By definition, Identity Management is at the heart of any government's responsibilities to its citizens, empowering their existence and enabling associated rights.
Quite simply, establishing
citizens' identification and personal data, and respecting the duty to care and protect this information, are perfect examples of the responsibilities that come with a State's right of sovereignty.
However, the development of secure and robust identity management systems is becoming ever more technically complex and requires increasingly significant investments.
At the same time, against in an international context characterized by high levels of public debt, governments must concentrate relentlessly on public service efficiency and make tough choices regarding the priorities they face.
Fortunately, financial markets have a real appetite for investment in projects brought by the private sector. Therefore, private companies presenting sound business cases enjoy access to several sources of funding.
The good news?
A number of convincing business models can be built around Identity Management projects and
Public Private Partnership (PPP) is and effective instrument of delivery of services such as national identification infrastructures.
In this web dossier, we are going to present the key concepts, issues and challenges that must be addressed by public authorities and private companies seeking to launch a successful PPP for Identity Management in the following 5 chapters:
- Common terms and definitions
- Main benefits offered by a PPP compared to traditional procurement processes
- Risks and responsibilities inherent in the implementation of such projects
- Key success factors for a PPP
- The role the public authority should play.
Two PPP examples for ID infrastructure development will illustrate the diversity of Public Private Partnerships.
Let's get started.
1. What are Public Private Partnerships?
There is no international consensus on the detailed
definition of a Public Private Partnership (PPP).
In practice, such initiatives take a variety of different forms, depending on both the prevailing legislation and the cultural characteristics of the stakeholders in the country concerned.
However, from a business perspective, a PPP is generally described as
a long term agreement between a public authority and a private company (or
consortium), whereby some services that usually fall under the competence of the public authority are administered by the private company.
The agreement defines common objectives and precise specification of outputs related to delivery of infrastructure and/or public services.
PPPs very often include a form of project finance in which the private sector handles the upfront costs for the provision of public infrastructures.
Let's dig a little deeper.
There are two main types of agreement.
A PPP agreement, whereby the public authority
retains the public service mission, but invites the private company to finance, build, renovate, operate and maintain the infrastructure, and/or supply a service.
Under this long term agreement (typically 10 to 15 years), the private company generates its revenues via a fee charged to the public authority. These revenues are linked to performance objectives defined in the contract.
Responsibility for project financing falls mainly on the private company; however, the public authority can also participate, in particular via grants.
Risks are shared between the public authority and the private company, according to the terms of the contract and on a case by case basis. In general, the
technical and operational risks lie with the private company, the
traffic risks* with the public authority.
*In the case of Identity Management, this is measuredeither by the volume of documents supplied, or events on which the valuation of the service is based (such as enrollment or number of border crossings).
At-a-glance: the PPP
- Public authority pays for the service
- Public authority keeps the public service mission
- Private company acts as a supplier to the public authority.
Public Private Partnership vs Concession
A Concession, whereby the public authority (known as the "concession authority"),
grants the private company (known as the "concessionnaire"), the right to use its assets.
Under this arrangement, the concessionnaire is responsible for the operation of the infrastructure and the public services, and bears the risks and costs related to the administration of the existing infrastructure and assets, as well as any new facilities.
bears responsibility for all the related investments, and is remunerated by citizens.
Not surprisingly, a concession is a long term agreement. In the field of Identity Management, ten years constitutes a minimum to amortize investments and cover risks.
The public authority
retains ownership of its assets. This includes any assets acquired by the private company during the concession period. At the end of the contract, the public authority recovers its assets in their correct state.
At-a-glance: the concession
- Private company acts on behalf of the public authority
- Citizen pays the private company for the service
- Public authority keeps control, and benefits according to the concession contract
What are Build Operate Transfer or Build Own Operate Transfer agreements?
Acronyms such as BOT (Build Operate Transfer) or BOOT (Build Own Operate Transfer) are commonplace in
Public private Partnership models
and concession agreements; however, they can create discrepancies and misinterpretations within the definitions provided above.
