Making tax digital: How your identity will be verified
HMRC’s digital transformation will change the way your online identity is verified, explains Donald Drysdale.
Increasingly, taxpayers and tax agents do business online with HMRC and other government departments.
Pressures to do so are growing. Some online services offer incentives (such as preferential filing dates for personal self-assessment) while others (for example, iXBRL for company tax returns) are mandatory. Some are eagerly awaited – with many agents keen to use HMRC’s agent online self-serve.
HMRC has publicised its plans for ‘Making tax digital’ by transforming tax administration to be more effective, more efficient and easier for taxpayers. However, it has not been so forthcoming about plans to introduce a new facility called ‘GOV.UK Verify’ which (the UK Government claims) will give individuals a secure and convenient way to access online government services.
Eventually every individual wishing to interact with government online will need to use GOV.UK Verify. It is unclear how the facility will impact on users other than individuals – for example, companies dealing with HMRC. Equally, HMRC has not yet made it clear how it will affect the ability of tax practitioners and their firms to transact business online on behalf of their clients.
The Government Gateway was developed between 2001 and 2005 to allow users to conduct a wide range of routine transactions online with government departments. Familiar to unrepresented taxpayers as the means by which they access HMRC’s online services, it is also used by tax agents to enable them to interact with HMRC on behalf of their clients.
Around the same time, plans were afoot to introduce a UK-wide identity card scheme. When the new coalition government came to power in 2010, one of their first steps was to scrap this and the associated national register. It had attracted widespread political opposition, and had been doomed to failure because the public didn’t want it. After a series of spectacular public sector IT failures and data breaches, citizens didn’t trust the government to keep their sensitive personal data secure.
The government is now building digital services which (it claims) are simpler, clearer and faster to use. These aim to meet a ‘digital by default’ standard – which means (according to the Cabinet Office) “digital services that are so straightforward and convenient that all those who can use them will choose to do so whilst those who can’t are not excluded".
GOV.UK Verify is another plank of the government’s digital strategy
This digital transformation programme began in 2013 with 25 major services that were to be digital by default by March 2015. These included HMRC’s services for personal self-assessment, checking or updating company car tax, and personal tax accounts – all now meeting the digital by default standard. HMRC’s agent online self-serve didn’t make it on time – it’s currently in beta testing behind the scenes.
GOV.UK Verify is another plank of the government’s digital strategy. It’s a potential game changer for streamlining access to online services, but it may not prove fit for purpose. Perhaps more importantly, it may not survive once the public understand its implications.
What is GOV.UK Verify?
GOV.UK Verify aims to replace the Government Gateway on a timescale yet to be determined. Once fully implemented, it would supplant the existing requirements for a user to register with both the gateway and the multiplicity of online services they want to access. Instead, it would provide them with a unique login credential acceptable (eventually) to all online services offered by GOV.UK.
The new facility can already be used on certain services. Each time a participating user accesses one of the services in question, their identity is verified independently by one of several private sector companies certified by the government for this purpose.
A user of government online services may choose which certified company (or companies) they wish to use. They then register online with their chosen company, providing enough personal data to verify their identity. Subsequently, each time they use one of the government services in question, their chosen provider confirms their identity, giving them access to the service. The facility is free of charge to the user.
There are currently four companies certified by the government to provide the service – Digidentity, Experian, Post Office and Verizon.
The government has an even wider agenda. It hopes that, once GOV.UK Verify is well established, private sector organisations will adopt it to control access to their own online services. This will make wider use of the facility, and doubtless create new revenue streams for the government.
Who provides GOV.UK Verify?
There are currently four companies certified by the government to provide the service – Digidentity, Experian, Post Office and Verizon. Five more will be added soon – Barclays, Paypal, GB group, Morpho and Royal Mail. A user can choose to have their identity verified by any of the certified providers.
Experian is a global information services group whose expertise as a leading credit rating agency suggests wide experience of handling sensitive personal data. The Post Office is a government-owned UK-wide network of branches offering a range of postal, government and financial services. Digidentity is a Netherlands company focusing on identity management, and lists the Post Office among its customers. Verizon, a Delaware company based in New York City, is one of the largest providers of communications services to the US federal government.
Next week I’ll share with you my frustrating experiences of trying to register with the four current providers.
Will GOV.UK work?
In autumn 2014, Defra expected farmers in England to register with GOV.UK Verify to apply for EU Common Agricultural Policy payments. Many enraged claimants were unable to register, and payments were seriously delayed. Eventually paper forms were used instead.
There are well-founded fears that the GOV.UK Verify registration and verification process is particularly testing for those with limited IT skills, and that this will impact unfairly on vulnerable members of society. Even recent tests have shown that as many as 20% of the population are unable to establish their identity using any of the providers on the list.
Many questions have been asked about how secure personal data will be, and whether the government’s strategy of offloading the risks of failure on to private sector providers makes sense. This strategy might put some of the data at greater risk than if it were held in a central government database, while protecting politicians by limiting the scale of any particular data breach.
Much of the data required to verify an individual’s identity – such as passport, national insurance number, driving licence – is already held by government departments, so why should the system need to rely on private sector providers?
It’s time that GOV.UK Verify was exposed to wider public scrutiny. ICAS is pressing HMRC for explanations of the repercussions for businesses, including tax agents. In addition, perhaps greater public awareness and a public debate such as that which met the ID card scheme might be timely.
Article supplied by Taxing Words Ltd