the individual and to all British citizens and legal residents from the age of 16, subject to the consultation. It will be introduced after the technical build and primary legislation are delivered in around 2028, and underpinned by robust privacy, resilience and security measures. I stress that all citizens, in time, will be able to get the new digital ID, but it is not compulsory. We will consult on minimum wage.

We are ensuring that it is inclusive and that, whatever the Government do, we maintain inclusivity. Rolling out a free national digital ID will be accompanied by a massive inclusion drive across the United Kingdom. This is an opportunity to empower the vulnerable and the left-behind in our society. Inclusion will be at the heart of the design and delivery, and no one will be disadvantaged as a consequence of the scheme.