Glad this is turning into (almost) a thread. Wendy, I don’t want government controlling our access to data–but I would be pleased as punch if government became an advocate on our behalf to provide easy access to data we cannot get (or can get with only great difficulty) at present. And Caspar, yes, that’s exactly what I’m thinking of–notification of a transaction, not details thereof, and going through the third party’s log-in if I want to chase it up. The IDM used to validate my entry into this portal can then be accessed by other government departments as either a sole-source or confirming support for other IDM–but I get notified of most government requests, and I get a chance to flag up information I believe is incorrect.

Seems to me the last thing we want is government controlling our access to transactional databases with other people.

wg

The Data Protection Act already gives you a right to insist inaccurate data is corrected - but admittedly it’s a real timewasting pain chasing down errors in practice.

What I am proposing is that you should have separate authentication credentials to log into separate data sources, but through one easy-to-manage authentication interface, and a legal right to access transactional/disclosure data online. A dashboard to allow the individual to correlate and consolidate seperate sources of data sounds fine to me, but frankly it surprises me that you think it is a good idea for government to manage this.

I think a dashboard that flags activity around use of my private information is something that would allay my fears about the hidden economy in personal information. I think that extending it to private party use of my information is exactly what I wish government would do in this space. I think giving me the opportunity/responsibility to insure the accuracy of this information gives me power that I don’t currently have, but should in any reasonable definition of civil society and private property.

I think it solves practical and philosophical problems for government. It helps keep their database clean and their reputation as open and honest alive. It provides a mechanism for private citizen to approach private parties regarding error and fraud that otherwise might become a dead weight cost for government. It also may allow for the improvement in provision of private party information services and security.

Maybe I’m painting myself into a corner here, but the more I think of this idea, the more I like it… Maybe when I come back from a week off I’ll mock up the service on a dead URL–maybe if you see it you’ll change your mind. Or maybe you’ll mock my web design skills as well as my ham-handed approach to issues that have bedeviled the information society for so long.

I don’t know why we are in disagreement. One of the distinctive elements of the European Union privacy regime is the individual ALREADY has a clear and absolute legal right to know not only what information is held by ANY organisation (subject to the exemptions above), but ALSO how it is used and disclosed. But the duty for fulfillment of this legal right falls on the data controller (in your example Experian), and they only have a legal duty to tell you this information by offline means (i.e. dead trees and snail mail), and they get to charge you up to ten quid each time (less for credit scores - but that doesn’t include disclosure info). So the question is - what is Experian’s incentive to let you access this information securely online?
This part of the Data Proetction Act (Section 7) needs reform and updating. I think IT infrastructures and authentication technologies have matured to a level where it is reasonable to expect new systems to implement a right to secure online access for free or a nominal flat cost (so phase it in over say 5 years). But only if the individual wants this - they may be skeptical about the security and should be able to block online access, and still get snail mail for ten quid if they want instead.

My quibble was with the suggestion that this should this be done through a government portal?

I am not in control of how information about me that is collected by third parties is used. Those third parties include government. Notification of activity is the first step towards retaking control.

I see the point and largely agree that notification probably would never include active criminal investigations, but I think the larger danger is the trivialisation of normal data exchages, especially as a stronger FOIA would allow for some truth checking after the fact on criminal justice issues.

But the rationale for something like this is again, robust identity management without user input is extremely difficult and expensive. Engaging the user requires offering something of value to encourage participation. Knowledge of how public and private institutions are using your information is of immediate and growing concern. Hence my modest suggestion.

To Robin’s point, it’s true that S.29 of the Data Protection Act has a law enforcement exemption to the individual’s right to know about their own personal data and what has been done with it. But this exemption is fairly narrow - it should not apply unless the data relates to a current criminal investigation specifically concerning that person. Caveat - this is not true of the nat.sec exemption (S.28), which can deny whole classes of data about everbody under a neither-confirm-nor-deny security doctrine (and this was a major issue in the recent Home Office decision to use road camera data in real-time for counter-terrorism)

Apropos a different Blindside thread, there’s more to Kim Cameron’s work than the seven laws/principles. The Identity Metasystem is a vision for interoperability between different identity systems - and there are good practical and theoretical reasons why different systems are needed for different purposes. Information Cards (and Microsoft’s implementation of the concept - “Cardspace”) provide a general mechanism both for authentication with context-specific credentials, AND for conveying identity claims from one system to another. So it would be an ideal way to manage access to many portals with a consistent interface, and to shunt useful data from one to another, but with the individual retaining full control.

More here - http://www.identityblog.com/wp-content/resources/Identity_Metasystem_EU_Privacy.pdf

There’s still something you will have to simply put up with, which is that you will not get told about all the accesses to your data. We have to be clear that there are going to be (at least) two discrete ‘views’ of your data: a ’service delivery’ view and a law enforcement view. The dashboards would relate to the former.

Separately, I have to say that I don’t think advertising has any place on a government web site unless it’s for government services. I think it’s better if governments don’t have outside sources of revenue. It’s one of the only things that keeps them accountable to us. By the people, for the people, of the people, yeah? (And yes, I know that’s Another Country. But still.)

wg