In fact, PPPs and concessions are two types of agreement that are well defined by laws based on codes, such as the one in place
Even if the same concepts and principles are used, under the system of common law, priority lies in the willingness of the parties concerned to reach agreement. This is behind many contracts that are built around such acronyms; they are "tailor made", with their title presenting the main characteristics agreed by the parties involved: for example, Design, Build, Own, Operate, Finance, Maintain, Transfer, etc..
Biometric population enrollment or registration is often key in modern national identity management programs.
2.Key benefits of the PPP model for governments
In the field of national identity management, government should consider a PPP model if it is convinced that partnering with a private company or consortium will realize better value for money than supplying, financing and operating such services itself.
Let's consider the main benefits:
Improved public service efficiency
Partnering with a technological expert
accelerates the modernization of public administration.
Furthermore, delegation of operations such as implementation, operation, technical support, delivery, communication and funding to an experienced private company will free up resources to improve the elements of the service that fall exclusively within government ownership.
And the best part?
These resources can be
allocated to other key services for citizens.
More rigorous budget management
Identity Management projects require a high level of investment to build a secured process that extends from enrollment to the delivery of documents and access to government services.
Moreover, they are difficult to launch because such investments are risky and impact directly on the government's budget and level of debt.
With a PPP model, these constraints are alleviated:
- No upfront investment is demanded of government. Instead, this is shouldered by private investors, stakeholders of the private company, or lenders. Costs are spread over the lifetime of the contract, enabling government to plan the modernization of its identity management programs more easily.
- Implementation risks are taken by the private company. Timetables are defined within the contract; any deviation must not be at a cost to the public authority.
- Operational risks also fall on the private company's shoulders. Indeed, this is the first commitment made within a PPP. The service level is agreed between the partners, and must be adhered to throughout the lifetime of the contract.
Broader economic development
Under a PPP, a private company makes a significant investment in the country's infrastructure - and manages it over the course of a long term agreement.
Moreover, the private company does this not only by supplying its technology and providing experts to set it up, but also through employing and training a local workforce.
In the process, these employees acquire a high level of skills that can subsequently be used to the benefit of other sectors.
The private company will also use local partners for implementation and operation, creating another channel for the diffusion of technology within the country and increasing diversification of the local economy.
Furthermore, the presence of a major private company within a country provides the perfect platform for further synergies and the 'cluster effect': developing other businesses, making further investments and, ultimately, participating in and contributing to the country's overall growth.
PPP example #1 - The Swedish Police experience
In January 2012, Sweden launched a
new generation of its electronic passport and national electronic ID (eID) card.
To enable this ambitious program, Gemalto was chosen:
- to manage the end-to-end delivery process, including the live enrollment solution in Sweden
- for the production of all secure ID and travel documents
- and the operated issuance services.
More specifically, the contract signed with the local authorities in 2011 encompasses the software for registering applicants' personal data, along with enrollment kiosks for instant capture of their photograph, fingerprints and electronic signature. Gemalto provides the operated issuance services, which ensure document personalization from its facilities based in the Stockholm area.
Notably, the same infrastructure and procedures are employed for both the National eID card and the ePassport. This leads to
significant savings in terms of equipment, processes, systems and staff training.
The Swedish Police consider expertise to be of paramount importance in performing their service functions. Each citizen is treated as a customer to be served with utmost competence and efficiency. And this is precisely what Gemalto offers via its operation center in Stockholm.
The police's bottom-line objective of providing a quality service and optimizing use of taxpayers' money were the primary drivers for
But the police have also maintained the fundamental characteristic of its own operations:
authority and the control that such authority guarantees.
Outsourcing production and personalization services to Gemalto based on a PPP model allows the Swedish Police to combine use of the latest technology with technical expertise. Moreover, it ensures that its own resources are not bogged down by functions that do not enhance their core competencies - such as printing documents and managing the logistics required to distribute them.
In addition, the increasing complexity of the technical environment, the challenge of hiring qualified candidates, particularly for IT operations, and the lengthy procurement cycle necessary to upgrade technology also represented valid reasons for the Swedish Police to consider outsourcing to Gemalto.
