Co-regulated digital identification: eight tests you can check

In person, you can see who you are dealing with before you hand anything over. Online the order is reversed. The individual is identified and verified first, and often never learns which organisations did the identifying.

Identity is what a person owns. Identification is what organisations and tracking systems do to that person. Keeping the two apart is the starting point.

Two rule sets at once

Every digital interaction runs under two sets of rules: the organisation’s own rules, set in its terms and its technical design, and the public rules of treaty, law and standards. Self-regulation on its own leaves the identifier privately defined. Regulation on its own has nothing to inspect at the moment of interaction.

Co-regulated digital identification puts the public rules into records that the individual, the organisation and the regulator can all inspect. The controller, the processor, the individual and the regulator each have a defined role in one shared framework that can be audited. The individual manages their identity. The controller is accountable for identification. People give consent, and systems set permissions.

Eight tests

Release 1 of the Kantara ANCR extension to ISO/IEC TS 27560:2023 sets eight conformance criteria, each assessed by inspecting a named record.

1. Sequence. A resolvable Controller Identification Record is available before anyone is asked to identify themselves.
2. Minimum notice disclosure. The required elements can be resolved at the time of the disclosure event.
3. Anonymity by default. The receipt can be generated and verified without an account or a personal identifier.
4. Public rule reference. The Notice Record states the code of conduct, code of practice or legal instrument relied on.
5. Evidence. The Notice Event Log records issuance and each material change, and each receipt binds to a notice version whose hash matches the notice retrieved at assessment.
6. Reciprocal and proportionate disclosure. The technology and controls in use are published and bound to the notice version in effect.
7. Non-exclusion. At least one privacy access point works without the person holding, presenting or authenticating a digital identification credential.
8. Authorisation state. Where authorisation is relied on, a single state record exists, each change is logged, and the state at a past time can be reconstructed.

None of the eight needs trust in the organisation’s own account of what happened. Each is a record someone else can look at.

Where to go next

The four records the tests inspect are explained in ANCR Release 1: what a notice receipt records. The Working Group is open to participants through the Kantara Initiative.