Control over data is still a long way off, according to Dutch Self-Sovereign Identity study
Research into Self-Sovereign Identity (SSI) in the Netherlands by INNOPAY and TNO has revealed that the SSI landscape is very fragmented, which is making it difficult for relevant parties to achieve critical mass. Nevertheless, the Dutch ecosystem has sufficient partners to be able to play a role in shaping SSI at the European – and perhaps even global – level. Researchers Eefje van der Harst (INNOPAY) and Sterre den Breeijen (TNO) call on the Dutch government to clarify the legislative framework and to agree on standards with the private sector. They also urge the government to bring an end to the ‘chicken-and-egg’ situation in the ecosystem by making source data available.
Over the past few years, a new way of thinking about digital identity has emerged: Self-Sovereign Identity (SSI). SSI is based on the principle of putting users in control of their digital identity and the related data. This has the potential to offer several advantages, such as process optimisation (especially in terms of administrative processes), data quality improvements and data minimisation, as well as more privacy, more autonomy and more transparency in the digital domain. As a result, the topic of SSI is attracting significant attention and investment.
In the Netherlands, various SSI initiatives, products and standards are currently being developed by the government, the private sector and academia. This has prompted the Dutch Ministry of the Interior and Kingdom Relations to commission INNOPAY and TNO to conduct a study of the SSI landscape.
Ministry spokesperson Wouter Welling explains: “As the policymakers for the Dutch digital identity infrastructure, we believe that the government should play an active role in creating trust in the digital world among citizens and businesses. A reliable source identity is crucial for this. We’ve noticed that the market has a growing need for clarity: what’s the link between the vision on Digital Identity and the relatively new idea of Self-Sovereign Identity? That’s why we asked INNOPAY and TNO to investigate the status and development of the Dutch SSI landscape. Their findings will help us to define our own position on SSI more effectively and to clarify the policy.”
Overview of the SSI landscape in the Netherlands (July 2021)
The survey of the SSI landscape confirmed the suspicion that numerous different parties are experimenting with SSI principles, architectures, infrastructures and technologies. Each party – sometimes in a cluster with other parties – uses SSI to facilitate digital data exchange within their own domain. Examples of this include the Blauwe Knop (‘Blue Button’) initiative of the Association of Netherlands Municipalities (VNG) to help citizens stay in control of their finances, as well as various initiatives supporting access to job references, diplomas and certificates during the recruitment process. To a certain extent, the Corona Check App can also be seen as an example.
While all these initiatives clearly illustrate the potential of SSI, there is still a lack of collaboration and cohesion between them. Sterre den Breeijen: “The landscape is fragmented in both the public and private sectors. One key reason is the lack of a clear-cut definition of what SSI actually is. The various parties also disagree on the benefit and necessity of SSI: is it aimed at improving privacy, or reducing the administrative burden? And isn’t there another way to achieve those benefits instead? Besides that, there are conflicting views on the best technological approach to SSI: with or without blockchain, should it be open source or not, and which standards should be used? At the same time, there are still limitations on the extent to which data sources like government base registers can be accessed and used outside of the source domain. That’s another barrier to stimulating the necessary network effects in order to create value.”
The need for clear rules of play
Numerous national and international developments and initiatives are influencing the Dutch SSI landscape, such as the Parliamentary Letter providing a progress report on the domain access and the Regie op Gegevens (‘Control of Data’) policy outline. Additionally, the impact of the proposed revision of the eIDAS Regulation in June 2021 should not be underestimated; in line with SSI thinking, it will give all citizens and businesses in the EU the right to an EU Digital Identity Wallet. Eefje van der Harst: “Market players are unclear on how the various national and international laws and regulations are interrelated. They indicate that this is one of the biggest barriers to using SSI to create societal value. They find it difficult to ascertain how future-proof implementation choices are. As a result, they are delaying their investment decisions and deliberately prolonging the exploratory phase.”
In the meantime, Big Techs such as Apple, Google and Microsoft are rapidly launching, rolling out and scaling up their own SSI-like wallet initiatives. Many of the respondents regard Big Tech players as a serious threat, particularly Apple and Google who – through their app stores – ultimately ‘control’ how mobile phones are used. Past experience has shown that it’s more difficult to curb existing products or services than it is to establish an appropriate framework beforehand.
Regardless of how the SSI landscape will look in the future, the government will be keen to strengthen the positive effects on public values and mitigate any negative effects. The study reveals that a somewhat more consolidated SSI landscape will generally be more positive for everyone involved in digital data exchange: citizens, businesses and the government. However, Self-Sovereign Identity and a cohesive SSI landscape is not an end in itself. The decision about whether to facilitate decentralised digital data exchange by making citizens fully sovereign or through the use of a more ‘traditional’ digital identity depends entirely on the context and the trade-off between the various public values (which sometimes conflict)… but that’s a societal decision rather than a technological one.
The researchers from INNOPAY and TNO conclude that, in view of the societal value of digital data exchange, the Dutch government would be wise to actively stimulate the further consolidation of the SSI landscape. A first step should be to provide clarity on the relationship between the Wet Digitale Overheid (national Digital Government Act) and the EU Digital Identity Wallet. The government can also play a role in creating a more harmonised and interoperable landscape by bringing together the 90-plus public and private parties that are experimenting with SSI so that they can share their knowledge and expertise.
These best practices should also be made available to the bodies across Europe who are currently working on the details of the EU Digital Identity Wallet. Moreover, the government is urged to accelerate its activities to make source data available through digital agents and/or data-straight-from-source interaction models. The government itself can also use this source data, both for validation purposes and to optimise its own processes. This will help the Dutch economy to start benefiting from the societal value of digital data exchange.