From Security vs. Privacy to Identity: an Emerging Concept for Policy Design?'

Abstract

Purpose To examine the electronic identity (eID) market from a social, technical and regulatory viewpoint, and the opportunities / challenges for policymakers. To discuss whether a single European market for identity is realistic and whether a common eID framework for Europe is timely and appropriate. Design/methodology/approach Structured review of user behaviours, timeline of technical developments, analysis of market trends and policy analysis in relation to the eID ecosystem. Findings Users of electronic systems and applications disclose increasingly more identity-relevant data. This data is often prerequisite to the supply of advanced electronic services. In economic terms, the utility functions of users and service providers in relation to eID data are divergent. This generates a market asymmetry, as service providers are able to extract value from user data via opaque value propositions. European policymakers have different options to redress this unbalance. An eID framework based on the 'privacy by design' approach is seen to offer a solution to excessive disclosure, market fragmentation and unclear value propositions. The strengths and weaknesses of the approach are assessed. Practical implications In discussing an eID framework, policymakers should address critical issues concerning 1) resources and funding; 2) balance between online vs. offline transactions and between present vs. future technologies; 3) users' actual behaviours; 4) the infrastructure of certification and trust; 5) governance at industrial, Member State and EU level. Research limitations/implications Results from the application layer of the eID market are based on exploratory research. Evidence from a larger number of cases and sectors is required to determine and articulate emerging value chains. Originality/value The paper draws together research in four domains: social, technical, market and regulatory. It addresses for the first time the barriers to the ¿privacy by design approach¿ alongside its virtues.