Now, as the scope of the
Swedish Police continues to grow, they have in place
industry-best processes and the scalable model needed to ensure an on-going cycle of efficiency improvements.
3. Risk sharing in PPPs
Deploying a physical and digital Identity infrastructure and operating it efficiently is a significant challenge. But with the PPP model, public authorities can
transfer some of the risks involved to a private company which has the skills and experience to better handle them.
Indeed, the concept of
risk sharing constitutes the very essence of the partnership. Ultimately, only risks related to the execution of the governmental responsibilities remain with the public authority.
4. Key success factors for a PPP
A PPP starts with a
business model, then grows into a partnership. Public authority and private company
must act as partners. In order to achieve this close relationship, both parties must build trust; trust based on each partner's credibility.
The right experience and skillset
Managing an Identity Management service in PPP mode demands the ability to implement all the related infrastructure and operate it over the duration of the contract. Clearly this requires technical skills and in-depth field experience to guarantee nationwide deployment in an efficient and timely manner.
References are key to providing the public authority with confidence in its future partner.
Furthermore, the public authority must pay careful attention to the profiles of all the employees who will manage the service going forwards, in particular the technical staff.
That's because they represent the first level of control to warrant that operations throughout the service chain are always undertaken securely.
Robust financial capability
Assuming that the business case proposed by the public authority is profitable, such an opportunity should attract a private company or consortium willing to implement and operate the project.
be able to demonstrate their capability to manage the local entity, its cash flow in the local currency, and all the financial and legal steps related to such processes.
It is then likely that the private company will ask several investors to participate and invest in the project, via equity or various other types of loan.
It is also important to verify that this group of investors and lenders is genuinely dedicated to the project's success – not only in the good times, but also the bad, which may be encountered from time to time over the course of any contract. A sound and securely funded company is undoubtedly one of the critical ingredients for a successful PPP.
Even when a business proposed by the public authority is credible and wins support, over a long term contract it is quite possible that challenges and problems will arise. Such hurdles can be overcome by partners, but this may well involve protracted negotiations. Above all else, the project must continue to run; any compensation necessary can be settled at a later stage.
Concession: The Senegal story
Traffic in Dakar, capital of Senegal
The Senegal government has handed Gemalto responsibility for the design, implementation and management of a comprehensive modernization of the country's driver and vehicle licensing and registration programs.
Gemalto, working with local partner Face Technologies, has signed a multi-year
Concession Agreement with the Ministry of Infrastructure, Land Transport and Disruption that includes migration to advanced eDriver and eVehicle licenses, along with new road transport licenses, secure registration plates and mobile verification terminals for the police.
Dramatic improvements in the security and efficiency of enrollment and issuance are to be achieved, cutting fraud and optimizing government revenues.
Awarded in 2017 after an international tendering process, the agreement is part of the
Senegal government's ambitious reform strategy, and will support the Program of Improvement for Transport and Urban Mobility. Gemalto's end-to-end solution incorporates financing, design, realization, operation, maintenance, management and training with the transfer of competencies to governmental agents.
Starting in September 2018, Gemalto is supplying and managing the entire lifecycle of a series of advanced electronic documents, including:
- eDriver Licenses – with a microchip to store the holder's personal and biometric data
- eVehicle Licenses – also with an embedded microchip and advanced security elements
- Road transport agreements – freight transport, private passenger transport etc.
- Secure vehicle registration plates - with a windscreen barcode label to facilitate verification
- 850 new tablet-style terminals to enable on-the-spot checks by police
To optimize customer service, Gemalto has modernized and will operate 13 enrollment and issuance centers in existing offices.
Four new locations have also been created, including a main center in the country's capital, Dakar, where documents are personalized. Key functions include biometric data capture, identity verification and collection of revenue on behalf of the government.
A modern, scalable IT platform has been deployed, with a central database providing an accurate real-time record of the country's drivers and vehicles. Reflecting the scale of the project, Gemalto has already recruited and trained 50 local agents to manage citizens' requests.
In-depth understanding of the local environment
Secure Identity Management is often viewed as the type of standardized service that can be replicated in every country with little customization.
But here is the rub. It's not the case.
