Jusletter IT

Following the referendum of 1997, the Parliament of the UK in Westminster passed the Scotland Act 1998 that established a devolved Scottish Parliament and Government, the «Holyrood Parliament». Its responsibilities and powers are roughly similar to that of a German federal state (Bundesland) as far as legislative competence is concerned, but fiscal control and ability to raise money remained under the 1998 Act mainly with the central government.

At the 2007 election, the Scottish National Party (SNP) won for the first time a majority in Holyrood. At that time, a Labour government in London was pursuing a national ID card project for the whole of the UK. The backbone of this scheme was going to be a centralised computer database, the National Identity Register (NIR). Biometric information in the form of fingerprint scans was to be linked to this register. The physical embodiment was to be three types of identity cards:

• The National Identity Card, lilac and salmon in colour, for British citizens only.
• The Identification Card, turquoise and green in colour for EU citizens living in the UK
• The Identity Card for Foreign Nationals, blue and pink for immigrants from non-EU/EEA countries

Refusal to register was to carry a fine, as was failure to alert the authorities that a card had been lost, or that details in the register had changed. Control of crime, terrorism prevention, detection of benefit fraud and illegal immigration were the stated rationales behind the scheme.

In 2009, the Scottish Government confirmed Scotland’s opposition to ID cards in a letter from Minister for Community Safety Fergus Ewing to the UK Government:

«The Scottish Government continues to be completely opposed to the National Identity Scheme, and the Scottish Parliament recently supported a call for the UK Government to cancel its plans for the National Identity Scheme. [...] There is little tangible evidence to suggest ID cards will deliver any of the benefits Westminster claim: it is far from certain they will do anything to safeguard against crime and terrorism, and there are real concerns that the cards and the identity database could increase the risk of fraud, not reduce it.»

Opposition against this card scheme was widespread, and after Labour lost the 2010 national election, it was scrapped by a coalition government of centre-right conservatives (Tory) and centre-left Liberal Democrats (LibDems).

In 2011, the SNP was returned to power in the Scottish elections with a much enhanced majority. Three years later, in December 2014, the SNP-led government in Holyrood published a «minor consultation» on the «proposed amendments to the National Health Service Central Register (Scotland) Regulations 2006». The proposal, once implemented, will transform the Scottish National Health Service (NHS) register (NHSCR) into a full-scale population register accessible to over 120 organisations. It will create a unique and persistent identifier that facilitates data sharing across agencies, while at the same time increases the reach of the database and also the type of information that it contains. According to several commentators, it will create the very thing that the SNP in Scotland and in Westminster had opposed in 2009: a National ID database.¹

Just as with its 2009 precursor, the new database has created significant concerns for privacy protection, The Information Commissioner’s Office (ICO) warned that the proposal, which lacks a Privacy Impact Assessment, risked breaching data protection laws and privacy standards. The ICO also echoed the concern that the «creeping use of such identifiers» would eventually lead to a national ID card, introduced in circumvention of the democratic process: «If we are to have a national identity number this should be the subject of proper debate and be accompanied by suitable safeguards. It should not just happen by default.»²

Such an explicit Act by Parliament seems also essential to comply with Art. 8(7) of the EU Data Protection Directive 95/46/EC, which states that «Member states shall determine the conditions under which a national identification number or any other identifier of general application may be processed». The present proposal, if it were to be seen as a national ID system, not only fails to specify in sufficient detail how and to what extend processing will take place. Absent primary legislation to introduce it, it could be questioned if this amounts to a «determination» by the UK to have an ID scheme in part of its territory – a question to which we will return below. We note however the issue that will be at the heart of this paper. The UK, as a signatory state, is the primary addressee of EU law. The constituent nations of the UK – England, Wales, Northern Ireland and Scotland – do not interact with the EU directly. As we will see, they remain however in varying degrees of autonomy «nations» with their own national identities. Art. 4(2) on the Treaty on the European Union states that «The Union shall respect the equality of Member States before the Treaties as well as their national identities, inherent in their fundamental structures, political and constitutional, inclusive of regional and local self-government. It shall respect their essential State functions, including ensuring the territorial integrity of the State, maintaining law and order and safeguarding national security».

On the bases of this provision, it may be argued that the UK, whilst being a State under public international law, currently includes a bundle of four different national identities,. The question then becomes if a) the Scottish National Identity scheme is a «National» ID scheme for the purpose of the Data Protection Directive, and if so, if b) the UK and the Westminster Parliament, or the devolved Holyrood Parliament, are required to make the appropriate «determination».

Before we will come back to this issue, the proposed changes in a nutshell:

1. At present, only the National Health Service and some local authorities can access the NHSCR for the purpose of identifying citizens. This ensures, as a side effect, also observance of the purpose limitation principle of Data Protection law. Only health related inquiries are likely to be made. In the future, NHSCR will provide services to 120 organisations, including police, prisons, universities and some publicly owned companies such as Glasgow Airport, Quality Meat Scotland and Scottish Canals, VisitScotland or the Bòrd na Gàidhlig (in charge of Gaelic language and culture).
2. At present, information about addresses is limited to around 30% of citizens captured in the NHSCR, the aim is to increase this to 100%, partly by data sharing and matching between the register and its new users, partly by merging it with the Community Health Index Postcode (CHIP).
3. At present, postcode data is only provided consensually, under the new system, this consensual model would shift towards mandatory registration (via CHIP).

The proposal states three general aims that are to be achieved:

 

1) to increase data quality

This would be at the expense of the consensus model which is a main source for poor or incomplete data.

 

2) Extend the ability to access online services using Myaccount to a wider range of public services

The new extended system will act as e-identity provider for Myaccount, an online system for the delivery of public service in Scotland. National Records of Scotland, as administrators of the NHSCR will acquire a critical role as an e-identity provider.

 

3) Assist with the tracing of certain persons

Explicitly named are children at risk (e.g. children missing within the education system) and foreign individuals with outstanding debts with the NHS. No more specifics are given – one of the key complaints by the Information Commissioner’s Office, since some of these functions are already discharged elsewhere, and without further specification could result in tracing citizens who for good and lawful reasons do not want to be found. This could be for instance vulnerable witnesses, or people in fear of abusive partners.

