Getting to the source

Despite this great increase in interest — not to mention the call for compliance with the imminent implementation of the new GDPR regulation – this new report from Citizens Advice stands out from the crowd. It provides an important perspective that has largely been ignored: how people really feel. For the first time, the CAB has started with the individual — giving a unique perspective, untainted by the agenda of those that have the data today, or want the data in the future.

Continuing the trend from their excellent previous paper — Personal data empowerment: time for a fairer data deal? — the report focuses on the most important element in personal data: the individual. Drawing on new research with consumers themselves, it reflects the main concerns they voice regarding digital trust, control over their data, accountability, and their relationship with service providers. As they say, their research “addresses [the] insight gap” (3) in terms of how consumers themselves experience the digital ecosystem.

We will reflect on the core themes of the paper, which align closely with our ideals at Mydex, and aim to contextualise these in terms of how these concerns can be alleviated not in the future, but today.

Accountability and the status quo

“There’s just no point – what can I, or even we, do against the likes of Google?” (12), reads one of the quotations from a research participant. We have previously discussed the inaction of individuals due to the status quo: a combination of a lack of tools, the convenience of ‘free’ services and the size of established digital monoliths. As the report points out, big digital brands are some of the most significant in people’s lives — particularly young people. Despite this, the ability for individual consumers to hold these organisations responsible when they have misgivings about their use of data is next to non-existent.

Measures are being taken to address this imbalance. The GDPR seeks to place tighter controls over what organisations can do with an individual’s data once they have agree to the terms of service. Data could become more protected, more portable for the individual, and use of data more transparent — but is this enough? Many companies and service providers are also seeking external ‘trust marks’ to display their commitment to the correct handling of personal information. The criteria for certification vary, from using stringent certification criteria (e.g. our own Mydex Trust Framework, the Fair Data certification, or tScheme) to peer-to-peer style review systems that rely on the community to enforce standards.

The idea of trust frameworks and accreditations aims to create ‘cross-brand’ seals of approval that demonstrate to consumers that a particular organisation adheres a particular sent of data handling and management principles. As trust becomes the central theme of many digital brands’ value proposition, these accreditations — able to develop faster and with more agility than regulation and legislation — are expected to pick up momentum, many of them gaining valuable status as respected and trustworthy.

The benefits do not extend only to the individual, however. Trust framework and accreditation schemes can also help organisations to become compliant with upcoming regulatory changes, such as the GDPR, which is to be implemented in May 2018. Going through the accreditation process could save organisations significant amounts of time and money with regard to compliance, as well as providing them with a valuable means of differentiating themselves in a way that consumers can understand.

We expect to see these kinds of frameworks become popular as big brands begin to realise that being a household name is no longer a free ticket to trust amongst individuals who are beginning to make more concrete demands about the use and handling of their information online.

Understanding the relationship

Not only are people making more demands in terms of the handling of their data, they are also becoming more aware of the exchange taking place when they sign up for online services. Consider this observation from the report (11):

As the convenience and reach of digital technology increases, so does dependence and with it the sense that it could all be ‘too good to be true’. There is a concern that perhaps nothing is actually really free and that there will be consequences for them.

The era of the interactive web that we are currently experiencing is built upon ‘free’ services. The vast majority of the biggest online platforms offer their services for no monetary fee. The current consent model — where a new user consents to the terms and conditions of a company at the point of signup — allows an organisation to share and ultimately to monetise its users’ data without their knowledge. Not only this, but this setup traditionally offers no means of recourse in terms of updating what data is shared and with whom in the future (not including self-posted data in the context of social networks).

This can, legally, be defended by the existence of supporting clauses in the terms and conditions that an individual agrees to — but invariably doesn’t read — in their rush to sign up for a service. As one participant in the report points out however, they “read them but you still don’t have a choice about what you’re signing up to”; or put perhaps more succinctly by another participant, “they’re a joke; no-one could understand them” (14). Indeed, a contract between two parties that can only be understood by one of them doesn’t seem to constitute a fair relationship.

