This post is about how we’re going to approach the issue of sub-contractors in our next procurement. It gives an update on our approach based on feedback we received at our market briefing event in October. Full details will be published with our OJEU Contract Notice.
A diverse group of certified companies
GOV.UK Verify gives people a choice of certified companies rather than having one supplier or the government doing the verification work itself.
This approach gives people more choice and control over their personal data than if we were using a single supplier or if government were doing all the verification work.
We expect this approach to make GOV.UK Verify better for users (because it provides a range of options for them) and more resilient. We are expecting that it will also result in more investment, competition and innovation in the new and growing market for identity assurance services.
Given that the market for identity assurance services is still quite new, we need to make sure we encourage diversity and competition among the certified companies that are part of GOV.UK Verify. We want to establish a range of companies that provide identity proofing and verification services as part of GOV.UK Verify. We don’t want all the certified companies to rely on a much smaller number of sub-contractors to carry out the work involved in verifying people’s identity.
Restriction on the number of ‘material subcontractors’
For the next round of procurement, a single organisation will only be allowed to be a ‘material sub-contractor’ for a maximum of three certified companies. A ‘material sub-contractor’ is an organisation that assesses and analyses evidence and data to meet one or more of the 5 elements of the Identity Proofing and Verification process.
Other sub-contractors and suppliers
There will be separate rules for sub-contractors or data and attribute providers that are not carrying out the analysis and assessment of data that’s involved in identity proofing and verification work. These might include, for example, companies that provide data for certified companies to use as part of their identity proofing and verification work, or technology or other support services.
For these kinds of suppliers, normal contractual controls will apply: certified companies will have to notify the Cabinet Office and the Cabinet Office will have a right to object to a proposed subcontractor. We’re not specifically restricting the numbers of these other types of sub-contractors or suppliers.
This post is not a formal part of the procurement documentation; it’s a summary of the thinking behind one aspect of our approach to the procurement. Full details will be provided as part of the OJEU Contract Notice and there will be opportunity to ask questions for clarification.
18 comments
Comment by Mr E posted on
Ok so the Government department allows the user to verify who they say they are. How does the user know that they have connected to the correct web site ? Are there any guidelines that a user can follow to check they have reached the intended web site ?
Comment by Rebecca Hales posted on
Hi Mr E, that's a really good question.
We take the security and privacy of our users very seriously. GOV.UK Verify was designed in close conjunction with CESG (The National Technical Authority for Information Assurance) and the Privacy and Consumer Advisory Group. The whole process, starting from the government department the user wishes to transact with, through choosing a certified company to verify with and then being passed back to the government department is conducted over a secure channel, as identified by the green lock you will see in your browser. We've blogged in more detail about how we keep Verify secure here: https://identityassurance.blog.gov.uk/2016/02/24/how-we-keep-gov-uk-verify-secure/
We do know that misleading websites can be a problem. This page has some information that will help you check you're in the right place: https://gds.blog.gov.uk/startatgovuk/
Comment by Jaya posted on
We've created a civil society register for modern slavery statements, and would like to use UK Verify to verify the identity of company officers uploading statements. How do we go about this - who do we contact?
Thanks
Jaya
Comment by Rebecca Hales posted on
Hi Jaya
Thanks for your interest in GOV.UK Verify.
GOV.UK Verify is the new way to prove who you are online in order to safely government services like filing your tax or checking the information on your driving licence. At this stage we're prioritising building a scaling a service that works for users of central government services so, no, you wouldn't be able to use GOV.UK Verify for your organisation.
We are looking at the practicalities of private sector re-use via the Open Identity Exchange. If, as a company, you'd like to find out more about this discovery work, or get involved, you can visit http://oixuk.org/
Comment by Mrs GV posted on
I have tried to verify my identity with each of the three suggested companies based on my available documents. All of them refused to accept my national passport, national ID car, both from an EU country.
If I try to log in directly in HMRC, I am obliged to provide a UK passport, which obviously I do not have. As a result, I cannot log in to my HMRC account now, despite the fact that I already have a HMRC account I used to submit my Self Assessment.
Completely unpractical and discriminatory for non-UK nationals and against EU laws. http://ec.europa.eu/justice/discrimination/rights/index_en.htm
Comment by Rebecca Hales posted on
I'm sorry that you experienced issues using the service.
GOV.UK Verify is being constantly improved and developed based on user feedback.
There will continue to be other ways for people to access services if we’re not able to verify their identity through GOV.UK Verify. If you haven't already, then please do return to the service you wanted to use and follow the guidance on the other ways that exist for you to access the service.
Overseas residents with non-UK addresses can sign up and enrol for HMRC Online services. When you enrol you'll have to enter specific HMRC reference information that identifies you or your organisation. You won't have to enter a UK postcode, unless you are registering (signing up) as a Corporation Tax agent or a PAYE employer.
Once you've enrolled to use the online service you will have to wait for a confirmation letter containing an Activation Code before you can use the service. This can take up to 21 days to reach you.
Please copy and paste the below link into your browser to start the registration process
https://online.hmrc.gov.uk/registration
Thank you for taking the time to contact us, we value all feedback. Although GOV.UK Verify has not worked for you, your feedback will be used to improve the process.
