Strategic Action Plan for the National Identity Scheme Safeguarding your
Foreword by the Minister of State for Nationality, Citizenship and
Immigration; the Under-Secretary of State for Nationality, Citizenship and
Immigration; and the CEO of the Identity and Passport Service
This Action Plan sets out how we plan to deliver the National Identity Scheme.
The Scheme will provide a comprehensive and secure way of managing the personal identity data of all those who legally reside or work in the UK.
Our ambition for the Scheme can be simply summarised: making good choices easier, bad choices harder.
An effective National Identity Scheme will do that, by delivering benefits in a number of key areas.
Specifically it will:
- help secure our borders and tackle illegal immigration: effective identity management will mean that
only those entitled can live and work in the UK;
- prevent identity fraud: the use of false identity currently costs the UK more than £1.7 billion a year.
The Scheme will make it much more difficult for such fraud to occur;
- become a key defence in the fight against crime and terrorism: the use of false identities plays an
increasing part in illegal activity, with sometimes devastating and costly results;
- enhance checks as part of safeguarding for the vulnerable: the Scheme will introduce a high level of
efficiency in authentication of identity, and this will significantly support checks on people working with
children and the most vulnerable; and
- improve customer service: the Scheme will make it possible to join up and personalise services across
government departments, and the wider public sector, by ensuring that we have a consistent means of
identifying those receiving services.
In delivering these benefits, we will:
- ensure that the Scheme delivers best return on investment. Not only are the benefits we have listed
above economically tangible, but it is also important to realise that much of the cost of what we are doing
would be incurred regardless of the Scheme. Specifically, biometric passports will soon be required in almost
all of the largest passport-issuing countries. Around 70 per cent of the cost of the combined passport and ID
card will be required to keep our passports up to international standards;
- take an incremental and pragmatic approach. We will keep risks and costs down, by using existing
Government investment and delivering incrementally, based on extensive piloting and trialling;
- provide key safeguards that protect the privacy of the individual and ensure the integrity of the
Scheme. These exist at every level from the legislative framework that underpins the Scheme and the
independent Scheme Commissioner who will oversee it, to the security of the systems that hold your
information and, crucially, your right to see your information and, if necessary, correct it; and
- deliver a positive customer experience during the implementation and operation of the Scheme.
The Identity and Passport Service, the government agency responsible for the Scheme, has a customer
service reputation that is literally second to none. We will ensure that those standards are maintained,
as we introduce the key changes described in this document.
The Scheme is a long-term programme, creating a comprehensive identity management infrastructure for the
UK. We have already begun work on laying its foundations.
As with any such long-term plan, the Scheme will evolve over time. The plan we are publishing today sets out
our current intentions and focuses on what we plan to deliver between now and 2010. As with any undertaking
of this scale, there is still much detailed planning work to be done, and we shall learn many lessons as we start
to deliver. We shall adjust the details of this Action Plan as required by experience, and we shall keep the
public informed by publishing updated plans periodically.
In delivering the Scheme, the Identity and Passport Service is working very closely with the Immigration
and Nationality Directorate of the Home Office, with the Foreign and Commonwealth Office and with
UKvisas to support their identity management requirements. Indeed, much of what we shall be delivering
in 2007 and 2008 will be in support of the Government's commitments to transform the immigration
system. The Borders, Immigration and Identity Action Plan, which is being published simultaneously with this
document, sets out how the Government will use the National Identity Scheme to strengthen our borders and
to enforce compliance within the UK. We shall deliver the first ID cards for British citizens in 2009.
We recognise that our ambitions for the National Identity Scheme are considerable. They reflect the scale of
the benefits that are achievable.
To return to our opening point. Good policy, well implemented, makes bad choices much more difficult. The
Scheme will do that. But the great promise of the Scheme is that it makes good things easier. A really effective
identity management scheme is central to aligning public services around the citizen and realising the goal of
truly joined-up and personalised government.
Liam Byrne MP, Minister of State for Nationality, Citizenship and Immigration
Joan Ryan MP, Under-Secretary of State for Nationality, Citizenship and Immigration
James Hall, CEO, Identity and Passport Service
This document explains what the National Identity
Scheme is, what it will deliver and when.
The Scheme will provide a comprehensive and secure
way of recording personal identity information,
storing it and making it possible for you to use it if
you want to prove your identity. It will be available
for all those over 16 years old who legally reside or
work in the UK. Specifically, it includes biometric
visas and biometric documents for foreign nationals,
enhanced passports, and ID cards for British citizens.
The Scheme will be implemented carefully and
securely and we will take an incremental approach to
getting it right. We have focused much effort on
reducing risk and have developed contingency plans
to cover potential delays. The overall timetable for
delivering the components set out in this Action Plan
will be determined by our total resources: central
funding, efficiency savings and income from
charging. It will also need to take account of
technical and commercial feasibility.
So, while continuing to provide excellent customer
service, we will strike a balance to ensure that best
value for money is obtained, without compromising
the Scheme's integrity.
We are also committed to meeting European and
worldwide initiatives to make passports ever more
secure, including the use of fingerprint biometrics.
The timing of these changes will depend on
balancing a number of factors, including costs, risk,
the outcome of pilots and development across the EU
As part of this, we will make use of pilots, which will
inform and refine our thinking as to the best way of
rolling out services as the Scheme develops.
