Discovering Needs for UK Identity Assurance. Workshops

Transcription

1 Discovering Needs for UK Identity Assurance Workshops

2 SETTING THE SCENE Technology agnos-c, non- profit trade organiza-on of leaders from compe-ng business sectors focused on building the volume and velocity of trusted transac-ons online. Innovate Iden-ty is a strategic independent consultancy providing advisory services focused on digital iden-ty, data, privacy, customer experience and technology innova-on.

3 SETTING THE SCENE Unique Project Overall UK Iden5ty Needs 2 x Discovery + 1 User Research Engagement in the Process

4 2015 PLAN TIMESCALES U - Collaborate 1 st DraP White Paper Published White Paper Phase 2 Discovery Start Workshops, Survey & User Research Report Economics Of Iden5ty Event May 2015 July End Sept Nov August 2015 Dec 7 th 2015 PHASE 1 PHASE 2

5 ONLINE IS GROWING UK Internet users are up 2.4 million from 2013 Online retail sales are predicted to reach 52.25bn this year Over 50% of adults now bank online, growing from 30% in m online banking transac5ons are now done through apps ONS UK Internet Use h\p://visual.ons.gov.uk/internet- use/ UK Retail Online Sales h\ps://econsultancy.com/blog/ uk- online- retail- sales- to- reach bn- in report/ This is Money h\p:// /ONS- Three- quarters- Britons- shop- online- half- use- internet- banking.html BBC Mobile Banking h\p://

6 THE RISKS ARE GROWING 41% of all fraud is iden5ty fraud Hackers are stealing personal data at an increasing rate Carphone Warehouse, Ashley Madison 57% of users are worried that their personal data was not being kept safe by organisa5ons 88% felt that keeping data safe and secure was a factor of importance when choosing an organisa5on to shop with or use Regula5on is increasing 4 th ML Dir, PSD2 ICO, Data Protec5on Rights: What the public want and what the public want from Data Protec5on Authori5es, May 2015 h\ps://ico.org.uk/media/about- the- ico/documents/ /data- protec5on- rights- what- the- public- want- and- what- the- public- want- from- data- protec5on- authori5es.pdf Symantec - State of Privacy Report 2015 (February 2015) h\p:// state- of- privacy- report pdf 4th Money Laundering Direc5ve h\p:// publishes- 4th- an5- money- laundering- direc5ve/ PSD2 h\p://ec.europa.eu/finance/payments/framework/index_en.htm Carphone Warehouse 2.4 Million Personal Records Compromised

7 UK IDENTITY MARKET Government Telecoms Sharing Economy Financial Services Legal Gambling Da5ng Travel Retail Employment The current marketplace is fragmented, any standards or regula-on that do exist differ from sector to sector meaning there is no consistent approach to addressing the problem of online iden-ty.

8 CHALLENGES WITH THE CURRENT MARKET For Organisa5ons Costly Customers drop off People don t have the necessary iden5ty proofing informa5on Fraudsters can exploit For Users Mul5ple methods of verifica5on and authen5ca5on Lack of control Lack of consent What do they do when it goes wrong?

9 UK IDENTITY MARKET Government Telecoms Sharing Economy Financial Services Legal Gambling Da5ng Retail Travel Employment What Does the Overall UK Market Want?

10 GOV.UK VERIFY Built on open standards, currently for the purposes of government use Premise is verify once, use many 5mes People s iden55es are verified by a cer5fied company each 5me they want to use a service Individuals choose the cer5fied company (they can choose as many as you like, and can change at any 5me). They don t have an account with government Any informa5on a cer5fied company or government has about people is strictly limited: no- one has more informa5on than the minimum to perform their func5on, and there is no central storage of informa5on GOV.UK Verify has been built to meet 9 iden5ty assurance principles to protect peoples privacy and put them in control of their data

11 PHASE 1

12 PHASE 1 May 2015 Workshop Financial services (banks, pensions etc), telecoms, retailers, local authori5es, online gaming, iden5ty providers, Central Government, sharing economy, Discussed 4 market models - benefits and challenges

