House of Commons - Home Affairs

Select Committee on Home Affairs Written Evidence

Annex

TIMELINE OF THE DECISION TO USE THE NIR AS A POPULATION REGISTER

Trust and surveillance

In this Annex, I show when decisions were taken to use the National Identity Register (NIR) of the ID Card as a population register. Since a population register is a form of surveillance, consideration of the issues surrounding a population register illuminates the issues of "trust" and "consent" which are central to the debate about a surveillance state.

The essential idea behind a population register is that all public authorities should be able to exchange (ie update and download) basic personal details via a central repository. By doing so, the system creates connections between diverse databases involved in such exchanges. There are obvious efficiency savings to be made when such data sharing is undertaken (eg the population register negates the need for a national census). However the risks are also apparent if the population register is associated with an audit trail which possesses an ability to enhance the link between public sector sources of information associated with each citizen (eg tax, social security, health, police, education)[41] and which is intended to extend to private sector information (eg opening a bank account, hire of a car).

The decision to widen the use of the NIR to include a population register fundamentally changes surveillance role. No longer is the purpose of the NIR limited to law enforcement and security where a reason to interfere with private and family life can be justified in terms of security, crime or immigration. Because of section 1(4) of the ID Card Act 2006 refers to "the purpose of securing the efficient and effective provision of public services", the efficiency of rubbish or council tax collection could become a legitimate reason for interference.

The security implications are also different—basic details from the NIR are potentially accessible to hundreds of thousands of public servants in any public authority. The civil penalty of not to keep the address details on the NIR could be viewed as a civil penalty not to update any public authority record (eg such authorities could report those who fail to update address records on the NIR). Who should run such a system also becomes an issue for legitimate debate—should it be the Home Office with its emphasis on security and crime, or the Office of National Statistics (ONS) which has a public administration ethos and is trusted by the public with respect to the Census? It is important to note that all these questions (and others) raise valid subjects of concern which could have (and should have) been debated when the ID Card Bill was before Parliament and that the ONS had identified about 30 issues of this nature.[42]

The basis of this analysis in this Annex has been published in Data Protection and Privacy Practice(July 2006), but it has been updated and fully cross referenced for the Committee. That updating has unearthed further information which has not been published.

2002 and 2004—The public consultations deny wide use of ID Card database

The Consultation Document launched by David Blunkett in April 2002 posed an interesting question: "As an entitlement card would need to be underpinned by a database of all UK residents, an issue for consideration is whether this database should be a national population register... or a new self standing database".[43]

The answer came in the subsequent document Legislation on Identity Cards (CM 6178) published in April 2004. Under a Chapter entitled Wider issues not included in the draft legislation (my emphasis), it stated that "The National Identity Register and a population register are separate but complementary proposals and they serve different purposes" but the Government was "open to the possibility of including provisions relating to the creation and operation of a separate population register within the identity cards legislation" (Paragraph 3.21).

Paragraph 3.20 of CM 6178 also promised that further legislation would be needed to establish a population register; it stated that further work would be undertaken and, that further developments "will also include public consultation to explore the issues around public acceptability of the proposal" so that any new "legislation would also introduce concrete safeguards for the public".

In summary, the public was informed that the NIR was to support security matters—there were overlaps with a population register but they were separate databases requiring separate legislation, and that access to the NIR by law enforcement agencies would be strictly limited.[44] In relation to a population register, a further public consultation was promised "to explore the issues around public acceptability of the proposal".[45]

April 2003—Legal advice and the CIP

Between the two public consultations, and prior to commencement of the Citizen Information Project (CIP), legal advice was taken ("Final Report, Annex 8: Legal issues").[46] This advice stated that if the population register contained limited contact details and if data sharing of these details were to be legitimised by legislation, then such legislation was unlikely to breach Article 8 of the Human Rights Act. The advice judged that any "interference by a public authority" in terms of Article 8(2) would very likely fall within a state's "margin of appreciation". This conclusion effectively told Government that it could lawfully draft data sharing powers, which permitted basic contact details about individuals to be shared across the public sector, without consent of the citizen. The data protection elements related to the First and Second Principles would also be resolved, as these cover essentially the same ground as Article 8.