As the report then points out, claims that individuals do not have any interest in understand their relationship with organisations are — certainly in the present day — not watertight (14):

…it is important to see this not as a lack of willingness to understand the relationship, but more of a lack of confidence in their abilities to do so given the complexity of terms and conditions. It is also clear that the terms and conditions, as currently designed, does not work for many consumers.

There is a clear call for a relationship between organisations and individuals that is conducted on a level playing field; that is, a relationship that everyone can understand.

Seeing through the facade

An important part of this ‘equal’ relationship is the ability for consumers to know what is happening to their personal data. Transparency is key. Those well versed in the changes brought by the GDPR will know that transparency is high on the agenda, with organisations having to provide more detailed information, more often, on how the customer, user, citizen’s personal data is used and will be used.

In her inaugural speech as Information Commissioner at Ctrl-Shift’s PIE2016 event, Elizabeth Denham reinforced this message, saying that “transparency is top of the list”, and stating her belief that “it’s not privacy OR innovation — it’s privacy AND innovation”. The full text of her speech has been published on the ICO website.

But there is more to what Commissioner Denham said than just the agenda of the ICO going forward. She expressed an increasingly popular sentiment in no uncertain terms: “however wide the range of possibilities there is a single common inescapable factor. Consumer trust is essential to achieving growth.” The findings of the CAB report corroborate this theory, and indicate an important change in consumer thinking (19):

“Consumers feel that terms and conditions and privacy policies which communicate how their data is used, are overly complex, and adopted to discourage understanding of what they are signing up to.”

If it were plotted on a graph, the importance of trust to individuals vs. the amount of trust they report to have in organisations are diverging greatly. Addressing this balance, whilst not having an obvious first-degree return like new features or a change in pricing, is an essential building block, without which other plans around new relationships with individuals will most likely fail. As the report explains (21):

If brands were more transparent about the value they get from consumer data, it would allow the people to have a better sense of their worth in the value exchange. This, by itself is not necessarily empowering, but it will allow a more honest relationship, which is a prerequisite to building trust.

The message is ultimately simple: building your interactions with individuals around trust and transparency will open up a wealth of opportunity as well as save a massive amount of time and money. It is an easy to way to ensure compliance with upcoming regulation, it’s a good means of ‘future-proofing’ your organisation, and most of all, it is essential if you want individuals to feel any sense of loyalty to your organisation. People are waking up, they are learning, and they are more discerning than ever. Trust is the big opportunity for brands to be on track for the next era of digital.

—

Liz Coll, the main author of this report, has now left the Citizens Advice Bureau and taken on an exciting new role in global digital consumer rights at Consumers International. We thank her for this report and wish her great success in her new position working on a global stage. You can keep up with Liz on Twitter via @elcoll.

These new services directly support the increasing demand for their existing services, Two-way data sharing and Identity services, which are central to delivering public services such as health and social care, housing, and the delivery of trusted evidence to underpin digital transactions.

The two new Specialist Cloud Services offerings are described as accelerators which enable organisations — working alone or in local clusters — to rapidly map out and implement transformative public services through taking a person-centred approach to delivery. This could mean tackling fuel poverty, access to specific benefits, or simply cutting the cost of processing applications and reducing the effort for citizens and public services employees alike.

The services are modular and configurable in nature, designed specifically to support the diverse needs of local authorities, housing associations, healthcare organisations, charities and central government. The services can be accessed by the smallest of organisations and clusters through to the very largest. The key components of the services are as follows:

• Workshops
  • Preparation (reading, coordination, stakeholder liaison)
  • 1 day workshops on client organisation premises
  • Workshop follow-up
• Customer journey data flow analysis and review (journeys, forms, dataset requirements, relying parties)
• Planning and implementation support (telephone and face-to-face, document & plan reviews)

The services are live as of today (1 August 2016) and available on the Digital Marketplace.

