UK cabinet ministers have frequently referenced the former Soviet State as an exemplar of the beneficial use of digital identity. PublicTechnology went to Tallinn to try and find out why.
Estonia is acknowledged as a leader in government technology.
A 2024 United Nations report on e-government development covering all 193 member countries ranked it second only to Denmark – with the UK seventh.
It is particularly well-known for its use of digital identity, with Pat McFadden, the chancellor of the Duchy of Lancaster, praising its work while visiting Estonia recently.
Prime minister Keir Starmer has since announced plans for a digital identity scheme that will be compulsory for anyone taking a new job by the end of this parliament, with a consultation to take place by the end of this year. Subsequent government announcements have used Estonia as an example of digital identity’s benefits and Estonian officials have worked with the UK government on its plans.
So, what might the UK learn from the Baltic country’s quarter-century of experience in developing digital identity?
“For better or worse, we have been honest with our citizens. We don’t treat our citizens like kindergarten.”
Rannar Park, e-Estonia
According to speakers at a recent press event run by government programme Trade Estonia in the country’s capital city Tallinn, the keys to its success are choice, transparency and trust.
While Estonians do not have any choice over whether or not to have a digital identity – as it has been included with the country’s compulsory physical identity cards since 2002 – it remains optional for accessing services.
Just 0.04% of those filing a tax return do so using paper forms – the online service has available since 2000 – but the option remains open.
Estonians do have a choice of technologies that support digital identities, with the chip on their physical ID card being the most popular choice with 64% doing so regularly. Some 53% use electronic ID through a smartphone app and 19% rely on a special SIM card that works in any type of mobile phone.
Rannar Park, head of business engagement at the government’s e-Estonia Briefing Centre, told the press event that making digital services voluntary and demonstrating benefits for citizens have been important in gaining acceptance for digital identity: “What’s your first question as a citizen? ‘Why? Why are you forcing this on me?’”
Of the recent launch of digital identity in the UK, which includes mandatory use for right to work checks, he said “how it’s been handled has been interesting”.
Critical services
Estonians can use digital identities in all government services – including e-divorce, the final service the country digitised in December 2024, as well as in private sector services, such as for banking and legal transactions.
They can also be used for voting: “I-voting is, without a shadow of a doubt, the most criticised part of e-Estonia,” Park told the press event.
Since digital voting’s introduction in 2005, levels of electoral participation have not changed, but more older people, as well as those in rural areas are voting, he said.
It took until 2023’s elections to the European Parliament for the majority of Estonians to use i-voting, and the proportion has since dropped back – with 54% of those voting in local elections held in October using paper ballots.
“Estonia is a poster child for how things take time,” said Park, adding that some young people prefer to use paper ballots to give voting a sense of process.
Estonian officials stressed the importance of government transparency and citizen control of their data. For digital voting, where it is not possible to know if someone has voted in privacy, votes can be cancelled and superseded by a subsequent submission – either digital or paper – and voters can check online that the right vote has been counted.
For digital identity, Estonia tells citizens which agencies have accessed their records and when. In 2020, Estonia’s data protection inspectorate fined a police officer who had accessed data on his fiancée, and a healthcare worker who had looked up why an ambulance had been called on behalf of a neighbour. Both admitted the offence and expressed remorse.
Estonia also aims to decentralise systems and data, with separate companies building the app used for i-voting and the system that counts votes. Healthcare records are highly digitised and highly distributed, with specific information on patients carrying only internal system identifiers.
Maksim Žukov, chief executive of Estonian healthcare digitisation company Kodality, said that systems avoid using public identity numbers that could link a record to an individual, such as the NHS numbers that often appear on UK healthcare records.
“There is no single point of failure in the ecosystem,” he said at a round table held as part of the Trade Estonia event.
Opening the Iron Curtain
Arguably, Estonia has advantages over the UK when it comes to building trust in government digitisation. With 1.3 million citizens – a figure that equates to less than 2% of the UK’s population – there are fewer degrees of separation between politicians, civil servants and everyone else.
People’s lives have improved greatly in terms of wealth and health since the country gained independence from the Soviet Union in August 1991, perhaps making it easier to have faith in government, while the ongoing threat from Russia generates solidarity.
However, the digital identity system has faced threats.
Digitisation does not appear to be politically controversial, with the programme having survived changes of government.
2002
Date of launch of digital ID in Estonia, via inclusion in physical national ID cards
54%
Proportion of voters filing paper ballots in person in Estonia local elections last month – despite the availability of remote digital voting
1.3 million
Population of Estonia
286,000
Number of Estonians affected by a 2021 hack on the national ID system
On 31 August 2017 security researchers discovered a vulnerability in the encryption used in around 750,000 Estonian identity documents.
Prime minister Jüri Ratas held a press conference a few days later disclosing the issue and, by late October, the country was producing cards free of the security problem. It also provided remote updates, although these initially failed due to too much demand, leading it to organise in-person updates at some locations.
Estonia now presents this as a positive experience that allowed it to learn from mistakes, as well as causing many people to obtain a SIM-based mobile identity as a back-up to a physical card.
Then in July 2021, a Tallinn-based hacker obtained photos, names and identity codes of more than 286,000 Estonians, although this data was then seized by the police. While this was a major attack that took advantage of a security vulnerability, it showed the benefits of data decentralisation as the information obtained was not enough for anyone to gain fraudulent access to the country’s online services or carry out legal or financial transactions.
In both cases Estonia’s government publicly addressed the problem shortly after it arose, following a pattern set in 2007. For several weeks from 26 April that year the country suffered waves of severe cyberattacks, as well as several nights of mass protests and riots, after the government decided to move a Soviet era bronze soldier statue from the centre of Tallinn to a military cemetery. Attacks took down media and government websites along with cash machines and online banking services. Russian involvement was suspected, if not proven.
The experience of ‘Bronze Night’ led Estonia to improve its cyber defences and develop its reputation in technology security. It is now home to both a Nato cyber defence centre of excellence and EU-Lisa, an agency that runs IT projects including the recently introduced Entry/Exit System for border control.
But Park said the experience also set the gold standard for clear and open government communications, with top government officials appearing on news programmes. Asked why Estonians tend to trust their government, he replied that the government has earned it: “For better or worse, we have been honest with our citizens,” he said. “We don’t treat our citizens like kindergarten.”
