IDENTITY OF INFORMANTS
86. Under the present law, when births, still-births
and deaths are registered, the information is provided, prepared
for entry by the registrar and then verified by the informants
and, at the end of the process, the register is signed. The GRO
states "The signature may be evidence that the person is
who they claim to be but no corroborative evidence is sought by
the registrar."[45]
Our understanding of this statement is that beyond the need to
establish a minimal match between the information given by an
informant and the information that is already held by the registrar
(such as birth notification details or information supplied by
medical authorities or the coroner in relation to a death) there
is no current test to establish the true identity of informants.
87. Our concern is that the establishment of facilities
for remote registration might make it easier for persons falsely
to register births and deaths, or details thereof, in pursuit
of fraud. We asked the GRO how this possibility could be protected
against. In its response, the GRO stated that its proposal to
link each registration event with a notification of that even
from the NHS would provide "a more secure and robust means
of ensuring that duplicate or fictitious entries are not made."[46]
It acknowledged however that the issue of identity will be particularly
important for birth registrations where the parents are not married,
as in that case both parents need to acknowledge the paternity
of the person who is the father of the child. Remote registration
would therefore increase the risk of a man being recorded as the
father of a child without his consent (for instance by the mother
logging on twice and falsely identifying herself as the man concerned).
88. In the light of this potential risk, the GRO
proposed that remote registration would not be introduced until
the Government Authentication Framework was fully developed, this
being the mechanism by which the identity of those persons accessing
remote services would have their identity verified. Furthermore,
in his oral evidence to us the Financial Secretary proposed that,
given the importance of Parliament having confidence in the eventual
Authentication Framework, the Government considered it would be
appropriate for Members of the House to debate the detail of the
proposed arrangements before they are introduced.[47]
We welcome the Minister's suggestion and agree that Parliament
should be given the opportunity formally to consider the proposed
means of verifying the identity of informants in any remote registration
procedure.
AUTHORISED USERS
89. Under Article 35 of the proposed Order, the Registrar
General would have a duty to make entries in the Register available
for inspection, to the extent that any person viewing information
is either entitled to see it or has been granted permission to
see it by a qualified person. The GRO expects that the establishment
of electronic registration will facilitate the exchange of data
and the more effective processing of data by government departments
and agencies.[48] It
also expects that non-government bodies such as financial institutions
and insurance companies will wish to have direct electronic access
to registration information. Those bodies who would have direct
electronic access are referred to as 'Authorised Users' and it
would be technologically possible to provide each such users with
levels of access which matched his level of entitlement to information,
although no details are given about the likely practical arrangements.
It notes that the Data Protection Act 1998 applies to the sharing
of information about individuals between government bodies and
that this Act provides a measure of protection for individuals.
In its statement the GRO provided a description of some features
of the suggested framework for the use of registration data once
the electronic registration system has been established. In some
instances, the exchange of data is permissive and requires the
consent of the data subject - the example is given of passport
applications, where the United Kingdom Passport Service would
need to obtain consent to access restricted data in the register.
In other instances, existing provisions for the release of data
provide for the release of data to Government departments and
these would not be affected by the proposal.
90. We asked the GRO what criteria it expected would
be applied in determining the suitability of applicants for Authorised
User status. In response, we were informed that the primary considerations
would be the privacy of individuals and the security of registration
information and the registration system.[49]
It was expected that applicants would need to show the following:
i. Demonstrable need to access the restricted
information in order to process applications/services that are
of benefit to the public;
ii. Access is required on a frequent, on-going
basis;
iii. Clear, robust and auditable processes are
in place for obtaining consent;
iv. Secure IT systems are in place.
91. The GRO also said that Authorised Users would
need to sign a contract or service level agreement, and that such
an agreement would be likely to include:
i. A confidentiality statement;
ii. An agreement to abide by the legislative
requirements
iii. An agreement to keep a list of operators
and to ensure their adherence to the terms of the contract;
iv. An undertaking to allow inspections/audits
aimed at ensuring compliance with the legislation and/or service
level agreement;
v. A statement agreeing to ensure the security
of any technical facilities allowing them access to the restricted
data.
92. We note both these suggested criteria for
the designation of Authorised Users and the proposed service level
agreements and agree that these could lead to an enhanced service.
We consider such requirements should feature in any future arrangements
for the granting of direct electronic access by Authorised Users.
Nevertheless, we note the provision for designating Authorised
Users under Article 35 is another instance where the Registrar
General is to be given a discretionary power.
10 HL Deb, 23 January 2001, col 298 Back
11
HC (2001-02) 389, para 16. Back
12
Q85 Back
13
Appendix H, Q94 Back
14
Explanatory statement, paragraph 20.7.12 Back
15
Explanatory statement, paragraph 20.1.2 Back
16
Explanatory statement, paragraph 20.8.22 Back
17
Explanatory statement, paragraph 20.8.35 Back
18
Qq1-67 Back
19
Q1 and Q69 Back
20
Q87 Back
21
Q86 and Q90 Back
22
Explanatory statement, paragraph 21.7.15 Back
23
Appendix F, Q60 Back
24
Appendix F, Q20 Back
25
Q89 Back
26
Treasury Sub-Committee General Register Office, 22 October 2003,
HC 1214-i, Q12-14 Back
27
Appendix F, Q8 and Appendix H, Q100 Back
28
See Office of Government Commerce's website. Back
29
Q106 Back
30
See paragraphs 95 to 96 below Back
31
Q100 Back
32
In our question to the GRO, we gave an example relating to section
3 A (1) to (4) of the Births and Deaths Registration Act 1953
(which imposes duties on the Registrar General regarding the registration
of births of abandoned children).We acknowledge that the example
mentioned in our question does not bear on this point as the burdens
it imposes would not be removed by the proposal but only amended
in an incidental way. Back
33
House of Lords, Third Report of the Delegated Powers and Regulatory
Reform Committee, Session 2004-05, Proposal for the draft Regulatory
Reform (Registration of Births and Deaths) (England and Wales)
Order 2004, HL Paper 14 Back
34
Appendix E Q68 Back
35
House of Lords, Third Report of the Delegated Powers and Regulatory
Reform Committee, Session 2004-05, Proposal for the draft Regulatory
Reform (Registration of Births and Deaths) (England and Wales)
Order 2004, HL Paper 14 Back
36
Appendix F, Q6 Back
37
Appendix F, Q7 Back
38
The GRO's description of how necessary protections would be maintained
is given at Chapter 10 of the explanatory statement. Back
39
See section 28 of the Births and Deaths Registration Act 1953 Back
40
Appendix F, Q60 Back
41
Appendix H, Q104 Back
42
For example, see Appendix G, Q100b Back
43
Appendix F, Q20 Back
44
Appendix J, Q110 Back
45
Explanatory statement, paragraph 10.1.2. Back
46
Appendix F, Q8 Back
47
Q96 Back
48
Explanatory statement, paragraph 6.10.1 Back
49
Appendix F, Q9 Back