1 of 31

�MyData 101�MyData 入門編

FUJITSU PLY Tokyo�October 31, 2018

Dixon Siu�Founding member, MyData Global

Twitter: �@mydataorg, @dixon_siu

2 of 31

MyData in a nutshell

3 of 31

The core idea of MyData is that individuals should be in control of their own data.

The MyData approach aims at strengthening digital human rights while opening new opportunities for businesses to develop innovative personal data based services built on mutual trust.

MyData Vision

4 of 31

Make It Happen, Make It Right

MyData is both an alternative vision and guiding technical principles for how we, as individuals, can have more control over the data trails we leave behind us in our everyday lives.

5 of 31

Weak

Data Protection

Lots of data usage

Less usage of personal data

Strong

Data Protection

Comply with the GDPR

People decide

Organisations decide

Old paper times

REGULATION

6 of 31

Three Models

API Ecosystem

Platform Model

MyData Model

7 of 31

MyData Principles

Human Centric: right to data, individual in control, privacy

Usability of Data: machine readable, open formats, APIs, standards

Open Business Environment: interoperability, possibility to change services without “data locks”

1

2

3

object: MyData Principles (White Paper Version)

Human centric control and privacy: Individuals are empowered actors, not passive targets, in the management of their personal lives both online and offline – they have the right and practical means to manage their data and privacy.

Usable data: It is essential that personal data is technically easy to access and use – it is accessible in machine readable open formats via secure, standardized APIs (Application Programming Interfaces). MyData is a way to convert data from closed silos into an important, reusable resource. It can be used to create new services which help individuals to manage their lives. The providers of these services can create new business models and economic growth to the society.

Open business environment: Shared MyData infrastructure enables decentralized management of personal data, improves interoperability, makes it easier for companies to comply with tightening data protection regulations, and allows individuals to change service providers without proprietary data lock-ins.

8 of 31

MyData shifts - what needs to change

Formal → actionable rights
Data protection → data empowerment
Closed → open ecosystems

1

2

3

https://mydata.org/declaration

原則：mydatajapan.org/declaration.html

9 of 31

GDPR

Strengthen, harmonise and clarify data protection

Enable new personal data based services

Strengthen individual rights and trust towards data handling

Partly overlapping aims of the GDPR and MyData -approach

10 of 31

GDPR Principles in summary

Consent
Data Portability
Right to Access
Right to be forgotten
Privacy by Design
Data Protection Officers
Breach notification

object: MyData Principles (White Paper Version)

Human centric control and privacy: Individuals are empowered actors, not passive targets, in the management of their personal lives both online and offline – they have the right and practical means to manage their data and privacy.

Usable data: It is essential that personal data is technically easy to access and use – it is accessible in machine readable open formats via secure, standardized APIs (Application Programming Interfaces). MyData is a way to convert data from closed silos into an important, reusable resource. It can be used to create new services which help individuals to manage their lives. The providers of these services can create new business models and economic growth to the society.

Open business environment: Shared MyData infrastructure enables decentralized management of personal data, improves interoperability, makes it easier for companies to comply with tightening data protection regulations, and allows individuals to change service providers without proprietary data lock-ins.

11 of 31

EU GDPR item	MyData Response
Consent	Entire MyData architecture is built on managing consents.
Data Portability	Realising and promoting functional APIs/interfaces for data, not just file access is central goal in MyData.
Data protection by design and default	MyData creates a framework where both control and transparency of data usage is done human-centric.
Profiling �	Profiling requires explicit consent. Human-centric, multipurpose profiles that data subject controls.
Sanctions	Concept of ‘Privacy as a Service’. Common operational model that brings crisp & clear principles.

12 of 31

13 of 31

How to benefit all the parties

I want easiness!

Instead of filling in the forms I wish to have a safe and trusted way of sharing existing information between organizations.

I want quality data!

I don’t want to bother my customers with data collection, but I need reliable data for personalizing our service.

I want to keep customers!

Be trusted and transparent, but also benefit from being the original data source.

Person

Data Using Service

Data Source

14 of 31

Make it Happen?

Tools, Companies, Activities...

15 of 31

1. VISION

2. PRINCIPLES

3. OPERATOR

MODEL

4. TECHNICAL

BUILDING

BLOCKS

5. BUSINESS

MODELLING

6. ESTABLISHING

OPERATORS

(TRUST NETWORK)

Value for all?

Individual

thinkers

White Paper

in Finnish

Working

Group

EU Commission

“PIMS round table”

White Paper

in English

MyData

Conf. 2016

Gov.

agenda

TrustNet

Proposal

2013

2014

2015

2016

2017

2012

BUILDING AN OPEN ECOSYSTEM

Finnish gov.

involvement

First events

International

contacts

MyData

Alliance (FI)

MyData

Alliance (EE)

Academic

research

Company

involvement

Gov. spearhead

programmes

MyData -pilot in

national data-infra.

Scaling up

the activity

Open Ecosystem: Low entry barrier, interoperability, fair and transparent governance (who sets the rules), balanced value sharing...

16 of 31

MyData Alliance

40+ organizations

Facilitate pilots

Create interoperability

Specification + Code

Architecture documentation & Reference implementation

“People’s right to decide about and monitor their personal information will be enhanced”

“start MyData based pilot projects”

Government agenda & spearhead programmes 2015 →

White papers

2014 (FI), 2015 (EN) and 2018 (FI)

International conferences 2016, 2017 & 2018

mydata2018.org

17 of 31

International community and movement

18 of 31

FINLAND

ESTONIA

SWEDEN

DENMARK

NORWAY

NETHERLANDS

BRUSSELS (Belgium)

UNITED KINGDOM

SWITZERLAND

BERLIN (Germany)

FRANCE (MesInfos)�BARCELONA (Spain)

TURIN (Italy)

SLOVENIA�SLOVAKIA

GREECE

BRAZIL

JAPAN

TAIWAN

CANADA

MADISON

NEW YORK

ATLANTA

NEPAL

MyData Local Hubs

mydata.org/hubs

CAMEROON

19 of 31

Companies and organisations ...