The remaining chapters of this document set out how
we do all this in more detail, as follows:
- First, in Chapter 1, we describe the scope of the
National Identity Scheme, its principal functions
and how it will deliver services to customers.
- Chapter 2 expands on this description of the
Scheme and sets out in more detail how we plan
to create the National Identity Register (NIR),
partly by using technology that already exists in
government. It sets out what we will do for people
applying to and enrolling in the Scheme, what
identity checking services we will make available,
and how these building blocks of the Scheme will
evolve from what we have today and how they will
- Chapter 3 explains how we plan to make the
Scheme secure and how we will ensure that
information held by the Scheme is only seen or
modified by those authorised to do so.
Whereas Chapter 2 answers the `what?' question,
Chapter 4 answers the `when?' question. Starting
from our existing work on passports and the
identity checking services available today, it sets
out the evolutionary changes which will build
up through the introduction of biometric visas
and other documents for foreign nationals,
enhancements to the passport, ID cards for
British citizens, identity checking services
based on these, and so on.
- Chapter 5 sets out how the Scheme will be
managed, explaining in particular that we will
introduce a framework of regulations under the
Identity Cards Act 2006 for the operation of
the Scheme and that we will appoint a Scheme
Commissioner to oversee the Scheme.
- Chapter 6 looks to the future, setting out how we
will proceed towards procurement and what our
key short-term activities are.
At the back, there is a list of abbreviations and
a summary grid of actions which brings together
in one place the key dates and activities from
The National Identity Scheme
The National Identity Scheme, underpinned
by the Identity Cards Act 2006, and other
important legislation such as the Data
Protection Act 1998, will provide a
comprehensive identity management service for
all those who legally reside or work in the UK.
Over time, this will include all British citizens
over 16 and foreign nationals (including
European Economic Area nationals) in the UK.
2. The Scheme has five major parts.
Applying for your card: this is how you
apply for a passport or a card. Through the
application process you will go on to enrol in
the Scheme and will be issued with a card.
- To apply, you will need to provide
biographical information covering basic
personal details (e.g. name, address, date
of birth). When you enrol, biometric
information (e.g. facial image, fingerprints)
will be recorded. This will allow your
identity to be checked by
what you tell us. This is to prevent people
attempting to defraud the system.
- For British nationals, biographical
and biometric information will be given
at a local office. For foreign nationals,
this will be done through existing
immigration processes, enhanced as necessary.
- Each person will need to re-enrol once
every 10 years, in much the same way as
passports are currently renewed every
- There will be a combined application and
enrolment process for passports and ID
cards for British citizens.
- A range of options will be available if you
want to register a change of details, such as
a contact centre or using the Internet.
- Storing your identity data: the National
Identity Register (NIR) is where your
personal identity details will be securely
recorded and maintained. It will have links
other Government systems to share
identity data, and will support
- Issuing your card: the creation and delivery
of your card and passport and documents for
- Checking your identity: you will be able to
use the Scheme to prove your identity.
- When you want to prove your identity to
an accredited organisation, for example to
open a bank account, they will, with your
consent, be able to use the Scheme's
identity checking services.
- Different levels of checking will apply,
depending on the service you want to
access. For example, a financial institution
may ask for proof of identity before
completing certain transactions and will
wish to check the validity of the ID card
when you present it.
- Some of the identity checking services will
only be made available to
organisations, authorised by the Identity
and Passport Service.
Securing the Scheme: there are integral
functions that will oversee and manage the
Scheme, to provide safeguards and make sure
the Scheme is properly run and is supported
by the proper legislation and regulations.
Home Secretary is ultimately
responsible to Parliament for the running
of the Scheme.
- The independent
will continually review the operation of
the Scheme and report to Parliament.
- The security, assurance and integrity
functions will act to drive out fraud,
protect your identity information and
protect the integrity of the Scheme.
- Regular reports will be provided to
Parliament on the progress of the Scheme
and its cost.
- The Information Commissioner has key
powers to protect personal information,
including information held in the NIR.
3. Our plans set out in this document
for delivering the Scheme show how this
will be done, building on what we have
4. The Identity and Passport Service (IPS) has been
reviewing over the last few months its plans
for delivery of the National Identity Scheme.
This is to ensure an integrated approach with
the Home Office's work on securing borders,
to minimise delivery risk, to ensure value for
money and to accelerate the introduction of
the Scheme's benefits.
5. The Scheme will require people, processes,
premises and technology. We will maximise the
potential of such resources already available
across government. This use of what is already in
place is in line with Government policy, both in
terms of sharing resources across government
and in terms of delivering more `joined-up',
personalised and effective services to customers.
6. This chapter explains, in more detail, how
we intend to deliver the Scheme, including
using resources that the Government has
already created. Figure 2 expands on Figure 1
(see page 6) to illustrate the key elements that
need to be delivered.
Application and enrolment, customer
services and document production
Application and enrolment
7. For British citizens, when you apply for an ID
card it will be a very similar experience to how
you will apply for a passport. Your application
details will be processed and you will be asked
to come to a local office, where your biometrics
will be enrolled.
8. We are already putting in place an expanded
IPS office network. We are opening 69 new
local offices to meet and interview first-time
applicants for passports, and to prepare for
recording biometrics. These offices will open in
2007 and will be used for the National Identity
Scheme. Where the network of enrolment
centres needs to be further expanded, we will
first seek to use high street offices that are
already used by central and local government.
