Digital Identity - what could it mean for consumers?

In our latest blog post Amanda Long, Director General at Consumers International, discusses the topic of digital identity and the potential benefits and threats for consumers.

The idea of people having an easy way to prove their identity online through a digital identity is not new, but has so far been used mainly by governments enabling citizens’ access to public services. Austrian citizens can use an approved app on their smart phone, or a smart card to apply for benefits, do tax returns or access healthcare. 

A digital identity is a means by which individuals can prove their identity online - for example, job applicants needing to prove their residency status, or even qualifications.  It links up to an identity checking system which can verify that the person with that identity is who they say they are – both online and in person. This means people can use their digital identity credentials to access services or products without having to physically present valuable documents, such as passports, birth certificates, driving licenses or a handful of utility bills.

Digital identity could represent a comprehensive solution to many millions of people who are effectively barred from entry to many things that could improve their quality of life. Without traditional forms of documentation, transactions like renting accommodation, setting up a bank account or getting a mobile phone contract become impossible.

It could also solve problems for consumers in more developed markets, wherever identity is a problem. According to a start-up digital identity provider: “Age verification online would prevent underage users from opening inappropriate social media accounts, and ensure that minors cannot access adult content. It would also help online retailed to confirm that someone is eligible to buy age restricted goods like DVDs, computer games, alcohol, cigarettes and knives” (YOTI)

Digital identity could potentially deliver financial inclusion, seen as a strong route out of poverty - or at the very least accelerates us towards it. The World Bank has a programme dedicated to identity and financial inclusion, ID4D – which “helps countries analyse problems, design solutions, and implement new systems to increase the number of people with official identification and the development impact of the overall identification system.”

Of course for some people, the scope that any kind of centralised identity system has for government surveillance and discrimination will be cautious about the implications of digital identity systems. With this large caveat in mind, what is there that we learn from the pioneering steps governments have taken in exploring digital identity that might be useful for budding consumer applications? The UK digital identity verification programme has developed a set of Consumer and Privacy principles to guide practice. 

These types of frameworks will be important as the implications of this technology could be significant. If it is not designed with protection in mind and regulated accordingly:

-          Individuals’ privacy could be at risk, with the potential for personal data for all parts of your digital existence being held by digital ID verification services, as a means to authenticate who you are, with you having little or no control of what’s collected and stored or how it is being used to make decisions about you.  If alternative income streams to monetising consumers’ personal data aren’t identified then the risks to privacy will continue.

-          There is a threat of lack of consumer choice. It is very possible that a critical mass could form of people using a particular digital identity service that means it is effectively forced onto everyone.  This could mean less competition between digital ID verification providers and also a weakening of consumers’ rights to protection. In this scenario, the speed at which a particular service is adopted by a mass of people may mean that the opportunity to check, challenge and reform terms and conditions of the service are reduced. An individual who is swept up with this, who sees it as the only way to continue access to a product, may agree to terms and conditions that if given more time or choice they would not.

-          We might also see a situation where one person would need multiple digital identities, in order to access a variety of services as companies may not recognise the same identity providers.

-          The liability model for digital identity is also complex. For example, should digital identity providers be responsible for actions done based on the authentication they give?

With so much potential for consumer benefit and significant threats at play, consumer organisations must build up their expertise on this issue so they can influence the private sector as it develops digital identity systems. Consumer organisations are in a strong position to draw upon existing public sector practice, and the need for trust, confidence and consumer protection in digital systems to influence this nascent industry for the better.

Groundbreaking Partnership to Create a People's Charter for the Internet

Amanda Long, Director General of Consumers International and Anne Jellema, CEO of the World Wide Web Foundation discuss their new partnership to create a People's Charter for the Internet and what this will mean for consumers.

"The web is now a public resource on which people, businesses, communities and governments depend. I believe that the future of the Web is under threat from some governments that may abuse their powers, some businesses that may try to undermine the open market, and from criminal activity. The future of the Web depends on ordinary people taking responsibility for this extraordinary resource and challenging those who seek to manipulate the Web against the public good."

