Renewal of electronic identification and authentication system (eID system)
The government wants all its transactions with the public and businesses to be settled electronically by 2017. The public and businesses must therefore be able to identify themselves digitally. With current methods such as DigiD being too vulnerable, the government is currently making preparations to introduce a new electronic identification and authentication system (eID system). We investigated whether the government’s development of the new system satisfied the governance, business case and supervision requirements.
Conclusions
In summary, we found that the government had not yet (in spring 2016) satisfied some of the conditions we investigated.
- It is not entirely clear who is responsible for the eID system and the governance structure is complicated.
- Decisions still need to be taken or worked out on fundamental aspects of the eID system, for example regarding the privacy and supervision criteria it must satisfy.
- The business case is neither up to date nor comprehensive and an alternative scenario has not been worked out. The total cost is therefore uncertain (the minister has reserved an additional €23 million to cover development costs in 2016 and 2017). It is also uncertain how much digital identification will cost individual members of the public.
- There is no integrated vision of the supervision structure for the eID system.
The government should clarify these points so that the House of Representatives can take well-considered decisions on the final structure of the eID system.
Response of the minister
In his response to our audit at the end of August 2016, the Minister of the Interior and Kingdom Relations placed the eID system, quite rightly in our opinion, in the wider context of the digital government. We agree with the minister’s objective of having one body bear responsibility for governance of the digital government but would note that it is currently uncertain who has overall responsibility for all aspects of the eID system.
The minister noted that he had written to the House of Representatives on 25 August 2016 to inform it of Impuls eID but we believe more clarity is needed regarding the admission criteria for the BSN domain, the multi-media strategy, supervision and the protection of privacy.
Finally, the minister said in his response that it would not be opportune to draw up a comprehensive business case now. However, we think a business case and an alternative scenario are essential to take well-founded decisions on the final structure of the eID system.