The general benefits of the CIP database were listed in this legal advice. These were described as: "ensuring that public bodies have accurate information about citizens"; "financial savings to the public purse"; "a reduction of the potential for fraud"; "speedier location of citizen records"; "reduced occasions when one citizen is confused with another"; "reduced occasions when communications between the state and citizen are sent to out-of-date addresses"; "simplified arrangements for citizens to notify changes of name and address"; and "improved targeting of public services and formulation of government policy".

The data items listed in the advice were: "names including name history"; "addresses including multiple addresses and address history"; "sex"; "place of birth"; "date of birth" and "unique identifier number". The advice did not consider that the NIR would become the database for the CIP.

This legal advice was obtained before the first meeting of CIP in February 2004 (CIP meetings involved staff from many Government Departments and senior personnel from the ID Card project were always in attendance). The advice contained sufficient detail to stimulate a public debate on the CIP if the Government wanted such a debate.

April 2004—Draft ID Card Bill published

Clause 1 of the draft ID Card Bill[47] identified one expansive statutory purpose which enabled information recorded in the National Identity Register (NIR) "to be disclosed to persons in cases authorised by or under this Act". Clause 23 of that draft Bill identified a power which allowed the Secretary to State to authorise disclosures from the NIR, without consent, for prescribed purposes which were unconnected with terrorism, national security, crime, taxation, and immigration.

It is clear that these two provisions were drafted in a sufficiently broad way to provide the legal framework for the use and disclosure of NIR data for the public administration purposes which was consistent with the CIP's legal advice obtained in April 2003. So if the intention was for the NIR, established by ID Card legislation, to assume CIP functionality, the Government was clearly in a position to inform the public and Parliament of this step. For example, during the first half of 2004, the Home Affairs Select Committee of the House of Commons was studying the Government's ID Card proposal in detail.

It can be argued that at the text of the draft Bill studied by the Committee reflected the fact that the CIP and NIR were seen as separate. In the draft Bill, the general public sector purposes were "to ensure free public services are only used by those entitled to them" and "to enable easier and more convenient access to public service". These purposes are more limited than the broadly defined "the efficient and effective delivery of public services" purpose found in Section 1(4)(e) of the Identity Cards Act 2006.

March-June 2004—CIP is separate from NIR

There is further evidence which suggests the two schemes were originally seen as separate. For example, the CIP Project Definition[48] prepared for CIP meetings in Spring 2004 identified around thirty policy issues to resolve. These included "Who should run the live register?" and "establishing trust in the organisation running the population register". Another document prepared for the CIP Project Board stated that a stand-alone Population Register Bill was the preferred option.[49]

Other evidence also supports the view that the CIP and NIR were seen as separate:

29 March 2004

20 May 2004:

18 June 2004:

June 2004.

Using the NIR as a population register was always a possibility—March 2004

A document made available to CIP personnel in March 2004[53] made it clear that "The Home Office has indicated that they are not averse to including CIP clauses" in an ID Card Bill because it had "already a slot in the legislative timetable". However, there were risks of "the Population Register being closely identified with the ID Card scheme" and that separate legislation would make it easier "to prohibit police or security access to the Register". Separate legislation would also "limit scope-creep" and would "set the Population Register clearly apart from ID Cards and allow it to be seen as a benign tool for improving public service". However, the "Home Office might consider that (separate) CIP legislation, if contentious, put the ID Cards scheme at risk".

It concluded the decision to use the NIR for a population register "may become the preferred option if the Minister makes a decision about CIP in time for CIP powers to be included in the ID Cards Bill".

