Futurewatch: Privacy, Identity

1
FuturewatchPrivacy, Identity ConsentToby
StevensEnterprise Privacy Group
2
The Enterprise Privacy Group

• A think tank for organisations developing best
  practice in the management of personal
  information
• The leading organisation of its kind in the UK
• Areas of interest include road pricing, national
  identity cards, identity theft, data protection,
  RFID
• Privacy-positive and politically neutral,
  actively influencing the debate on privacy and
  identity
• The views expressed in this presentation do not
  necessarily reflect those of the Groups Member
  organisations

3
The privacy paradox

• Privacy is the right to be left alone
• we find it hard to define how much privacy we
  want, but we know when its been breached
• compliance with Data Protection laws by no means
  indicates respect for privacy
• We tend to view the needs of national security
  and transformational government as conflicting
  with privacy, even when that need not be the case
• good identity systems support privacy rather than
  damaging it
• Widespread confusion between identity,
  identification, authentication, binding,
  uniqueness

4
So what happened in 2007?

• The year was a dark one for data loss incidents
• HMRC - 25m names and bank details
• 9 NHS trusts - 168,000 patient records
• DSA - 3m learner driver records
• Citizens Advice Bureau - 60,000 bank details
• NHS - 30,000 doctors records
• But it wasnt just the public sector at fault
• TK Maxx - 200m credit card records
• Monster.com - 3.1m customer records
• Loans.co.uk - 250,000 records unlawfully sold
• Nationwide fined 980,000

5
The short-term 2008

• A year of reports
• HM Treasury Public-Private Forum on Identity
• Ministry of Justice Report on Data Sharing
• House of Lords committees
• Changes at the Information Commissioners Office
• shift towards enforcement
• Efforts by government to renew trust and consumer
  confidence in public sector data processing
• transparency about data losses
• debate about Data Breach Notification
• Start work on BS10012 Data Protection Standard
• Industry makes it voice heard in ID Cards debate

6
Long-term 2009 beyond

• Privacy becomes the new Green
• personal data recognised as a high-value
  commodity, much like free-range/organic food
• Realisation that Identity Management schemes are
  not necessarily of interest to consumers
• shift towards identity assurance, pan-industry
  restitution and repair
• Industry kick-back against government ID schemes
• seeking greater assurance for liability, proof of
  return on investment
• Industry demands proof of business case for
  privacy
• understand whether it is compliance or value-add

7
The outlook

• The mood for privacy, identity and consent will
  get worse before it gets better
• government, industry and consumers need to
  rethink their assumptions before we can move
  forward
• need to develop a common framework for discussing
  these issues without resorting to polemic
• Individual companies need to make their voices
  heard
• not just government, vendors and civil liberties
  groups