What if companies gave me control of my data?

Innovation is your friend here. Unsolicited marketing of the kind you describe is not only annoying but grossly inefficient. It could all be sorted out between computers, according to rules you set.

I have said that I don’t want innovative services and you are saying that innovation is my friend. One of the biggest problems I have is people will not take NO for an answer. 🙁

No thank you, I don’t need marketing, telephone sales, people on the doorstep, unsolicited mail/email or having information sorted for me. I can conduct efficient Web searches and even look up Yellow Pages. I can use price comparison sites. Humour me and let me carry on in what you undoubtedly regard as my own inefficient way, please.

@MalcolmR: So you always pay by cash then?

@MalcolmR: what about a service that uses your transaction data to keep you on the best energy/mobile/current account deal?

So you are still being profiled then!

By not using a Tesco Clubcard (other data collection cards are available) you are paying inflated prices compared with those who do use loyalty cards. How did we ever get to this crazy situation?

Beware of the innovative services. I think it can only get worse.

I wish I could say the same, Malcolm. Unfortunately I would have to drive a fair distance to use anything other than Tesco.

Soon after I reluctantly signed up for the dreaded Clubcard I had a call from Tesco and I made it clear that this was the last time they called me. Thankfully, I have never received another call.

David – as I’ve said elsewhere I don’t propose to correct your misapprehensions about Mydex via social networks. My offer to speak with you to explore and to respond to what’s biting you remains open. I assume you got my email, and I imagine you still have my phone number.

Reply to William from Mydex, 10:22 p.m., 15 December 2012.

This matter has been covered, http://www.computerweekly.com/blogs/the-data-trust-blog/2012/11/the-significance-of-the-identi.html#comment-182015

The repeated claim is made that “Mydex gives individuals back control over their personal data”, http://mydex.org/

Question #1 of many – how? How does Mydex give back control to us consumers? Is this control in Mydex’s gift? If a consumer stores all his or her data in a PDS with Mydex, that looks more like giving up control. BIS claim that midata will give us control of our data but can never explain how (http://blogs.bis.gov.uk/blog/2011/11/03/giving-consumers-the-midata-touch/). The Cabinet Office make the same point (http://www.cabinetoffice.gov.uk/news/digital-public-services-putting-citizen-charge-not-state) with regard to their Identity Assurance Programme but, similarly, cannot explain how we gain control rather than giving it up.

These public representations made to the public need to be explained in public. That should be a simple matter of explaining the sales pitch. Most companies and policy-makers can manage that. 18 months I’ve been asking about Mydex and 12 months about midata. It must look peculiar to the public that answers are still unforthcoming.

@DavidM: you raise some great issues which a whole crowd of people and organisations – including consumer and privacy groups – volunteered to help address in an open way through both the ‘midata’ programme over a year ago. Many countries have similar programmes (including the French!) and even the World Economic Forum has a process for “Rethinking Personal Data”, for example. Ironically, however, ‘midata’ represents a painfully slow process of reflecting sunlight into certain industries that still profit from keeping their customers in the dark. The e-commerce world is way ahead in enabling people to use transaction data to improve their purchasing decisions and personal information management services are already commercially available to help make sense of it all. So in some ways ‘midata’ is just a very slow game of catch-up. I should add that it’s not an ID scheme, nor dependent on one, though ID authentication tools will be needed in the course of enabling the transfer of ‘midata’.

“… you raise some great issues which a whole crowd of people and organisations – including consumer and privacy groups – volunteered to help address in an open way through both the ‘midata’ programme over a year ago” — so let’s see a bit more openness.

“Many countries have similar programmes (including the French!) and even the World Economic Forum has a process for “Rethinking Personal Data”, for example” — so what?

“Ironically, however, ‘midata’ represents a painfully slow process of reflecting sunlight into certain industries that still profit from keeping their customers in the dark” — such as? Which industries?

“The e-commerce world is way ahead in enabling people to use transaction data to improve their purchasing decisions [examples, please] and personal information management services are already commercially available to help make sense of it all [so we don’t need midata].”

“So in some ways ‘midata’ is just a very slow game of catch-up” — what?

“I should add that it’s not an ID scheme, nor dependent on one, though ID authentication tools will be needed in the course of enabling the transfer of ‘midata’…” — that’s just flat false, isn’t it. The opposite of the truth. The Mydex PDS which receives your midata transactions is the same PDS which will be used if Whitehall has its way to verify your identity when DWP, for example, ask Mydex with its identity provider hat on whether this applicant for Universal Credit really is Simon Deane-Jones.