10 and 16 September 2004—CIP's population register should be part of NIR

By the end of the summer these dilemmas had been resolved in favour of using the NIR as a population register for general public administration purposes. A letter dated 10 September 2004[54] was sent from the CIP project board to the Chief Secretary of the Treasury which stated that the merging of CIP into the NIR would "strengthen the VFM case for ID Cards". It therefore recommended that "the Home Secretary[55] be asked to include improving the efficiency and effectiveness of public services as a purpose of the Identity Card" and that "the NIR should become the national adult population register long term (but only if ID Cards become compulsory)".

The letter also explained that the broad concept of a CIP had gained acceptance with the focus groups but when the detail of the CIP project were explored by these groups "concerns are raised that whether the potential benefits could justify the cost and that this would lead to linkage of sensitive personal information across government".

The CIP minutes of 16 September 2004 supported the integration of the NIR and the CIP. These stated that the "ID Card legislation presents no impediments to the NIR sharing data with other registers to support their statutory purpose" and it was recognised that "the CIP position is now reflected within the ID Card Bill". The minutes also show that the Home Secretary would know of the change: it stated "Home Secretary to write to cabinet colleagues in early October to clear some changes to the IDC Bill. This will include greater clarity on the statutory purposes of the scheme, including the purpose of supporting greater public sector efficiency".

24 September 2004—Privacy Impact Assessment completed

A preliminary Privacy Impact Assessment (PIA) for the CIP was finalised in September 2004 (published in "Final Report, Annex 8: Legal issues")[56] and succinctly identified the benefits of the CIP project as they were known at this date. Because of the merger of the CIP into the NIR, these benefits also applied to the ID Card scheme. The Assessment split the benefits of the CIP into three groups:

Benefits to the individual

Benefits to the tax payer and society

Benefits to government:

Given the Committee's interest in the concept of a Privacy Impact Assessment, it is noted that the senior civil servant from the ID Card project is recorded in the minutes[57] as expressing interest in the PIA for the CIP's population register.

End of September 2004—a status summary

By the end of September, in relation to the use of the NIR for "the purpose of securing the efficient and effective delivery of public services", the evidence suggested:

— the CIP and NIR were intended to be fully integrated and CIP functionality was to be implemented by the powers Ministers were seeking under the ID Card Bill which was before Parliament;

— that consent of the individual would not be needed to permit data sharing to achieve CIP benefits (legal advice; April 2003);

— both public consultations on the ID Card had reassured the public that there would not be general access to NIR and that there would be another round of consultation about a population register;

— the purposes associated with the CIP which were to be integrated into the NIR were well defined and detailed; and

the ID Card had to be compulsory and Ministers knew this

any

October 2004—Government replied to the Home Affairs Committee ID Card Report

However, in its official response, MPs on the Home Affairs Committee were told that the Government) was "no longer actively exploring plans to develop a separate population register but rather will be exploring options to improve the quality and effectiveness of existing registers".[59] As the NIR is not an existing register, this statement cannot refer the NIR which had not yet been created.

The Government also told the Committee in its official response that it believed that "the NIR has the longer term potential to fulfil some of the functions envisaged for the national population register". This statement with its reference to "potential" is difficult to reconcile with the definite position as recorded in the minutes taken a month earlier (16 September 2004) which stated that "ID Card legislation presents no impediments to the NIR sharing data with other registers to support their statutory purpose" and that "the CIP position is now reflected within the ID Card Bill".

The Government's reply did not go into detail as to the nature of these "longer term" functions, even though these were set out in the legal advice of April 2003 and in the Privacy Impact Assessment of September 2004. Nor did the Government reveal that the legal advice stated that consent of ID card-holders was not needed to permit sharing of contact details to achieve CIP functionality. Also absent in the Government's reply was any explanation that powers in the proposed ID Card legislation were broad enough to legitimise data sharing of a general administration purpose.

It is interesting to note that Recommendation 38 of the Committee's Report had stated that "The Government must be clear and open about the issues involved and enable informed parliamentary and public scrutiny of any decisions". The Government's response to this recommendation was unequivocal: "The Government agrees this is an important issue".

