Yes, a digital ID could be safe and secure – but the BritCard hasn't gained my trust

The British Prime Minister Keir Starmer chose the crowded room of the 2025 Global Progress Action Summit to officially share with citizens how the government plans to combat illegal immigration. All adults would have to prove their right to work and live in the UK through a mandatory digital ID app – the BritCard.

A petition demanding to scrap the scheme over privacy concerns attracted over one thousand signatures in around 24 hours – though there are now more than 2.8 million at the time of writing. Politicians, from both sides and even from within Starmer’s party, have also strongly criticized the decision.

It is true: a digital ID isn’t necessarily evil. Estonia is one of the handful of examples worldwide proving that a digital ID can fight against illicit activities like fraud, speed up bureaucracy, and make democratic participation more accessible. Trust is key to achieving this, though, and the BritCard doesn't have mine.

The UK has a bad track record when it comes to keeping people's sensitive data safe. In the latest instance, a cyberattack on the UK's Legal Aid Agency in April led to up to 2.1 million pieces of citizens' data, including criminal records, being leaked.

In its official announcement, the UK government ensures that the digital ID scheme is "designed with best-in-class security at its core" and "credentials will be stored directly on people’s own device." The system is also expected to use "state-of-the-art encryption and authentication technology" to keep data private and secure.

Yet, the continuous push from law enforcement to backdoor encryption also makes cryptographers, security experts, and ID software developers worried, arguing that such a requirement could make all our devices even less safe.

A privacy nightmare

A push to digitalize citizens' IDs isn't unique to the UK. The European Union has introduced a similar scheme, with some member countries already rolling out the first iterations. Yet, there’s a key distinction – we will all be forced to use the BritCard, whether we like it or not.

It wasn't always this way, though. As per the GOV.UK Wallet scheme, announced back in January, Brits would have the option to digitize their documents in a single app, starting with their driving license, in a bid to make using the government's services easier.

Its evolution to the BritCard stems from an idea of the Labour Together think tank, which first published a detailed report in June. Here, a UK digital ID is mostly a measure to tackle illegal immigration.

As per this plan, a mandatory national digital identity would be issued free of charge to all citizens with the right to live or work in the UK, whether they are British-born nationals or legal migrants.

"The BritCard would be a verifiable digital credential downloaded onto a user’s smartphone, which could be instantly checked by employers or landlords using a free verifier app," explains the report.

Digital rights campaigners and even some politicians are worried, though, about the prospect that a mandatory digital ID could create a "checkpoint society" where everyone will be less safe.

In its report, the Big Brother Watch argues that the BritCard could end up normalizing data sharing while removing the need for proportionality included under the current legal framework.

Campaigners also mention the risk of "function creep," arguing that digital identification systems may be prone to expansion. "This is particularly true of systems designed to pre-empt harm, disorder, or crime, which often operate under the assumption that it is necessary to acquire as much data as possible," they wrote.

After all, an arguably dystopian possibility to introduce a "community impact score" also appears to be already in the cards. As outlined in a report published by the Tony Blair Institute for Global Change, citizens could ultimately use the BritCard to report issues in the community, "ensuring they feel the impact of effective delivery in their everyday lives."

Security starts with trust

The increased need for trustworthy identity management software has made the sector grow. Companies have been working on developing private and secure digital ID software. These experts believe that, if well-implemented, digital IDs can even be a secure way to enforce age verification.

If well-implemented – that’s the key.

A single database including all citizens' most sensitive pieces of information would certainly be an appealing target to malicious actors committed to carrying on ID theft and similar attacks.

The UK, however, has demonstrated multiple times to be not well-equipped to keep our data safe. At the same time, encryption backdoor orders like the one resumed against Apple could end up eroding the security offered by this technology.

It's then not so surprising that civil liberty groups are worried that the BritCard could turn into a honeypot for hackers and hostile governments.

People in the UK are concerned, and for good reason. At best, there’s the prospect that our most sensitive data gets compromised, hacked by some bad IT actors. At worst, this mass collection could open up to greater control and surveillance from those who promise that a digital ID would make our lives better.

Perhaps the saddest thing of all is seeing the government depicting the Brit Card as a way to tackle illegal immigration. In reality, though, many have doubts that a digital ID card can bring any meaningful benefit.

As an EU immigrant living and working in the UK myself, I know that a system to prove your right to work and live in the country is already in place. In the form of a numerical combination, instantly delivered by the government portal upon request.

So, is the UK's mandatory digital ID scheme just a desire to innovate bureaucracy, or something more? Whether it's the case, the UK surely needs to fix its problems with data security first before accidentally creating a new side entry into our most sensitive information. A hot dream for hackers that could turn into our worst nightmare.

You might also like

• The Online Safety Act isn't just about age verification – end-to-end encryption is also at risk
• Before moving from "analogue to digital," the NHS has to fix its privacy flaws
• If we want to still have privacy, we need to ban spyware