Finally, and this too is an issue we will need to come back to, its aim is to:

 

4) Enable the identification of Scottish tax payers to ensure the accurate allocation of tax receipts associated with the Scottish Rate of Income Tax to Scotland

At least on first sight, it seems that the Scottish Government not only aims to introduce the type of database that it initially strongly opposed when proposed by the Labour party, the method to achieve this looks like a particularly worrying «repurposing» of health data for issues such as tax enforcement and policing. To understand exactly what these changes to the NHSCR amount to and if the charge of hypocrisy is merited, we need first to understand what the NHSCR is – and for this, a historical analysis of the origins of the database and the discussion surrounding it will be needed.

The NHSCR is an electronic database held and maintained by National Records Office (NRO). It contains basic demographic details of everyone born or deceased in Scotland, or who was at some point registered with a General Medical Practitioner (GP) here. In modern times, its primary purpose is to facilitate the movement of medical patient records between Health Boards both within Scotland, and between Scottish Health Boards and the rest of the UK. Its earlier history though gives us a rich case study in the problems of national ID systems.

The NHSCR grew out of a census held in the UK in 1939 as part of the effort to put the UK on war footing. An example of wartime emergency legislation, the National Registration Act 1939 paved the way to a national census (or «enumeration» as it was called in law). As part of the census, every person received a unique «civil registration number» (based on their address on enumeration night, and later on the birth register). This prepared the ground for issuing the (short lived) National Identity Card, aimed at identifying spies and other enemy agents who might have infiltrated the country, issuing of food ration books, and identifying eligible adults for conscription.³ It also was used to identify children for evacuation purposes, which made the address an essential part of the information. Other data collected were names, gender, age, occupation, marital status and membership in the armed forces or auxiliary services.

Most of these purposes became obsolete after the war had ended, though rationing continued for a few years. Introduced as emergency legislation with a sunset clause, the law that had enabled the census nonetheless proved remarkably difficult to get rid off. In 1946, Parliament passed the first of what would become a series of «Emergency Laws (Transitional Provisions) Acts», which perpetuated several wartime laws, before they became ultimately repealed in the 1956 Emergency Laws (Repeal) Act. The universally unpopular ID card system did not survive quite as long. It had been a controversial piece of legislation even under the tense conditions of 1939. The speeches of two Members of Parliament (MPs) at the time are particularly insightful.

The Labour MP for the constituency of Farnworth, Georg Tomlinson, who had been elected in a by election just the previous year, said:

 

«It may be that there is a necessity for compiling a register, but here you have the possibility of people being stopped and asked whether they have or have not lost their cards. You may challenge a dozen people and you find one who has committed an offence. It will not help a scrap to win the war, but there is the possibility of penalising somebody who is perfectly innocent because we have passed a law for another purpose entirely.»

Here we find two ideas that had a lasting impact. First, Tomlinson can be said to have invented what would later become, under Data Protection law, the purpose specification principle, but he also anticipated that once data was collected, «mission creep» was all but inevitable. Second, we find a separation between the legal requirement to carry a physical Identity Card and the database that underpins such a card. It is only the former, not the latter that is seen problematic. At a time when the capacity to search and cross-reference archives was very limited, this is not a surprising position to take. However this attitude would remain a defining feature of public debate on identity cards and identity registers up to the present day, when the capacity of databases and e-registers has vastly improved. Back in 1939, John Tinker MP expressed the concerns thus:

 

«We do not want to be stopped in the street by any person anywhere and to be forced to produce a card. If that kind of thing begins, we shall be afraid of people meeting us and asking for our cards. One thing that we do respect in this country is our freedom from being challenged on every occasion to produce something to prove that we are certain persons.»

The requirement to carry a physical ID card became subject of a criminal trial in 1950, when Clarence Henry Willcock became the last person in the UK to be prosecuted under the wartime act. He had been challenged by a police constable of the name Harold Muckle, to present his identity card at a police station within 48 hours. Willock refused as a matter of principle, saying: «I am a Liberal and I am against this sort of thing». During his subsequent trial, where leading liberal politicians of his day offered their service as legal councils for free, he argued that as the stated purpose of ID cards had lapsed with the end of the war, citizens were under no obligation to produce them. This was to no avail, and he was convicted and charged the pricely sum of 10 shillings, approximately £11 in today’s money.

He duly appealed the decision, even though the Court of Appeal upheld the conviction in Willcock v Muckle [1951] 2 ALL ER 367, Lord Goddard, the then Lord Chief Justice of England and Wales, showed strong sympathy for the defence:

 

«This Act was passed for security purposes, and not for the purposes for which, apparently, it is now sought to be used. To use Acts of Parliament, passed for particular purposes during war, in times when the war is past, except that technically a state of war exists, tends to turn law-abiding subjects into lawbreakers, which is a most undesirable state of affairs.»

Here too we find the fear of mission creep, but also again the focus on police powers and their right to demand identification from citizens.⁴ We also note in passing that despite strong objections, the courts were unable to invalidate the law. This too is a feature of the UK constitutional settlement, with a strong emphasis on parliamentary sovereignty and a correspondingly weak(er) control by the courts, which can not normally invalidate primary legislation. This only changed, to a degree, when in 1989 the UK enacted the Human Rights Act. While the Human Rights Act still does not allow the courts to invalidate legislation enacted by Parliament, it allows a number of nominated courts to issue a «declaration of incompatibility». In these cases, the law remains in force up to such a time when (and if) Parliament removes the incompatibility.