We will also look at options for the private
sector providing outlets. At these offices, the
systems which staff use to help people applying
for their passports will be used to handle ID card
applications for British citizens.
9. We will be using new tools to do background
checking against identity information from other
parts of government and the private sector.
Particularly important is improving our ability
to check people's identity details against other
data within government, most obviously data
held by the Department for Work and Pensions
(DWP), which covers the vast majority of the
UK population. In 2007, checks to validate
identity will start being done against the
electronic records of deaths (held by DWP) and
naturalisation (held by the Immigration and
Nationality Directorate (IND)), followed
progressively by data on marriages and births,
and matching against identity information on
other relevant government department databases
from 2008 onwards.
10. We will deliver customer services in a range of
ways (e.g. online, by telephone) and these will
include handling changes to your personal
details, correcting data when necessary (for
example if you change your address, or if you
lose your card), and allowing you to review your
National Identity Register (NIR) information.
Production and delivery
11. We will produce ID cards for British citizens
and other identity documents, such as a British
passport. After secure production, the applicant's
personal details will be written onto the chip in
each document and electronically `signed' to
ensure it cannot be modified. For passports,
production will continue to use the existing
contract, which will be replaced when it expires.
The secure delivery contract for passports is
currently being retendered.
12. In the shorter term, for card production we will
seek to use secure production facilities that the
UK government already has in place. Going
forward, we will secure new capability to
produce cards in the medium to long term.
The National Identity Register (NIR)
13. There are already several government databases
that hold biographical information used to
identify people. The real step change in the
National Identity Scheme is that biometrics,
such as fingerprints, will be recorded and linked
to a single, confirmed biographical record
(covering name, address, etc.). Biometrics will
tie an individual securely to a single unique
identity. They are being used to prevent people
using multiple or fraudulent identities.
14. The capacity to record and link biometric and
biographical details, along with administrative
data (for example, details of the card issued to a
person), in the NIR, is laid out in the Identity
Cards Act 2006. The Act details specifically the
information that can be recorded in the NIR.
15. These sets of information biometric,
biographical and administrative do not all
need to be held in a single system. In fact, for
security reasons, and to make best use of the
strengths of existing systems, it makes sense to
store them separately. Specifically:
- for NIR biometric information, we will
initially use existing biometric systems used for
asylum seekers and biometric visas to meet our
short-term needs, moving to new biometric
services when the NIR is fully operational;
- for NIR biographical information, we plan to
use DWP's Customer Information System
(CIS) technology, subject to the successful
completion of technical feasibility work.
DWP's CIS technology is already used to hold
records for everyone who has a National
Insurance Number i.e. nearly everyone in
the UK. However, even though the CIS
already contains personal details for most
adults in the UK, these entries will not
simply be copied to the NIR. The details of
any individual entered in the NIR will be
recorded when they apply and verified to
the highest possible standard before being
recorded in the NIR; and
- for NIR information related to the secure
issue and use of ID cards, passports, etc.
(technically called `Public Key Infrastructure'
(PKI) information), we will build on the
existing IPS systems. These are used today to
issue the six million ePassports each year.
This separation is summarised in Figure 3.
16. On each of the three systems that hold NIR
information there will be other information that
is not part of the NIR. For example, the
biometric store will hold biometrics for children
aged between 11 and 16, in line with the EU
requirements for passports, but this information
is not part of the NIR; and the CIS technology
holds information specific to DWP's work,
which again is not part of the NIR.
17. As explained in Chapter 3, there will be a range
of shields and controls in place to ensure effective
separation of NIR information from this non-
NIR information, critically in terms of who can
see and who can change which information. This
will be subject to independent verification.
Identity checking services
18. ID cards will be widely used and part of
everyday life and we want to make sure we
design the Scheme to get the most out of them.
19. ID cards will be used to facilitate access to
many public services. This will be the case
throughout the country, as the Scheme is
UK-wide. Application, enrolment and the
storage of data in the NIR will be managed on
a UK-wide basis, in much the same way as
passport applications operate today. However,
the devolved administrations will have
responsibility for how the ID card is used to
gain access to those public services which are
Authentication and identity verification: you will be able to present your card to give consent to having
your identity verified. There will be a number of ways of doing this, reflecting the importance of what you
want to do. Offering these different levels of identity check allows organisations to balance the level of
assurance of someone's identity with the investment they make to support this:
- visual check: the person you present your card to might check whether the photograph on the front
of the card is your photograph;
- card authentication: the person you present your card to will be able to check, using information
held on the chip on the card, whether it is a genuine, unaltered card;
- PIN check: if they require a higher level of proof, they might ask you to enter a Personal
Identification Number (PIN) that only you should know;
- verification online or over the telephone: if you want to prove your identity to someone on the
telephone or over the Internet, you will be able to do this by supplying your card details and possibly
some `shared secret' information, like banking services use today. Higher levels of security will be
possible by using the chip on the card to generate a temporary password. Small hand-held devices to
support this are cheaply available. Using one of these, the chip can provide a temporary code which
confirms that your card is the one being used and that you have entered your PIN correctly;
- biometric check: if they require a still higher level of proof, they might ask you to present a
fingerprint to be checked against those which you gave when you enrolled for the card.
Identification: finding out, by searching for your details in the NIR, who you are. This might be used
if you do not have your card with you.