28 October 2004 (Col 53WS—First written statement about the CIP)

The Government informed Parliament of a "feasibility study" which found that a "UK population register has the potential to generate efficiency benefits" and that "if ID Cards were to become compulsory, it may be more cost effective to deliver these benefits (efficiency savings) through the NIR". The statement also does not reflect the status of the project as described in September 2004 (eg "the CIP position is now reflected within the ID Card Bill") and is very low key. Its use of words such as "feasibility", "potential", "if" and "may" makes the statement less definite than the decisions which had been taken.

There was a promise of a further statement after June 2005 when a "second stage of project definition" was completed. This also reinforces the idea that matters have not yet been determined.

29 November 2004—Regulatory Impact Assessment published

Home Office Minister, Des Browne MP, signed a Regulatory Impact Assessment (RIA) which was produced to provide Parliament with details which related to the impact of the ID Card Bill. The section of the RIA dealing with "more efficient and effective delivery of public services"[60] described the use of the ID Card to achieve savings. It did not refer to the fact that far more efficiency savings were to be realised by sharing the personal data in the NIR. The RIA did not reflect the CIP minutes of 16 September 2004 which noted that "the CIP position is now reflected within the ID Card Bill". The RIA did not even illustrate the range of benefits to individuals, government and society which were specified in the Privacy Impact Assessment (dated September 2004).

Similarly, paragraph 26 of the RIA (dealing with longer term benefits) did not mention the use of the NIR for public administration as described in earlier CIP minutes. It tentatively suggested that the National Identity Registration Number "should the card scheme become compulsory" could "provide the means to make more fundamental improvements in the delivery of Government services" but that this step was "not part of the immediate business justification of the scheme". In addition, "the ID Cards scheme could provide a basis for people to notify changes of personal details such as address, only once", but this is "not currently costed as part of the functions of the Identity Cards scheme". (Note: as this function was specifically outlined as part of the CIP in the legal advice of April 2003, it is difficult to imagine that some cost estimates did not exist).

March—April 2005 CIP benefits form fifth of ID Card business case

The CIP minutes of 18 March 2005 identified "substantial CIP related benefits (address sharing benefits) within HO ID Cards outline business case, amounting to around one fifth of the total". Progress had been such that there was to be a "phased reduction of the CIP team". The Home Office representative stated that she "was able to re-assure the board that there were no anticipated issues with the Identity Cards Bill or the efficiency and effectiveness clause that is relevant to CIP".

In addition, the CIP role was being augmented by the e-government agenda. The representative from the Treasury stated "Working with the Identity Cards programme to establish how Identity Cards could be used to help meet e-government needs" for example "Scoping the issues of e-authentication with service owners and Chief Executives" and "Development of a strategic approach to identity in government including a review of business processes and provision of a risk management framework for e-service delivery in a business sense". The Crosby Review (expected in the summer) could further widen the use of the NIR.

The decision to have wider use of the NIR was in time to have been captured by Labour's manifesto for the 2005 General Election—especially as 20% of the ID Card's business case was being justified on CIP's functionality. Labour's Manifesto itself stated that ID Cards would be established to assist the authorities in purposes connected with crime, terrorism, illegal employment and immigration. There was no mention of the public administration purpose or data sharing of contact details based on the NIR, or that registration on the NIR had to be compulsory (with the implication that the ID Card had to be compulsory) to achieve 20% of the benefits of the ID Card scheme.

The CIP minutes of 15 April 2005 stated that "up to 30 tactical data sharing opportunities (for the NIR) have been identified". These 30 data sharing opportunities have not yet been made public (unlike the 17 benefits which were identified in September 2004 but only made public in April 2006).

25 May 2005—Updated Regulatory Impact Assessment published

After the General Election, on May 25, the ID Card Bill was re-introduced into Parliament; the Bill specified the "the purpose of securing the efficient and effective provision of public services" and provided wide ranging disclosure powers (in line with the legal advice of April 2003). Home Office Minister (Tony McNulty MP) signed an "updated version" of the Bill's Regulatory Impact Assessment (RIA) to inform subsequent Parliamentary debate on the Bill.