Mydex CEO David Alexander said

“We are excited to be able to help organisations and local communities get to grips with person-centred services more quickly and easily than ever before. We can work with them to realise the dramatic benefits that come from including improved outcomes, faster, more efficient services and reduction in time, cost and effort of all involved. We look forward to making our long-standing expertise in this area more easily accessible across the public and third sector — either directly or via the growing number of G Cloud-approved suppliers, increasingly seeking new and innovative ways of transforming public services.”

Note to editors

Government Cloud Computing (also called G-cloud) is a U.K. government programme to promote government-wide adoption of cloud computing. The initiative focuses on cloud computing’s capability for economic growth, capitalising on cloud’s cost savings and flexibility to create a more efficient, accessible means of delivering public services.

Since its inception in 2012, over 1,200 suppliers have gone through the procurement process, listing over 13,000 approved services. The Digital Marketplace saw organisations across the public and third sector purchase pre-approved services from G Cloud to the total value of £1.2bn.

https://www.digitalmarketplace.service.gov.uk/

Mydex is a Community Interest Company and Social Enterprise. Its live, certified Platform and Trust Framework allows individuals and organisations to securely exchange verified data with confidence. This enables organisations to massively reduce the traditional cost, risk and effort associated with shifting to a seamless digital channel, whilst greatly improving customer service.

https://mydex.org

Timpson have opened a pilot shop for their new concept brand, ‘ArkHive- The identity shop by Timpson’ in Henley-on-Thames. This pilot shop will be used to test a variety of identity-focused services. One of these services is verification, capture and digitisation of documents and forms of evidence an individual needs to prove their identity e.g. an individual who cannot verify their identity online, a potential employee for a job, bank to open an account or, get a loan or mortgage.

The services are on offer to both organisations and individuals. Mydex CIC, its Trust Framework and Platform provide the underpinning Identity as a Service that delivers the ArkHive ID, the personal data store at the heart of ArkHive services itself and its consent management. Mydex CIC was selected for its high availability, security and external independent certifications for ISO27001 (Information Security Management System) its community interest company status and as a certified Fair Data Enabler.

Mydex CIC are facilitating many of the services at ArkHive which Timpson believe could end up forming part of their service offering in their core estate of retail branches. These services will help address identity verification and assurance requirements across the public, private and third sectors, providing the important missing link between online and offline transactions. Timpson have already run trials with the public sector at ArkHive and are keen to continue doing so.

All verified documents and evidence of identity are stored in the Mydex-powered ArkHive, which means consumers can capture evidence once and share it when and where they need to.  The UK Government’s GOV.UK Verify scheme could benefit from ArkHive services by enabling individuals with limited identity evidence to capture what they have and make it available to any of the certified companies, using the data sharing capabilities of the Mydex Platform — all with informed consent of the citizen.

Timpson have over 1,400 hundred shops across the UK today. The first ArkHive shop is being trialled for 6 months. If successful, Timpson plan to expand the ArkHive brand further into major cities across the UK. Alternatively, particular services may be selected to form part of the offering in their existing retail shops.

For further information

• Lack of resources
• Lack of technology
• Lack of motivation.

The four-year-old drought in California, one of the most severe since the state started keeping records, provides a good example of the interplay of these factors. Neither money nor labour can create more water: the resource simply is not there. Better technology might help California’s residents and businesses make more efficient use of what’s available, and provide more efficient and affordable methods of treating water that today is unusable. However, technology is only useful if people are aware what it can do and are (a resource that’s often missing) willing to accept change (a motivation that’s often lacking).

The will to make only changes that support the status quo is probably greater than the will to change how California uses water for the long term. Entrenched interests resist shifting to less water-hungry crops. It may be impossible to reach a compromise that balances different users’ needs. Finally, the time scales are mismatched: refilling depleted aquifers or reversing climate change is measured in centuries and millennia, not human lifetimes. All of these factors help create a stalemate.