William

Data collection is bad enough but the biggest security threat is when the pieces of the jigsaw are assembled. If these data fall into the wrong hands, the individual has a great deal to lose.

You may be able to tell me that Mydex has never had a security breach and I might believe you, but if you were to say that your system is secure I would not believe you any more than I would believe any organisation – commercial or otherwise – that claimed their systems were secure. I well remember when banks denied that phantom withdrawals from cash machines could happen and eventually it was proved that the banks were either poorly informed or maybe telling lies.

The whole system for data protection needs to be overhauled to ensure that no personal data are kept unless necessary and deleted when no longer needed. I do not mind if some people want to provided data voluntarily, but it MUST be an opt-in system.

I have not looked into this as much as David Moss has and I am probably a little less concerned about data collection than Malcolm R. but I do feel uncomfortable that companies like yours exists. Having looked at your website and seen that one way your organisation will charge organisations a fee for certain data sharing services makes me even more uncomfortable.

Thanks for your reply, William. There are obviously big differences between what individuals are comfortable with in their everyday lives. Many are happy with sharing a fair amount of personal information via Facebook et al. but it’s not for me, thanks. It will take a lot to convince me that the government’s plans for midata are a good idea.

I can appreciate that a PDS could make life easier, just as direct debits have done for me over many years. Many are suspicious of direct debits and standing orders because of the risk of errors. Strangely, it has been the ease with which errors have been corrected that has provided me with reassurance about these systems.

I do not know what the future will bring but I certainly do not want to be an early adopter.

@DavidMoss I do participate in the Interoperability Board of the midata programme, and have been very public about that. I was invited to participate on a voluntary basis and have no client in that process. I am independent of Mydex, Ctrl-Shift, the UK government, the ICO and the dozens of other participants. I used the screen-name “Simon DJ” to comment here in a personal capacity and my views should not be taken as representing those of the Interoperability Board or the Midata programme. My public profile can be found on LinkedIn.

Good – we all know where we stand now.

I am merely an unofficial and non-representative member of the general public who is worried about what has happened with personal data in the past and very worried about what could happen if it is collected and collated. I believe that this is perfectly normal paranoia.

You’re not on your own here. I agree with what you are saying. I don’t want my personal data in the hands of yet another company (and their subcontractors). Personal data is valuable and it is so easy to misuse either deliberately or accidentally. If the authorities want to give more power to consumers then it must involve the consumers controlling their own data and not handing it over to others. Another option would be to force companies to present the information they already hold on us in a clear way and then there would be no “need” for proposals like “midata” at all.

I was going to second your motion, Malcolm. Too late. Mark’s already got there. So I’ll third it.

midata is a practical problem. You can’t assess it without knowing how it works. Perhaps Which? approached it a bit too theoretically when they compiled their response to the BIS consultation, http://www.which.co.uk/documents/pdf/which_response_bis_consumer_access_to_data_sep12-299211.pdf

Their response to Q3, for example, notes that the privacy issues are very serious. How can the security problems behind those issues be solved? Which? take three pages to answer that at Q9. Have all the safety measures prescribed there been achieved? In practice, no. The theoretical answer that Which? give to Q1 – yes, Which? do agree with the principles of midata – is therefore at least mitigated, if not completely undermined.

Q6 asks what new services could be offered by midata, presumably services which consumers would find useful and which would empower them. Which? has no comment to make. Not much point, surely, advocating midata if the benefits can’t be named.

In what form should data be given by suppliers to consumers (Q12)? That’s an important practical matter but Which? aren’t sure of the answer. So can they be sure of the (unnameable) benefits being achieved in practice?

Which? have no comment to make about the costs likely to be incurred by midata (Q14) except to say that the suppliers shouldn’t charge consumers (Q15). How does that work? Which sugar daddy, in practice, is going to pay the (unknown) costs, if not the consumer?

QQ17-21 elicit two pages of responses from Which?, prescribing accreditation and regulation, all in addition to the regulation we already have, all of which would cost money (no comment) and all in pursuit of the benefits of midata (no comment).

Which just leaves Q22, in answer to which Which? succinctly restate the risks of midata, which are well known, unlike the benefits, which we still don’t.

Completely up to them, of course, but Which? may care to take the opportunity to revisit their response to the midata consultation.

