Mobile ID can bring both convenience and citizen privacy

By David Kelts, Director of Product Development, Mobile Identity, GET Group North America

Many U.S. states are implementing mobile driver’s licenses (mDL) as an option for their citizens. There are multiple pilots and legislative studies in advanced stages of completion and some states approaching full-scale integration. In states that have involved businesses that rely on ID, a “Mobile ID ecosystem” is becoming reality as governments that issue ID cards and commercial entities that require ID cards discover the advantages of mDLs. Once accepted everywhere, like tap payments, citizens may have the option to leave their wallet at home and not carry a physical ID card that is easily lost, stolen, or misused.

The “win-win” privacy design for mobile driver’s licenses is to give control and choice to the holder while ensuring Mobile ID ecosystem operations are transparent to all parties. Many people do not leave home without their smartphone, so an mDL can mean one less thing to carry or worry about misplacing. The smartphone never leaves the citizen’s hand. In our post-COVID world, verifying identity through a contactless exchange rather than handing over a physical credential is much more appealing to businesses and citizens. Businesses check the cryptographic signature to trust the issuer-signed data while processing customers faster.

The International Organization of Standardization (ISO) used Privacy by Design Principles to develop the standard for mDLs and mobile ID technology – ISO 18013-5. It specifies technical and interoperability mechanisms to obtain and trust the data from an mDL for in-person transactions. The mDL holder uses a tap (NFC) or scan (QR) to initiate and control data transfer. ISO/IEC 29100:2011 defines eleven principles for privacy protection that software design should strive to achieve.  There are multiple restatements of the same principles in FIPPS, GDPR, PIPEDA, OECD Guidelines, and many regional standards.

Citizens need these principles to be met in order to trust any new ID technology – or they won’t and shouldn’t use it.  Let us investigate how a mobile driver’s license– defined as an ISO 18013-5-compliant mobile identity application – can meet these principles.  There are designed-in advantages and recommendations to look for in solutions when making a choice.  Quality white papers exist describing in-depth the design (PDF), possibilities, goals, and even shortcomings of ISO 18013-5.

Further defining these eleven principles lets us analyze the ISO 18013-5 mobile driver’s license standard to see where these privacy principles can be met and where there are gaps to be filled.

An ISO mobile driver’s license is strongest in providing data minimization with additional control and consent to the citizen – the mDL holder.  Physical cards and their barcodes divulge all data to the relying party even if they only require age and to prove that it is a government-issued ID.  ISO mDL provides the ability to share and validate subsets of data appropriate for the transaction.  Paper does not provide the citizen more control, as anyone knows who has watched a foreign hotel staffer photocopy their identity document and place it in a plain folder at the counter.  Control is in preventing over-collection from happening by sharing necessary identity attributes with the expectation of secure electronic storage.

Accuracy and quality are other areas where mobile driver’s licenses shine.  The benefits of accuracy are often considered to be for the relying party.  Knowing accurate address information and the up-to-date status of driving privileges can help businesses like rental car agencies assess risk.  Weeding out fakes by quickly checking cryptographic proof of ID also benefits businesses that are liable for accepting fake documents.  But data accuracy benefits the mDL holder also.  Correct addresses save time at hotel check-in.  Accurate names, genders and veteran’s status represent your rights in our society.

Multiple methods of standardized interaction with a mobile driver’s license will unlock the power of mobility for obtaining trustworthy identity data. The ISO standard specifies that verifiers confirm the mDL data is unchanged and matches the official record by checking the issuer’s signature on the data.  Verifiers can obtain and trust the data through different user interactions.  The exchange can begin with an NFC tap or a QR code scan, and then the data can be shared over NFC, Bluetooth, WifiAware, or via an online Web API or Open ID Connect.  This means that verifiers can set up “Tap & Go”, “Tap & Hold”, or “Scan & Request” interactions as fits their business flow or develop new flows. ID information is exchanged entirely contactlessly, without the mDL holder ever giving up possession of their phone.

It is critical to note that identity privacy is always an ecosystem play… there are identity proofers, credential issuers, people, people within organizations, regulatory agencies, and businesses that rely on identity data (relying parties) that each share responsibility to protect individual privacy. Every issuer within an ecosystem can implement perfect privacy but if a regulatory agency sets up a reporting system to gather usage information, or one business stores data they cannot protect, then privacy is not preserved.  This is why in today’s information systems privacy has been so difficult; but all is not lost.  mDL is definitely a start in the right direction.

About the author

David Kelts is an innovative developer of mobile ID technology with over 20 years of experience in identity management. In addition to his role at GET Group North America, he is a key contributor to the ISO 18013-5 standard and contributing author and editor of the Secure Technology Alliance’s mDL Ecosystem series.

DISCLAIMER: Biometric Update’s Industry Insights are submitted content. The views expressed in this post are that of the author, and don’t necessarily reflect the views of Biometric Update.

Article Topics

biometrics  |  data protection  |  data sharing  |  digital identity  |  driver's license  |  GET Group  |  identity document  |  interoperability  |  ISO standards  |  mDL (mobile driver's license)  |  privacy  |  Privacy by Design