So wrote Sir Tim Berners-Lee, World Wide Web inventor, and founding director of the Web Foundation, last year. Of course, the opportunities - and challenges - posed by digital technology have been long foretold. In 1962, addressing the United States Congress, US president John F. Kennedy observed: "The march of technology... has increased the difficulties of the consumer along with the opportunities; and it has outmoded many of the old laws and regulations and made new legislation necessary."

What can we do to ensure that Internet's power is returned to individuals, and that the Web is advanced as a public good that benefits all of us?

At Consumers International, and the World Wide Web Foundation, we think it's time for a People's Charter for the Internet. One which starts with the presumption that all women and men should have equal access to the life-changing power of the Internet, and should have the same rights and freedoms online as apply offline. One that gives us control over our personal data and how it is used, whether by companies, governments or other organisations. One which puts fledgling entrepreneurs on a level playing field with giant multi-nationals, and gives everyone a chance to create and succeed - whether in business, science, education or any field of human endeavour.

We're not alone in feeling this way. The United Nations Special Rapporteur on Privacy has declared that it's time for a new 'Geneva Convention' for the Internet. Countries such as Brazil and Italy have created their own 'Bills of Rights' for the Internet. Meanwhile, 80% of respondents to a recent Consumers International member survey said that legislation, regulation and standards relating to redress are ineffective at keeping pace with the digital economy.

We know what is at stake and so we are determined to tackle this challenge. That's why, today, we're announcing a new partnership between Consumers International and the World Wide Web Foundation to drive this idea forward. By joining forces, we can bring together over 400 member and partner organisations that span consumer rights, digital rights and civil liberties across more than 120 countries. By bridging our two communities, we can create a powerful vehicle for change.

How might we develop such a Charter? We're clear that it needs to balance the views of experts, industry stakeholders, regulators and ordinary people, so it truly reflects the Web we all want, and we'll be gathering views far and wide. And how might it be used? We're not naive enough to think that it will become international law anytime soon, but using our networks, we can work to convince companies and governments to commit to its principles, and ensure that the Internet advances empowerment, rights and opportunity for all..

We'll be making more announcements in the new year with specifics about how the Charter will be built and launched, but for now keep up to date with developments on the Consumers International website and on our social media channels, Facebook: facebook.com/consumersinternational and Twitter: @Consumers_Int.

Towards a Magna Carta for the Internet

Speaking at the Web We Want Festival at the Southbank Centre, London, CI’s Director General Amanda Long explains why a ‘Magna Carta’ for the web could be the vehicle to delivering established consumer rights for everyday digital consumers.  

The concept for developing a Magna Carta for the web is an initiative being taken by Sir Tim Berners-Lee and the World Wide Web Foundation.

The web has transformed consumer experiences, with the Internet fundamentally changing for the better how people interact and transact with markets. 

We can now engage at a time of our choosing, draw on a massive volume and range of information, select from unprecedented choice; all with access to global markets on hand held devices. 

The Internet also transforms notions of what it actually is to be a consumer – we’re pro-consumers and collaborators on the web. Creating, curating and sharing content including rating and reviewing our experiences.

Because the web grants access to a media for the masses, where information flows bottom up, at scale, for the first time in history, dynamic new forms of consumer empowerment emerge. 

However, whilst the web makes collaboration easy - from forming groups to aggregating demands to achieve a shared goal - these many benefits come with major challenges. 

Technology outpacing consumer protection

Back in 1962, in a landmark address to Congress on Consumer Protection, President Kennedy observed that: “The march of technology….has increased the difficulties of the consumer along with the opportunities; and it has outmoded many of the old laws and regulations and made new legislation necessary.”

For our Members, that observation has worrying relevance today. In our recent Consumer Protection Survey their responses contained a clear message that: The rapid evolution of the digital economy is outmoding and outpacing consumer protection. 76% felt enforcement of consume protection was ineffective in the digital economy – worse than any other sector.