Lord Goddard, in his speech in Willcock v Muckle, went as far as he could to express something very similar, but without the more serious legal consequences that such a ruling would carry today. Nonetheless, when the Labour Government of Attlee was defeated in the general election of 1951, the new Conservative government under Winston Churchill abolished the law in 1952, to great support from the general public but against the expressed wishes of police and security services. Here, we note another emerging pattern. While subsequently both Conservative and Labour governments tried to reintroduce ID cards, support for them tended to be particularly high under Labour administrations and the political left. Conservatives by contrast tended to emphasise that the very concept is an alien, foreign idea, something they identify with the French or German «administrative» state, and thus not «properly British».⁵ Not having a British Identity Card thus became part of British identity.

While 1951 saw the end of national ID cards, the database or register that underpinned them stayed in existence. Governments rarely give up information about citizens once they collected them, and soon a new use for the census data emerged.

From the 19^th century onwards, the state had taken on a more and more active role in providing public health care, not only in the UK but throughout Europe. During the interwar years, it had become clear however that the UK was significantly lagging behind continental Europe and the US, as measured in international league tables. The Local Government Act of 1929 had hoped to bring much needed reform, but despite general improvements in local administration failed to deliver for health services. William Alexander Robson, one of the most influential academic commentators during that time, decried the «’multiplication of health authorities and the disintegration of function», and was in particular concerned about the «failure to envisage the health of the community at different ages and different stages».⁶ In 1942, this insight became one of the three core principles of what was to become the National Health Service, when Beveridge’s famous report on «Social Insurance and Allied Services» envisioned a welfare state that provided «from cradle to grave».⁷ Of course, any hope to address Robson’s concern would be facilitated, in due time, by having a «sticky» single identifier for health service providers that allowed to track an individual through their ages and stages in life.

Keeping track of an individual over time was only one of the requirements that were to come with a National Health Service. As important was the need to track individuals through space. Despite considerable differences in detail, health provisions in England and Scotland at the time were blighted by a chaotic and highly fragmented system of service provision and governance. A particular problem was the co-existence of a private and a public hospital system, which, in the words of Bertrand Dawson, author of the influential Dawson report of 1920, resulted in «duplicating and even conflicting, without machinery in existence for coordinating their activities».⁸ According to another report they were «self governing institutions, jealous of their independence and only loosely associated with each other». In South Wales alone, 93 public hospitals were «governed» by 46 local authorities. Thrown into the mix were a further 48 voluntary hospitals that operated totally independently of each other and any state control.⁹ Local resistance by these independent bodies against any form of more streamlined administration was fierce, and, supported by the medical associations, successful in preventing any reform in the interwar years.

This chaotic state of affair was however unable to cope with the demands the war made on Britain, especially once civilian causalities were mounting as a result of German air raids. An Emergency Medical Service was put in place, centrally controlled and with significant new infrastructure investment. As contemporary observers noted: «the bombing plane, by transforming the nature of warfare, has forced on us a transformation of our medical services». Or as Charles Webster put it in modern days more acerbically: «The Luftwaffe achieved in month what had defeated politicians and planners for at least two decades».¹⁰ The considerable improvement of this new approach soon became manifest, and it became clear that after the war, a return to the old system was inconceivable.

In 1941, the Government announced a proposal for a comprehensive hospital service, which however had a significant degree of «localism», putting local authorities in charge of providing it. The Beveridge Report of December 1942 recommended in 1942 a National Health Service with General Practitioners who would work though regional health centres and hospitals. Support in the medical profession existed for even further decentralisation and an insurance based system that centred around independent GPs

A 1944 «White Paper» finally included the founding principles of the NHS as a nationalised health provider:

• all services are to be provided free at the point of use and financed through general taxation
• Everyone, independent of income, nationality, or age is eligible for care.

The last point is of particular importance for our discussion. It meant that questions of (national) identity were less relevant for the new system than one might have thought. It had from its inception a duty to also provide services for foreigners temporarily visiting the UK (undoubtedly also necessitated by the large scale displacement of people during the war), who were not taxpayers and hence also not part of a prior registration or identification system.

When after the war Clement Attlee’s Labour Party government tasked Aneurin Bevan with implementing these ideas, it soon became obvious that the idea to leave control with local authorities was in this form not feasible, and that the existing system needed a more fundamental reform. He decided that «the only thing to do was to create an entirely new hospital service, to take over the voluntary hospitals, and to take over the local government hospitals and to organise them as a single hospital service». This resulted in a more monolithic and homogenous entity than the wartime discussions had anticipated. Yet it still showed that it was based on a compromise between groups favouring a highly decentralised and regionalised approach, and those favouring a stronger role for a centralised administration. One consequence of this compromise was to keep the health systems of Scotland and England separate entities, with entirely different lines of command and responsibility, and different funding streams. The NHS in England and Wales was established by the National Health Service Act 1946, which received Royal Assent on 6 November 1946. NHS Scotland was created by the National Health Service (Scotland) Act 1947.

The balance between centralism and regionalism was achieved by a «tripartite» system:

Firstly, hospital sector became nationalised, with (In England) 14 Regional Hospital Boards with overall responsibility to coordinate health services, and below them 400 Hospital Management Committees responsible for the administration of hospitals. University associated teaching hospitals had different arrangements – they played for historical reasons also a particularly strong role in Scotland.

Secondly, local authorities took on many of the roles the old «Poor laws» had assigned to parish councils, including vaccination programs, health education and midwife services.

Crucially, the main responsibility for primary Care was to lie with General Practitioners (GP) – the German «Hausarzt» – who remained semi-independent. Payment came from the state, but «followed the patients» in that GPs were paid for each person on their list. As points of first contact, they also created the health records of their patients. Because payment was by number of people recorded on their lists, the creation of administrative records that identified individual patients became part and parcel of their role. Since, as we discussed above, people are entitled to NHS treatment independent of their nationality or place of residence, these patient registers included people who would not be part of any other governmental register or data set.