The processes involved are derived from prevailing laws and the characteristics and strategy of the local administration. As a result, in-depth knowledge of the local ecosystem is extremely important for successful implementation of a PPP project.
Stay with us for a moment.
- First of all, the technical infrastructure installed must support the service throughout the country.
- Secondly, the behaviors and attitudes of citizens must be assessed thoroughly in order to propose the most suitable solution.
- Finally, the impacts of the project on the local administration must be anticipated and taken into account to enable the PPP project to be deployed efficiently.
5. What role should the public authority play?
Respecting regulations and winning citizen support
Responsibility for Identity Management always lies with the State.
A PPP will only delegate the operation of such a service. Ultimately, the government will always be held responsible for Identity Management by its citizens. Therefore, laws and related regulations defining the scope of the delegated service, the roles and responsibilities of each partners, and their limits, must be clear.
Information about the project and its benefits for the citizen must communicated to, and supported by, the population.
In other words, the
legal framework and
citizen-oriented communication constitute the basis of the project business plan.
Getting the specification right and avoiding implementation delays
The specification must be reasonable and adapted to the local infrastructure.
Focusing on the outputs that define the service is by far the best way to get a satisfactory solution.
The essence of an
effective partnership is to let the provider propose a solution that satisfies such requirements, one that combines optimum quality of service with the lowest possible cost.
At the selection phase, government will have the opportunity to compare and select the most attractive offer.
Project implementation should never be rushed. The resources required for a digital infrastructure are complex and must managed with mutual trust.
Sadly, too much pressure on project implementation
planning constitutes the first potential cause of PPP failure; it creates tension and conflict between partners at the very outset of the project.
Taking a long term strategic view
Government must always bear in mind that digital technology moves fast. A Public Private Partnership project will succeed for government if the infrastructure installed can evolve and be reemployed effectively at the end of the contract.
The first step to achieving this is to ensure compliance with international standards.
Government should also put in place a strategy for the country's Identity Management that encompasses plans for mid-term developments.
Maintaining control and cooperation
For the private company, the public authority remains a customer as well as a partner.
As such, consistently controlling the quality of service and the performance of the delegated operations constitutes an extremely important role for the public authority.
Furthermore, a PPP is a long term collaboration; it is simply not possible to anticipate all the issues that might arise over the course of its execution. Several arrangements might have to evolve.
Both partners must therefore retain a deep understanding of where the project stands, and have confidence in each other's ability to make the necessary adjustments and maintain momentum within the partnership.
Public Private Partnership challenges
PPP constitutes an extremely cost-efficient means of
accelerating the modernization of a country's Identity Management program.
However, it is a partnership. Success will only be realized if both parties are committed for the long term.
Above all else, the critical factor for the public authority is to establish a sound contractual scheme, endorsed by relevant laws and supported by citizens.
Beyond that, it must
give its private partner the freedom to propose what it can do best, ensuring that any constraints or performance requirements are focused on the outputs, rather than the means of achieving them.
Finally, in the event of the proposed plan not unfolding as originally anticipated, the public authority must be willing to share any pain, and the need to make adjustments.
For its part, the private partner should deploy all its expertise to build and operate the promised system, and ultimately transfer it back to the public authority in good shape.
Choosing the right partner remains the critical challenge. Proven expertise, knowledge of the country, and long term financial credibility constitute the defining features of an ideal candidate.
Where do we fit in?
Gemalto's contribution to Public Private Partnership (PPP) projects provides us with outstanding capabilities in terms of a culture of services, processes, resourcing and project financing, all of which are essential for creating trust between partners.
Gemalto's know-how in providing end-to-end solutions and services has been proven in over 200 projects worldwide. Typically our customers have renewed their confidence in Gemalto's solutions and expertise by commissioning further projects.
Recent examples include the Oman National Registry, eID and ePassport, the Swedish eID, ePassport and driving license, and
voter registration infrastructures in Gabon, Burkina Faso, the Democratic Republic of Congo and Benin .
With more than 25 years of experience in identity solution integration, Gemalto represents a stable and reliable system integrator for your identity project; above all else our purpose is to serve and support your transformation.