Access is a significant consumer challenge; the majority of consumers are yet to use the internet, let alone see the benefits. There is also the issue of having reliable, good connection alongside, affordability, quality of customer service from the providers and unfair and overlong contracts. User license agreements are often too long, too complex and too inflexible, making consent look like submission.

In some cases consumers are being exploited for their data by companies using it to enable discriminatory, personalised pricing. The question of ‘who owns our data?’ is an increasingly important current issue.

Why we need a Magna Carta for the web

We really are at a vital stage in the evolution of the web, in the digital century it is an essential service. Considering the challenges that consumers face we need to establish users’ rights and ensure they are respected. A ‘Magna Carta’ for the web has the potential to be:

• global in its application and reach;
• not subject to the vagaries of implementation that afflict institutional responses;
• draw directly on the voice, aspirations and priorities of web users in its drafting and reflect them in its final form;
• an effective tool of self-regulation if companies voluntarily commit to its principles;
• the stimulus, building political will to develop relevant legislation, and for policy-making in nations.

The web we want

This Magna Carta initiative represents an ideal opportunity to articulate a vision of the web where:

• Innovation can still move fast, without playing fast and loose with established rights;
• Commercial success online is based not on a business model that exploits users, but on ensuring users are better able to exploit all the potential of all of the web.

The ‘Magna Carta’ could be the vehicle to deliver this and consumer rights have the potential to be one of the key agents for change globally. 

Tick, click and hope for best no longer cuts it for consumers who want tech on their terms.

The next big step for consumers in the digital age could well be one that puts consent to share data on the terms of the individual, not the service provider. CI Director General, Amanda Long, explains.

The storm over Uber’s consumer privacy settings is just the latest in a growing list of concerns about the tech industry’s handling of our data. From general irritation about targeted ads; to deep unease about our personal data security, to fears over the erosion of civil liberties – there is concern about who has access to data about us and what they are doing with it.

In the US 86% of consumers have tried to use the internet in ways that minimise the visibility of their digital footprints. Across Europe, 55% of consumers fear becoming a victim of fraud when disclosing personal data in online transactions, while 68% of UK consumers find the way that brands use the information they hold on them creepy.

This unease is exacerbated by the lack of transparency over who is obtaining our data, who they are sharing it with, how they are using it, and to what ends.

Take Axciom, one of the world’s largest data brokers. Unbeknown to almost everybody, it is reported to hold 1,500 pieces of information on more than 500 million people around the world, giving it the ability to predict 3,000 possible reactions to brands and marketing techniques. 

Such data brokerage firms – part of a multi-billion dollar industry that has emerged to meet growing demand – are harvesting data about us from multiple sources online (and offline) and combining it into rich, if incomplete and context-less, profiles of individuals, segmented to meet the needs of their clients.

The collection of such data is being used to sell us stuff in more and more extraordinary ways.  

Personalisation

In 2012, for instance, US retail giant Target sought to outdo its competitors in reaching the lucrative ‘new parent’ demographic by developing an algorithm that used purchasing history data to predict which of its female customers were pregnant. It would then send tailored discount vouchers for maternity and baby items to women it predicted were in their second trimester. The results are now data segmentation folklore.

Authorities in London last year had to stop a company’s roll out of ‘smart’ litter bins that were connecting with pedestrian’s phones and serving up targeted ads based on places the passer-by had previously visited.

UK retail giant Tesco is installing facial recognition technology that will see screens target ads at customers based on age and gender. 

Marketing innovators such as Ditto are using digital photo recognition software to trawl social media and analyse how brands are being contextualised in images people share online.

Just a taste of how the arms race to create personalised marketing campaigns is well underway; a race only likely to pick up as we take the next digital leap into the internet of things.

