A potential breakthrough on personal data … and productivity
As far as Government announcements go, this one hardly seems the most exciting: there’s not many people who will see this title — “Digital Identity and Attributes Trust Framework Gamma (0.4) Pre-release” — and think “Oh wow! I must stop everything and read that!”
Yet, amidst a welter of other announcements and initiatives coming from the new Government, this could be the most important thing it does in its entire term of office. We’ll come to why in a minute. But first, what’s it all about?
Why identity matters
In a digital world, identity verification matters. If you are transacting online you need to be confident that the person at the other end of that transaction is who they say they are. If they’re not, all sorts of horrible things could happen, including damaging errors and fraud. Without some way of building this confidence, online commerce and service provision either grinds to a halt or entails all sorts of potential risks and associated costs.
Not surprisingly the potential benefits of cracking this identity problem could be huge. According to McKinsey for example, getting digital identity right “could unlock economic value equivalent to 3 to 13 percent of GDP in 2030”. One example: it could reduce organisations’ costs of onboarding new staff and customers by up to 90%.
But that’s just organisations. McKinsey also estimated that “just over half of the potential economic value of digital ID could accrue to individuals, making it a powerful key to inclusive growth”.
“Beyond quantifiable economic benefits,” their research continued, “digital ID can offer noneconomic value to individuals through social and political inclusion, rights protection, and transparency. For example, robust identity programs could help guard against child marriage, slavery, and human trafficking.”
So, as we said, it matters.
Yet finding a way to verify these identities has proved to be a very difficult task. We know because we’ve been involved in trying to find a workable solution for many years. For example, we were one of just five companies chosen by the UK Government to pioneer its first big attempt to crack this problem way back in 2011 with its Gov.UK Verify programme.
Three hard won lessons
Verify didn’t work and the lessons from its failure are extremely important.
When the UK Government first tackled the identity problem with its Verify programme, its underlying assumption was that ‘digital identity’ would become a new ‘market’ like another, where specialist producers called ‘identity service providers’ would produce a specialist product called ‘an identity’ which they would sell to buyers in a competitive marketplace.
There were three things wrong with this assumption and the lessons learned about them are key to where we are today.
First, there is (and never can be) one, single ‘thing’ called an ‘identity’. People often think of ‘identities’ in terms of a single document like a passport or driving licence. But while these documents are very useful in many cases, they don’t always work. What happens if a person doesn’t have a driving licence or passport, for example? For an identity system to work, it needs to work for everybody, all the time, and ‘identity’ is too fluid and complex a concept to be nailed down by a single identity ‘product’.
Second, identity verification is first and foremost a process, not a product. Driving licences and passports are not official identity documents, for example. They are documents that provide people with certain entitlements. But the information they contain is widely trusted because of the stringent processes that went into creating them.
Crucially, these so-called identity documents are examples of ‘composite’ data points: one piece of data — entitlement to a driving licence — made up of a series of other, separate data points — such as name, date of birth, address and so on — each of which have been separately checked. Each one of these data points being a separate attribute.
That’s what really goes into verifying someone’s identity — the ability to verify different details about them, with these details varying according to the situation. For example, if a person does not have a driving licence or passport, or happens to be homeless, then other ‘verified attributes’ will be needed to verify them. Ultimately, it’s the attributes and the processes for verifying these attributes that matter.
Recognising this is a crucial step forward. For a system of identity assurance and verification to work it needs to be based on the ability to share and access a wide range of ‘verified attributes’ which may vary from one person and situation to another. Identity verification is a by-product of the ability to assemble enough such verified attributes for a person to be confident enough in their reliability for them to act on the information provided. This is why it was hugely important that the Government’s programme was renamed to say ‘Digital Identity and Attributes Trust Framework’.
The third key lesson has been to realise that ‘digital identity’ isn’t a single-purpose product. It covers many different purposes each of which may require different bits of information — different verified attributes. For example, being able to prove you are over 18 so that you can buy an alcoholic drink is very different to being able to prove you are a qualified pilot and really able to fly an aeroplane or that you are not a sex offender seeking to work with children (which is one of the functions of the Disclosure and Barring Service).
For an identity and attributes verification system to really work well, in other words, it needs to be flexible enough to share and assemble a very wide range of different verified attributes for a wide range of different use-cases.
This is what that exciting sounding document called “Digital Identity and Attributes Trust Framework Gamma (0.4) Pre-release” represents: the fact that these lessons have been learned and that, for the first time, after decades of trying, the UK Government has actually worked its way through to creating an approach that can actually work, efficiently and effectively, at scale.
Lifting the productivity logjam
“Yes,” you might say, “That’s great. But does that really make this the most important announcement that a Government could make in its entire time in office?”