In this case, however, it’s reasonable, if short-termist, for people to think that even this long a drought is temporary: rain must fall sometime and restore “normality”. We can’t have the same confidence about solving our most intractable social problems after centuries, of failure.

The UK is one of the richest countries in the world. And yet, government statistics say that in 2013 2.35 million households – approximately 10.4% – lived in fuel poverty, up from ten years earlier, down from 20 years earlier. In October 2015 the Money Charity estimates aggregated personal debt at £1.456 trillion – a per-household average of £53,918. Average debt per UK/EU student in England was £12,6511 in 2013/2014. A BBC study found that 21% of Britain’s population are digitally excluded because they lack the digital skills and capabilities necessary to benefit from internet access, and that just under 10% of the adult population may never be able to gain them. These are just three of the long-term intractable issues that our country struggles to solve – see also community rehabilitation, world-class health and social care, prisoners’ connections to their families, and digital enablement.

Even during the past few years of austerity, the money spent studying and trying to fix such problems has run to billions of pounds. Arguably, therefore, the problem is not a lack of resources.

Britain’s long history of failed large IT projects also tells us that the simple availability of technology by itself won’t be enough. In the past decade such efforts have included the National Project for IT, which was meant to move the entire NHS into a single national infrastructure to connect England’s 30,000 GPs and 300 hospitals and gave every patient a centrally held electronic health record. The project was initiated in 2002 and originally budgeted at £2.3 billion over three years; it was effectively disbanded in 2011, by which time the final cost was estimated at £20 billion. In 2013, the Public Accounts Committee called it one of the “worst and most expensive contracting fiascos” in public sector history.

But that’s just the beginning. Billions more have been spent defining strategic road maps, visions for the future, and architectures for the implementation of a digital revolution in how people should interact with government services and the world at large. And yet, what changes?

One consequence of the recession and these expensive failures was the 2011 formation of the Government Digital Service to take a new approach. Instead of large, eventually cancelled projects plagued by time and budget overruns, GDS is intended to create light, small pilot projects that can be quickly adapted to changing conditions and, when successful, copied and deployed. GDS is meant to create digital channels – not just internet access – through which government may interact differently with citizens and other sectors.

And yet, even GDS, while effective at improving the “customer experience”, has failed to effect fundamental change. For example, one early proof-of-concept demonstration was intended to show what “government as a service” might be like, turning the process of completing the paperwork to start a new business into one of a few minutes rather than a few months. Even if this demonstration had been turned into a real service, it was still built on the old organisation-centric structure in which the government holds and processes the data. Why do even these expert, well-intentioned staff wind up creating yet another enterprise architecture, rather than a paradigm shift?

That kind of streamlining is a beginning, but not the right one. Solving our most complex problems will require profound reinvention of how we think about systems and data. If every system continues to be built as a front to a large, centrally held database, citizens and consumers will continue to be fundamentally disempowered – and no new solutions to age-old problems will present themselves. Meanwhile, the cyber threats to such databases will continue to rise, leaving all of us vulnerable to the big customer system hacks and personal data losses that reached the headlines every week in 2015 and are endemic to these failed architectures .

In the coming months, we will discuss each of these problems separately with a view to suggesting how they might be reimagined to find real solutions.

It was an informative and inspiring event. First it showed the Young Foundation confident and vigorous after a period of transition. It is doing new work on people, places and gender equality, with major projects in Leeds and Northern Ireland, and a new tie up announced with Mondragon, the Spanish conglomerate of co-operatives.

Some of the still vigorous household-name institutions Michael Young founded – such as Open University, and the consumers’ association Which? – were strongly respresented, full of relevance and ideas.

But for all the institutions represented there, many of which Michael Young had founded, the most informative and compelling insights came direct from the man himself, via several people who had worked with him known him well including the new director Glenys Thornton, Kate Gavron and the Young Foundation’s original director Geoff Mulgan.