The section on "more efficient and effective delivery of public services" was almost identical with the RIA published 29 November 2004. Although the RIA was promoted as "an updated version" it still did not reflect the use of the NIR to achieve the functionality described in the CIP minutes and background papers (eg minutes of 24 September 2004) and the "30 tactical data sharing opportunities" which had been identified in April 2005 were not mentioned in the RIA. It is also curious that an RIA, which contains many figures which relate to the ID Card, did not state that 20% of the ID Card's business case depended on the merger of CIP into the NIR, or that compulsory entry of contact personal data into the NIR would be needed to implement CIP functionality.

24 June 2005—Final meeting of the CIP project—evidence from the minutes

The final CIP minutes of 24 June 2005 showed that contact details from the NIR would be widely shared (upload and download) and that the Home Office had assumed responsibility for implementing CIP functionality. The minutes stated that the Home Office would have:

— "the responsibility for delivering an adult population register that enables basic contact data held on NIR to be downloaded to other public sector stakeholders" (The "Treasury and Cabinet Office should ensure that NIR delivers CIP functionality as planned");

— "the responsibility for ensuring from around 2021 basic contact data held by stakeholders can be up-loaded to the NIR"; and

— to "design the take-up profile of the NIR to be such that population statistics can be realised for the 2021 census".

The CIP's final report which was prepared at this time (but not published until the ID Card Act 2006 had received Royal Assent) stated that secondary legislation (which is in the ID Card Bill) will allow "public services to be provided with NIR data without the need to obtain specific citizen consent"(page 17). The CIP final report also provided examples of how NIR data could be used (which presumably are a sub-set of the "30 tactical data sharing opportunities" identified on 15 April 2005).

These opportunities were:

— "DWP targeting the 300,000 eligible citizens not currently claiming pensions";

— Taxation authorities "contacting employees required to complete self assessment";

— Managing passport application peaks by getting customers to apply early;

— "DfES tracing children at risk via their guardians' addresses";

— "Local councils collecting debt from citizens who have moved to another authority";

— "NHS targeting specific citizen groups for screening campaigns"; and

— "reducing the overall administrative burden on bereaved people".

As the ID Card Bill was commencing its Committee stage in Parliament, there was no barrier to allowing debate to include the new responsibilities of the Home Office as described above.

On 13 June 2005, the Parliamentary Research Department of the House of Commons Library published its 58 page research document into the ID Card Bill. These research documents were produced to inform MPs impartially about the issues—as with the RIA, this research document into ID Cards did not contain details of the decision to merge the CIP into NIR functionality as described above.

30 June 2005—CIP staff wants Parliament to be informed

A draft list of recommendations were prepared by civil servants for the CIP Project Board ("Submission to Ministers—draft")[61] to consider to send to ministers; the list showed that CIP officials were very aware of the privacy and constitutional issues.

Paragraph 2 of the draft recommendations began: "Urgent—Home Office believe there would be advantages in making an announcement before Parliament rises on 21 July so that the Government's intention to use the ID Cards register in this way is confirmed while the ID Cards Bill is still being debated". The reason for this is explained in paragraph 17: "Home Office believe there would be advantages in making an announcement before Parliament rises on 21 July" as "that would confirm the Government's intention to use the ID Cards register in this way while the ID Cards Bill is still being debated and so avoid subsequent criticism, say from the Information Commissioner, that the ID Cards register is subject to `function creep'".

13 July 2005—Ministers left to decide about informing Parliament

The Project Board sent different recommendations to Ministers ("Submissions to Ministers") and the explicit 30 June text mentioned above was dropped in favour of a simple statement: "it is in the public domain that CIP is due to report to Ministers this summer but no date has been given for a Ministerial response". However, a draft letter prepared for Chief Secretary of the Treasury to distribute to Cabinet colleagues sought responses by 7 September 2005 as "I intend to make an announcement after Parliament returns" (in October 2005).

