The UK’s Department for Culture, Media and Sport (DCMS) and Office for Digital Identities & Attributes (OfDIA) have published the draft code of practice for public authorities sharing information with digital verification service (DVS) providers.
The statutory code, issued under the Data (Use and Access) Act 2025, “provides guidance for public authorities in disclosing information under section 45 of the Data Act,” which “applies when a registered DVS provider requests information about an individual from a public authority for the purpose of providing the individual with DVS, at their request.” Section 45 gives public authorities the power to disclose that information to that provider for that purpose.
The code outlines relevant legislation, including the following section on the UK GDPR relevant to biometrics: “lf public authorities share special category data (see Article 9 of the UK GDPR) with registered DVS, they must have both a lawful basis under Article 6(1) of the UK GDPR and must meet one of the conditions under Article 9 of the UK GDPR and (where relevant) Schedule 1 to the DPA.” Biometrics are classified as special category data under the GDPR when processed for the purpose of uniquely identifying a person.
In tandem with the draft code, the government has issued an “explanatory memorandum to the code of practice for public authorities sharing information with digital verification services.” It provides an overview of the legal instruments at play, detailed information on the DVS, and context on what is being done and why.
Shuffling departments raise questions
Speaking to a Public Accounts Committee in UK Parliament this week, Permanent Secretary for DCMS Susannah Storey fielded questions about responsibilities for oversight of the government’s digital ID activities, now that the Department for Science, Innovation and Technology (DSIT) has been dismantled. Storey says she sees the reorganization as a “digital mainstreaming” of responsibilities that will see greater overlap between business and innovation.
It is noteworthy, however, that at government levels, officials are still being asked to define digital identity on the most basic level, and to differentiate it from One Login. No matter who is in charge, or what formal DVS guidelines say, there is still a heavy lift to be undertaken in untangling the conceptual threads in the public mind.
Article Topics
biometrics | data sharing | digital verification service (DVS) | OfDIA | UK | UK GDPR
Leave a comment