Loretta Maxfield

The proposals form part of a new Digital Information and Smart Data Bill, introduced as part of the King’s speech. The UK government said the bill, which will apply across the UK, will harness the power of data for economic growth.

The UK data economy now represents an estimated 6.9 per cent of UK GDP (as of 2022). Furthermore, data is critical for UK businesses. Seventy-seven percent of UK businesses handle some form of digital data, increasing to 99 per cent for businesses employing more than 10 people.

Among the key initiatives outlined by the bill is the creation and adoption of secure digital identity products and services from certified providers to support people who need to prove who they are. The verification could be used for purposes including securing mortgages, pre-employment checks, and buying age restricted goods and services.

Loretta Maxfield, a partner at Thorntons, who is dual qualified in Scots and English law and is certified as a specialist in data protection by the Law Society of Scotland, said: “For me, digital verification is one of the most interesting aspects of the new Digital Information and Smart Data Bill.

“The government has said that people can choose to participate in the new uses of data that it is proposing, but are people going to be excluded from accessing certain services if they don’t sign up to this?

“I can see how digital verification could be useful, allowing organisations to verify identity more efficiently and securely, but as always, the devil will be in the detail.

“We need to know more about the information that will be processed and how far certified providers will be required to go to demonstrate that they can keep that information safe, because it is likely to be quite sensitive, potentially including things like birth certificates, driver’s licenses and passports. These certified providers will need to have very robust technical and organisational measures in place to ensure such data is secure.

“We also need to see how digital verification interacts with current data protection legislation. It will be important to ensure that individual’s rights are not unduly impacted and certified providers are tightly managed to prevent this data from being used for any other purpose or in a way that could be harmful.”