This set-up immediately created an obvious problem. As an increasingly mobile workforce moved between Health Boards, (not even counting refugees, internally displaced people whose houses were still in ruins, relatives of the soldiers of allied forces) or indeed between Scotland and England, they would end up on several lists, one for each GP whose services they used. This proliferation of lists made reliable payment to GPs impossible, and also made it difficult to ensure that the current GP got access to the health records of his patients when they had been created by a GP elsewhere in the UK. A method needed to be found to track an individual across different care providers – and the census data provided just that information. As it had recorded people irrespectively of their nationality or employment status, it matched the requirement of a health service free for everybody. Because it was the result of a central effort (though with separate registers for England and Scotland), it avoided duplication of IDs. So while the national ID cards were discarded, the census data that underpinned them found a new use as a central enabler of the modern welfare state and formed the core of the National Health Service Central Register

In Scotland, maintaining this register, the NHSCR, became one of the functions of the General Register Office for Scotland (GROS), already charged since 1854 with recording all births and deaths in Scotland. With this system in place, the aim of the modern welfare state and the NHS in particular, to provide services from cradle to grave, could be supported administratively. In 2011, GROS and the National Archives of Scotland (NAS) merged to form the National Records of Scotland (NRS), which is the body now charged with maintaining the NHSCR.

When registering with the NHS, patients receive a unique and persistent identifier, their unique citizen reference number (CHI) Number. This number is created from the patient’s date of birth followed by four digits: two random digits, a digit identifying gender at birth (odd for men, even for women) and a check digit.¹¹ Crucially, the NHSCR does not contain patient’s health records (with the exception of that of certain types of cancer patients for research purposes). It enables however to locate a health record wherever it is held. At this point, we can see why the Scottish SNP can argue that its proposal is nothing like the UK database it had rejected in 2009: NHSCR is not (just) a national database, rather, it is a register of all customers of the NHS, domestic and foreign. It is also not linked to a physical card, let alone one mandatory to carry – as we saw the main focus of opposition to national ID systems in the UK.

However, while the NHS was the historical corner stone of the modern welfare state in the UK, it provides of course only one important element of it. A whole range of services and benefits are provided, many administered locally and facing similar problems as those that had been experienced by the young NHS sixty years ago. In Scotland for instance, pensioners are entitled to free bus passes. But since many bus companies are run by local councils, a way had to be found to identify pensioners and make their entitlement portable across municipal boundaries.

It is therefore maybe surprising that it took until 2004 before politicians realised that the NHSCR could also support these types of «public service delivery». That year, NRS was asked to provide the unique reference number created for NHS customers also to the equivalent index of customers of Scottish local authorities. To pre-empt concerns, only data of people who had specifically asked to be included in the local authority database was added. This new and widened remit of NHSCR soon became linked to the National Entitlement Card – a multi-application smartcard that according to the local councils that promote them are

• quick to use – just flash it over a reader and it scans automatically;
• convenient – a single card with many uses helping you to reduce the number of cards you need to carry.¹²

Depending on the local council, the card can be used e.g. as library card, cashless catering within schools, taxi travel for disabled people, or as proof of age for pupils.

Here we can see why the critics of the new scheme fail to see the significant difference to a national ID card system: by combining a mandatory but card-free registration system whose purpose initially was national defence, and became central for national health as a public good, with a carded but not mandatory system, the resulting database does create a de facto mandatory, universal and nation-wide ID and ID card system.

An additional layer of complexity was added when the Scottish government introduced as part of its «Digital Future agenda» the «Myaccount» facility, soft launched in Edinburgh in 2014. Myaccount is the digital equivalent to the Entitlement card – a single online account that allows registered users to access government services. Participation is (so far) voluntary and all services remain available offline. As more and more government services are moved online, not just in Scotland but throughout the western world, this is not an unusual development. An e-identity is a necessary precondition for such a system, and both on the level of the UK (and by implication England) and on the Scottish level, steps are taken to create one. However, on the details of how such an e-identity should work, Scotland and the UK differ in interesting ways. For the UK, the Cabinet Office in London envisions a federated system where private sector providers will become accredited e-identity providers. In Scotland, this role was taken on by the government through NHSCR. This is not just a minor technical detail, it reflects a deep and systematic difference in political culture between these two constituent parts of the UK, and is an explicit policy decision:

 

«The Scottish Government considers that the people of Scotland will prefer a public sector, not-for-profit body to be responsible for ‹Myaccount›. This contrasts with the UK Government’s approach of individuals setting up an account with a private sector body.»¹³

In the international discussion on privacy, the US approach with its trust in companies is often contrasted with the European trust in governments. Within the microcosms of the UK, we find the same juxtaposition. Post-war Scotland tended to return governments that were to the left of the UK-wide majority, England, especially southern England, favoured more conservative policies. Support for the public sector in Scotland remains very strong; privatisation is driven by policies formulated in London. This also maps to the wider issue of attitudes to the EU, with Scotland generally more EU friendly, England more euro-sceptical and oriented towards the US.

By accentuating the role of the government to certify and protect e-Identities, the Scottish approach aligns therefore on first sight well with the overall political landscape and a narrative of Scottish exceptionalism, which defines itself systematically also «against» the politics of London and the City.

Thus viewed in its historical context, the latest proposals to further extend the coverage of the NHSCR can be seen as a logical extension of post-war Scottish (identity) politics: Where the 2009 proposal for the UK ID card had emphasised fear of crime, illegal immigration and the social problem of benefit cheats, the Scottish approach accentuates the positive role of the welfare state and the need of service delivery to the infirm. With the possible exception of «tracking foreigners», it follows the trajectory of the 1939 census described above and is unlike its abandoned UK predecessor essentially inclusive. It is not based on nationality but either residency or mere use of services, and for this reason alone indeed not a «national» identity database in the technical sense. Unlike the UK ID proposal, no criminal sanctions are proposed – yet – for not carrying a correct ID, nor is the NHSCR database linked – yet – to biometric identifiers the way the 2009 proposal was. It even becomes understandable why the measure was hidden in a minor consultation, without a full debate in the Scottish Parliament.¹⁴ If the discussion is framed as a minor administrative-technical question about service delivery as opposed to a major change in policy to address significant external challenges such as terrorism and crime, technocratic rather than policy issues are the focus.