@ Malcolm R Data protection is a very significant focus of the midata programme. Increasing numbers of significant retailers are making transaction data available to customers in machine readable format, though they are still comparatively few in number. So this programme provides an early opportunity for the private sector (including consumer groups and independent) to work with the UK public sector to both support and encourage that trend and help ensure the various operational risks are proportionately addressed. Why don’t you want everyone to work together in this way? Would you prefer the adversarial style of public intervention long after problems arise, as in the banking sector?

@ David Moss Numerous private and public sector trends appear to be travelling in a similar direction, including the few you mention, but that doesn’t mean they are directly linked or will be coherent in helping to ensure that common operational risks are addressed. If anything you’re giving government departments too much credit for being joined up, whereas they need to be put under pressure to work better and more efficiently together (ideally to spend less in the process of achieving more).

It’s true that the voluntary midata programme might not necessarily “cause” additional suppliers to release transaction data to their customers in machine readable format – that trend began and will continue independently. But resolving some of the issues should help guide their approach and reduce project time/cost. This would bring forward the benefit consumers, as well as ensure that the public sector is proactively supportive, rather than unhelpfully reactive, in helping to control common operational risks.

I certainly don’t agree that we have effective switching applications for energy, current accounts or mobile phone packages, or that there is even enough genuine choice for consumers or micro-enterprises. In fact, there is extensive evidence to the contrary. A dazzling array of packages and pricing designed to deliver fantastic profits for the suppliers at customers’ expense is hardly genuine choice. But I’m sure that the big energy providers, banks and telcos will be as delighted by your perception on this front, as they will be with your assertion that only suppliers and fraudsters could be empowered by making transaction data available to customers.

Simon

On this occasion, you underestimate Whitehall. You may not have realised the connection between BIS’s midata and GDS’s Identity Assurance Programme but Whitehall do. You can’t run midata without identity assurance. The same goes for DWP’s Universal Credit. These aren’t independent initiatives which some fruitcake called Moss is battily linking. They’re the same initiative.

We already have regulators in the financial, energy and telecommunications markets, not to mention retail. If they can’t oversee these markets, if they can’t ensure that tariffs are comprehensible and that consumers can see the data they need to see, if they can’t be “proactively supportive”, why do you imagine that midata will be able to?

The big suppliers already release transaction data in the form of bank statements, electricity bills, etc … You know that. What I’m saying is that storing that data for tens of millions of people on servers in the cloud which could be anywhere in the world, in or out of the UK’s jurisdiction, under the more or less distant control of Mydex or whoever, relying on security tools and procedures which are demonstrated every day to be liable to breakdown would not be wise even if someone could say what is the benefit of midata but, as it is, no-one can and it is therefore incomprehensibly and wantonly irresponsible for anyone to suggest that midata is a good idea.

As for large suppliers, let’s let our hair down for a moment and do a bit of speculation.

62 million or so people in the UK. Over 33 million of them are monthly users of Facebook. A Facebook account is pretty well a PDS. Even more of them use the web. Google will have the browsing history of most of them and GMail/Youtube/Google+ accounts for many – again, that amounts to PDSs for millions of us. That’s where identity assurance is heading if GDS have their way and so that’s where midata is heading, too – forget little young Mydex.

midata is headed straight into the arms of big, quasi-monopolistic suppliers. Amazon (cloud computing), PayPal (payments), Google and Facebook for PDSs. They will all four of them be “delighted with your perception on this front”, as you put it. The rest of us won’t. Or rather wouldn’t. This is just speculation after all.

It is disappointing how few comments have been made but if the risks were explained I think there would be overwhelming support for our concerns.

‘Luddite’ originally referred to those who went round smashing modern machinery. Let’s hope it does not come to that, but I have seen nothing to convince me that personal data will be held and used responsibly. Every time my phone number rings and the number is withheld, or I get a call from one of these confounded market research companies I think it’s time to put a stop to data use/misuse.

Wow wavechange, something we agree on. It is OUR data not theirs and so it is up to each individual to secure their own.

It would be really useful if individual companies doing cold calling had to provide a unique reference number and name when they contact anyone. That would then allow the recipient to make an application to remove such data from the source and contactor – but that would require some authority to impose such capability!

Also in an earlier post you indicated that you do not like people who will not take NO for an answer (what about NO I don’t want to be forced to use Metric!)

David

I look forward to finding more we can agree on. 🙂

Spam is another example of misuse of information. I have to put email addresses on my website in the form of images to prevent them being harvested and used to deliver spam. Maybe some people do want the benefits of midata, but let them opt in and let the rest of us get on with our lives.