The MyData Nordic Model: a promising paper

Personal control over personal data

Mydex CIC was delighted to see the publication of a paper entitled MyData: A Nordic Model for human-centred personal data management and processing. The paper champions the concept of personal control over personal data, the model they suggest aiming to “strengthening digital human rights while opening new opportunities for businesses to develop innovative personal data based services built on mutual trust” [1].

The paper echoes our values both moral and practical around empowering the individual to get stuff done. We were also pleased to read many similar ideas regarding the potential for reform in local government — enabling truly joined up and cross-channel services. Mydex CIC was particularly pleased to see the emphasis not only on the right of the individual to control over their personal data, but the important, practical point that the individual must have the “right to obtain personal information and use it freely” [3]. The benefits of this approach to individuals and business alike are significant, as we recently wrote about.

MyData Principles

The three principles stated at the beginning of the paper are as follows:

1. Human centric control and privacy: Individuals are empowered actors, not passive targets, in the management of their personal lives both online and offline — they have the right and practical means to manage their data and privacy.
2. Usable data: it is essential that personal data is technically easy to access and use — it is accessible in machine readable open formats via secure, standardized APIs (Application Programming Interfaces).
3. Open business environment: Shared MyData infrastructure enables decentralized management of personal data, improves interoperability, makes it easier for companies to comply with tightening data protection regulations, and allows individuals to change service providers without proprietary data lock-ins.

These principles are the basic enabling concept, designed to reap the benefits of such an approach, as the paper goes on to discuss.

Straightforward benefits

The benefits illustrated by the paper closely align with those that we have presented time and time again throughout Mydex CIC’s growth. Individuals, the paper says, end up with (among other things) “better data based services”, “better privacy, transparency and control”, “insight into their own behaviour”. Companies benefit from (again, among others) “consumer trust [strengthening] engagement”, “integrated complimentary services enhancing the core service product”, “insight and transparency into consumer behaviour and its impact”, and “tools for complying with data protection legislation”. We are happy to see a set of technical and moral principles that align with our vision for the digital ecosystem, and we think that the paper presents these very well, in a way that clearly demonstrates the value both to individuals and to organisations. There paper also emphasises the fact that this approach is sector independent [1], and this is of great importance, and something that we at Mydex CIC value highly. The wider benefits for society is a vision that we also share, particularly “parallel developments of digital rights, innovation and business growth” [1].

The Nordic MyData model and the Mydex Platform — subtle differences

We see a great amount of alignment between the concepts presented in this MyData model and the live services offered by Mydex, yet there are subtle differences in approach. Mydex offers three core services: A MydexID as a means of online identity credential management, a set of tools for consent management around personal data, and a Mydex Personal Data Store to store the data you enter or receive from organisations.

We did a basic comparison to illustrate the differences in approach that we perceived from the paper:

Identity management

The MyData model doesn’t explicitly include a portable, interoperable online credential that can be used to log in via multiple protocols across the web. The MydexID makes this possible by equipping its members with a portable ID that they can combine with verified information about themselves to access a particular service online.

Personal data storage

The MyData proposition seems to focus on data aggregation and use, and not storage. The MyData account “stores information on how the individual’s personal data is connected to different services and the legal permissions and consents for using the data” [5], as opposed to storing any data itself. Data and even consent & permission settings have to be stored somewhere, so why not in a secure, ‘zero-knowledge’ space that only the individual can access, instead of across multiple, disparate servers?

Data Distribution

The paper doesn’t specifically mention methods of redistributing verified data, more the aggregation of data stored across services and the control over the permissions to access and share this data. Mydex CIC believes verified attributes (digital pieces of information) are vital in the development of the digital ecosystem. Verified data delivered to the individual, stored in their Personal Data Store, that can be used again elsewhere when accessing a different or future service, will be a key empowering factor in saving individuals and organisations time and money, whilst increasing trust and data quality. We wrote about this in our white paper The opportunity of attribute exchange.

Expansion

The MyData approach is an exciting one, and we would be excited to see its principles come to fruition. It was unclear to us whether this was a completed product or a set of guiding technical principles. If the former, there is no mention of the potential for creation of apps and services that connect directly to the MyData service and integrate with it to enhance the management, insight and integration capabilities that personal control over personal data allows.

The Mydex Platform is built on open source components, and both relies on and welcomes the creation of services to get the most out of personal data under the individual’s control. As we mentioned in our blog post about the Boston Consulting Group’s essay on digital disruption, we see personal data, the individual’s control over it and its interoperability as a key part of the successful development of a layered digital ecosystem.