However, this socially inclusive narrative hides the significant privacy concerns that the 2014 approach shares with the abandoned 2009 proposal. It also ignores that the question of centralised and persistent identifiers, as opposed to federated and temporal solutions, is orthogonal to the public sector- private sector dichotomy.¹⁵ This means that more privacy friendly solutions that preserve the structural advantages of the «trusted third party» model favoured by the UK Cabinet Office seem highly feasible also for Scotland, even within a context of public sector governance.

Evaluated from this perspective, the concerns about the ID consultation are not (just) what the new enhanced system will disclose about citizens. Rather, it is the lack of detail about intended application, the lack of any recognition that while the extended database will not be a national ID system, it can easily be extended to become one, and given this, the choice of technical implementation and lack of parliamentary scrutiny. As the Information Commissioner in his response pointed out, not only is a Privacy Impact Assessment missing, the description of the intended applications remain so ill defined that a proper proportionality assessment will be difficult to carry out. Even after substantial external pressure the government defeated in a narrow 60:65 vote an amendment to give MSPs at least the opportunity to discuss these measures in full.

So how should we judge the proposal? Should we judge its proponents gently, the way Robert Burns, Scotland’s national poet urged us to judge each other always, for «What’s done we partly may compute/ But know not what’s resisted»? Or should we consider it as a disingenuous power grab by an administration and remember Burn’s words that «Some books are lies frae end to end»? The answer attempted here tries to find a third way. While the proposal raises serious concerns for privacy in particular, and also for the democratic process, these are not best understood as merely a cynical ploy. Rather, they are the result of long-term dynamics of UK political history. Some of these we encountered already in the historical background narrative of the NHSCR. It left the UK with an «asymmetric» constitution, where each constituent part (England, Wales, Scotland and Northern Ireland) has different degrees of autonomy and responsibility, and where the UK’s four nations were never were fully coordinated with each other or the central government in a systematic way. Underlying these are informal and contingent ways to understand and conceptualise what «national identity» means, a process where regional identities (Scottish, Irish, English, Welsh) and federal (British) identity remain in constant flux and are persistently renegotiated. This creates inevitable tensions when the law is asked to «fix» these identities in regulation. But «pinning down» identity through laws is necessary not just for «enabling» laws on collection and sharing of data across the UK, but also «protective» data protection rules, as any decision on what counts as «identity» or «membership in the database» for the purpose of the law risk pre-empting highly charged political discussions. In such an environment, low-key administrative actions visibly separated from governmental functions, e.g. as promoted here by a neutral body like the National Archives, provide mechanism for resolving problems without having to enter the much more symbolically charged political arena.

This becomes particularly clear if we look at the fourth of the intended uses of the new system, to identify taxpayers liable to the new «Scottish» income tax. It is this new power of the Scottish executive, won in a complex political process that ultimately forces the hand of the administration. It requires a determination of «being Scottish» that does not apply to any of the other parts of the UK, as it is based on a power that previously only existed on the level of the UK. To understand this context, we once again have to look deep back in history.

At the beginning of the 18th century, Scotland and the Scottish economy found themselves in the grip of a deep financial crisis. At a time when globalisation promised investors in many countries unimaginable riches and massive returns on investments by investing in trade with the colonies, Scotland feared to be left behind. To establish Scotland as a global player, its aristocrats and merchants, town councils and guilds had raised money to finance an audacious scheme that would bring part of the bounty that the Americas promised to Scotland. Eventually, between around 20% of the wealth of Scotland (and half of its GDP) was going to flow in a project by the Company of Scotland, founded by an Act of the Scottish Parliament in 1695, to establish a colony in Darien, on the Isthmus of Panama.¹⁶ The project was to become a disaster, with only a few hundred of the 2500 settlers that had sailed to Panama returning alive, defeated by illness, starvation and the Spanish army. Never before had investments been spread so widely across the population, with many private citizens and public bodies investing money they could not afford to lose.¹⁷ Never before affected a failed company so many in their daily lives. While it would be overly simplistic to see the failure of the Darien scheme as the main reason why in 1707, Scotland would seize to exists as an independent nation, it definitely contributed to its demise. Art. 15 of the Act of Union granted £398,085 10s sterling from English coffers to Scotland, a sum known as the «Equivalent». While technically an insurance against future liability of Scotland for the English national debt, it was de facto also a compensation scheme for the investors, with 58.6% of the sum allocated to the shareholders and creditors of the Company of Scotland.

Fast forward. At the beginning of the 21^th century, Scotland and the Scottish economy found themselves in the grip of a deep financial crisis. At a time when globalisation promised investors in many countries unimaginable riches and massive returns on investments by investing in trade with the former colonies, Scotland feared to be left behind. To establish Scotland as a global player, it’s major banks such as the Bank of Scotland and the Royal Bank of Scotland, and through them also small investors such as ordinary workers and tradesmen, town councils and pension funds had raised money to finance an audacious scheme that would bring part of the bounty that the Americas promised to Scotland. Attracted by a buoying housing market in the US, Scottish banks went on an acquisition spree that included the US mortgage bank Charter One, and investment in the more risky segments of the US mortgage security market. The project was to become a disaster, with only a small percentage of the investment returning to Scotland. Only once before had investments been spread so widely across the population, with many private citizens and public bodies investing money they could not afford to lose. Only once before affected a failed company so many in their daily lives. While it would be overly simplistic to see the aggressive expansion policy and subsequent collapse of the Scottish banks as the main reason why in 2014, Scotland would vote by a small margin against becoming an independent country again, it definitely contributed to the Yes vote’s demise. The massive bailout needed from the UK government, totalling £65bn, undermined the economic case for independence and reminded people of the benefits of a fiscal union.

From the events of the 18^th century through to the devolution referendum in 1997, the financial crisis in 2008 and the independence referendum in 2014, we can see events unfolding that would leave the UK with a constitutional settlement which poses unique challenges for legal regulation, and none more so than for the legal regulations that pertain to a person’s identity. For questions of national and cultural identity are deeply intertwined with all of these developments.