13 ORGANISATIONS INVOLVED

14 UK MARKET MODELS

15 BENEFITS

16 CHALLENGES

17 PHASE 1 RESULTS White Paper Wider Research User Research Sector groups Workshops & Survey

18 PHASE 2

19 Financial Services Retail Online Gambling Telecoms IT Industry Landlord Sharing Economy Others SECTORS AND SUPPORT

20 CROSS INDUSTRY GAMBLING Mul5ple accounts mul5ple cost for each firm KYC acquisi5on cost - - bingo, poker etc Customer drop off customer experience Customers who cannot be verified no footprint Addi5onal iden5ty checking at payout Fraud

21 CROSS INDUSTRY GAMBLING

22 CROSS INDUSTRY FINANCIAL SERVICES Mul5ple accounts mul5ple cost for each firm KYC acquisi5on cost - Customer drop off customer experience Customers who cannot be verified no footprint Addi5onal iden5ty checking required through the customer lifecycle Fraud

23 CROSS INDUSTRY FINANCIAL SERVICES "Of the people that come to our site and acempt registra-on, around 35-40% fail the Know Your Customer process and we have to turn them away. This hurts our business two- fold; through wasted cost of acquisi-on, and the opportunity cost of lost business. For us having a cross industry digital iden-ty scheme could mean more customers, more revenue and we would save money. Alex Le-s - Ffrees Family Finance Ltd

24 CROSS INDUSTRY RETAIL Mul5ple accounts mul5ple cost for each firm Iden5ty checking cost Customer drop off customer experience Customers who cannot be verified no footprint Fraud

25 CROSS INDUSTRY RETAIL

26 BREAK

27 THE SURVEY minutes to complete Ques5ons are related to the exis5ng federated scheme in the market GOV.UK Verify 7 Themes - Market needs, market development, standards, cer5fica5on, branding iden5ty assurance principles, other details Survey will be issued via aper workshops

28 PRIVACY STATEMENT By par-cipa-ng in this survey, your personal data is collected by Innovate Iden-ty Ltd on behalf of the Open Iden-ty Exchange Ltd. Your personal data will be used solely for the purpose of administering the survey, and we may contact you in connec-on with the survey. Your personal data will be destroyed ater the survey report is complete. Your personal data will not be passed to any third par-es, but anonymised results will be retained and published by Open Iden-ty Exchange Ltd.

29 1. IDENTITY MARKET NEEDS In what circumstances does your organisa5on need to know who the customer is? Open text How do you currently ini5ally iden5fy your customers and how do you authen5cate them when they use digital services? Open text

30 2. IDENTITY MARKET DEVELOPMENT In your own words, if the iden5ty assurance market develops successfully in the next 3 years, what will be the 3 most important characteris5cs of the market at that point? 3 Boxes In your opinion what are the 3 main opportuni5es from the rapid and successful development of this iden5ty market in the UK? 3 Boxes In your opinion what are the 3 main barriers to the rapid accelera5on of a UK iden5ty market? 3 Boxes Is there anything else you would like to add? Open Text

31 3. STANDARDS The UK Government has developed a range of open standards covering different aspects of iden5ty assurance, and GOV.UK Verify has been built to meet those standards. These open standards are designed to enable diverse technical solu5ons to be developed that are interoperable and meet common levels of assurance. GPG43 - Requirements for Secure Delivery of Online Public Services GPG44 Authen5ca5on and Creden5als GPG45 Iden5ty Proofing and Verifica5on of an Individual Opera5ons Manual Detail on the GPG44 & 45

32 3. STANDARDS Upon reading the Good Prac5ce Guides 43, 44 and 45 and the opera5ons manual how well would you say you understand them? Range 5 Choices Don t understand to excellent understanding How relevant are these documents to your industry? Range 5 Choices Not relevant to extremely relevant Does your industry have a standard for iden5ty proofing and verifica5on and / or authen5ca5on? Open text