The submission

It is well established that terms of use, End User Licence Agreements and privacy policies – the mechanisms by which we ‘consent’ to the harvesting of our data -  are too long, too complex and too inflexible. Ironically, in light of the targeted advertising they fuel, they are distinctly impersonal.  Analysis undertaken in 2008 calculated that it would take 76 working days to read every privacy policy an internet user encounters in the course of a year.

No surprise then that research shows the median time users spend on license agreements was only six seconds; that 70% of users spend less than 12 seconds on the license page; and that no more than 8% of users read the License Agreement in full. 

Yet despite the growing unease and risk, most individuals still tick the ‘I agree’ box and ‘consent’ to giving this data. But is it given either knowingly or willingly? I think we can safely say the answer is no.

Faced with a binary ‘take it or leave it’ choice and with no opportunity to set their own preferences, current T&Cs can make consumer consent look more like consumer submission. We are left having to tick, click and hope for the best.  

This has led the World Economic Forum to caution of a developing ‘crisis of trust’, stemming from the use of personal data in ways that are inconsistent with individuals’ preferences or expectations.

Finding a more meaningful solution to this problem requires mechanisms that enable the consumer to express their terms in a simple and accessible way; not a one sided, one-size-fits-all model of consent.

Encouragingly, there are growing indications that change may be on the horizon.

The blowback

In September, the Financial Times reported that a “backlash over privacy and security has started to ripple…..through Silicon Valley.”

Earlier this year the US Federal Trade Commission’s own look at the data broker industry found that “data brokers operate with a fundamental lack of transparency”;

GlobalWebIndex research found that more than a quarter of the world’s online population are using tools to disguise their identity or location.

In March the father of the web, Tim Berners Lee called for an online Magna Carta - a bill of rights that would guarantee the independence of the internet and ensure people’s privacy.

And even the tech giants have begun to make a virtue of privacy. For example, Microsoft’s global ad campaign asserting ‘Your Privacy is Our Concern’. Or Apple’s CEO feeling obliged to publish an open letter to its customers stating that “your trust means everything to us”, and outlining its ‘strict’ data handling policies (just as Apple gears up for a big push on health and financial services – two of the most sensitive forms of consumer data).

Analysts are predicting that privacy is set to become a competitive differentiator, and the driving force for the next ‘killer app’; and the pressure for something different, for something better is now building to the point where change looks inevitable.  

A new breed of tech companies are already taking the lead on developing tools that enable consumers to start taking back control.

For example, 40 million people are using Ghostery - a browser extension that enables users to see and block companies that track you when you visit a website. Personal data vault services are emerging that allow consumers to securely gather, store, control and release their data on their own terms. The development of ‘sticky’ data policies, bind a consumer’s permissions to their data “as it travels across multiple parties, enabling users to improve control over their personal information”.

Of course, to enable effective permission-setting consumers need to understand the permissions they are granting. This too is prompting new initiatives in how to present potentially complex contracts and preferences in a ‘human readable’, engaging form.

A job for consumer groups

CI and its Members have key roles to play in helping bring about these changes too.

We must advocate to ensure the right underlying principles are enshrined in legislation. It is why CI is calling for the revised UN Guidelines for Consumer Protection to adopt an objective to safeguard consumers against the unauthorised collection, use, disclosure or loss of their personal information. 

CI has also recently launched a privacy and data protection initiative with the governments of Germany, Brazil and China – a high-level dialogue that concerns the data of more than a third of the internet users worldwide.

We must support the development of the new tools and services that can empower consumers in relation to their data, and, where appropriate help bring them to the mainstream. We must bring the consumer group testing expertise to the digital age, helping consumers identify the superior services that can best serve their needs.

And across all of this, consumer groups have a key role to play in contributing to an infrastructure that can give consumers the confidence they need to take control of their data and take a stake in the value that it will increasingly deliver in the digital economy.

The pressure is mounting for a better deal on data and privacy for consumers. It’s coming from a range of actors: governments and regulators, tech titans, internet visionaries, consumer bodies and, crucially, it’s coming more and more from consumers themselves.  