We find a first trace of this issue already with the Darien Scheme mentioned above. Ostensibly, it was marketed at a newly found national pride in Scotland – the «Scottishness» of the scheme was a key selling point, and subscription seen as national duty and part of Scottish identity: Lord Basil Hamilton commented that «he won’t be looked upon as a true Scotchman that is against it».¹⁸ Even further went the law that created the Bank of Scotland in the same year, 1659. The final clause of its founding Act (repealed only in 1920) made all foreign-born proprietors naturalised Scotsmen «to all Intents and Purposes whatsoever».¹⁹ If we think of the subscription lists as an early «ID database», then its definition of national ID was an inclusive, economy-oriented one: invest in Scotland to be Scottish.

The collapse of the scheme was followed swiftly by the Treaty of Union in 1706, which gave Scotland the promise of financial relieve, while resolving English concerns of a catholic monarch at some point in the future ascending the Scottish throne. Two separate and symmetrical Acts by the Parliaments of England and Scotland, implemented the treaty, the «Acts of Union». In 1707 the Parliament of England passed the Union with Scotland Act and in the same year the Parliament of Scotland passed the Union with England Act. Having shared a Monarch since 1603, the Union of the Parliaments became legal reality on 1 May 1707 when the Scottish Parliament and the English Parliament united to form the Parliament of Great Britain. This new Parliament was based in the Building of one of the old ones, the Palace of Westminster in London. This choice became emblematic for one of the persistent problems with national identity in the UK: For England and the English, there is no sharp demarcation between English and British identity, they seep into each other – Westminster, while formalistic legally only Parliament for the UK, is also seen as the de facto Parliament for England. For Scotland and the Scots, Scottish and British (and indeed European) identity are more strictly delineated, even for unionists who emphasise the benefits of continuing membership in the UK.

Under the terms of the Treaty, Scotland maintained its legal system and with it a significant part of its administrative and judicial structure. This was in marked difference to Wales, which had at that time already been fully integrated into the Kingdom of England. The Laws in Wales Acts had extended the English legal system and its administration to Wales, creating a single state and jurisdiction. For a discussion of «identity», looking a bit more closely at the Act is of interest:

 

«(4) some rude and ignorant People have made Distinction and Diversity between the King’s Subjects of this Realm, and his Subjects of the said Dominion and Principality of Wales, whereby great Discord, Variance, Debate, Division, Murmur and Sedition hath grown between his said Subjects;

(5) His Highness therefore of a singular Zeal, Love and Favour that he beareth towards his Subjects of his said Dominion of Wales, minding and intending to reduce them to the perfect Order, Notice and Knowledge of his Laws of this Realm, and utterly to extirp all and singular the sinister Usages and Customs differing from the same [...]»

Distinctive identities are inimical to union and peace, and nowhere more so when they result in distinctive legal status. This also requires cultural amalgamation, with distinctive national identifiers such as language, dress or customs becoming outlawed.

Ireland as the fourth of the «sister kingdoms» was not included in the Union, though it tried to leverage the event to this aim. Both its Houses of the Parliament of Ireland urged Queen Anne in 1707, asking «May God put it in your royal heart to add greater strength and lustre to your crown, by a still more comprehensive Union» – an expression with additional poignancy today in the context of the European project of a «closer and closer union». The (newly formed) British government did not respond to the invitation, and it would take almost another century before the Union with Ireland finally came on January the First 1801. In the meantime, the Kingdom of Ireland remained separate but legally subordinate to Great Britain.

The Treaty of Union comprised 25 articles, not fewer than 15 of which were economic in nature and aimed at creating a monetary union and a free trade area. This focus on economic maters, together with the above mentioned «equivalent», was seen by large parts of the population, which remained deeply hostile to the Treaty, as a corrupt betrayal. It led to Burn’s famous dictum:

 

We’re bought and sold for English Gold

What a parcel of rogues in a Nation.

Scotland kept the independent Church of Scotland, and the Court of Session as highest Scottish appeal court was to «remain in all time coming within Scotland», to adjudicate according to Scots law which would «remain in the same force as before». It provided for Scottish representation in both Houses of Parliament, but left most of the day-to-day governance of Scotland in the hands of the «College of Justice». This body comprises the Court of Session, the High Court of Justiciary, and the Office of the Accountant of Court as the supreme courts of Scotland, and the Faculty of Advocates, the Society of Writers to Her Majesty’s Signet and the Society of Solicitors in the Supreme Courts of Scotland as its associated body – rule of law became thus (self)rule by lawyers.

We have to fast-forward through the next 300 years, interesting as they are for a discussion of the interaction between cultural, political and legal notions of «identity». The bloody uprisings against the Union in 1715 and 1745 failed to break up the UK, but caused a period of systematic hostility to the outward signs of Scottish (or more precisely, Highland) identity. This culminated in the Highland Clearances, which saw the large-scale removals of the indigenous populations of the Highlands and the active suppression of their language and culture.²⁰

In the mid-19^th century however, we find renewed calls for «Scottish Home rule», just as we find them for Ireland at that time. Unlike Ireland however, this change in attitude was buoyed by a sudden and emphatic embrace by Victorian England of Scottish culture – or rather, a romanticist vision of Scottish culture recreated in the literary salons of London. Many of the icons that we identify today with Scottish culture and Scottish identity were reinvented at the time and imbued with a manufactured historical pedigree. Of these, only one ought to be mentioned here. The tartan, the multi-coloured criss-crossed weaving pattern associated with the Scottish kilts, had been outlawed in 1746 by the Dress Act as on of many legal measures to extinguish the Highland cultural identity. It had however never been an identifier of clan membership – at best, regional fashion styles and differences could be established. Since they were created using natural dyes, weavers would use whatever plants were locally available and in season, resulting in rapidly changing colour schemes only loosely related to geographic areas. They lacked with necessity the uniform reproducibility that is necessary for an identity signifier. Modern Victorian technology and the invention of artificial dyes meant that these restrictions had become irrelevant, now the same colour pattern could be reproduced again and again. The idea that the colour of the tartan acted as an ID card for clan membership was thus born as a faux history in this environment, and enabled by technology. But it was only in 2009, and again enabled by modern technology, that the tartan received legal recognition as a personal identifier. On 9 October 2008, the Scottish Parliament passed the «Scottish Register of Tartans Bill» which set the legal framework for an electronic register of tartan weaves. Launched on the on 5 February 2009, the Register’s website contains specification for over 4000 tartans, and is maintained by the Scottish National Archives – the same body also tasked, as we have seen, for curating the nascent Scottish ID database.