33 3. STANDARDS Does your organisa5on need to verify other a\ributes about customers, apart from their iden5ty? Yes / No / don t know & open text to list Please list any transac5ons you are responsible for that you have assessed as requiring LOA2 iden5ty proofing and verifica5on as defined by government standards. Open text What further checks would you need to do, if any, to reach the required level of iden5ty assurance for these transac5ons? Open text

34 4. CERTIFICATION GOV.UK Verify iden5ty scheme requires companies to be cer5fied. Cer5fica5on adds costs but provides assurance that standards are being met by the cer5fied organisa5ons. Different mechanisms of cer5fica5on exist; cer5fica5on by a third party/audit amongst others To be able to trust a digital iden5ty asserted by a third party organisa5on, would this organisa5on have to be: Independently cer5fied against a set of standards for iden5ty proofing and verifica5on, and authen5ca5on Self- cer5fied under an industry scheme

35 4. CERTIFICATION How well do you understand the cer5fica5on requirements for government iden5ty providers? Range 5 Choices Don t understand to excellent understanding How important is it for you, in consuming iden5ty assurance services from third par5es, that providers of iden5ty assurance are cer5fied as mee5ng defined standards? Range 5 Choices Not important to very important As a provider of iden5ty assurance services, how valuable is it for you to be cer5fied as mee5ng defined standards? Range 5 Choices Not important to very important What do you think needs to happen next in the development of the market for cer5fica5on services? Open text

36 5. BRANDING Brands have an important role to play in the communica5on of trust. They are also an important marke5ng tool for organisa5ons. But the appearance of too many logos and symbols within a digital transac5on can have the impact of confusing the user.

37 5. BRANDING How important is a cross industry brand / logo to communicate trust in a digital transac5on? Range 5 Choices Not important to very important How valuable would it be for the GOV.UK Verify brand / logo to play any part in private sector digital transac5ons? Range 5 Choices Not important to extremely important How appropriate would it be for the GOV.UK Verify brand / logo to play any part in private sector digital transac5ons? Range 5 Choices Not appropriate to extremely appropriate Please explain your answer to ques5on 2 and 3 Open text

38 6. IDENTITY ASSURANCE PRINCIPLES

39 6. IDENTITY ASSURANCE PRINCIPLES Upon reading the 9 Privacy Principles, how well would you say you understand them? Range 5 Choices Don t understand to excellent understanding How important is it to have a published set of privacy principles for providers of iden5ty assurance services? Range 5 Choices Not important to extremely important What is the best way for users to be assured that providers are mee5ng stated privacy principles? Open text

40 6. IDENTITY ASSURANCE PRINCIPLES How relevant are the privacy standards to your industry? Range 5 Choices Not relevant to extremely relevant If not, what would need to change to make them relevant? Open text Outside the Data Protec5on Act, does your industry have a standard or guidelines for privacy? Yes / No / Don t Know Do you think your industry would benefit from adop5ng the 9 Iden5ty Assurance Principles? List of principles with Yes / No / Unsure

41 POTENTIAL CROSS SECTOR VALUE For Organisa5ons Costly Customers drop off People don t have the necessary iden5ty proofing informa5on Fraudsters can exploit For Users Mul5ple methods of verifica5on and authen5ca5on Lack of control Lack of consent What do they do when it goes wrong?

42 6. POTENTIAL CROSS SECTOR VALUE How valuable do you think it would it be to explore a cross sector approach? Range 5 choices Not valuable extremely valuable What do you think the main benefits would be of a cross sector approach? Open text What would be the challenges of a cross- sector approach? Open text

43 6. POTENTIAL CROSS SECTOR VALUE Does your organisa5on have difficulty verifying customers? Yes / No / Don t Know What characterises customers whose iden55es are difficult to verify? Open Text If these customers who were difficult to verify had a digital iden5ty, what value would this have to your organisa5on? Open Text

44 7. OTHER DETAILS Is there anything else you would like to add? Open text

45 SURVEY TIMELINES Survey will be in your inbox by midday tomorrow There will be a two reminders sent Deadline for the survey is 30 th of October Any issues please oixuk@openiden5tyexchange.org

46 FEEDBACK What can we do more / less of?

47 GET INVOLVED