We learned about an exuberant and enfuriating man who made a point of treating “no” as a question, who advised entrepreneurs to seek out their severest critics because they were the most helpful, and to persevere to the point of stubbornness until the problem was solved. He was an academic sociologist whose research method of listening and talking would now be described as ethnography. But the point of his efforts wasn’t academic; the point was to change the world. And he did this by creating viable institutions, both commercial and above all social enterprises.

Geoff Mugan’s recollections are well worth reading, and his summary is characteristically succinct and insightful. Happy anniversary to all involved.  Mydex CIC wishes the Young Foundation every future success and looks forward to being part of Michael Young’s successful legacy still to come.

Interoperability for all

Mydex CIC is committed to open standards and is pleased to support the OIX in this endeavour. We continue to state the importance of interoperable standards in creating the secure, smooth and cost-effective exchange of data that will allow the budding digital ecosystem to flourish. The OIX’s work will support the Mydex Trust Framework and the core components of the Mydex Platform, which are detailed and documented on our listing, and we are pleased to have a listing that supports our mission and increases our reach.

Read the FAQs on OIXnet to find out more, our website to read more about what we do, or visit the Mydex Community Platform to ask questions and find answers.

]]> https://mydex.org/blog/2015/11/25/mydex-cic-listed-on-oixnet-registry/feed/ 0 https://mydex.org/blog/2015/11/24/the-mydata-nordic-model-a-promising-paper/ https://mydex.org/blog/2015/11/24/the-mydata-nordic-model-a-promising-paper/#respond Tue, 24 Nov 2015 18:00:45 +0000 https://mydex.org/?p=11877 the publication of a paper entitled MyData: A Nordic Model for human-centred personal data management and processing. The paper champions the concept of personal control over personal data, the model they suggest aiming to “strengthening digital human rights while opening new opportunities for businesses to develop innovative personal data based services built on mutual trust” [1]. The paper echoes our ...]]> Personal control over personal data

Mydex CIC was delighted to see the publication of a paper entitled MyData: A Nordic Model for human-centred personal data management and processing. The paper champions the concept of personal control over personal data, the model they suggest aiming to “strengthening digital human rights while opening new opportunities for businesses to develop innovative personal data based services built on mutual trust” [1].

The paper echoes our values both moral and practical around empowering the individual to get stuff done. We were also pleased to read many similar ideas regarding the potential for reform in local government — enabling truly joined up and cross-channel services. Mydex CIC was particularly pleased to see the emphasis not only on the right of the individual to control over their personal data, but the important, practical point that the individual must have the “right to obtain personal information and use it freely” [3]. The benefits of this approach to individuals and business alike are significant, as we recently wrote about.

MyData Principles

The three principles stated at the beginning of the paper are as follows:

1. Human centric control and privacy: Individuals are empowered actors, not passive targets, in the management of their personal lives both online and offline – they have the right and practical means to manage their data and privacy.
2. Usable data: it is essential that personal data is technically easy to access and use – it is accessible in machine readable open formats via secure, standardized APIs (Application Programming Interfaces).
3. Open business environment: Shared MyData infrastructure enables decentralized management of personal data, improves interoperability, makes it easier for companies to comply with tightening data protection regulations, and allows individuals to change service providers without proprietary data lock-ins.

These principles are the basic enabling concept, designed to reap the benefits of such an approach, as the paper goes on to discuss.

Straightforward benefits

The benefits illustrated by the paper closely align with those that we have presented time and time again throughout Mydex CIC’s growth. Individuals, the paper says, end up with (among other things) “better data based services”, “better privacy, transparency and control”, “insight into their own behaviour”. Companies benefit from (again, among others) “consumer trust [strengthening] engagement”, “integrated complimentary services enhancing the core service product”, “insight and transparency into consumer behaviour and its impact”, and “tools for complying with data protection legislation”. We are happy to see a set of technical and moral principles that align with our vision for the digital ecosystem, and we think that the paper presents these very well, in a way that clearly demonstrates the value both to individuals and to organisations. There paper also emphasises the fact that this approach is sector independent [1], and this is of great importance, and something that we at Mydex CIC value highly. The wider benefits for society is a vision that we also share, particularly “parallel developments of digital rights, innovation and business growth” [1].

