The UK government has laid before Parliament a draft statutory code of practice for public authorities that share the information they hold with registered digital verification services (DVS), the data-sharing power known as the information gateway. The government intends to commence the power once the code is published.
The power, in section 45 of the Data (Use and Access) Act 2025, allows a public authority to disclose information about a person to a DVS provider that is certified against government standards and listed on the government’s DVS register, when that person has asked the provider to verify them. Authorities must have regard to the code when they share information under it.
The draft says requests should not be refused unless there is a reasonable justification under public law principles. It recommends that an authority seek legal advice before refusing and explain its decision. Because providers can be asked to meet upfront and technical costs, the code says cost or lack of resources should generally not be an obstacle to sharing.
Authorities may charge for the data, but fees must be cost neutral and must not be used to make a profit, whether charged per check, up front or both. An authority that builds an API for providers and charges for access should give every registered provider equal access at the same fees unless there are legal reasons not to.
On data protection, the code tells authorities to share only what a service needs. Its examples include permitting a yes/no check against a single data point, such as a date of birth to prove age, and considering whether a provider needs an entire credential. It recommends a data sharing agreement before any information is shared and says data can be released through an API, as a credential or by other means.
Authorities must check that a provider is on the DVS register before entering into an agreement and again immediately before information is shared, which can include using the register’s machine-readable infrastructure.
The draft must be approved by a resolution of each House of Parliament. When section 45 is commenced, it will not yet apply to HM Revenue and Customs, the Welsh Revenue Authority or Revenue Scotland, whose information sharing powers will follow at a later date. The Department for Digital, Culture, Media and Sport, which prepared the code with the Office for Digital Identities and Attributes, expects to publish non-statutory guidance and templates for authorities and providers later this year.
Sources: GOV.UK
–
By the ID Tech Editorial Team