Well, here’s why it could be.
Our entire economy — and society — is in the midst of a gut-wrenching, disconcerting and often bewildering economic shift. For hundreds of years it was organised around one, single basic model of wealth creation: deploying energy derived from fossil fuels to drive machines that turbocharged the transformation and movement of physical things. That is what ‘industry’ was about: the production of ever more physical items at ever lower cost.
It was an incredible driver of wealth creation, but now that model is reaching its sell-by date and our entire economy is in transition. It is beginning to pivot around the deployment of an entirely different type of resource — data — that enables us to do a different set of things that provide new value along different dimensions: make new discoveries; make better, more informed decisions; organise and coordinate the detailed actions needed to implement these decisions.
In other words, we are moving from a ‘thing’ driven economy to become a data driven economy and with that, we are opening up opportunities for improved productivity (and quality, and innovation) that the industrial age couldn’t reach.
Here is the point most people miss: Data in the form of verified attributes lies at the epicentre of every step of every service that deals with an identified individual. As well as identity assurance, these activities include onboarding and recognising service users when they return, deciding on eligibilities, configuring service details according to the specific needs and requirements of the individual and the circumstances in which the service is being provided, planning coordinating and executing the many necessary details of service delivery, and undertaking associated record keeping and customer services. Data is how services are provided.
If at any point, the data needed to drive these activities is wrong or unreliable the whole process either grinds to a halt or starts producing the wrong outcomes. In this sense, verified attributes are the new oil of an efficient, productive economy - not the ‘new oil’ that people talk about, as in Big Money and Big Power struggles, but the easily overlooked but ABSOLUTELY ESSENTIAL oil that lubricates the machinery of the entire economy. This is true of every citizen-facing service you may think of, from central and local government services, through health and care to education, financial services, retailing, travel and so on — across every sector (public, private and third).
It is precisely because we do not have reliable operational processes for the sharing of verified attributes that productivity in this country is flatlining. By opening the door to these reliable, trustworthy processes the new Digital Identity AND ATTRIBUTES Trust Framework is opening the door to a new, economy wide productivity revolution.
As part of this, the new Framework has identified the core functions that lie at the heart of this new data-driven economy. They are:
‘Attribute Providers’ that collect, create, check or share pieces of information that describe something about a person, ‘Relying Parties’ that use this information to undertake a service, and ‘Holder Services’ which provide individuals with the ability to securely “collect, store, view, manage or share identity and/or attribute information”, and which enable these individuals to “control what information their holder service stores, when it can be shared, and who it is shared with”. (A personal data store is one form of Holder Service.)
The Trust Framework identifies other categories and functions too. They include identity service providers which “verify a user’s identity for one-off use at a single point in time”; orchestration service providers that “make sure data can be securely shared between participants through the provision of their technology infrastructure” but are not user-facing; and component service providers who provide specialist information (such as biometric data) that can be used in an identity verification process.
But it is the first three that really count in terms of understanding how the emerging data-driven economy will work. It will be driven by organisations which produce information (particularly verified attributes), organisations that use this information to provide specific services, and Holder Services that connect the two, including and embedding individuals as active parties in the collection and sharing of their own information.
This is the logical structure and architecture of a data sharing economy that has grown up inside an industrial age. Modern service providers don’t only produce services. They also produce and use data (e.g. verified attributes). Holder Services provide the glue that brings them together safely and efficiently — as the hub and clearing house for data sharing.
This is what makes the Trust Framework so important. The concepts and processes it is laying out have the potential to last long into the future, becoming embedded into how our economy works in 20 years time and beyond, with transformational impact on how this economy works. Remember McKinsey talking about 90% reductions in the costs of onboarding new staff and customers? With the approach identified by DIATF, similar productivity breakthroughs become possible with every step of every service that needs verified information about people in order to serve them.
Ensuring trust
But the Trust Framework does a lot more than just identify the shape of things to come. It is also helping to ensure that these things happen on the ground, and that they happen safely. It doesn’t allow any old chancer to come along and say “I am an attribute provider” or ‘Holder Service”. It creates processes for their independent certification, so that people can trust their operations.
It also creates room for supplementary schemes that apply the Framework’s core principles and processes to specific situations where more detail is required. It is creating what it says — a framework — by which this system can actually work.
One key question remains. Will the public ‘buy’ it?
Here, research undertaken as part of the development of the new Framework is crucial. Below we include some quotes from this research. We quote them in detail because they speak so strongly to the work we at Mydex CIC have been doing all these years on this front.
Please note: in what follows we are quoting from the research report. These are not our own words.
A human rights issue
“Participants’ attitudes towards identification and digital identity services shifted during the course of the dialogue. Many participants began the dialogue believing that having identity documents is purely practical. As participants’ discussions developed, many began to think of identity documentation as a basic human right.