20 of 31

... across the globe

FINLAND

UK

US

GERMANY

FRANCE

ISRAEL

UK

AUSTRALIA

FRANCE

BELGIUM

SWITZERLAND

UK / US

FINLAND

NETHERLANDS

UK / US

21 of 31

日本の会社がない

FINLAND

UK

US

GERMANY

FRANCE

ISRAEL

UK

AUSTRALIA

FRANCE

BELGIUM

SWITZERLAND

UK / US

FINLAND

NETHERLANDS

UK / US

22 of 31

Data banks - Japan

The state to give permissions for organisations to act as data banks (aka MyData-operators)
In addition to the MyData operator functionalities (like consent), databanks would represent people as “information fiduciary”, representing people in “data issues”.

This is slightly analogous to e.g. lawyer in legal matter, or real estate broker in real estate matters. Assumption is most people will not be capable to act on their own, these kind of representatives are needed - but need to be regulated.

Japan is looking at Europe, but obviously there are big differences culture. The data bank law is a step toward European, “individual-oriented” thinking

23 of 31

Personal Analytics

Service Discovery

Consent & Policy Management

Identity Management

User Experience

Relationship Management

Governance & Regulation

Data Standards

Personal Data Storage

Authentication and Authorisation

Interoperability

System Security

Object: Technical Building Blocks��Example initiatives:

Personal Data Management and Creation Interface

E.g. Meeco, Healthkit

Personal data management, relationship management, decision support, self-report, data visualization, privacy control etc.

Algorithm and Application Sandbox, Analytics Engine

E.g. Synergetics, Genecloud, Cozy Cloud, OpenPDS

Algorithm and application sandbox, analytics engine. Run analysis and applications locally instead of sending data out. Aggregating and analysing encrypted data

Semantic Models, Schemas “Profiles”

E.g. Hub-of-all-things

Industry sector standards; API harmonisation; New personal data semantics; Multi purpose data profiles (i.e. health, mobility, intent profile, contact, status)

Data Storage, Database model, Data APIs

E.g. Mydex

Local, cloud, distributed storage. Data as a Service. Various security approaches.

Authorization, Audit Trail, Consent models

UMA, XDI2, TAS3, Minimum Viable Consent Rereipt

Consent management as a service, authorizing and later auditing the data transactions. Standard user policy management and sticky policies (policies travel with the data). Permissions and Obligations

Service Registry, Service Discovery

E.g. Appstore, Google Play, IFTTT

Base of the “app store”, discovery of compatible services and data sources

Identity Management

E.g. Tupas, eIDAS, OpenIDConnect, Glome Soft Account��Trust networks, IdPs, strong authentication, regional regulations, identity non-disclosure as default, unique Identifiers, pseudonymization mechanisms.

Trust Assurance

End2end trust assurance (trust being the container for trust + security + privacy); No backdoors; Aggregating and analysing encrypted data; Privacy by Design; Must utilize best of breed cyber security tools and protocols; Tools that enable individual control and privacy management.

Governance model

Best practices, rules and regulations (legal and technical); Clarity of rules and division of legal responsibilities; Federated and/or hierarchical trust networks and schemes; separation of concerns;

Relationship management

Human-centric or symmetric counterpart to organization-centric CRM thinking; Vendor Relationship Management (VRM); Customer Managed Relationships (CMR).

24 of 31

MyData and Related Phenomena

Big Data

Open Data

CRM

Identity Management

Cyber

Security

Privacy

MyData enables trusted and privacy-aware Big Data analytics

MyData is open approach to personal data, but it is not open data

MyData is human-centric or symmetric counterpart to organization-centric CRM thinking

MyData must utilize best of breed cyber security tools and protocols.

MyData approach provides tools

that enable individual control and privacy management.

Major part of personal data is linked to digital identity and can be also considered as identity attributes

MyData

25 of 31

DATA SOURCE

Ex. National registry of educational degrees

DATA USING SERVICE

Ex. Recruitment portal

PERSON

Ex. Me authorising my data sharing from the national registry to the recruitment portal.

MyData Business Networks

26 of 31

Individual (Principal)

MyData Operator (Custodian)

Data Sources and Data Using Services (Providers and Relying Parties)

Consent Flow

Data Flow

27 of 31

The MyData opportunity

Current state

Opportunity

Solution

Trillion €

The Value of Our Digital Identity in EU - Boston Consulting Group (2012)

Solving the trust challenge requires interoperability and new practices

Trust is Broken

78% state that it is hard to trust companies in how they manage personal information - The future of Digital Trust - Orange (2014)

Governance

Brands

Technology

Practices

Easy of Use

28 of 31

29 of 31

Portability

Cases

Our Data

Business

Future

Empowerment

AI Ethics

Interoperability

Design

Main Stage

Sessions

Perspectives

Open Space

We also invite like-minded communities to organise meetings as extended events before or in parallel with one of the main MyData conference days.

30 of 31

MyData Global/Japan

Engage:

Join the lively Slack: https://mydata.org/slack/

Communities:

MyData Japan: https://mydatajapan.org

MyData Global: https://mydata.org/

31 of 31

Credits

A big thanks to Teemu Ropponen for sharing his okf.fi/mydata-idrc-webinar and allowing us to remix/modify the contents.