A draft "Written Ministerial Statement" to Parliament was included as Annex B of this package. This contained sufficient detail to stimulate an informed debate about the merger of the CIP with the NIR if the statement was issued. In the event, no statement was made to Parliament in October 2005; however the draft Statement delivered in Annex B is not significantly different from the Statement which eventually appeared in 18 April 2006 after the ID Card Bill had become law.

The Chief Secretary of the Treasury at this time was Des Browne MP who had also signed the Regulatory Impact Assessment on 29 November 2004, which related to an earlier version of the ID Card Bill. It is not known whether his detailed knowledge of the ID Card scheme played an influential part in the decision not to inform Parliament.

19 July 2005—ID Card Bill Committee stage (Commons)

In Committee, the Home Office Minister avoided reference to the fact that powers in the Bill were needed to ensure integration of CIP's wide data sharing functionality into the NIR (eg as identified by 24 September 2004). Instead, explanations were provided in narrow terms; for example "In fraud investigations it would be sensible, from its point of view, for it (a local authority benefits inspectorate) to have access to the register" or that "The fire and ambulance services could also be beneficiaries of access when verifying identity against the register following a major accident",[62]

20 Jul 2005—Response to written question, column 1783W

The following written question illuminates what was to be the "denial line" adopted by Government with respect to the use of the NIR for public administration purposes (until the ID Cards Act received Royal Assent in March 2006).

Harry Cohen

Andy Burnham

5 and 18 October 2005—(Third Reading debate)

There were two further Parliamentary opportunities for Ministers to refer to the decision to use the NIR as a basis for the CIP functionality. On 5 October,[63] MPs were told that "Direct access to information held on the National Identity Register by anyone outside those responsible for administering the scheme will not be possible, only requests for information can be made by third parties. In the vast majority of cases, verification of information on the Register will only be possible with the person's consent". During the Third Reading debate on the Bill, on 18 October, the Home Secretary[64] (Charles Clarke) reinforced this message in the House of Commons: "What the Bill allows is for information to be provided from the register either with the consent of the individual or without that consent in strictly limited circumstances in accordance with the law of the land".

It is a challenge to reconcile these two statements, and the answer to Mr Cohen's PQ, with the letter sent to the Home Secretary in September 2004 or the 24 June 2005 minutes which envisaged that, without the need for consent of the individual concerned, "basic contact data held on NIR to be downloaded to other public sector stakeholders" or for "basic contact data held by stakeholders can be up-loaded to the NIR".

24 October 2005—Joint Committee on Human Rights

The Joint Committee on Human Rights (JCHR) published a report which questioned the access to NIR data via wide ranging powers in the ID Card legislation.[65] It reported that "We consider however that there remains a risk that a number of provisions of the Bill could result in disclosure of information in a way that disproportionately interferes with private life in violation of Article 8". These comments reflect Recommendation 60 of the Home Affairs Select Committee Report into Identity Cards which stated that "It is unacceptable that basic questions about the degree of access to the NIR should be left to secondary legislation".

Both these comments were targeted at the kind of disclosures that were the subject of the legal advice dated April 2003 and were eventually published in April 2006. It is curious that although the Government saw no problem in publishing this legal advice in April 2006, the advice was not made available to inform the JCHR's scrutiny of the ID Card Bill in October 2005—some six months earlier (or indeed the Home Affairs Select Committee).

9 November 2005—The Delegated Powers and Regulatory Reform Committee

The House of Lords Delegated Powers and Regulatory Reform Committee, in its Fifth Report[66] on the Identity Cards Bill, followed other Select Committees and expressed concern at the wide ranging powers in the Bill. In their evidence to the Committee,[67] Ministers did not explain the need for these powers so that the NIR can possess CIP data sharing functionality. Instead they explained that these wide data sharing powers were needed to cope with the exceptional or obscure emergency situation:

104 ..."The more obvious recipients of information from the Register are dealt with explicitly in the preceding clauses, but it is regarded as essential to have a reserve power to use in the public interest if it should be necessary. For example, it is conceivable that the power could be used to specify public authorities that are not Government departments such as the emergency services or local authorities for specified purposes".