The Nordic MyData model and the Mydex Platform — subtle differences

We see a great amount of alignment between the concepts presented in this MyData model and the live services offered by Mydex, yet there are subtle differences in approach. Mydex offers three core services: A MydexID as a means of online identity credential management, a set of tools for consent management around personal data, and a Mydex Personal Data Store to store the data you enter or receive from organisations.

We created a simple table to illustrate the differences in approach that we perceived from the paper:

We look forward to this MyData Nordic model evolving into a working ecosystem over time. We learnt many lessons ourselves from taking ideas into reality, and we have no doubt that this model has the potential to have a positive impact on digital data exchange and management.

We are also excited about the potential for Mydex to be a component or certified provider within any future MyData ecosystem that is created using some or all of our component services.

We believe the future is one of interoperability, with the individual at the centre, and we are committed to ensuring that the individuals we service as a community interest company and the organisations who connect to them using our platform can secure global advantage and interoperability as new services and ecosystems emerge.

Mydex CIC is often asked: why are you different? It’s a reasonable question. At first, the description of Mydex CIC’s service doesn’t sound so different. For example: like most other platforms today, the data you store on the Mydex platform is stored in the cloud. Like most other platforms, processing of that data is also done in the cloud, not on your own computer. Mydex CIC is built on entirely open source components but our specific configuration of those components is not open source. So, people ask, how is Mydex CIC different from companies whose platforms it calls “walled gardens” that collect personal data and monetise it?

When you follow the money, the difference is clear.

In the early 1990s, it was popularly predicted that the Internet would be a platform for disintermediation. For a time, that was true: online retailers that began by sourcing their products from distributors began dealing directly with goods manufacturers. Other sectors followed the same pattern: when’s the last time you used a travel agent to book airline tickets or a family broker to buy insurance?

But even then the Internet was simultaneously spawning new intermediaries, beginning with payment providers that accepted credit cards on behalf of individuals and small businesses who couldn’t qualify for merchant authorisations. Many more intermediaries have grown up to join them: search engines act as gatekeepers to content we want to access; aggregators pull in content from myriad sources; mapping services on the web and mobile phones serve up local geography; and social media platforms intermediate personal relationships that formerly, online and off, were direct, private affairs. As the Internet of Things develops to connect up physical objects that today are inert lumps of metal, wood, or plastic, other service providers and manufacturers will begin to intermediate activities as mundane as going to the refrigerator to get out some milk.

These intermediaries make their money in multiple ways. While end users do not pay directly in money for online services such as search, relationships, and communications, they pay with the data the services collect about their behaviour. The intermediary makes its money via commercial relationships with advertisers and others wishing to exploit that data under terms that are never disclosed to end users. Mydex CIC does not do this.

With payment gateways and ecommerce sites, the user pays directly for the service – yet the services still collect and exploit the data. Functionality, such as that embedded in a fitness device or a mobile phone, again captures data about its owner’s activities, which may be uploaded to the cloud and aggregated with others’ data to make it possible to share new functions, create comparison charts, or provide advice. Mydex CIC does not do these things either.

In all these cases, if we as individuals want to view or exploit our data ourselves, we must ask the service provider for access, and even then the data may not arrive in a format we can use. The services can share our data, but we can’t. If possession is nine-tenths of the law, the data is ours, but it’s not ours, and what is done with it is subject to densely written policies that differ from provider to provider and that give us no insight into the underlying commercial relationships.