Some entrenched parties will try to resist it, but those genuinely working in the consumer interest must embrace this eagerness for change.  So let’s move towards a digital future set on terms that put the consumer first.

This blog is an extended version of a piece first featured in the Huffington Post on 26 November 2014.

An end to online autonomy?

In Part 2 of her blog on digital data ownership, Liz Coll, senior policy advocate with CI member Consumer Focus, asks: Does being part of social and economic activity online mean giving up autonomy over our personal data, or withdrawing from the online world altogether?

In my last blog post I talked about the big contrast between the importance that external agencies attach to consumer data, and the significance consumers themselves assign.

Now I turn to look at if the digital economy runs on personal data, and consumers are the primary source of this new commodity, will consumers seek to exploit its potential, or continue to be exploited for it?

The challenge

The challenge for those working in the consumer interest is to find a way to transform the current scenario into a mutually beneficial one. This could involve helping consumers develop a stronger understanding of the potential value of their data, and getting them ready to engage with new opportunities.

If consumers are able to exert more control over how their data is used, there is much to gain. We are starting to see initiatives such as midata in the UK, or Green Button in the USA which offer consumers opportunities to have access to, and benefit from, the data that companies currently hold.

Despite attracting some controversy because of security and privacy concerns, they are an indication of how personal data is becoming a market in which consumers could take a bigger share.

Our research

As discussed previously, we commissioned ICM to survey 2,002 adults aged over 18 so we could develop a better appreciation of consumers’ understanding of the issue.

One of the things we wanted to test was how consumers felt about some of the new thinking around terms and conditions which effectively reverses the current provider-dominated relationship.

It works by getting providers to agree to terms and conditions that are set by an intermediary on behalf of the individual, prior to them taking up the service.

Only 8% of respondents were keen on this option, perhaps seeing it as impractical. The preferred option was shorter terms and conditions in plain English and equivalent to no more than two sides of paper (47%).

Forty per cent of respondents wanted to use a set of more consumer-friendly generic terms and conditions developed by an independent body. Perhaps personalised terms and conditions are only for the early adopters, but the support for conditions written in the consumer interest is strong.

Want control, but don’t use it

The vast majority of consumers think they should have more control over their data, but only a few use existing controls: Despite limited understanding of what is collected and why, 84 per cent of people want more control over what information organisations collect about them and how it is used.

This also came through strongly in Demos’ recent research on public attitudes  towards personal information and data sharing.

They found that people would welcome measures to give them more control over personal information, in terms of knowing what is held on them and having the ability to withdraw it.

Generally consumers wanted to have a more honest and open dialogue about how their data is used and on what terms.

However, only one in eight consumers say they currently use any form of control panel or dashboard (for example, http://adblockplus.org/en/features) to set their online privacy and personal information collection preferences; most do not know they exist.

This could reflect the visibility, accessibility and usability of the tools as well as people’s awareness of them. (The survey took place before regulations requiring cookie consent notices on websites were introduced in May 2012, it is likely that awareness is higher now.)

Mutually beneficial

Earlier I set a challenge to those working in the consumer interest to find a way to transform the current one-sided scenario into a more mutually beneficial one.

To start to do this, consumer groups could take a bigger role in enabling people to engage with new opportunities and tools in the personal data economy.

These have the potential to shift the relationship between providers and consumers onto a more balanced footing. Whilst data protection should always be at the heart of consumer advocacy and empowerment, the status of personal data as such a major new commodity also demands additional attention.

There are question marks over whether the usual routes to protection are still able to adequately regulate the actions of global companies. Think, for example of the threatened fine to Facebook chief Mark Zuckerberg of €20,000 over privacy concerns by the German data protection agency.

There are similar doubts as to how effectively regulation can keep up with the fast pace of change online, and how national law can be imposed on a global network.

Danger of stifling advantages

Too hard a clampdown may well stifle the advantages to be had from effective, consensual sharing of personal data and would almost certainly alienate the large numbers who are comfortable with, and feel they benefit from, sharing.

