The government has confirmed it will not go ahead with plans to make digital ID mandatory for workers in the UK.
For many people, that will feel like a moment of relief. The proposal had sparked widespread concern about privacy, surveillance and the risks of concentrating sensitive personal information in large digital systems. Nearly three million people signed a parliamentary petition opposing compulsory digital ID, and the public never got behind the plans.
But while the mandatory element has been dropped, the wider picture hasn’t changed as much as it might seem.
Digital identity checks are still expanding. Right-to-work checks will continue to move online. Public services are becoming increasingly digital by default. New platforms and verification tools are being built, used and relied upon every day.
And that means the same underlying question remains: how safe is our data, really?
The real issue was never just compulsion
Much of the opposition to mandatory digital ID focused on the idea of being forced to register. But for many people, the deeper concern went beyond that.
It was about trust.
- Who holds the data?
- How securely is it stored?
- What happens if it’s breached?
- And who is accountable when things go wrong?
With so much of our identities still online, these questions don’t just disappear.
Strong laws, weak outcomes
The UK already has robust data protection laws, including UK GDPR. On paper, organisations handling identity data are required to protect it, limit how it’s used, and be transparent when failures occur. In practice, that protection is patchy.
Data breaches are now routine. Notifications are often delayed or unclear. Accountability is frequently blurred between departments, contractors and third-party providers. For individuals affected, the impact can be serious — from fraud and identity misuse to long-term loss of trust.
Why protection still needs to improve
Digital identity data is among the most sensitive information an organisation can hold. When it’s compromised, people can’t simply “reset” it in the way they would a password.
That’s why safeguards need to be robust and applied consistently. Not treated as box-ticking exercises or buried in policy documents. As digital identity systems continue to develop across work, public services and online platforms, the focus needs to shift from whether they exist to how responsibly they are run.
Our Digital ID pledge
In response, we’ve launched the #ProtectOurDigitalID pledge, calling on every organisation that uses digital identity data, public or private, to commit to higher, clearer standards.
The pledge demands:
- Full transparency over where digital identity data is stored
- Immediate and full disclosure of any data breach or attempted breach
- Independent annual audits of system security and resilience
- Strict limits on data sharing, including a total ban on commercial profiling
- Clear accountability for any organisation handling digital identity data.
These aren’t radical demands. They are the basics needed to make digital identity systems worthy of public trust.
What happens next matters
The government’s change of course shows that public concern can make a difference. But dropping one policy does not solve the wider problem.
Digital identity is here to stay. The question is whether people are properly protected as it becomes more embedded in everyday life.
If digital systems are going to ask for more trust, organisations must show they are willing to earn it.
To stand with us and call for stronger protections, share your support using #ProtectOurDigitalID
