Question to the Department for Science, Innovation & Technology:

To ask the Secretary of State for Science, Innovation and Technology, if she will review the findings of the Spanish Data Protection Agency regarding the handling of biometric and personal data by Yoti; what safeguards are in place to help ensure that the use of Yoti complies with UK data protection law and protects users’ privacy and online safety; and what assessment she has made of the potential implications of these issues for the development and public trust in any future Government-led digital identity scheme.

Yoti provides a range of digital identity and facial age estimation services, and its Digital ID app service is certified against the UK digital verification services trust framework. Services certified against the framework are entitled to be on a statutory register, providing the public and businesses with confidence that a service is safe, accurate and trustworthy.

Continued presence of Yoti’s service on that register should assure users of its compliance with the trust framework’s robust rules.

The department is aware of the findings of the Spanish Data Protection Agency regarding this app and has reported them to the independent conformity assessment body that certified Yoti’s service against the trust framework. If that body finds that the service isn’t following the framework, they will report the non-conformity to Yoti, which Yoti must either fix or lose their certification and registration.

If the department isn’t satisfied with the conformity assessment body’s assessment and determines that the trust framework isn’t being followed, we can remove services from the register independent of the certification process.

The Government’s digital ID scheme is currently under consultation, and any findings regarding Yoti’s service have no implications for its development.