National Identity Scheme
41. Our predecessors published two Reports on the
Identity Cards Bill in the last Parliament and we published a
further Report on the Bill in 2005 before it finally reached the
statute book.[47] The
main focus of these Reports can be summarised as follows:
The difficulties of human rights compliance in this
Bill relate not to the issue of ID cards, either on a voluntary
or a compulsory basis, but to the related provision for the gathering,
storage and in particular the disclosure of personal information
as part of the National Identity Register to be established under
the Bill.[48]
42. The Identity Cards Bill was an enabling provision
and the details of the scheme will be set out in secondary legislation.
Our predecessors expressed their concern that the opportunity
for parliamentary scrutiny of the human rights compatibility of
the identity cards scheme will therefore be limited.[49]
They also drew attention to the scale of the personal information
which may be held on the National Identity Register.[50]
43. The Information Commissioner told us he had been
"consistently sceptical" about the database aspects
of the project and that he still sought "absolute clarity
as to the rationale and purpose for the identity card scheme".
He went on to add that:
it is one thing to collect basic identity information
- name, address, date of birth and so on; but if one is going
to record details of every time that card is used or every time
that card is passed through a reader of some sort, one then begins
to build up a very detailed picture of the daily lives of citizens
… That does go to the heart of the relationship between state
and citizens.[51]
In addition, he said he was concerned with issues
such as who had access to the data on the database, and under
what circumstances, and the purposes for which data was collected
and used.[52]
44. We share the concerns expressed by the Information
Commissioner about the National Identity Register, which also
mirror the views of our predecessors in their work on the Identity
Cards Bill. Identity cards do not in themselves raise issues of
human rights compatibility. The creation and maintenance of a
national identity database, however, must involve safeguards,
both to ensure that the information which is collected is proportionate
to the purposes for which it is required and to limit access to
data to those who need it.
45. We received a letter from a number of academics
specialising in IT security who claimed that the Government's
confidence in biometric security was "based on a fairy-tale
view of the capabilities of the technology". In this inquiry,
we have not tested their view of the effectiveness of biometric
technology in limiting the impact of human error. In the light
of recent events, however, they argued that the use of the most
advanced technology available would not necessarily prevent human
error causing lapses in data protection:
Biometric checks at the time of usage do not of themselves
make any difference whatsoever to the possibility of the type
of disaster that has just occurred at HMRC. This type of data
leakage, which occurs regularly across Government, will continue
to occur until there is a radical change in the culture both of
system designer and system users. The safety, security and privacy
of personal data has to become the primary requirement in the
design, implementation, operation and auditing of systems of this
kind.[53]
46. The Minister told us "we obviously are going
to have to look at the National Identity Register again"
following the loss of child benefit data and that the Government
"will have to learn the lessons".[54]
The Information Commissioner suggested that, when it came to concerns
about the national identity scheme, Ministers were "listening
to us a great deal more actively and more seriously in the last
month or so than before".[55]
When we asked the Minister about reviewing policy for the National
Identity Register, he said:
I did not in my evidence make any commitment myself
to review this project. My colleagues in the Home Office will
of course be taking into account any developments that may influence
the implementation of the National Identity Register, including
issues relating to data protection.[56]
47. Recent breaches in data protection by Government departments
do not encourage us to feel confident about the security of data
collected as part of the National Identity Register project. We
intend to take a close interest in the Government's detailed proposals
for the National Identity Register as and when they emerge.
23 
