Good news for our privacy
57 per cent of Dutch people are worried about privacy
Until recently, most people with nothing to hide regarded privacy protection as an unnecessary luxury. And disinterest remains strong amongst younger generations: 31 per cent say they don't think about privacy protection much. In the wider population, though, interest is fortunately growing. The Privacy Monitor 2021 – a survey by the DDMA (Data Driven Marketing Association) – found that 57 per cent of Dutch people are worried about lack of personal data protection. And 89 per cent want more control over their data. Nearly all the respondents (96 per cent) said it was important to be able to choose what data they share with whom.
Substantial risk of falling victim to identity fraud
Not long ago, we thought of privacy protection mainly in terms of the information about us that the government and big tech companies such as Google and Facebook were collecting. Although such activities were regarded as disagreeable and sometimes very disturbing, they weren't generally felt to present any immediate danger. But, sadly, the landscape has changed. Alongside the persistent concerns about the integrity of big tech and certain state agencies, a more acute threat has emerged: identity fraud. The Data Protection Authority (DPA) has observed explosive growth in hacking for the purpose of harvesting personal data. The number of reports received by the DPA last year was 30 per cent up on 2019. In other words, the likelihood of you or me falling victim has increased enormously.
Our personal data is everywhere
The growing risk is perhaps unsurprising when one considers how much personal data we are sharing all over the internet. The more information about us there is in circulation, the more opportunities there are for criminals to steal our identities. And few things are more worth stealing, because a stolen identity is a golden ticket to criminal profit. It enables crooks to fraudulently order goods, arrange SIM swaps and empty bank accounts.
What's more, some online service providers, including public service providers, apparently don't always give privacy protection the priority it deserves. The answer to such problems seems obvious. As the Privacy Monitor findings emphasise, the time has come to give consumers control over their own personal data.
A self-sovereign identity solution puts you in control of your personal data
Consumers' growing desire to keep control of their personal data is reflected in the rise of self-sovereign identity (SSI) apps. SSI is a term used to describe identity solutions based on validated, secure personal data that remains in your control. You then share that data with online service providers as and when you wish, without the involvement of a third party, such as DigiD, Google or Facebook. Central to an SSI solution is a phone app that works like a digital wallet containing your data in the form of digital ID cards. So, for example, you can show your public service number card (BSN card) to your health insurer, but withhold your DigiD. Consequently, the government isn't aware when you've logged in with which service provider. The same principle applies to using your Google or Facebook profile to log in with an online service provider. When you do that, the big tech company knows when and where you've used your ID, and you don't know exactly what profile information has been shared with the online service provider. An SSI solution puts an end to that undesirable scenario.
Decentralisation and data minimisation
SSI solutions are typically based on decentral infrastructures and designed to minimise data disclosure. For example, with an SSI solution, your personal data isn't stored in a huge central dataset, meaning that there's no data honeypot to attract cyber-criminals. Another advantage of an SSI solution is that evidence of one particular fact can be provided, without sharing any other information. Want to buy alcohol online? No problem: you show the retailer that you're old enough, but keep your precise date of birth and other details to yourself. Need to rent a car? The rental firm gets confirmation that you've got a valid licence, but doesn't get a copy of your licence to retain.
For the moment, there aren't many SSI apps around, and relatively few service providers support SSI logins. However, the market is growing exponentially. And that's good news for the protection of our privacy.
Available SSI solutions
SSI solutions already available include the internationally active US network Sovrin and the Dutch IRMA platform. Although both adhere to the SSI principle, the two systems are technically quite different and offer different levels of privacy protection. Sovrin is a blockchain application, but IRMA isn't. IRMA is an open-source platform developed by the non-profit foundation Privacy By Design.
SIDN is now responsible for the reliability, management and further development of the IRMA platform. In that role, one of our priorities is maximising the scope for using IRMA. So, for example, we've developed IRMAconnect, which makes it easier for online service providers to enable their customers to log in with IRMA. We hope that'll lead to IRMA login becoming an option for a wide range of applications, such as accessing and managing medical records in personal health environments.
What's already possible?
Visit IRMA.app to download the IRMA app, learn about populating it with 'attributes' (items of authenticated information retrieved from trusted sources) and get news of the latest developments. Meanwhile, we're working hard to ensure that, before long, you'll be able to use IRMA to log in to all sorts of services. Putting you increasingly in control of your own personal data.