Vindicated!
By: Alan Mitchell
Tags: Regulation, Data Portability, Personal Data Store

It’s over 13 years since we at Mydex Community Interest Company set up shop.

Back then, we had a vision and a mission: that every human being — every citizen in every country in the world — should have the right and ability to gather and use their own data for their own purposes, including exercising control over how others collect and use their data.

At the time, this idea seemed so outlandish that most people simply ignored or dismissed our ideas as irrelevant.

But over the years the need for our mission has become ever more apparent, with mounting abuses and accelerating imbalances of power and reward, and with growing awareness that our society and economy is failing to unleash the full potential of data — especially personal data.

Also, slowly but surely, the means of achieving this mission has also become clearer. Every citizen needs to have their own personal data store which enables them to collect, store, use and share their own data under their own control, independently of any other party or organisation that might have collected data about them.

Critical design principles

Particular details of how this system should work have also become clearer. Over the years, we worked hard to clarify the design principles that are critical for our mission’s success. We laid out the most important ones in a blog back 2018. Key amongst them were:

1. Public/social purpose and mission. The purpose of the new personal data infrastructure should not be to monetise data but to promote the public good e.g. benefits for citizens.

2. Independence. It should work for people — citizens — not for the profits of private corporations or for the state.

3. Neural and enabling The infrastructure should not be designed or used so as to favour one party’s vested interests over another.

4. Distributed, not centralised With each personal data store uniquely and separately encrypted, held by individuals for individuals (i.e. not creating yet another massive centralised database).

5. Zero-knowledge operations It should not look into or seek to influence how individuals use their data. Its job is to promote and enable their agency, not to seek to control them.

6. Aligned incentives The way it earns its money should be structured so that it has no financial incentives to monetise, manipulate or seek control over individuals’ data or their uses of this data.

7. Separation of storage from use The only way to achieve all the above is to create a structural separation of functions and roles: with one focused on the provision of infrastructure enabling citizens to collect, store and share their data, the other actually using the data (e.g. to provide financial advice, treat a medical condition, or assess an individual’s eligibility for a service).

8. Built to last — the infrastructure should have built-in safeguards against changes to its role, functions and priorities — for instance, in the case of a change of leadership, stock market listing, merger, sale, acquisition, bankruptcy etc.

The EU agrees!

This week, the EU published its new Data Governance Act, its core purpose being to “foster the availability of data for use by increasing trust in data intermediaries and by strengthening data-sharing mechanisms across the EU”.

A core part of its provisions are rules relating to data intermediaries that enable what it calls ‘C2B’ [consumer to business] data sharing. This is what the Act says:

“These providers will have to comply with a number of requirements, in particular the requirement to remain neutral as regards the data exchanged. They cannot use such data for other purposes. In the case of providers of data sharing services offering services for natural persons, the additional criterion of assuming fiduciary duties towards the individuals using them will also have to be met.”

Just as we had said.

Clause 23 goes on to say (in a rather long-winded paragraph):

“A specific category of data intermediaries includes providers of data sharing services that offer their services to data subjects in the sense of Regulation (EU) 2016/679 [GDPR in other words]. Such providers focus exclusively on personal data and seek to enhance individual agency and the individuals’ control over the data pertaining to them. They would assist individuals in exercising their rights under Regulation (EU) 2016/679, in particular managing their consent to data processing, the right of access to their own data, the right to the rectification of inaccurate personal data, the right of erasure or right ‘to be forgotten’, the right to restrict processing and the data portability right, which allows data subjects to move their personal data from one controller to the other. In this context, it is important that their business model ensures that there are no misaligned incentives that encourage individuals to make more data available for processing than what is in the individuals’ own interest. This could include advising individuals on uses of their data they could allow and making due diligence checks on data users before allowing them to contact data subjects, in order to avoid fraudulent practices. In certain situations, it could be desirable to collate actual data within a personal data storage space, or ‘personal data space’ so that processing can happen within that space without personal data being transmitted to third parties in order to maximise the protection of personal data and privacy.”

All this is pretty much what we wrote in our blog back in May 2018.

One step forward …

It is incredibly positive that the EU has made this step, in many ways.

It’s very important that there is legal recognition of personal data services that work for and behalf of individuals; that are not traditional ‘data controllers’ that collect and use data for a particular organisation’s purposes.

It is very important that the two way nature of data sharing — both so-called ‘B2C’ [business-to-consumer] and ‘C2B’ [consumer-to-business] — be recognised. (We would rather that the ‘C’ refer to citizens rather than ‘consumers’, which is a derogatory term in our minds. But you can’t have everything).

And it is particularly important that the core design principles outlined above are recognised, embraced and enforced.

That said, there’s still a long, long way to go. Writing down some good principles is one thing. Interpreting them in the right way and actually implementing and enforcing them is something else entirely. The new Act makes progress easier, but in no way does it make progress inevitable.

There’s also the question of how the UK responds. Will the UK Government adopt a similar approach? With its own National Data Strategy consultation coming to a close next week, the UK Government has an immense opportunity to unleash the full potential of personal data for the nation’s citizens, society and economy. Has it got the vision and political will to do this?