- Information provision: this is the ability to make data from the NIR available to other parts of
government, to make sure that all parts of government are using the most up-to-date identity
information about you, for example to make it much simpler when you change your name or address.
20. Initial identity checking services will be
available, to enable cardholders to prove their
identity easily, to get access to services, to prove
entitlement, and, for British citizens, to travel
within Europe using their ID card instead of a
passport. The key types of services that will be
offered are shown in the box on page 11. Not
all of these services may be available when ID
cards are initially launched, but they will
be introduced as the Scheme moves forward.
21. These services will be delivered by using cards
that we will issue securely, including through
the current passport-issuing business. The cards
will, like passports, contain a microprocessor
chip. The chip will hold data in line with
International Civil Aviation Organization
(ICAO) recommendations, including a biometric
image of the bearer's face. This is important in
their use as travel documents, as they can be
used to cross other countries' borders.
22. When we record and store fingerprint biometrics
(all 10 fingerprints for each person), we store a
complete set in the NIR and a subset of these
will be recorded on the card or passport, in line
with ICAO recommendations. Again, this will
be important for travel, given the international
move to adopt fingerprints in travel documents.
23. Subject to reaching commercial agreements,
we also intend to make the ID card for British
citizens compatible with Chip and PIN card
readers. We have started work on this. We will
seek to work with the owners of the Chip and
PIN infrastructure in our feasibility work and
collaborate in piloting future identity-related
protocols and services.
24. Being sure we can make best use of ID card
technology in the future means working today
with a range of partners to refine the uses
of the Scheme.
25. We will enter into joint venture partnerships
with other parts of government and the private
sector to develop those identity checking services
that will be offered at the launch of the Scheme.
26. We expect to engage with the private sector to
encourage the innovative provision of an ever-
evolving set of identity checking services. All
services delivered will have oversight and
accreditation from IPS, to ensure the necessary
safeguards are in place.
27. In terms of initial services offered, the Passport
Validation Service (PVS) is a valuable platform
to be built upon. PVS is a service which
organisations can already use to check that a
British passport, which is presented to them as
proof of identity, has been issued validly and has
not been reported lost or stolen. For British
citizens, this means an assurance of their
identity; for business, a reduction in the
potential for fraud. For example, using PVS we
are already making it easier and more secure to
apply to the Driver and Vehicle Licensing
Agency (DVLA) for a driving licence, if you
have a recently issued passport.
28. At the end of September 2006, there were 18
different organisations using PVS, including
three high street banks, and IPS was handling
thousands of enquiries per week. PVS is
currently engaging with a large pool of
interested potential user organisations and will
continue to grow to maximise efficiency and
provide the best possible customer service.
Securing the National Identity Scheme
29. The success of the National Identity Scheme
in delivering its benefits relies on public
confidence, especially in the accuracy and
security of the information held in the National
Identity Register (NIR).
30. Effective security measures will be in place for
the entire Scheme. For example, ID cards and
passports will be produced and delivered under
appropriate levels of security, including the
necessary physical and electronic security
measures. However, key to the security of the
Scheme is the security of the NIR, and that is
what this chapter concentrates on.
Creating each person's NIR record from
new, based on rigorous checking
31. When a person applies to the Scheme, they
provide a small set of biographical and biometric
information. A range of background checks
will be carried out, based on this information.
For example, biographical details will be
corroborated against private and public sector
databases, such as those of the Department for
Work and Pensions (DWP) and the Immigration
and Nationality Directorate (IND). Biometrics
will be checked against those of other people
who have enrolled in the Scheme, to stop the
same person applying twice under different
identities. This corroborated information will
be stored in the new NIR record.
Effective checking when a person
reports a change to their details or
wants to look at their record
32. It is important that all customers can have access
to their record and tell us when, for example,
they have moved or changed names. But we need
to guard against fraudulent changes being
reported or fraudulent access being requested.
33. So we will put in place effective checks to make
sure that the person we are dealing with is who
they claim to be, before making any changes to
their NIR record or revealing information.
34. Also, the number of staff who will be able to see
the whole of a person's identity record or make
changes to it will be limited and fully security
vetted. For any such access by staff there will be
rigorous auditing, alerts and a range of technical
controls to guard against internal misuse of, or
fraudulent changes to, the NIR.
Holding each person's NIR record in separate, discrete parts
35. As described in Chapter 2, the information
in each person's NIR entry will be in several
parts, with each part being held on a separate
set of technologies:
- biometric details will be held on the
- a biographical part of the entry will be held
on the Customer Information System (CIS)
- Public Key Infrastructure (PKI) related
information will be held on the PKI
technology already being used for issuing
36. This separation is important in guarding against
malicious or fraudulent damage to the NIR,
since it would require unauthorised and
undetected changes to these separate systems and
the corresponding card.
37. Each of these systems will have its own specific
security controls and integrity mechanisms.
Biometric information will be stored with very
tight security. We will build on our experience
with passports, where photographs have been
held for a number of years with no known
compromise or misuse of the images. Stringent
controls on access will be used to protect the
information held and all staff will be vetted
prior to employment.
Enforcing a clear separation
38. On each of the three systems that hold NIR
information, there will be other information
that is not part of the NIR. For example, the
biometric store will hold biometrics for children
aged between 11 and 16, in line with the EU
requirements for passports, but this information
is not part of the NIR. The CIS technology
holds information specific to DWP's work;
again, this is not part of the NIR.
