A government-commissioned citizens’ panel in the United Kingdom has delivered a verdict that should unsettle anyone pushing for centralized digital identity systems: the public doesn’t trust the institutions that would run them. Not even a little.
The findings, published in a report by the UK’s Department for Science, Innovation and Technology (DSIT), emerged from a deliberative process involving 57 members of the public drawn from across England, Scotland, Wales, and Northern Ireland. These weren’t activists or technologists. They were ordinary people — recruited to reflect the demographic makeup of the country — asked to spend weeks wrestling with a question that governments worldwide are eager to resolve: how should digital identity work?
Their answer was blunt. As The Register reported, participants expressed deep skepticism about government and private-sector stewardship of personal data. The panel’s recommendations amount to a demand for radical transparency, user control, and ironclad data protections — conditions that few existing digital ID proposals come close to meeting.
The Trust Deficit at the Heart of Digital Identity
The UK government has been working on a digital identity framework for years. The ambition is straightforward enough: replace the tangle of passwords, paper documents, and in-person verification with a streamlined digital credential that can prove who you are online. Other countries — Estonia, India, Australia — have moved ahead with their own versions. Britain has lagged behind, partly because it lacks a national ID card (the last attempt, under Tony Blair’s government, was scrapped in 2010 after fierce public opposition) and partly because the political appetite for anything resembling a mandatory identity database remains low.
But the pressure to act is mounting. Financial services firms want faster onboarding. The NHS wants better patient verification. Employers want reliable right-to-work checks. And the government itself wants to reduce fraud across benefits and public services. The UK’s Digital Identity and Attributes Trust Framework, first published in draft form in 2021, was supposed to lay the groundwork. It sets rules for organizations that want to become certified digital identity providers.
The citizens’ panel was convened to inject public opinion into this process. What DSIT got back was not the endorsement it might have hoped for.
Participants were troubled by the prospect of a single digital identity controlled by government. They worried about data breaches. They worried about mission creep — the idea that information collected for one purpose would inevitably be used for another. They worried about exclusion: what happens to people who can’t use digital systems, whether because of age, disability, poverty, or simply preference?
These aren’t hypothetical concerns. The UK’s track record on large-scale government IT projects is, to put it charitably, mixed. The Post Office Horizon scandal — in which flawed software led to the wrongful prosecution of hundreds of sub-postmasters — remains a fresh wound. The NHS’s failed National Programme for IT, which burned through billions before being abandoned, is another. And repeated data breaches across government departments have eroded whatever reservoir of public goodwill might once have existed.
So when panelists said they didn’t trust the government to handle digital identity responsibly, they weren’t being paranoid. They were being empirical.
The panel’s specific recommendations reflect this wariness. They called for digital ID to be voluntary — never a requirement for accessing public services. They insisted on minimal data disclosure, meaning a system should reveal only what’s strictly necessary for a given transaction. Buying alcohol? The system should confirm you’re over 18 without revealing your date of birth, address, or anything else. They wanted independent oversight, not self-regulation by the companies or agencies involved. And they demanded clear, enforceable penalties for misuse of data.
Perhaps most strikingly, panelists pushed for what amounts to a decentralized model: individuals should hold their own credentials on their own devices, rather than having them stored in a central government database. This aligns with a technical approach sometimes called self-sovereign identity, which uses cryptographic techniques to let people prove claims about themselves without exposing underlying data. It’s gaining traction in privacy-focused circles but remains far from mainstream deployment.
A Global Pattern of Public Resistance
Britain isn’t alone in confronting public resistance to digital ID. Australia’s myGov digital identity system has faced persistent criticism over usability and privacy. India’s Aadhaar system, which covers over a billion people, has been dogged by concerns about surveillance and exclusion — with reports of vulnerable citizens being denied food rations because biometric authentication failed. In the European Union, the revised eIDAS regulation is pushing member states toward digital identity wallets, but civil liberties organizations have raised alarms about the potential for tracking and the security implications of trusted website certificates baked into the framework.
The pattern is consistent. Governments see digital ID as an efficiency tool. Citizens see it as a surveillance risk. And the gap between those two perspectives keeps widening.
In the UK, the tension is compounded by the country’s complex relationship with identification itself. There is no national ID card. The driving licence and passport serve as de facto identity documents, but neither is universal. Roughly 11 million UK adults lack a passport. The absence of a foundational identity document makes building a digital layer on top inherently more complicated — and more politically fraught.
Privacy advocates have seized on the panel’s findings. The Open Rights Group, a UK-based digital rights organization, has long argued that any digital ID system must be built on principles of data minimization and user consent. The panel’s conclusions track closely with those positions. But translating citizen preferences into policy is another matter entirely.
DSIT has said it will consider the panel’s recommendations as it develops the next iteration of the trust framework. That language — “consider” — is doing a lot of heavy lifting. Government consultations have a well-documented tendency to absorb public input without meaningfully changing course. The question is whether this time will be different.
There are reasons for cautious optimism. The political environment has shifted since the early 2020s. Public awareness of data privacy has increased, driven by high-profile breaches and the slow cultural absorption of GDPR principles. The Post Office scandal has made “trust us, we’re the government” an even harder sell than it used to be. And the rise of decentralized identity technologies means there are now credible technical alternatives to the centralized database model that citizens most fear.
But there are also reasons for skepticism. The commercial incentives pushing toward centralized digital ID are enormous. Identity verification is a multibillion-pound industry, and the companies positioned to become certified providers under the trust framework have significant lobbying power. Government departments, meanwhile, have their own institutional reasons to prefer centralized systems: they’re easier to manage, easier to audit, and easier to integrate with existing infrastructure.
The citizens’ panel has laid down a marker. Whether anyone in power is genuinely listening remains an open question.
For those of us who’ve watched technology policy debates play out over decades, the dynamic is painfully familiar. Public consultation produces clear, well-reasoned recommendations. Officials nod respectfully. And then the system proceeds largely as it was going to anyway, with perhaps a few cosmetic adjustments to demonstrate responsiveness.
The UK has a narrow window to do this differently. Digital identity systems, once built, are extraordinarily difficult to retrofit with privacy protections that weren’t part of the original design. The architecture choices made now will shape the relationship between citizens and the state for a generation. Getting it wrong doesn’t just mean a bad IT project. It means embedding surveillance infrastructure into the fabric of daily life.
The 57 people on that panel understood this. The question is whether the ministers and civil servants reading their report understand it too.
WebProNews is an iEntry Publication