Not to mention very quickly infuriating almost all online users with the possibility of bringing free-to-use services to an end!

So, are we left with the alternative of accepting that being part of social and economic activity online means giving up autonomy over our personal data, or withdrawing from the online world altogether?

None of these seem particularly productive, and all fail to make possible the benefits of using personal data in a more mutually beneficial way.

Doing things differently has potential benefits for consumers. For example using personal data more intelligently could mean personalised, and more responsive, products and services.

There are advantages for business too, particularly if they can be part of a more balanced, permissions-based relationship with consumers.

New opportunities

Taking up opportunities, including but moving beyond data protection, will depend on consumers and consumer groups quickly building a more critical understanding of the:

•  current relationship that we are part of online with regards to our personal data, based on a much fuller understanding on what we give up in exchange for what. As part of streamlining consumer protection laws, BIS is considering (see page 21 point 62) whether consumers should have the right to remedies for ‘free’ digital content (eg download/streaming/games) which are supplied without payment of money, but in exchange for something of value other than money such as personal data or virtual currency.
• scale at which personal data is used, and to what end by providers. As well as concerns about an individuals’ personal data and its use, the large scale data and analysis available to providers and the potential for this to shape markets will be a major issue for consumers.
• growth of consumer empowerment and personal data as an emerging market, and how new services and developments via intermediary bodies may work. Helping individuals protect and manage their own data is fast becoming a market in its own right, leading to a growth of business which can help consumers negotiate services and products to their advantage, such as personal information management systems.

Such developments enable consumers to have access to their data and share it with parties that put it to work for them.

The increased influence that consumers have due to the potential of digital technology to cheaply and quickly facilitate collaboration and joint action. The web has made possible a more effective way for consumers to participate and achieve goals together.

This bypasses the need for traditional institutions and enables consumers to counter powerful interests and exert more control – see previous Consumer Focus research on things like collective switching, using mapping software to identify and fix problems, online feedback and the theory and practice of online collaboration and consumer co-operation.

Understanding these new dynamics will require digital literacy in the widest possible sense, what Rheingold would describe as knowing how to participate online for both individual advantage and collective influence.

Increased control

Certainly, our research and the Demos survey both point to consumers wanting to have more control over their personal information. Contrasts (such as wanting more control, despite not using existing controls) could be explained by the lack of tools, services and motivation to do things differently online.

What is not yet clear is what the catalyst will be that prompts the majority of consumer to take an active interest in their data. Here are a few suggestions for what might spur on more collective and collaborative action to rebalance the personal data equation:

• Further high profile examples of forcing through changes to terms and conditions changes such as the new terms imposed by Facebook might be the start of the turning point. Instagram’s reversal of a decision to suddenly change its terms and conditions on privacy is also a good example of consumers showing their collectively powerful hand.
• The availability of alternatives such as midata, which is now starting to gain traction as the UK Government looks to put it on a statutory footing may be able to demonstrate what a more balanced personal data relationship looks like in practice. Companies such as Tesco in the UK are planning to release back their Clubcard data to customers to enable them to see and make plans on the basis of their shopping habits – just as Tesco have done behind the scenes.
• Greater awareness of the outcome for consumers of businesses applying personal data inferences to prices. In the UK, the Office of Fair Trading is investigating personalised pricing, where inferences about our personal habits and data affect what price we are charged.

 Forecasting the potential and impact of digital technology is common practice on the web, with new scenarios and ideas regularly emerging.

When considering predictions for personal data (central to so many future developments), we must remember that the way we use digital technology is still in a period of negotiation and development.

Certainly, powerful interests have consolidated some control, and are moving to take more, but users and consumers still have a stake in how things develop and an opportunity to influence ways in which they can exert more control over their fate.

There is much to play for if consumers want to make the most of the prized commodity that derives from them, and there is a critical role for consumer advocates to support them. Are you ready for the challenge?