A Way Forward for Personal Data

Over the past months Mydex CIC has been working for the Scottish Government on a strategy for implementing and scaling a system of ‘smart entitlements’ for the citizens of Scotland.

The Smart Entitlements concept is very simple. Its goal is to create a common, easy approach for citizens to access public services that is consistent across multiple service providers. To achieve this, it provides citizens with the ability to store their personal information in an Attribute (or personal data) Store which they own and control. Using this Attribute Store, citizens are able collect, receive and keep verified data about themselves and subsequently allow its reuse (if relevant) when they seek to access or use other public services.

Practically speaking, under the proposed system service providers would a) generate a secure electronic tokens that verify facts about a citizen (such as proofs of their address, age, disability or educational qualification), b) provide these tokens to citizens to be held safely in the citizen’s own attribute/personal data store, so that c) citizens can share these tokens with other service providers, under their control, as and when they are needed.

The benefits could be immense.

• Citizens would have to spend much less time and effort trying to find, present and prove information — filling in endless forms — and would also find the process less stressful and yes, sometimes less humiliating.
• Organisations could use the process to reduce unnecessary data processing, verification of data entered into forms, all the duplicated effort, and errors that come from forms, enabling them to do more with less.
• And the Government itself would benefit from the creation of a safe, efficient, privacy-protecting data sharing infrastructure that would support its inclusive growth and wellbeing agenda, while providing it with the digital capabilities to respond to new situations as they arise — such as the COVID-19 pandemic.

In a separate project we proved that, technically speaking, it is indeed feasible for service providers to generate verified attributes and for citizens to store them in an Attribute Store. (A ‘verified attribute’ is any piece of information about a person or performance that has been generated or checked by a responsible trustworthy body and made available to another party in such a manner as to be trustable as a specific attribute.) This approach is already being put into practice in other projects working with groups of organisations serving the same citizen.

But is such an approach operationally feasible? Could it work at scale? And how to achieve that scale?

A roadmap for success

The good news is that we have identified a way to achieve all the above.

It involves some technical things like creating metadata standards to make sure data is machine readable and to ensure clarity about levels of assurance about the data ( including descriptions of how the data was collected, created, protected and verified). But essentially, it boils down to identifying a good place to start (for example, focusing on attributes that are widely used by many services and are easy to mint and share) — and then getting on with it.

Crucially, it is do-able, now. There are no critical technical, operational or legal obstacles stopping Scottish Government from being able to implement this approach with immediate effect which is why they are able to move ahead with their Beta Phase during 2021.

The details of this approach are laid out in this report. But its core features are simple.

First, Scottish Government agencies, departments and initiatives such as the National Entitlement Card, local authorities, housing associations and the Scottish Qualifications Authority have all the data that’s needed to deliver critical mass. Other bodies and agencies, such as Social Security Scotland, can always add additional data to the system as it grows and matures, as well as accessing verified attributes (with citizens’ permissions) for their own service provision purposes.

By enabling these agencies and departments to share data via citizens’ Attribute (personal data) Stores, the recommended approach minimises dependencies and maximises agency for the citizen. It can be done, now, by the Scottish Government without needing the permission or cooperation of other bodies. And it enables the Government to independently pursue its own agenda and policies.

Second, it can be done without major disruption and risk. The recommended strategy does not require any significant changes to existing back office systems that provide attributes or consume them. Instead, it connects these existing systems with a new piece of infrastructure (Attribute Stores) that join the data dots, adding a new layer of capability, flexibility and opportunity as they do so.

At the same time, it can proceed incrementally, taking one step at a time, so that the risks of big leaps into the unknown are avoided. Instead, it allows for a test-and-learn approach that builds momentum, impact and benefits over time.

Third, taking this incremental step-by-step approach brings immediate benefits for the uses of data that are initially prioritised while setting the right course for the future. The more service providers, verified data points and citizens that are involved, the more it builds the infrastructure and capabilities needed to bring further benefits. Once this infrastructure and processes have been put in place, an increasing number and range of attributes and attribute providers can be added incrementally, thereby expanding the number of use cases that can be supported and benefits that can be realised.

Fourth, in doing this, it generates powerful win-wins. All the key stakeholders involved — citizens, service providers and Government — benefit from doing it.

The Scottish Government is now launching a Beta Phase to take this initiative to its next steps. The opportunities it presents are huge.