Note the use of the phrase "it is conceivable"—far more reaching decisions had been already been conceived months earlier (eg see 24 June 2005).

16 Jan 2006—Lords Committee Stage: no explanation of CIP functionality

Baroness Anelay of St Johns successfully moved an amendment which replaced the words "securing the efficient and effective provision of public services" with "preventing illegal or fraudulent access to public services". This amendment removed the legal basis for the integration of CIP with the NIR (eg as decided in September 2004).

In her attempt to defeat the amendment in the Lords, the Minister did not take the opportunity to expound the virtues of data sharing or explain that 20% of the business case for the ID Card depended on the merger of the CIP with NIR. Instead, the Minister explained the phrase "securing the efficient and effective provision of public services" in terms of the use of the Card whereas in practice, most of the efficiency gains of the CIP will depend on the use of the database.

"We should not limit the use of identity cards in helping to deliver better public services. It is not just a question of combating fraudulent use of public services; it is also about helping to transform those services. We believe that the public will want the introduction of identity cards to be used as a way of helping public services to deliver quicker and better services. Why should we have to keep filling in different forms with details of our name and address? If production of an identity card when seeking access to a public service can confirm our identity quickly and easily, surely we should be aiming to provide that. If producing an identity card enables address details to be confirmed, that will help both the public service and the applicant for that service".(16 January 2006: Column 478)

The amendment was overturned by the House of Commons (13 February 2006). There was no Commons debate on the matter because of a guillotine motion, used by the Government, limited debate on Lords' Amendments. This fact alone, in itself, raises important issues of Parliamentary scrutiny.

March 2006—a game of Parliamentary ping-pong

The House of Lords and Commons disagreed over the interpretation of Labour's manifesto which promised "We will introduce ID cards, including biometric data like fingerprints, backed up by a national register and rolling out initially on a voluntary basis as people renew their passports". The House of Lords said that this meant that people should be able to choose whether to obtain an ID Card with the passport; the Government said that as people volunteered to get a passport, that the ID Card could be issued to passport applicants. The result was a dispute and the ID Cards Bill ping-ponged five times between both Houses of Parliament.

Eventually, a compromise was proposed by Lord Armstrong, where individuals did not have to have an ID Card if they applied for a passport before 2010, but their details would be entered into the NIR. Accepting the amendment, the Home Secretary told Parliament: "Lord Armstrong's amendment preserves the integrity of the national identity register. It ensures that the details of all applicants for designated documents will still be entered on it. That will mean that they will be afforded the protection that that will provide from identity theft. It will also provide the wider benefits to society by ensuring that attempts by people to establish multiple identities are more easily detected".[68]

The minutes of April 2005 stated that the CIP formed one-fifth of ID Card's business case so long as entry of citizen details into the NIR is compulsory. This had been known for almost a year—however, this reason was not proffered by the Home Secretary in his explanation for accepting Lord Armstrong's amendment.

18 April 2006—Government announced NIR and CIP merger

At the end of March 2006, the ID Card Bill gained Royal Assent without the merger of the NIR and CIP projects being raised. On 18 April[69] an announcement was made to Parliament by means of a written statement which explained that the CIP project had wound up. The April statement is not significantly different from the draft sent by the CIP Board on 13 July 2005—some nine months earlier. There was a comprehensive disclosure of CIP documents on its website which explained in detail the new functionality of the NIR.

15 May 2006—Prime Minister promotes "identity management"

In an open letter, Tony Blair promoted the widespread public administration use of the NIR database. He told Home Secretary John Reid[70] "Eighth, I am keen to maximise the benefits of ID management (ie all transactions where a declaration of identity is required), including the introduction of ID cards by 2009. The full range of activity relating to identity management needs to be co-ordinated across government to maximise benefits to the citizen. I would like you to identify a Minister to focus closely on this and the agenda across Whitehall". Identity management also includes the e-government agenda.