Comment by Mrs GV posted on
Please, read again what I wrote. Maybe I should have been more specific. I spent several minutes to explain my problem for nothing. This is very frustrating. I LIVE in the UK. I am not British. I already have an HMRC online account. The problem is that the system does not allow me to log in without passing the GOV VERIFY thing which is unable to verify my identity. I have used several of your certified companies and the answer is always the same: they cannot verify my ID as my documents are foreign. I am trapped in a circle and nobody can help me now.
Comment by Rebecca Hales posted on
Apologies for the misunderstanding and, once again, I'm sorry that you've had difficulties.
We’re not able to verify everyone yet using GOV.UK Verify but we’re working to constantly expand and improve the service. Verifying someone's identity without talking to them or sending things in the post is a complex process and it will take us some time to make it work for everyone.
If you have a bank account and credit card, you can now verify your identity without either a UK passport or driving licence. If you return to the service, go back through the GOV.UK Verify path and select 'no' when asked if you have a driving licence or passport, you should be able to chose a certified company that may be able to verify you.
If this does not work, please be assured that we are working with our certified companies to improve GOV.UK Verify and they are investigating other sources of data and methods to ensure that the service works better for more people, first time.
As I explained, there are always other ways to access services so if GOV.UK Verify doesn't work for you, please return to the service you were trying to access and use one of the other available ways to access it. You may also wish to contact HMRC direct https://www.gov.uk/contact-hmrc
Comment by Rebecca posted on
Why am I being asked to give away all of my private information in order to avoid identity theft?
Comment by Rebecca Hales posted on
Hi Rebecca
Thanks for your question. We take the security and privacy of our users very seriously. GOV.UK Verify was designed in close conjunction with CESG (The National Technical Authority for Information Assurance) and the Privacy and Consumer Advisory Group. The whole process, starting from the government department the user wishes to transact with, through choosing a certified company to verify with and then being passed back to the government department is conducted over a secure channel, as identified by the green lock you will see in your browser.
Certified companies have to work to published government standards when they verify your identity. To do this, they have to look at a range of evidence and checks to establish that you are who you say you are – no single piece of evidence is sufficient. There are five elements involved, and the company has to achieve specific thresholds in each one before they can verify someone’s identity.
The user asserted information of name, date of birth, address and gender is used to find the relevant credit reference file which is then used by the certified company the user has chosen, to create questions the answer to which only that user is likely to know. The user is generally not providing private information, rather they are confirming the information the certified company has is or is not correct.
The only time a user is asked to provide information is if they have chosen to use a certified company that allows them to prove who they are by providing their credit or debit card details to authorise a non-value transaction from their account via a secure payments service.
Comment by Stephen posted on
Hi,
Do you offer an api (software nterface) to UK companies who may want to use the gov verify service as their e-signature engine? ie, a firm of solicitors wants to add a .gov verify signature to a word document as proof of a client agreeing to it.
?
thanks
Comment by Emily Ch'ng posted on
Hi Stephen, no we don't.
We do, however, work with the private sector to look at the potential re-use of secure identity assurance, such as that provided by GOV.UK Verify, outside of government. You can find out more about that work - and projects to get involved with - on the Open Identity Exchange website oixuk.org.
Comment by Sylvia posted on
Both my husband and I registered to fill in Tax form online. Neither of us have passports so cannot now log in. Also I gave up and tried to print the form to send in a hard copy but could not print all the pages. We are UK pensioners.
Comment by Emily Ch'ng posted on
Hi Sylvia,
I am sorry to hear about your difficulties and were unable to print all of the pages of the form. If you go back to the service you were trying to use, you'd might like to try accessing it by logging in through GOV.UK Verify.
GOV.UK Verify is the new way to prove who you are online so you can access digital services securely and safely and at your convenience and without having to use postal or face-to-face services. You also do not need to have a passport to use the service, so it may be an alternative option for you.
Comment by Zara posted on
Hi,
I have been asked to verify my UK citizenship using UKtenantdata.com. They are not on your list of certified companies and I am concerned at whether this company can legally verify my identity, using just a scan of my UK passport. Can companies other than those which are "certified" still verify documents?
Thanks
Comment by Emily Ch'ng posted on
Hi Zara
Thanks for your query. Before I decide how best to help you on this, can I please confirm you were using GOV.UK Verify? https://www.gov.uk/government/publications/introducing-govuk-verify/introducing-govuk-verify
Comment by MKR posted on
Hi. We are rolling out a big digital transformation programme for a city council, and want to know if we're able to use Gov.uk Verify for identity assurance? Which common government components are available for building councils' user-centered services? If not, are there are plans to do so? Thanks.
Comment by Jyoti Basuita posted on
Hi
Many thanks for your query and apologies for the delay in response.
We do have plans for making common government components available to councils. Currently, we’re collaborating with local authorities to pilot 2 services using GOV.UK Verify for identity assurance: older people's concessionary travel and residential parking permits. These pilots will allow us to understand how GOV.UK Verify can meet local authority user needs and to agree the operating models across government.
You can find more information on the blog: https://identityassurance.blog.gov.uk/?s=local+authorities. We want to enable any local authority to transform their services for the better using GOV.UK Verify. So, if you'd like to chat about this with me in more detail, please feel free to email verifylocal@digital-cabinet.office.gov.uk.