‘Wash up’ delays hopes for the UK’s Digital Identity regime
Written By
Partner
UK
As a partner in Bird & Bird's Commercial team and a member of our Media, Entertainment & Sport Group based in London, my practice focuses on regulatory and commercial matters in gambling and sport.
Associate
UK
I am an associate in our commercial practice, based in London. I advise clients across the gambling, sports, media and entertainment sectors on regulatory, transactional and commercial matters.
Related
Practices
Sectors
Trending Topics
Regions
Countries
Following the announcement on 22 May 2024 of a snap general election, the ‘wash-up’ that followed has curtailed hopes for reform to the UK’s data regime in the immediate future. In particular, further delays to the UK digital identities regime now seem likely to result in the UK lagging yet further behind other jurisdictions, such as the EU, where statutory digital identity frameworks have already been established.
What is the ‘wash-up’?
As a general election will be held in the UK on Thursday 4 July 2024, a ‘wash-up’ has now occurred where the UK government attempted to pass draft legislation perceived as a priority before parliament was dissolved. The wash-up only lasted two days, ending on Friday 24 May 2024. As a result, any legislation which had not passed through Parliament by this date will cease to go through the legislative process and will, in effect, be lost.
How has this impacted reform to UK data legislation?
The Data Protection and Digital Information Bill (DPDI Bill) had been progressing through parliament. Prior to the general election being called, it had reached the committee stage of the House of Lords meaning that a significant portion of the legislative process had been completed. As the DPDI Bill was not included in the wash-up, its progress will be halted, it will not enter into law and the contents of the DPDI Bill will not result in any regulatory change.
The DPDI Bill was set to reform UK data legislation in three key ways:
- reforming the UK General Data Protection Regulation and the Data Protection Act 2018;
- establishing a new regulatory regime for “smart data” in different sectors, which would allow for secure data sharing to drive the smart data economy; and
- introducing a statutory regime for digital identity verification technologies in the UK, aiming to encourage their wider adoption and use.
Now that the wash-up has concluded, the changes envisaged by the DPDI Bill will not come into force. Once a new parliament has been called to meet on 17 July 2024, it remains to be seen whether similar legislation is revisited and the form that this will take. If there is a change in government, it is very likely that new areas of reform will be prioritised and this will, at the very least, delay reform to the UK data regime. In any event. if the new government wishes to revisit the DPDI Bill (whether in its existing or an amended form), it would need to start afresh in the legislative process.
Digital Identity Verification
We have previously reported on the DPDI Bill in the context of digital identity verification. Specifically, we commented on the fact that the DPDI Bill would:
- establish a trust framework which certified organisations providing digital identity verification technologies would need to comply with;
- lead to the creation of a list of certified organisations who would be issued with trust marks where they had complied with the trust framework; and
- empower public authorities to share data with certified organisations through the government information gateway, provided the individual had consented to the data sharing.
The collapse of the DPDI Bill means that the UK digital identity framework will not enjoy statutory status for now. However, this does not mean that the developments which had previously occurred in the digital identity space will be lost entirely. Instead, the framework in the UK will continue to exist on a non-statutory basis as it had done previously. The beta version of the UK digital identity and trust framework will continue to apply, and entities which were certified under the beta version of the framework will continue to enjoy such status where they are complying with the trust framework. One major consideration with the passage of the DPDI Bill was the fact that providers would need to achieve re-certification under the statutory framework, but for now providers will not need to be concerned with this.
Although we cannot rule out that a new government could scrap the framework entirely, it would seem unlikely, especially given employers and landlords can now use certified providers to carry out identity checks for the purpose of right to work, right to rent and DBS checks. In our view, the development of a functioning digital identity market is too important for any new government to put to one side completely, so we would expect it to be revisited at some point in the (near) future.
When the government does revisit the issue of digital identities, it is possible that any framework which receives statutory status would be based upon beta version of the framework, but with material changes (as we understand would have been the case even if the DPDI Bill was passed in the ‘wash up’). Before then, the beta version of the trust framework will continue to undergo testing and granular change, which we will report on as and when updates are implemented.