“Participants perceive it to be an articulation of being human and a demonstration that they have a recognised role in society. Participants believe the importance of identity data is not simply practical but also instrumental in people having control over their lives and life chances.
“This has ethical implications. It means participants want to know that service providers will look after them and their data and protect and support the vulnerable and disadvantaged in society. This is important so that everyone can accrue benefits from digital identity services.
Human centred
“This human-centred approach is requested throughout the system…
“This points to a broader, more philosophical point that is a thread throughout the dialogue. Participants are concerned that digital identity service providers will be more focused on the technical aspects of the service than they are with developing a service that will take care of users and provide them with the support they need to use the service, and to ensure their data is safe and secure. Participants believe their confidence and trust in services will develop and increase if they see evidence, through the trust framework and in the actions of service providers, that they support people and put user needs and experiences at the centre of service design and delivery.
A public service & trustworthiness
“Participants want to know that digital identity service providers are motivated by more than generating income. They call for the trust framework to make it clear that public benefit is a core value for those being certified to deliver digital identity services, and the government and OfDIA [Office for Digital Identity and Attributes] as overseers of the programme.
“Participants articulated a ‘trust tension’: whilst they do not trust the government, they feel that a public sector organisation, a non-profit organisation or a research consortium might be more trustworthy than private sector organisations. This is seen as more trustworthy as it would operate without vested interests or the need to satisfy company shareholders … whilst trust in government is low, trust in government sponsored bodies is higher and perceived as more trustworthy than private sector organisations.
Benefits to society
“This leads to the second key factor. Participants want to know that digital identity service providers are motivated by more than generating income. They call for the trust framework to make it clear that public benefit is a core value for those being certified to deliver digital identity services, and the government and OfDIA as overseers of the programme. In this context, convenience on its own is not seen as a strong enough benefit. Delivering services which provide a trusted resource which can be used interchangeably across services and in a range of contexts is more powerful.
Inclusion
“Participants do not see convenience on its own as a compelling enough reason for increased use of digital identities. They want to know how digital identity services are going to benefit society by making proving identity more inclusive. “Participants want to know that these services are accessible to those that want and need to use them. Having options that work for everyone is seen as part of an inclusive system, one which enables people to verify their identity or attributes in the way which works for them, whatever their background, level of skills and experience. “They want to know that service providers will look after them and their data; protect and support the vulnerable and disadvantaged in society so that they too can accrue benefits from digital identity services.
Control
“Participants believe the trust framework should provide a clear statement on how users ‘own’ and ‘control’ their data.
“Having control over their data is important to participants. They want assurances within the digital identity services trust framework that they have choice about who they share data with and why.
“Participants believe the trust framework should provide a clear statement on how users ‘own’ and ‘control’ their data, including being able to update it and protect personal data they do not wish to share.
Personal utility and agency
“Participants see identification for consequential transactions such as renting or buying a property; proving you have the right to work in the UK or to get or renew a passport or driving license as more complex. It moves identification beyond the practical to instrumental in achieving life shifts such as demonstrating something significant and personal to them, including gender transition.
“The more participants thought about identification, the more they considered it a route to demonstrating that they are part of and contribute to society. Many participants feel that not being able to demonstrate something about themselves could have a significant impact on their lives, including having a meaningful role in society.
Conclusion
In trying to find an answer to the pressing question of digital identity, the UK Government has been on a long and steep learning curve. It might have taken nearly a decade and a half, but it has now arrived at a way forward that works — a way forward that could prove transformational for our economy and society as a whole.
A key part of this is recognising the role of individuals and their Holder Services: the right and need for individuals to participate in an identity and attribute data sharing ecosystem with all the qualities identified by the programme’s public engagement research: human rights, human centredness, public service and trustworthiness, benefits to society, inclusion, control, personal utility and agency. That is what we are about as a Community Interest Company.
DIATF encapsulates a formula for the treatment of personal data in a data-driven age. It transcends the limitations of the organisation-centric database by enabling data sharing via Holder Services. By embedding human rights into how it works operationally, it also transcends the trade-offs between data protection and innovative uses of data. This trade-off has bedevilled the growth of this economy in its early years. In doing these things, it enables the data sharing that is needed to unleash personal data’s full social and economic potential.
Of course there is many a slip between cup and lip. Everything depends on how this Framework is interpreted and implemented. But for now it represents a strategically crucial beginning.
At Mydex, we have been involved in this journey from its beginnings with the Verify programme of 2011. We look forward to contributing further as it unfolds.
A potential breakthrough on personal data … and productivity was originally published in Mydex on Medium, where people are continuing the conversation by highlighting and responding to this story.
1.png)
1.png)