Back to our analysis of the historical trajectory that ultimately leads us the contemporary «Scottish Identity» that a Scottish ID card would have to capture. The discussion on Irish Home Rule became a central aspect of UK politics in the late 19^th century, with similar debates regarding Scotland also present, but not as predominant. From the Easter Rising of 1916 to the final truce of 1923, a series of armed conflicts resulted in the eventual partition of Ireland between Northern Ireland that remained a part of the UK, and the Republic of Ireland as an independent state. From a legal perspective though, UK constitutional law remains ambivalent to this new national identity – granting for instance Irish citizens – as only nationality in the EU – the right to vote in UK parliamentary elections, thus continuing to include them in the UK «demos».

While the Second World War had pushed segregationist sentiment to the very margins of political discourse, the 1950s and 60s saw a resurgence of Scottish nationalist feeling. John MacCormick, father of the legal philosopher Neil, had succeeded for some time in uniting a fragmented political movement (also by reversing the Scottish Nationalist policy of opposing the draft at the outbreak of the war) and in 1951, his non-partisan Scottish Covenant Association managed not only to «liberate» the stone of Destiny from the Westminster House of Parliament, but also to deliver a petition with over 2m signatures (out of a population of around 5m) asking for a devolved Scottish Assembly. The direct political impact of the petition was low, also because questions would be raised bout the authenticity of some of the signatures – without the ability to use an official register of voters, the ability of the SCA to ascertain the identity of the signatories was limited.

The idea of a public, democratic decision on the constitutional makeup of the UK however had taken hold. In 1973, under highly contested conditions, a referendum was held in Northern Ireland – boycotted by the main nationalist parties, it returned a resounding majority for the status quo and Northern Ireland’s continuing membership in the UK. In 1979, a dual referendum was held in Wales and Scotland. In Wales, a majority rejected the proposal for a Welsh assembly with legislative powers, in Scotland, a majority voted in favour but failed to achieve the required 40% of the total eligible electorate. In 1997, Welsh and Scottish voters were again asked to the ballot boxes. In Wales, they were asked the single question: Should there be a Welsh assembly with some law-making power? Scotland was asked two questions: «Should there be a Scottish Parliament» and «If there is a Scottish Parliament should it have tax-varying powers». Interesting again, for our purposes, is the «franchise» or the identity of the «demos» for this referendum with its tremendous consequences for the UK and Scotland: Residency was again the main eligibility criterion, which means citizens who described themselves as English but lived in Scotland had the vote, whereas Scots living in England were excluded. Excluded were also all expatriates living outside the UK, even though they had received the vote for parliamentary elections in 1983. Included, on the other hand, were EU citizens resident in Scotland.

There are two ways one can think about this «inclusive» definition of the franchise in a referendum that was after all about national identity. The more cynical explanation saw the referendum as an attempt by the Labour Government in London to stave off demands for full independence. Labour ministers stressed that devolution was about localism and therefore residence, and therefore also not raising issue of «Scottishness» or affinity with Scotland more broadly. This avoided, rather than settled the issue of who, in the eyes of the law, is «Scottish», an issue to which we will have to return below. However, as we saw above, there was also a historical precedent of sorts for this model: Just as investment in Scotland had come with the legal entitlement to citizenship in the Darien scheme, so now, «investing in» Scotland by living, working and paying taxes was what counted.

In the event, Wales voted with the smallest of margins for a devolved Assembly, Scotland with a strong majority for reconvening the Scottish parliament, and with a somewhat smaller majority that it should have tax varying powers.

In response, the UK Parliament passed the Scotland Act 1998, creating the Scottish Parliament and Scottish Executive. Emphasising the continuity with the past, on the 12 May 1999, Winie Ewing, as oldest elected MSP, opened the first meeting with the words «The Scottish Parliament, which adjourned on 25 March 1707, is hereby reconvened». The Scottish parliament gained wide ranging law making power, in a settlement not too dissimilar from German federalism: Unless stated explicitly otherwise (the «reserved» issues such as defence), legislative competence rests with the Scottish Parliament by default. Unlike the German settlement however that was designed «from the top» and gives identical rights to all regions, the asymmetric constitution, where each part gained its powers through individually negotiated and fought referenda, creates some anomalies. In the absence of a corresponding legislative body for England, Scottish Members of Parliament in Westminster continue to be able to vote for laws that will only affect England, while English MPs cannot any longer vote on decisions that are devolved to the Scottish Parliament and affect Scotland only.

If the aim of the UK Labour party had been to «ward off» nationalist sentiment in Scotland and supress through devolution any desire for full independence, then this hope was in vain. The Scottish National Party became under devolution the dominating political force in Scotland. Having won decisively the elections in 2011 with a clear commitment for a plebiscite on independence, the UK government offered to provide the Scottish Parliament with the powers to hold a referendum, and in 2012, the Edinburgh Agreement between the UK and Scottish governments put in place the legal mechanisms to carry out the referendum under Scottish administration.

The Scottish Independence Referendum (Franchise) Act 2013 was passed by the Scottish Parliament on 27.6.2013, receiving Royal Assent on 7.8.2013. As with the 1997 referendum, the franchise was defined inclusively: all UK, EU and commonwealth citizens resident in Scotland for a set period of time were eligible to vote. However, while in 1997, the inclusive definition of the franchise had side-lined the discussion of what Scottish identity in constitutional law was going to be, this time round it became an explicit part of the nationalist project. The inclusive approach to nationality aligned with the plans of the SNP for a post-referendum, independent Scotland, where all lawful residents, English, European or from the commonwealth countries, were to be offered Scottish citizenship, toleration of dual nationality and protection of residency rights of those who chose not to take up that offer.

