The First Minister’s new policy prospectus “Equality, opportunity, community” sets out the importance of “rolling out modern digital services that are easy to access, reliable and effective.” This will “remove the need for manual processing, reduce failure demand and meet people’s expectations of how they want to interact with government, securely and in a manner which protects their privacy.” 

This reflects the aims set out in Scotland’s Digital Strategy, jointly developed by Scottish Government and COSLA (Convention of Scottish Local Authorities), which includes the commitment to introduce a digital identity service for all users. 

The digital identity service, ScotAccount, went live in partnership with Disclosure Scotland, as a pilot, which we call ‘private beta’ at the end of February 2023. ScotAccount has been integrated into Disclosure Scotland’s new online service, providing users with digital access to their disclosure results. This supports delivery of the Disclosure (Scotland) Act 2020. 

Once a person’s application for the Protection of Vulnerable Groups (PVG) scheme has been processed, they receive an email from Disclosure Scotland inviting them to view their results online. They can then create a secure ScotAccount, using an email address, password and two-factor authentication. Applicants can then verify their identity, using an official document – currently a passport, driving licence or biometric residence card. They do this by taking a photo of their document and a photo of their face, which the service compares to see if they match.

If the identity check is successful, the applicant will be able to view the results of their PVG application online. It means that Disclosure Scotland does not need to post a certificate to them. This cuts down on manual processing, postage costs, and can speed up recruitment for positions that require a PVG check. 

The pilot is providing us with valuable insight into how ScotAccount performs in a live environment and is informing how we prioritise service improvements. 

We are working to identify how to continually improve the usability of ScotAccount and drive up our identity verification rate. Our analysis tells us interesting things about how people use our service. Some users have been unable to verify their identity as they have not entered their name as it appears on the documents, for example using “Chris” instead of “Christopher’’. We improved ScotAccount to accept variations in how people enter their names. Others have tried to use expired documents. So, we are exploring the feasibility and security implications of accepting some limited documents past their expiry date. We also plan to implement other ways for people to verify their identity, including expanding the types of documents that can be used and by answering questions that relate to personal information only the person applying would know (sometimes known as ‘knowledge-based verification’) instead. 

We are planning and prioritising a range of next steps in the development of the service, including introducing additional means for two factor authentication, such as using codes sent to landline telephones. Additionally, we are building another core component called ‘MySafe’ – where users can choose to store verified personal information, for reuse elsewhere in the future. The data that is stored, will be held securely and only ever be accessible by the individual and those that they consent to share it with. Initially, MySafe will be used to store the results of the identity check for reuse with other public services, thus saving time and effort for users who would only need to verify their identity once and reducing costs for the public sector. 

We are delivering ScotAccount as a reusable set of common components, which can be integrated into public services across Scotland. We are working hard to roll this out to more organisations later this year. Our ultimate aim is to enable people to access the services they are entitled to in a secure online journey. 

If you work for a public service organisation and are interested in finding out more about ScotAccount, or to access our test environment, you can contact us here: scotaccount@gov.scot