Mydex CIC is also free to end users; it does not charge end users for the use of its platform, tools, or capabilities. However, Mydex CIC has no access to users’ personal data stores, does not sell data or insights about individuals based on their data or behaviour, does not swap data with other services, does not monetise the individuals it serves, and does not insert advertising into users’ experience of its service or any other. Finally, Mydex CIC does not prevent or inhibit users from exporting their own data to use in any way they wish, including sharing it with anyone else; you control the data you collect and capture, and you choose with whom to share it. This is not a walled garden.

A key element is Mydex CIC’s data-sharing agreement, a standard set of legal terms and protections to which organisations must agree before they are allowed to connect to the Mydex CIC platform or the individuals who use it. No clauses are hidden from anyone, Mydex CIC has no data rights, and no one has access to any individual’s data without their express permission. The commercial terms are published: connecting organisations pay a one-time fee per system for connecting to the Mydex platform, a one-time connection fee per individual they use it to connect to over it, and an annual support fee of 25% of the aggregate of all connection fees the organisation has paid across systems and individuals. There are no volume-based charges; however, Mydex CIC takes a 4% transaction fee where paid transactions are involved, whether that’s the organisation using the platform to either pay individuals for access to their data or using it to charge individuals for use of their service or app. This pay- as-you -go model reflects a sustainable and proportionate approach to funding both Mydex CIC’s community interest and the platform’s safety, security, and stability of operation. The real benefit for organisations is that they are freed of the expensive and risky burden of collecting, curating, checking, and protecting their customers’ data and needing to expose it externally directly.

There is an Internet saying, generally attributed to Andrew Lewis, that holds that: “If you are not paying for it, you are not the customer, you are the product being sold.” Mydex CIC’s commitment as a community interest company is to “carry on its activities for the benefit of the community we serve, which is made up of individuals in all contexts of their lives”. In short, you are not the product.

Providing information about yourself online is a very common process. Whether it be basic details or more complex and private information to verify transactions or access specific services, every customer of an organisation with an online offering has undoubtedly submitted information in an online form at one point or another.  This repeated, manual data entry is not a good process. It requires to data to be verified after entry, and is often data that an individual has entered hundreds of times before in different contexts.

More and more, government bodies and organisations from the private, public and third sector will be relying on online verification processes to get things done, moving away from the physical channel to cut costs and time, and increase service scope and quality. But brands tend to see these processes from behind the lens of their own organisation, without zooming out for a wider perspective. This is not unusual, they are busy with their service offering, verification is part of a means to an end. Mydex CIC identifies some key characteristics that are vital to the success of an interoperable, useful and valuable means of verifying and using identity online. More broadly, this enables end-to-end trusted digital transactions, removing the need form-filling and post-submission verification of information supplied.

Basic tenets of online identity services

Based on a question in the survey, Mydex CIC identified what we consider to be the three most important characteristics of the online identity assurance market. They are as follows:

1. Individuals are able to accumulate digital portable proofs of claims that can be used to underpin their identity and broader entitlements anywhere online.
2. Identity credentials (username and password) and identity assurance / verification will be separate from each other, so that an individual can use any credential supported by the evidence needed to prove their identity.
3. Individuals will be in control of their identity credentials and the underpinning evidence, and can safely traverse digital services with privacy and security independently.

Interoperability is a key element in the success of the wider digital market. Having said that, interoperability is only useful if the individual has interoperable data to take elsewhere. If they can collect proofs of the verified claims that they make about themselves to use elsewhere in the future, the process improves each time they collect another piece of verified evidence.

Similarly, login credentials like a username and password should be considered as separate to the evidence needed to support the access to a particular service. Seen in this way, the credentials (‘identity’) and the required supporting evidence (made portable and interoperable by point 1) can be combined to fit the needs of the specific use case.

With individuals as the point of integration, having control over their online credentials and supported evidence, they can seamlessly access many different online services without the need for organisations to set up difficult data sharing processes amongst themselves. The individual arrives with their portable evidence and identity and accesses a service by combining their credentials and evidence to fit the requirements of the desired service.  This creates a truly scalable and trusted identity ecosystem.