On the 18th September 2014, Scotland voted with a 45–55 majority to remain in the UK. However, during a hard-fought campaign, where polls at one point had indicated a majority for exit, the Westminster government had already indicate a willingness to far reaching concessions in the case of a No vote, and in particular substantially increased powers to vary income tax. These new powers are likely to come into law in 2016. While also the earlier Scotland Act of 1997 had granted some tax varying powers, these had been so limited that exercising them would have been in all likelihood been harmful for the Scottish economy. The new powers are not only more extensive, they come at a time where a right-of-centre government in Westminster pursues austerity policies, while the more left-leaning Scottish government favours a much more interventionist and Keynesian approach. This means that the Scottish government is much more likely to make use of them at some point in the future. This requires an administrative infrastructure that allows the tax authorities to distinguish between Scots and non-Scots – or rather those affected by the regime and those who are not. This infrastructure however is not in place – the UK tax regime had no need to differentiate along the geographic boundaries of the nations that constitute the UK. The rate for UK income tax was uniform across the Kingdom, and since the Welsh and Northern Irish Assemblies do no have tax raising powers, and the English no separate parliament at all, there was also no need to co-ordinate centrally between separate regional income tax regimes.

In this asymmetric environment, no existing register or database matched exactly what the new tax rising regime in Edinburgh needed – and as we saw for understandable historical reasons, as this would require the very debate was almost intentionally avoided through the centuries: what it means to have in addition to a British also a regional Scottish Identity. Nor is there a body similar to the German Bundesrat that could co-ordinate between the constituent states. Rather, the relation of each kingdom within the UK with the central government grew in ad ad-hoc, one-to-one basis where shifting power balances created a unique set of rights and rules for each of them, with no centralised mechanism to resolve the resulting tensions.

In this power vacuum, administrative bodies and decision makers can often operate outside the public gaze, and nowhere more so than when decisions can be framed as abstract questions of ICT technology. The informal practices of UK administration (which relies much more on conventions and «understandings» than the comparatively legalistic and juridified system of continental Europe), government departments have always been able to commandeer the e-governance agenda to push decisions that ought to have been subject to public debate and accountability into technological questions to be answered by software developers – after appropriate instruction by senior civil servants.²¹ A much more daring argument along similar lines had been suggested by Jon Agar in the Government Machine²², where he argued that the introduction of computers to control state action was indeed close to a revolution in the technical sense of «overthrowing the government», led by civil servants and resulting in a new form of technocracy.

Of the rationales given for the extended new database, its use for tax administration is the most unexpected – previous attempts to create a national ID database in the UK had presented them either as «crime and terrorism prevention» or «entitlement cards». In the analysis here, it is however the most important, and arguably the main driver behind the project. The referenda of 1996 and 2014 created a constitutional reality whose ramifications for everyday practice had never been properly planned. In such a situation, re-using what is available and bootstrapping on existing systems is a logical response. The critics of the proposed system are both right and wrong: They are right in that there are privacy implications that give rise to reasonable concerns, but not because of an attempt to introduce surveillance through the backdoor, but because it is an ad-hoc and unplanned response to needs created by the devolution referenda. The Information Commissioner is right in saying that ideally, such an important decision should come through Parliament, and after proper political debate, but his analysis too underestimates what is at stake. The issue, ultimately, is not just if as a society we should have a system like the NHSCR, it is much more momentous than that – a national database needs to answer what it means to be part of that nation.

That question had played out in the cultural and political arena ever since the union in 1707 and was an ever present undercurrent in the referenda debates, but never crystallised into legal form. In 1996, the UK government had intentionally framed the discussion so as to avoid an open debate on Scottish identity when it opened up the franchise to all and only residents. In 2014, the SNP campaigned on an equally inclusive concept of citizenship, but its plans to translate this into a legal concept were rendered moot when the electorate rejected independence. This also prevented the creation of a national constitutional convention, and an open public debate about a rational form of constitutional arrangement for the UK. In this political and legal vacuum, the choice of the NHSCR as a de facto national database could be described as inspired. The inclusive concept of membership that it inherits from its foundation as part of the modern welfare state and the NHS aligns it well with the inclusive understanding of the franchise that informed not just the 20^th century referenda, but is much older and deeper ingrained. Above we located it first with the Darien scheme and the foundation of the Bank of Scotland, financial contribution to which gained in law Scottish citizenship. With this the wheel comes full circle, for linking the use case for a national database to the question of taxation answers the question «who is Scottish» in a peculiar yet time honoured way: not by race, creed, or the accident of birth, but by the very material contribution to the collective good that one is willing to make.

What this discussion also shows is that modern technology does not operate in a vacuum. While we are often tempted to emphasise its disruptive nature and the radical break with the past that it heralds, and while the Internet’s global nature seems to render discussions about localism and local identity-forming practices moot, in reality, success or lack of it, uptake or rejection of technology is still intimately linked to social practices and modes of understanding that evolved over the centuries. This is true for international and inter-state relations, but it is equally true if less obvious for sub-national, intra-state questions. Countries with asymmetric constitutions in particular face a dual challenge when harnessing and regulating ICT: maintaining a balance between the needs of identities and identity-constituting practices that are in constant flux and a process of renegotiation, the ever-changing technological landscape, and the internal need of the law to fix both of them, at least temporarily, and give them explicit form.

---

 

Burkhard Schafer, Professor of Computational Legal Theory and Director, SCRIPT Centre for IT and IP Law, University of Edinburgh, Old College, EH8 9YL Edinburgh, UK, b.schafer@ed.ac.uk; http://www.law.ed.ac.uk/people/burkhardschafer.

 

 

This is a substantially extended, updated and revised version of a study initially published as Burkhard Schafer (2015), An ID Database for Post-Referendum Scotland? A Legal-Contextual Analysis. Datenschutz und Datensicherheit 2015, Issue 39.9, pp. 611–616.