Driven by the pandemic forcing many conventional services online, the seemingly unstoppable shift to digital services is continuing across the world. Citizens and consumers can benefit greatly from the ability to immediately access a range of essential services through a trusted digital ID. But it’s increasingly clear that data privacy considerations need to be placed at the forefront of the development of digital identity solutions.
Just as digital identity solutions have grown, so too has interest from regulators around potential privacy concerns. Thanks to the introduction of privacy regulations in many regions, especially GDPR in Europe, consumers have been empowered to make informed choices about the data they share.
Balancing act
On a daily basis, thousands upon thousands of data points can be collected about personal behaviour, preferences and interests. Some of this data, which is often linked directly to a persons digital identity, is sensitive and personally identifiable. Not only should meaningful consent be provided for this information to be collected and shared, but it should be protected from falling into the wrong hands.
In recent weeks, regulators in Canada reaffirmed the importance of respecting privacy rights during the creation of digital ID systems. Among the resolution put forward by the privacy regulators was the need to undertake a privacy impact assessment in several stages of the design process. They also stated that the principle of minimising personal information collection should be followed, especially when it coms to sensitive and intimate data.
When implemented correctly, it is possible that digital identity can enhance user privacy, rather than put it at risk. In practice, ensuring that transparency, user control and security are core parts of the final digital identity solution will help build user trust.
Privacy-by-design
While data is a very valuable resource for companies, over-collecting and over-retaining data that is not needed represents a growing problem for organisations. Many new regulators explicitly state that data minimisation should be pursued and collecting too much irrelevant data can also increase privacy risks.
One of the most common mistakes made by businesses is to think of data privacy considerations as an afterthought and a standalone issue, as opposed to an essential element of virtually all parts of the digital identity solution.
Thanks to the creation of a digital identity that offers verifiable and trusted credentials, it is possible to achieve a decentralised identity solution. This form of ID doesn’t require personal data to be stored, as verified details can simply be transmitted once from, for example, a digital wallet.
A mindset shift may be required by some companies that previously saw privacy concerns as merely a box-ticking exercise. By making sure than corporate boards are involved in privacy related issues is important going forward, as consequences of a breach around sensitive data can open up an organisation to everything from brand damage to large fines.
If businesses proactively seek out ways to embed privacy benefits across a digital identity product, beyond simply meeting minimum regulations, users will feel more comfortable and adoption will grow.
_______________________________________________________________________
The conversation continues at the Future Identity Festival 2022, co-located with the Fintech Talents Festival on the 14th – 15th November, at The Brewery, London.
Join 2000 festival-goers as we explore the trends and technologies shaping the future of financial services. World-class learning and engagement, meets live entertainment and our famous craft beer bar, all while connecting with the industry players you are looking to meet. Book your place now!