So recently I’ve been trying to get my head around identity, privacy, trust and personal data. And how it all fits together, and why that’s important.
I thought it’d be best to go back to basics and try to define identity, so here are a few thoughts.
Identity is context
If identity is how you express yourself to others – a statement of what you believe, ‘who’ you are – then it must vary by who you’re with, where you are, what you are doing, when you are doing it, and why. For example, my identity can be a number of things.
- Football supporter (e.g. who I’m with)
- Temple-goer (e.g. what I believe in)
- Volunteer (e.g. what I’m doing)
- Soldier (e.g. what I’m wearing)
- Employee or pupil (e.g. where I am)
- Conference attendee (e.g. what interests me)
I can of course be any of these things at the same time (I can be a football supporter at work, or a soldier while volunteering), but the important thing is that it’s all about the context.
Identity is sharing
If identity is about you in a context, then it must also be about how others perceive you in that context (indeed we often say “I can identify WITH her” – that we have a connection with each other in some way). This means that by definition, identity has to be about sharing – sharing things about ourselves with others – so that an opinion can be formed.
But what is being shared?
- The logo from a personal device?
- A uniform?
- A username and password?
- A medical record?
Of course it’s all of these and much more. It’s all personal though – all Personal Data.
Identity is personal
Before we can understand identity we must first look at personal data.
What is personal data? It’s clear to me that this term means so many different things to different people. I think now is a good time to define what exactly personal data is, and how different types of personal data have different characteristics. So here are some terms I think are helpful to explain what Personal Data means.
This is the stuff you’re born with – blood type, sex, finger print, genome information, date and location of birth. It’s both self-evident and usually captured at birth. A lot of it is called your ‘biometric’ data.
The value here is two-fold: as a set of data it is entirely personal to you and can’t be duplicated; and it’s perpetual – it will never change.
These are the types of data that are a result of being alive. Height, weight, religion, sexual orientation, BMI, shoe size and health diagnoses are all types of Being Data. These types of data are likely to be steady-state for most of your life, though are subject to change during times of physical, emotional or spiritual growth or upheaval. It’s captured in various ways; most often as medical records.
The value here is being able to see patterns of cause and effect, and to influence behaviours throughout our lives.
This is the data that is attributed to you by others, or is data that you claim yourself (and which is usually validated by a 3rd party). This includes education, awards, achievements and most government data held about you – driving license data, criminal record, National Insurance number and census data.
Attributed Data is also any record of things you own (or look after) – including your car, your credit card, white goods, pets and mobile phones. As such, it also includes your contact details: your address, phone number, email address and social media handles e.g. Skype, Twitter etc. (of which of course, you can have multiple versions e.g. work email and personal email).
The value of Attributed Data is that we can determine levels of trust: so that we can both trust others and ask others to trust us.
This is pretty much everything you generate and produce yourself: photos and videos, status updates, browsing and shopping history, banking and financial records, plus the records of all your communications (phone calls, SMS etc.). It’s also your intentions, your wish-lists and personal ‘check-ins’ (a la Foursquare).
Importantly, Created Data must be published somewhere, even if that’s in your own private documents.
Created Data reflect snapshots of you, frozen in time. The value is that together this data tells a story about you, the richness of which increases over time.
This is the last category of personal data; and it’s not really personal. Inferred Data is data that someone (or something) has assumed about you. This data is not produced for you, nor is it generated on your behalf; it is there to serve some other purpose. Some would say this is so that a company can better ‘target’, ‘acquire’ or ‘own’ you.
Inferred Data includes your credit score and other segmentation data that companies hold about you. The value of inferred data is ultimately for organisations to make sense of their customers.
It became clear to me as I was writing this that these different types of personal data are actually layered upon each other, a bit like Maslow’s Hierarchy of Needs. See the diagram below.
Self Data is the core of us – indeed it’s used by forensic and security teams to prove who we are. Being Data is a by-product of living our lives; of interacting with each other and of changing as we grow older. Attributed Data is the next layer, which in Maslow’s terms is social: data about things we are responsible for and about how we interact with our community/ society. Created Data is at the top of the hierarchy, as this is about self esteem and self expression (note that much of this is a product of our digital society – consider how much Created Data exists for a homeless person, or a Buddhist Monk).
You’ll see that the there are two halves – the ‘real me’ is on top – visible and shared – and the ‘hollow me’ is underneath – not usually visible to us as it’s held by others (usually organisations). I’ve done this deliberately to show that the real me is your actual data – my actual medical records, my actual location, my actual intentions. This is very different to the Inferred Data which is really guess work, and which is produced by – and only ever for – others.
You can see that Inferred Data can reflect any type of personal data – inferred sex or age, inferred state of health, inferred level of education, inferred address, inferred financial activity, inferred location, inferred intentions. Inferred isn’t real; it’s based on assumptions.
So it’s clear – to me at least – that identity is contextual, about sharing and about personal data. And that inferred personal data can result in an inferred identity – a ‘hollow me’.
I believe these ideas underpin what we mean by privacy and trust, but more on that another time.