39. There will be controls to enforce the clear
separation between NIR information and
information that is not part of the NIR. These
will be enforced at various technical levels and
will be supplemented by strict access controls to
determine which data can be seen by those with
the appropriate permission (e.g. security-cleared
Identity and Passport Service (IPS) staff).
40. Any information held that does not relate to the
NIR will not be part of the NIR and will not
be available to NIR users. Conversely, any NIR
information that does not relate to the needs of
other users of these systems, such as DWP staff,
will not be viewable or accessible in any way by
Making sure only authorised people and
organisations can use NIR information
41. Security-cleared IPS staff will be responsible for
the running of the NIR and the authorised
provision of information from it. It will be a
criminal offence to tamper with the NIR, with
a maximum penalty of 10 years' imprisonment
for an unauthorised disclosure of information.
We will enforce these powers.
42. The Identity Cards Act 2006 allows for certain
NIR information to be provided, with a person's
consent, to an accredited organisation, for
example a bank. This could be to confirm an
ID cardholder's identity when opening a new
account. This may include information such as
their address, which is not shown on the face of
the card. IPS will be responsible for accrediting
all such organisations to ensure they and their
staff do not misuse these services. IPS will also
put in place rigorous security controls so that
only accredited organisations can use such
services and only in the way intended.
43. It is important to stress that no part of the
NIR will be directly connected to the Internet
or any public network. Any request for NIR
information will have to pass through a number
of intermediate systems and filters, to make sure
only authenticated and authorised requests can
get through. Further, very strong physical
security will be in place, to guard against the
risk of direct physical attack.
44. The National Identity Scheme is also intended
to support and enable the prevention and
detection of crime and safeguard national
security. NIR information may therefore be
provided from the NIR without an individual's
consent to the security services, the police and
HM Revenue & Customs. Again, IPS will
enforce strict controls to ensure any such access
can only happen when fully authorised.
45. It would also be possible, subject to
Parliamentary approval, for information to
be provided without consent to, for example,
government departments or other public bodies.
This might allow a person to report a change of
name or address to government once, rather than
the many times needed today.
Accrediting the NIR Overseeing the wider Scheme
48. Data storage in the NIR will meet the
requirements of the Data Protection Act 1998,
including customers' rights to see information
held about them in computer systems.
The operation of the Data Protection Act is
overseen by the independent Information
Commissioner, who has a statutory role to
protect personal information and legal powers
to enforce compliance with that Act.
Making sure the NIR's operation is secure
49. Further, in terms of day-to-day integrity and
security, two key expert groups will be put in
place, building on the significant expertise that
already exists within the Home Office.
Supporting the use of biometrics
50. We will put in place the skills and expertise to
support large-scale use of biometric matching.
Biometric technology identifies small percentages
of what are known as `false matches' or `false non-
matches'. These need expert human assessment to
ensure that matches are being made correctly. For
this, we will build on resources which currently
exist within government.
Counter-fraud, intelligence and enforcement
51. We will enhance existing fraud and intelligence
capabilities to counter attempted fraud and
enforce the powers of the Identity Cards Act
2006 on those who attempt such activity.
Chapter 4: Delivering the National Identity Scheme
52. Improving the security and management
of identity has already started, and the
National Identity Scheme will build on
many enhancements and initiatives that are
well advanced at the Identity and Passport
Service (IPS), the Immigration and
Nationality Directorate (IND), the Foreign
and Commonwealth Office (FCO) and UKvisas.
We will also maintain the high levels of
customer service achieved over recent years
for the third year in a row, IPS topped the
independent Comparisat Customer Satisfaction
survey, ahead of organisations such as Amazon,
Asda, eBay, Marks and Spencer, and Tesco.
53. Figure 4 shows our recent major areas of
delivery. We also work closely with related
initiatives in other areas of government, in
particular those in IND, such as the Application
Registration Card (ARC). Since 2002, this
system has been recording fingerprint and facial
biometric data from asylum applicants in the
UK. We also work closely with the Iris
Recognition Immigration System (IRIS)
initiative, which since early 2006 has been
offering a quick way for registered travellers
to clear immigration at some UK airports.
Enhancing customer experience
54. We have done the following to enhance
- 2001: we introduced extended opening
hours, so that all offices are now open at
weekends and in the early evening following
the introduction of appointment-based
- 2001: we introduced guaranteed service
levels, with fast-track and premier services.
- 2003: we introduced integrated call handling,
improving the ability of the contact centre to
resolve queries about the progress of passport
applications without needing to transfer calls
to passport offices.
Increased passport integrity
55. We have done the following to increase passport
- 2002: we introduced information updates
from the Office for National Statistics and
others on infant deaths to detect passport
- 2002: we set up the personal identity
process pilot project, collaborating with
a credit reference agency to validate the
personal information provided on passport
- 2003: we established a new system to manage
lost, stolen and recovered passports.
- 2004: we introduced secure courier delivery
- 2006: the full operational implementation of
the personal identity process took place.
- 2006: proof-of-concept trials took place of
facial recognition to detect fraudulent
- 2006: ePassports were rolled out nationally.
These are the first `biometric' passports: they
contain a chip with key personal details and
the photograph of the bearer (as already
printed in the passport) stored on it.
They cannot be changed, but can be read
electronically at borders both here and
abroad. By the end of 2006, we will have
issued four million ePassports.