The opportunities for rapid and successful development of the identity market in the UK

Once again, Mydex CIC’s response detailed three main areas that would aid in the acceleration and reduction of difficulty in the creation of this market. At the risk of repeating ourselves (we really do think this is important):

1. Attribute exchange that allows the evidence of identity and entitlement to be served up during an online process.
2. Separating out identity assurance and verification from usernames and passwords and allow them to be a portable proof of claim that individual can serve up.
3. Interoperability across Trust Frameworks and Schemes –  we cannot get to a single protocol or standards so we need to map the differences.

These might seem straightforward, but they are vital — and not a given, as they are not present in the majority of online transactions and interactions to date. Having a purely digital channel with the right protocols in place to allow verified information to flow securely between individuals and organisations is the first step, it removes the need to break out to another (usually physical) channel to provide evidence or achieve verification. This is key in saving time and effort and improving customer experience, and particularly in terms of government and services requiring higher levels of authentication, this allows for truly online service provision with end-to-end trust and no need for offline verification activities, trust travels with the data.

As the market develops, we expect to see a variety of methods for authenticating these kinds of transactions and verifications, based on different trust frameworks and schemes offered by different service providers. It is unlikely that a universal, ‘harmonisation’ type effect will be achieved, at least not in the near future, and for this reason it is critical that the difference between offered protocols and standards are understood and enabled to communicate and understand one another.

Staying realistic: challenges

The OIX survey logically asked about the barriers to this expansion, and Mydex CIC once again identified three problem areas that are pain points for the rapid expansion of the internet identity services market in the UK:

1. UK Government not being a verified attribute provider. They hold many forms of verified evidence of identity for many of the hardest to reach citizens in the UK. By providing that data in verified form back to the individual digitally they could serve it up to any certified company or process needing the proof.  There is strong evidence of the value of governments being attribute providers as can be seen in New Zealand and more recently India.
2. Private, third and local government sectors not making service-derived data about their customers available as verified attributes the individual can collect and reuse to provide proof of status, and claims as part of online digital services.
3. Fixation on monetisation of personal data and fees for identity services instead of looking at it from a cost, risk and effort reduction ROI model.  The focus is constantly on making money instead of saving money, reducing risk and cutting down the effort customers organisations have to expand to verify an individual’s identity and entitlements.

Information held by the government is usually considered trusted, and often used as evidence in the physical channel (e.g. passport or driver’s licence as proof of identity). However, this information is hard to access in digital form and is currently not provided by the government to individuals as portable digital proofs that an individual could use verify themselves to any other organisation requiring this proof online. Allowing this to happen could go a long way in supporting those individuals who don’t have a large online presence to be included in online-only service developments and processes.

The situation in the private sector is similar. Most companies do not currently give data derived from an individual’s use of a service back to them. As above, this could be valuable information that the individual could add to their roster of digital proofs available to access other services online.

The conversation around identity and personal data often turns to monetisation. Mydex CIC believes that the monetisation of the data and paying for the identity verification itself cannot be successful in the long term, and acts as a barrier to the development of a useful and successful online market. A much greater return on investment could be made if the focus was on cost, time and risk reduction instead of the small amount of income that could be generated as a result of the identity verification process.

Make it portable, flexible and interoperable — a surface-level change is not enough

“Fixing the front door isn’t enough”. Creating a user front-end that looks nice and works well is definitely a necessity as part of a customer journey, but it will not go very far in solving the problems facing the online identity market and the digital services that it intends to support. Online identity and evidence needs to be viewed in the context of the wider developing market. People are already trusted with card transactions and other secure practices, why not trust them with evidence about themselves to complete similar processes online? The benefits of portable, reusable proofs and identities are vast for businesses and individuals alike.

]]> https://mydex.org/blog/2015/11/10/shaping-online-identity-services/feed/ 0