The minutes of this project also shows that there are early links to the use of the NIR in relation to the Government's policy of Identity Management. Transformational Government and e-Gov initiatives (eg see the minutes of the CIP project around March and April 2005). The Crosby Review could add to the use of the NIR in this respect.

October 2006—national identity management confirms use of NIR on the lines of the CIP

The term "national identity management" is being used by Government to represent the wider use of the NIR (eg to include a population register as envisaged in the Citizen's Information Project (CIP)). This can be shown by reference to the government's first "Section 37 report" on the likely costs of the UK Identity Cards Scheme (published in October 2006). Page 7&8 of this report on ID Card costs (at bottom) reads:

— "Firstly, it (use of the NIR as a population register) would allow organisations to be more proactive—people could be contacted before their passport needs to be renewed; when employees need to fill out self assessment tax returns; targeting 300,000 citizens who are not claiming state pensions or those in particular age ranges who are eligible for health screening; allowing authorities to collect debt from citizens who have moved to another area; and reducing the overall administrative burden on bereaved people"

This can be compared with the list published on the first page of the Citizen Information Project's final report given to Ministers in June 2005[71] The opportunities of wider use of the NIR for CIP purposes are listed as including:

— managing passport application peaks by getting customers to apply early;

— taxation authorities "contacting employees required to complete self assessment";

— "DWP targeting the 300,000 eligible citizens not currently claiming pensions";

— "Local councils collecting debt from citizens who have moved to another authority"; and

— "reducing the overall administrative burden on bereaved people".

March 2007—NIR to be used as a population register

According to Home Office Ministers,[72] as "the National Identity Register is intended eventually to contain up-to-date identity information for all United Kingdom residents aged 16 and over. This will include name, age, address, nationality and biometric information, such as photograph and fingerprints. The National Identity Register will then be able to serve as a United Kingdom adult population register".

It is interesting to note that one of the original Government consultations[73] stated that legislation would be needed to establish a population register and that "this stage will also include public consultation to explore the issues around public acceptability of the proposal". This promised public consultation has yet to occur and this subject has, as far as I can assess, could have and should have formed part of Parliament's scrutiny of the ID Card Act 2006.

41 See Sections 1(5)(i) and 3(4) of the Identity Cards Act 2006 which shows that any reference to an entry in the NIR will leave such a footprint in the audit trail. Back

42 CIPPB(04)(02) "Citizen Information Project: project definition stage-aims and policy issues" dated February 2004 on http://www.gro.gov.uk/cip/Definition/ProjectBoardPapers/index.asp Back

43 Entitlement Cards and Identity Fraud, Cm 5557, paragraph 2.40. Back

44 For example paragraph 3.29 of CM 5557 states that "the Government would want to see a full debate on this point and seek views on what safeguards there should be. For example, whether access to the database in these circumstances should be governed by a warrant applied for on a case-by-case basis". The question posed of the public was whether law enforcement agencies should have access to the central register "in closely prescribed circumstances" such as "national security or very serious crimes". Back

45 Paragraph 3.20 of CM 6178 ("Legislation on Identity Cards"). Back

46 Annex 8 is on http://www.gro.gov.uk/cip/Definition/FinalReportAnnexes/index.asp Back

47 Published in April 2004 in CM 6178. Back

48 CIPPB(04)(02) "Citizen Information Project: project definition stage-aims and policy issues" dated February 2004 on http://www.gro.gov.uk/cip/Definition/ProjectBoardPapers/index.asp Back

49 CIPP(04)12-"Towards a Legal Strategy" on http://www.gro.gov.uk/cip/Definition/ProjectBoardPapers/index.asp Back

50 Answer to PQ 163155, 29 March 2004. Back

51 From http://www.gro.gov.uk/cip/Definition/ProjectBoardMinutes/index.asp Back

52 From http://www.gro.gov.uk/cip/Definition/ProjectBoardMinutes/index.asp (Minutes confusingly posted under the date of 21 July). Back