Introduction of identity checking
56. We have done the following to introduce
identity checking services:
- 2002: we provided a Passport Validation
Service to the Foreign and Commonwealth
- 2005: we provided a Passport Validation
Service to the Driver and Vehicle Licensing
Agency (to validate driving licence
applications), IND (for border control
purposes) and other government departments
(for relevant business purposes).
- 2006: we provided a Passport Validation
Service to financial institutions.
57. Figure 5 shows how we are building on existing
successes to put the foundation for the Scheme
in place. Some examples of how we are doing
this are listed below.
Improving passport security and
strengthening passport checks
58. In mid 2007 we plan to commence a
live pilot of interviewing first-time adult
Biometrics required for visa applications
59. We will do the following in relation to
biometrics for non-EEA foreign nationals
coming to the UK:
- 2008: by April 2008 we will be
recording biometrics for everyone from the
169 nationalities outside the EEA applying to
work, study or stay in the UK for more than
six months, and for people from 108
nationalities applying to visit the UK.
Evolution of the Scheme's identity
60. We will do the following to improve identity
- 2007: we will enhance the Passport Validation
Service and continue its expansion.
- 2007 onwards: we will design and prototype
new and expanded identity checking services
through joint ventures with other parts of
government and the private sector. In parallel,
we will work with the private sector to
develop innovative identity checking services
for use across the UK.
Biometrics introduced for non-EEA
foreign nationals already in the UK
61. We will do the following in relation to
biometrics for non-EEA foreign nationals:
2008: we will begin to issue biometrically-
enabled identity documents to foreign
nationals from the 169 nations outside the
EEA who are already in the UK and reapply
to stay here.
62. We will do the following in relation to
- 2009: we will issue the first ID cards
for British citizens, using the improved
application and enrolment systems. We will
build on our experience of biometrics for visas
and other documents for foreign nationals,
and will use our learning from the piloting
of identity checking services.
- 2010: we will issue significant volumes of ID
cards alongside British passports.
63. We are also committed to meeting European and
international initiatives to make passports ever
more secure, including the use of fingerprint
biometrics. The timing of these changes will
depend on balancing a number of factors,
including costs, risk, the outcome of pilots and
development across the EU and internationally.
2009 and beyond
64. The first ID cards will be issued to British
citizens in 2009. As the Scheme rolls out
thereafter, it will continue to evolve, with the
delivery of innovative services. There will be
increasing involvement from the private sector,
and growing numbers of people enrolled in the
Scheme. This will eventually lead to registration
being made compulsory (subject to
65. When you enrol into the Scheme, your
fingerprint biometrics (all 10 fingerprints) will
be recorded and stored in the National Identity
Register. A subset of these will be held on
your ID card or passport, in line with
International Civil Aviation Organization
standards. The introduction of iris biometrics
also remains an option.
66. As the Scheme grows, we will continue to
engage with the private sector. The identity
checking services that you will be able to use to
prove your identity will grow in scale, and the
range of channels through which they will be
made available will also be increased. We expect
the private sector to play a key role by driving
innovation in the use of these services. Our first
steps can be seen in our work on joint ventures
(see Chapter 6).
Take-up and compulsion
67. Our enrolment strategy will be to focus firstly
on target groups who stand to make most use of
ID cards, or to address specific risks, for example
where existing documents are abused.
68. It is the Government's policy that registration in
the National Identity Scheme should eventually
be compulsory for all those resident in the UK
who are over the age of 16. The Identity Cards
Act 2006 allows for the registering and issuing
of an ID card to be linked to the issuing
of official documents such as passports and
immigration documents. This means that we
can issue ID cards to a large proportion of the
population while managing the delivery risks.
For example, around 8 per cent of the adult
population receive a passport each year, but we
will never be able to issue everyone in the UK
with an ID card by this method. At some time
in the future, further primary legislation will be
laid before Parliament to provide the powers to
issue ID cards to the rest of the population.
Overseeing the National Identity Scheme
69. For British citizens, the National Identity
Scheme will be administered by the Identity and
Passport Service (IPS) on behalf of the Home
Secretary. IPS will be responsible for the data
held and for the provision of data from the
National Identity Register (NIR).
70. For foreign nationals (including both EEA and
non-EEA nationals), authentication, enrolment
and the production of documents will all
be carried out in the early stages by the
Immigration and Nationality Directorate
(IND), supported by IPS.
71. To deliver the Scheme, IPS will be commissioning
work from a range of organisations including the
Department for Work and Pensions (DWP) and
private sector companies.
Laws and regulations for the Scheme
72. The National Identity Scheme will be governed
by the Identity Cards Act 2006, immigration
legislation, the secondary legislation (regulations
and orders) made under the Identity Cards Act
2006 and approved by Parliament, and other
legislation (e.g. the Data Protection Act, etc.).
This includes regulations that will set the fees
to be charged and the requirements for applying
for ID cards. All of these regulations and orders
will be subject to Parliamentary scrutiny, which
will allow debate on the detailed proposals for
73. The first secondary legislation will be an order
under Section 38 of the Identity Cards Act
2006. This will be placed before Parliament
in early 2007, and provides for verifying
information in passport applications. It enables
orders to be made specifying organisations that
may be required to provide information for this
purpose; this is necessary to ensure that IPS has
the ability to identify fraudulent passport
applications and guard against identity theft.
National Identity Scheme Commissioner
74. Appointing a commissioner to oversee the
operation of the National Identity Scheme is a
key safeguard of the Identity Cards Act 2006.
