MEF’s latest survey, supported by Boku – Personal Data, Digital Identity, Verification and Authentication in the Enterprise: Analysis and Opportunities – has the goal of increasing knowledge around current enterprise usage and plans for the future – segmented by sector, geography and enterprise size. Report author Andrew Parkin-White shares some of the key findings around the issues of the ownership of personal data in 450 enterprises that we spoke to.
Across the globe we are seeing dramatic changes in the approaches to personal data and authentication driven on the one side by the threats we are facing online and by the need to prove and verify who we are.
We are seeing moves by governments and regulators to enable the individual to have ownership of their personal data and pushing towards the position of self-sovereign identity where the individual owns, manages, controls and issues their personal data.
The reality would appear to be far from this at present as there is considerable discussion around whether the subject or the organisation owns the personal data of the individual. We decided to find out what is really happening and asked 450 enterprises about their views on personal data ownership.
We asked whether it is the individual, the enterprise or a hybrid of both that owns the customer data and a very clear picture has emerged. At an overall level, we see that 78% of enterprises claim that they own the personal data of customers, a further 16% say that it is a hybrid of the enterprise and the individual and only 5% say that the individual owns their own data.
This overall figure does not take into account the situation in the individual countries we looked at with 100% of enterprises in Indonesia and 96% in India saying that the enterprise owns the data.
This is in sharp contrast to the USA at 53%, Spain at 60% and Germany at 64%. If we look in more detail at countries where the enterprise states that the individual or subject owns their own data, we can see this most markedly in Spain at 31%, Germany at 30% and the USA at 27%. Interesting only 6% of enterprises in the UK say that the individual owns their own data.
We wanted to look at the same question from the perspective of the various sectors that we interviewed and we can see some distinct differences here. It appears that organisations in the dating and gaming areas offer the greatest degree of data ownership to the individual with over a third of businesses in these areas saying this is the case. At the other end of the spectrum, 92% of payment companies and 89% of financial services organisations say the customer data belongs to them. There is also little variation in this figure by enterprise size with smaller organisations of less than 1,000 employees having a marginally higher ownership at 82% compared to an average of 78%. In enterprises with more than 25,000 employees, 7% say that the customer has ownership of their own data.
Of course, ownership of data is only part of the picture and this is a snapshot in time rather than a trend. The individual is very concerned about the security and safety of the data that the enterprise holds and needs to feel confident that they are protected from online harms and fraudulent attacks on the enterprise. We see that enterprises are striving to enhance means of identification and verification of the customer and the survey examines a range of methods in place and planned to mitigate risk and threats. As long as the enterprise is in ‘charge’ of their data, individuals need the knowledge that their data is safe and that they can exercise trust in the integrity of it.