Last fall, we published a blog announcing a new effort to address concerns about the potential overuse of new mobile driver’s licenses (mDLs) and other government-issued verifiable digital credentials (VDCs). As part of that effort, we released a framework for a voluntary code of conduct. Today, we are excited to release the final version of that document.

“Verifiable Digital Credentials — Best Practices for Organizations Requesting and Using Identity Data” aims to set a high bar for security, privacy, usability, and inclusivity in the use of VDCs by:

·       Introducing a set of core best practices for the use of VDCs.

·       Defining core use cases and attribute bundles in which it is appropriate for online service providers to request validated identity information and/or attributes.

·       Outlining use cases in which a request for validated identity information and/or attributes is inappropriate and should be restricted.

VDCs have the potential to improve security, privacy, usability, and inclusivity for individuals and businesses if they are designed, deployed, and used responsibly. However, the introduction of government-issued VDCs also carries the risk of eroding security, privacy, and civil liberties.

One of the top concerns is that, because VDCs make it easier than ever for individuals to prove who they are online, companies and government agencies will begin asking for ID in use cases in which they rarely, if ever, did so before.

A wide variety of stakeholders, including digital wallet providers, identity issuers, privacy and civil liberties advocates, policymakers, and online service providers, have made clear that a world in which people are expected to present proof of identity everywhere they go online would be harmful. We have found strong consensus that rules of the road are needed.

These best practices seek to advance VDC adoption while addressing concerns about abuse. They are intended for organizations, such as vendors, that help online service providers verify and validate identity using government-issued VDCs.

The Best Practices detail six primary principles:

1.     The emergence of VDCs should not materially affect the ability of individuals to be anonymous or pseudonymous online.

2.     VDCs are designed specifically to preserve and enhance privacy by allowing a verifier to request only a limited subset of an individual’s identity information without enabling any party to track how or where the individual uses the VDC. Issuers, digital wallet providers, verifiers, verifier service providers, and others in the digital identity ecosystem should design and use VDCs only in ways that preserve these features, with a focus on data minimization.

3.     Online service providers have a legal or regulatory requirement in some use cases to collect and validate data about an individual’s identity — either a full credential or a subset of attributes associated with that credential. The use of a VDC for these purposes should be explicitly permitted, provided that the request is limited to identity data directly relevant to the requirement.

·   For example, a bank is legally required to obtain the name, date of birth, address, and taxpayer identification number (TIN) from customers opening new accounts.

4.     There are a number of use cases in which there is no legal or regulatory requirement to collect and validate data about an individual’s identity, but in which:

·       The service provider’s risk model would prevent it from making a product or service available online unless it could validate an individual’s identity or an attribute tied to that identity; and

·       Most consumers would want the ability to access that product or service in a fully online environment and would welcome the ability to do so rather than having to present their ID in person.

The use of a VDC for these purposes should be permitted, provided that:

·       The request is limited to a subset of identity data directly relevant to the requirement or transaction.

·       The use of a VDC allows a consumer to access a product or service online when doing so would otherwise require presenting an ID in person or completing another form of online identity verification.

5.     For the categories of use cases above, an online service provider’s legal, regulatory, or business requirement to collect identity data for one use case should not serve as a license to collect identity data for every use case. A user’s consent to the collection of identity data for one use case should not be interpreted as blanket consent.

6.     Some potential use cases involve no legal or regulatory requirement to collect and validate data about an individual’s identity, and collecting that information would not enable a service provider to make a product or service available online that would otherwise be unavailable. The use of a VDC for these purposes, such as marketing, should be restricted.

The Transition from Code of Conduct to Best Practices

The Better Identity Coalition decided to shift from a formal “Code of Conduct” to a set of “Best Practices” focused less on establishing formal, binding rules and more on outlining guidance that a variety of stakeholders could support.

The change was made in response to stakeholder feedback. Specifically:

·       Some stakeholders argued that a code of conduct would not be meaningful without a clear enforcement mechanism.

·       Other stakeholders, including some issuers, noted that they were uncomfortable with a third-party organization making these decisions because doing so could create friction and stall consensus for action.

If consensus among industry and government stakeholders on the ideas in these Best Practices grows stronger, we may seek to formalize the document as a self-regulatory code of conduct. We also expect that policymakers may attempt to codify some of these standards into law. Most importantly, a wide variety of industry and government stakeholders should come together to make clear that rules of the road are needed to govern the use of new digital credentials.

‍