The Commissioner will be recruited by means
of an open competition, which will begin
significantly before the first ID card is issued:
there will be full and proper oversight from the
outset. We will ensure that the Commissioner
is in post before the first ID cards are issued
under the Identity Cards Act 2006. To ensure
independence, the Commissioner will not be
based in IPS. He or she will review the operation
of the Scheme, including the uses to which ID
cards are being put and the arrangements made
for securing the confidentiality and integrity
of information recorded in the NIR. The
Commissioner will make regular reports to
the Home Secretary, and these will be published
and laid before Parliament.
Managing shared services
75. There are challenges inherent in operating a
shared service, where a single system meets the
needs of two or more organisations; this will be
the case with the NIR operating on Customer
Information System technology. We are working
with partners across government to ensure that
there are effective management and governance
arrangements in place for managing this shared
use of technology.
76. In order to effectively manage shared services,
the following arrangements will typically
- Working with other partners, such as UKvisas,
IND and DWP, IPS will develop the processes
and systems required to support the enrolment
and maintenance of biographical and
biometric data in separate data stores, as well
as the links between the two.
- IPS will be responsible for the Scheme and
accountable for its success.
- IPS's partners, such as DWP, will deliver the
changes needed and operate the technologies.
- IPS will integrate the Scheme, ensuring that
each component part from each partner fits
with the rest (e.g. card production, biometric
- A governance framework which is joint and
multilateral across all key partners will be put
- Service delivery will remain embedded within
the key partner organisations and will be paid
for through agreed charging mechanisms.
The wider Scheme
77. Beyond the NIR, governance structures are
being developed to address the following:
- The processes for accreditation through which
organisations both public and private sector
can make best use of the Scheme. Such
processes will make clear who is able to verify
an individual's identity using the Scheme.
- Counter-fraud, intelligence, and the measures
necessary to protect the security, resilience and
integrity of the NIR. This will be developed
in close liaison with the relevant security
specialists within government and with the
Scheme's independent security accreditor.
Chapter 6: Next steps
78. The Scheme will evolve, delivering increasing
benefits over time, to support ever more effective
identity management across the UK. The
introduction of the National Identity Scheme
will be incremental not a `big bang'. Even
now, we are adding to and enhancing our
existing systems and services to ensure that
the Scheme delivers.
79. As already stated, our strategy for delivery is to
make best use of existing assets and investment.
Within this, we will continue to explore (with
other parts of government and the supplier
market) innovative options for delivery of
the Scheme's services. As discussed below, we
expect to put in place flexible and responsive
commercial arrangements to enable us to
80. An important aspect of our preparation is how
we engage with private sector partners to deliver
the services needed to make the Scheme a reality.
During 2005, the Identity and Passport Service
(IPS) commenced its market engagement by
taking soundings on a potential procurement
strategy and its implementation. Intellect's
Concept Viability Scheme was used as part of
this process. Now that the Identity Cards Act
2006 is in place, we have used that market input
and further work on priorities and planning to
refine our strategies for delivery. The intention is
to update the market on the new propositions
(through a briefing pack available on our
website and with other public information),
with further engagement and consultation
taking place during early 2007. This will lead
up to significant procurement activity beginning
in the second quarter of 2007.
81. The procurement approach will harness the
knowledge gained from earlier market soundings.
We will be outcome-focused and will work in
collaboration with the market to define solutions
and long-term strategies. As part of this we will
consult with the market on how best to `package'
the services needed. In addition to the detail of
the consultation, we will be looking at how the
market can deliver speedily and flexibly, while
achieving value for money.
82. There are a number of key passport-related
contracts within IPS that are due to expire over
the next few years. By adopting an incremental
approach, IPS will seek to put contracts out
to tender in a manner that will promote the
continued successful delivery of passport
operations and enable the development of new
capabilities for future Scheme delivery. We
believe that this approach reduces risk and
provides best value for money.
83. During 2007, we will begin the work to put in
place new commercial arrangements for key
parts of the Scheme, including the following:
- The core biometric services underpinning
National Identity Register (NIR) delivery.
We will meet our early needs by using
existing biometric storage and matching
systems from within IPS and the Immigration
and Nationality Directorate (IND). We will
need to procure further capabilities as
the Scheme grows and we will put in place
the necessary room for expansion. We will
ensure that the security measures necessary to
protect the data are in place. The first stage of
this procurement process is planned to begin
formally in the second quarter of 2007.
- Key IPS operational services, not least in the
areas of application and enrolment processing.
Again, we plan to formally begin
procurement in 2007.
- The manufacture and delivery of identity
products, some of which will be procured and
delivered in collaboration with delivery
partner organisations (such as IND and the
Foreign and Commonwealth Office).
- An innovative and growing range of identity
84. We plan to initiate a series of joint ventures
strategic partnerships across government and the
private sector that will shape the development
of the Scheme.
85. The Government has said
(Cabinet Office (November 2005) Transformational Government: Enabled by Technology
that it wants ID cards
and the NIR to be the `glue' that allows personal
and identity-related data to be joined up across
government. Through these joint ventures, we
aim to build confidence in and support for the
National Identity Scheme among those people
who have enrolled, people in the public sector
and people in business. We also aim to tackle
identity-related business challenges and to
improve the customer experience for all those
(the individual, as well as the private and public
sectors) who interact with government services.
