“Identity and Access Management is more than an enabler. It’s a critical prerequisite in the fourth digital disruption.” At the helm of Vlaams Datanutsbedrijf, Björn De Vidts views IAM as a key factor in building digital ecosystems. As TrustBuilder and Vlaams Datanutsbedrijf are partners in the ICON project, we took some time to interview Björn De Vidts on the mission and vision of the Datanutsbedrijf, the role of government, being a frontrunner in implementing data vaults and how self-sovereign identities and data minimization help to restore trust.
Vlaams Datanutsbedrijf (Flemish Data Utility Company) wants to let data flow like water does, hence the reference to a utility. The mission of this public-private cooperation is to strengthen the privacy of citizens, market data vaults in cooperation with private partners, realize an innovative platform for data sharing, and develop data-driven ecosystems. “If we talk about the mission of Vlaams Datanutsbedrijf and what we want to achieve, I think it’s best to look at the problems we engage to solve,” said De Vidts. “The first problem is about trust in sharing data. There is not enough trust for companies to share data with other companies, even though management knows full well there is value in sharing data. The same with citizens: they recognize the value of data, but negative experiences have eroded trust. This is the data paradox: people want to participate in all these new data-driven experiences, but they hesitate to share their data with big technology firms for fear of losing control and having their personal data monetized. Sharing data leads to innovation, so the lack of trust is harming our economy and our society.” Standardization in the interoperability of data is another challenge. “How are data defined? How are they governed? What is the legal framework? How can they be used in a business context? You need agreement on these four aspects of standardization before you can develop a data-driven ecosystem.”
Government has a role to play
Historically, the Flemish government has always played a role in helping develop these ecosystems. “The private sector cannot do this alone, as there is always a societal component to it,” claimed De Vidts. “Building bridges between different industrial segments can best be achieved when the government is involved. Companies take the opportunity because they recognize new business models, but they need government sponsorship to ensure citizens trust the initiative. That is the role of Vlaams Datanutsbedrijf: to bring different parties to the table and demonstrate citizens can trust the initiative.”
De Vidts is ambitious and does not believe that trying to build trust is fighting a losing battle, even when every day brings new stories of systems being hacked and data being stolen. “Studies from research agency Imec has shown that our citizens still trust government,” De Vidts reminded us. “But you have to make clear to people what’s in it for them. We know that people are willing to share data if it increases convenience, saves time and costs, or can improve their health. An example: if you can get a cheaper energy contract by sharing data for a personalized benchmark, for instance by combining consumption data from a smart meter with data on household composition, data on how the house is built, etc., not many will object.”
Selective sharing of data
These motivators, comfort, cost savings and health, are at the basis of the use cases Datanutsbedrijf is developing. Together with Docbyte, Enhansa, karamel and Randstad, TrustBuilder and Datanutsbedrijf are working on a research project called ICON, focusing on the secure and selective sharing of personal data in HR, based on the Solid data vault Pod technology developed by internet pioneer Sir Tim Berners-Lee. “We want to help citizens take their careers into their own hands, while also offering convenience. By saving your diploma in a data vault, you will always know where to find it and there is no need for scanning it or asking the university for a copy when you lose the paper version. Once the diploma part is covered, we can move on to store data on certificates, assessments… This project takes the hassle out of managing your career and getting the job that suits you best, by being able to demonstrate you have the right competencies.”
The ICON project consortium received a grant from innovation agency VLAIO, to kickstart the research. “By funding, the Flemish government mitigates part of the risk for commercial companies and creates trust between the parties that need to work together. Each use case is different. For some projects, the societal impact may be so big that government simply needs to stay involved. In other cases, government can let go and can completely spin off the project to private partners.”
The added value of identity management
Björn De Vidts sees the role of an IAM vendor like TrustBuilder as elemental in the ICON project and any use case that implies a data vault. “When you are talking about trust, it is key to be able to identify and authenticate yourself as the owner of a Pod. That is where TrustBuilder can provide a huge value. In the ICON project, different partners have different roles in the ecosystem. Datanutsbedrijf will be the Pod infrastructure provider, other partners will provide data or applications that use data. TrustBuilder takes care of connecting to Identity Providers.”
De Vidts firmly believes in trends such as self-sovereign identity, data minimization, and zero-knowledge proof. “Self-sovereign identity is a direct result of the fourth digital disruption. Citizens no longer want to hand over all their data to five big tech firms in exchange for internet services. I see self-sovereign identity as one of the applications of the Solid data vault technology. Data minimization will increase trust as citizens will no longer need to share all their data. Let me illustrate that with an example. When you want to buy a house or take out a mortgage, all the real estate agent, notary or bank needs to know is if you earn enough to pay for the house. Currently, we send a pay slip to these organizations, containing all sorts of sensitive personal data they have no business with. And we send that through Gmail or Hotmail, taking a huge security risk. By using a data vault, you create an intelligent traffic exchange where you as a citizen can decide what information you want to share. If the bank only needs to know whether your income is above a certain threshold, then that is all the information a bank will get. As Datanutsbedrijf, we will put our stamp on that information and say we verified it is correct. In fact, this is also beneficial for companies that request the data: they can be sure they are not storing irrelevant personal data which may make them liable to GDPR fines. What we are doing is creating legal security and trust for organizations and providing privacy by design. You could say that we are enabling people to share more data than ever, by sharing fewer data.”
Flanders as a frontrunner in DataTech
Flanders has been a frontrunner in DataTech for over 25 years, De Vidts said. “Google Maps was launched in 2005. But Flanders already had its geolocation platforms in 1997. The work we did with geographical information systems has inspired the European Inspire Directive on spatial data infrastructures. Likewise, we will be the first to implement a data intermediary as instructed in the Data Governance Act to bring supply and demand together. I am convinced that our DataTech and LegalTech can be an example for other European countries. Companies that participate in our ecosystems will get a head start thanks to our work. Based on their experience in Solid data pods, Flemish companies are now winning tenders abroad. As an example, Digita has realized a data vault for the employment agency in Sweden.”
De Vidts attributes the Flemish leadership to the research that is being done at universities, the experience in building platforms that scale, and the fundamental belief in ecosystems. “Everyone in our government and administrations has an ecosystem mindset and knows that value does not come from silos, but from collaboration across public services and external partners.”
