Part 2: Citizens Advice Bureau report on personal data empowerment

This post is the second in a series of blog posts on the recent Citizens Advice Bureau report Personal data empowerment: time for a fairer data deal?

We highlight the issues and ideas raised in the report, which calls for a new vision for the way personal data is managed and used. We also examine how Mydex’s services can contribute to the realisation of the report’s vision for personal data empowerment, where consumers have meaningful control over their personal data.

Post one looks at the status quo. Here we evaluate the report’s suggestions for a new alternative.

Blanket ‘consent’ models are not the answer

Consumers are prepared to share their data, but they want to do it on their own terms. Simple, right? The problem lies in the regulation and enforcing of these basic principles. Most organisations were not built from the ground up with this model at their heart.

It is still possible to achieve this ‘benefits for all’ ecosystem, but the current means of regulation are perhaps lacking, simply by virtue of the fact that laws and regulations are usually made in response to an event. Pre-empting what will happen (just like predicting customer behaviour!) is a risky, expensive and largely unsuccessful endeavour. As the report points out, “dealing with issues as they arise will no longer be enough to uphold consumer rights in the long term” (p.8). It comments that it is “widely accepted that data protection regulations in Europe need updating” (p.21).

The main problem, according to the report, is that “the backbone of the system is ‘notice (or disclosure) of consent’”, which it claims is “not fit for purpose” (p.21). The terms and conditions, it says, are too long and complicated, and not designed to be understood or even read by the user. Indeed, the report states that “no more than 8 percent of users read the License Agreement in full” (p.21). A blanket choice, one-size-fits all data privacy policy is not compatible with the notion of data empowerment and control over personal data: “privacy is above all a personal setting so trying to establish one blanket permission leads to policies that cover every eventuality and consequently minimise effective consumer control” (p.22).

The main aim is instead to “demonstrate legal compliance with privacy legislation, as opposed to enabling real consumer choice over privacy requirements” (p.22). Since regulatory reform does by default have to be a fairly wide reaching set of rules, the report suggest that “ regulatory reform alone may not yet provide an answer” (p.26).

Empowering the individual: a new alternative

But how could it be done differently?

If the data actually belongs to the individual, and they should be in control of it wherever it goes, then someone needs to give them the tools to achieve this. And these tools are developing. “Over the last few years a growing number of new tools, apps and services have emerged with offers to help individuals assert more control over how their data is collected and used, and by whom” (p.26), the report observes.

The key point about these services is that they “are being offered independently of the consumer’s relationship with any particular supplier” (p.26). This means a service that stays with the individual for life, that they take with them, and use to connect to different organisations that they need to share data with. This is a distinct difference to the much more ‘vertical’ concept of each organisation having a database, often containing the same information about an individual as the database of another organisation. If the information is different, each organisation has an incomplete, difficult-to-manage image of their customer. One individual might be represented 200 times across 2,000 databases.

This new type of service could equip the individual with the tools they need to interact on a level playing field with the organisations they want to connect with. Not only that, but it also allows them to control and share a much more complete picture of themselves if they wish to, including their preferences and intentions. This is gold dust for brands marketing their products, but to achieve this in a trustworthy manner, the exchange of information has to take place under the control of the individual.

The report lists “ten core service components on offer that go some way to addressing the barriers and problems experienced by consumers” (p.27). Below are the ten core principles that the report suggests these services be built upon (p.27):

Screen Shot 2015-05-22 at 12.56.37

We at Mydex CIC were delighted to see such a close alignment with our mission and vision laid out here.

The report also highlights Mydex CIC as an enabler of the core concept of personal data empowerment: “the ability of individuals to store their own data safely, where a copy of the data in question remains under their own control” (p.29). The Mydex Platform enables individuals to comprehensively view and manage the data they are sharing and effectively manage their online identity and interactions, setting permissions in a per-context manner where appropriate, rather than agreeing to a blanket policy with unclear motivations and potential loopholes.

A tool such as the Mydex Personal Data Store — centred around the individual — in turn enables them to gain insight into their own behaviour in a more holistic way than ever before: the combination of data streams from multiple sources can create an incredibly wide and complete picture of oneself, and can reveal where the real value exchange lies for the individual sharing their personal data.

Our final post in this series will consider the wider perspective of the personal data ecosystem. How can individuals, organisations and enablers of personal data empowerment work together to allow everyone to get the best out of personal data? What guiding principles do they need to follow in order to create a thriving personal data ecosystem?

One clap, two clap, three clap, forty?

By clapping more or less, you can signal to us which stories really stand out.