It is important to stress that the use of the NIR
here will be to provide proof of identity to joint
venture partners, by only providing identity-
related data that is specific to the partner's
business process not to provide wider access
to the full set of data that the NIR holds.
86. The first joint venture initiatives have been
selected on a priority basis, based on their
attractiveness and achievability. They are a
mixture of initiatives both to make access to
services and proper use of identity data easier,
and to make fraudulent use of identity, illegal
working and illegal immigration harder. The
following joint ventures have been prioritised for
- Criminal Records Bureau (CRB): the
National Identity Scheme will help to make
identification within the CRB process
quicker, and will help with cracking down on
criminals applying for jobs working with
children and vulnerable adults.
- IND and employers: a combined `identity
and right to work' checking service will
make it harder for foreign nationals to
- Retail sector: when customers buy age-
restricted goods, retailers will easily be able
to establish proof of age.
- Department for Work and Pensions
(DWP), the Department for Communities
and Local Government (DCLG) and local
authorities: we are exploring the feasibility of
a joint venture with DWP and DCLG, and in
association with local authorities, to establish
how efficient verification of identity will
inform customer experience improvements
and access to entitlements.
- Government Gateway: a single access
point to multiple government services using
secure identity verification. It provides a
means for citizens to update their identity
Trialling and piloting
87. We will build upon the trialling work carried
out to date both to learn lessons from a
`customer experience' perspective and to prove
the effectiveness of the technology and processes
that we plan to adopt. Excellent work in this
area has already been carried out by IPS, IND
and UKvisas, and this will inform our trialling
plans going forward. Trialling will be based on
analysis from IPS's risk management strategy of
what is necessary, and on input from suppliers
and the market. The following are some of the
key features of our approach to trialling
- We will be flexible about the scope of the
trials and will adapt our trialling approach to
changing circumstances and the results of
- We will test suppliers' technology to ensure
that it meets our requirements as the Scheme
- Testing will be undertaken through the life of
the Scheme. We will trial solutions at key
points in the development process, and will
be looking for assurances that solutions are fit
for purpose before use.
Recruitment Refining our estimate of Scheme costs
89. In accordance with the Identity Cards Act 2006,
a report of the estimated costs of the National
Identity Scheme was laid before Parliament on
9 October 2006(Identity Cards Act 2006: First Section 37 report to Parliament about the likely costs
(presented to Parliament pursuant to Section 37 of the Identity Cards Act 2006).
The report estimated the
costs of issuing passports and ID cards over
the coming 10 years at some £5.4 billion
(excluding the cost of issuing documents to
foreign nationals), much of which will be
recovered from fees. We will continue to revise
our estimates of the costs of implementing the
Scheme as work proceeds, and will provide
regular updates to Parliament; the next is
scheduled for April 2007. As part of it, we will
be validating the estimated costs of the work set
out in this Action Plan. We will have updated
the business case in the light of the approach set
out in this document and will be subjecting it
to independent scrutiny, including through the
Office of Government Commerce Gateway
process over the coming months.
Leadership in identity management
90. IPS will continue to lead collaborative work
across government to improve identity
management and to help to ensure that this fits
with the related changes prompted by Sir David
Varney's review and the Government's strategy
on data sharing, both of which aim to enable
better, person-centred public services.
91. Government and business have a shared interest
in accurate and accessible information about the
customers of their services and in building
public confidence in how identity information is
used. The Public Private Forum on Identity
for more information).
chaired by Sir James Crosby, who
was appointed by the Chancellor of the
Exchequer, is considering these issues, and how
the public and private sectors can work together
to deliver real improvements for individuals. The
forum will report to the Chancellor of the
Exchequer and the Ministerial Committee on
Identity Management in April 2007.
92. Within the Home Office we are already working
on simplifying and improving the way we
handle identity information. Over time, we will
be able to link people to a single identity across
our systems using biometrics.
A really effective identity management scheme is
essential in order to shape public services around
the citizen and realise the goal of truly joined-up
and personalised government.
Annex 1: Actions up to 2009
By April 2007
- Increase roll-out of Passport Validation Service for finance sector
- Finalised design of Criminal Records Bureau joint venture
- Report from Public Private Forum on Identity Management published
By June 2007
- Live pilot of interviewing first-time adult passport applicants begins
- Biometric Home Office travel documents are introduced (facial biometric)
- Biometric procurement begins
- First secondary legislation introduced (under Section 38 of the Identity Cards Act 2006)
- Design work completed on using the Department for Work and Pensions' Customer Information System database technology
- IND enhanced employee checking service available for employers
- Roll-out of commercial partnership enrolment of UK biometric visas
By end of 2007
- Network of offices to meet first-time passport applicants operational
- Joint venture work initiated with a range of other partners
- New contact centre services operational
- Biometrics recorded for most visa applicants
- Electronic data on deaths and naturalisation used to check passport applications
By end of 2008
- Biometric documents introduced for non-EEA foreign nationals already in the UK who reapply to stay here
- Electronic data on marriages and births and other government departments' data used to check passport applications
- National Identity Scheme Commissioner appointed
- Biometrics recorded for all visa applicants
By end of 2009
- New contract for application systems for passports operational
- Enrolment of fingerprints for passports and ID cards begins
- New contract for secure biometric storage in operation
- First ID cards issued to British citizens
Back to source document.
- Initial identity checking services operational