From GDPR to eIDAS 2.0: why digital trust needs rules

Often a regulation is a reflection of an incident. The plot is now over and all the problems have been solved. And little did you know something happens. If I open a bank account with a meal bank that I don't know, can I trust them and can they trust me? We're seeing and we're noticing some pushback from European states that are trying to layer of national roles on the top of the roles that were decided by the EU, which could create division in the way we can provide trust services. I'm a nerd, I'm a mathematician. I love rules, I love logic, so yes, we need trust rules. Welcome to Trust Rules, where we've done the boring reading of the European Digital Trust regulations. And we sit down with only the rules that matter, spoken down into who and how, grab a coffee and let's have some real talk about what's actually changing. This podcast is brought to you by Signacat, European leader in digital identity. Hi, I'm Will and I'm one of your two hosts in this podcast. Together with me here is Lucy. Hi, hi everyone, I'm Lucy. You will hear my voice and Will's voice over the next episodes of Trust Rules. Great to have you and great to do this together, Lucy. We've collaborated quite some time in Signacat. How would you describe your role, who are you for the distance that haven't met you yet? OK, I'm a bit of a regulation geek, let's say. And so many, many years ago, at school, I studied law and this is how I got into the business of identity. My role is at the intersection between sales marketing but also compliance as our industry is heavily regulated. Obviously, so it's good to have, well, legal skills, so to say, can you say a few words about your role, Will, for the listeners? Yeah, I'm almost a veteran in the area. I started in IT research and business development summer, end of last century, in a research institute. But moving into the identity space, relatively short term, about 10, 15 years ago, that's when we started a company that has now been absorbed by Signacat, where we worked in the field of identity and preventing fraud. So I kind of grew up in this world. I'm not a legal expert, I'm not a regulation expert. But of course, when you're in this business, that's what you have to deal with. There's a lot of legal stuff going on, a lot of regulation that we're confronted with. And that's also, basically, what we want to achieve, of course, in this podcast is learn and experience and discuss with each other and with others how identity and regulation works, what are the trust rules? Yeah, looking forward to doing this in the upcoming episodes together with you. And I'm also looking forward to listening and discussing these things with a lot of the guests that we'll have in the upcoming episode. And welcoming our guests, exactly, is not just going to be you and I, Will, on the next episodes. We've got special guests lined up, identity experts, legal experts. We'll have them all on the podcast, on trust roles. So I mean, where does it come from? Right. Since when do we have all of these roles on identity? When you started your career, but maybe a bit before I imagined that there was a world where we didn't have roles on trust, what was trust back then, online trust. Almost like an old guy. But at the end of the previous century, things were connected. I worked in universities. There's some research there. And for example, if I would go to a university, university, somewhere abroad, I could simply remotely log in to my workstation here at University of Twentha, just capture the screen, send the screen to Germany and work there remotely. And the only thing I needed was say, you should write in the password. It's very hard to imagine that that was considered safe. Or that it was safe. And I don't think that the rules were lacking. They were less needed because it was a relatively small infrastructure. It had very little business value. And I think that's where things changed. So early this century, I mean, the internet became part of the business infrastructure of everybody's daily infrastructure. And also very soon, governments and other people recognized the potential of it for gathering data. And that was of course sped up by things like 9/11, where lack of information, lack of combination of information, led to terrible events in the US. And the US started to gather loads and loads of information to gather intelligence to prevent such a disaster from ever happening. And internet infrastructures are of course a great way to gather that information like telcos are and similar. So yeah, things have changed since then. So we're definitely in an era where we need trust rules. Yeah, I think so. Yeah, it's hard to imagine nowadays how different the internet was, how different the use cases of the internet was. But an internet that underlies the whole financial infrastructure that would explain the regulation production of the last 15, 20 years, really. I mean, with the rise of the internet and the use of more social media, of course, also the scandals came. And I think there's definitely a relationship between scandals and breaches and regulation. So Edward Snowden, after 9/11, he showed how much data was collected by the governments. And we didn't realize, until incidents like with Edward Snowden, that was the case. So there's a very interesting relationship between let's say data breaches or disclosures. And regulation, after the regulation is a reflection of an incident. What good thing to recall as well as the 2018, I think, Cambridge Analytica scandal? Do you recall that one still? Lucy? I do. This had something to do with a political campaign for an election where. Exactly, yeah. And it turned out that secretly Cambridge Analytica, as a supplier into Facebook, gathered all kinds of data on people and used it for political profiling and campaigning thereafter. So that's basically your first. One of the first times that everybody started to realize that data and personal data can manipulate society. And it is democratic power. And I mean, that has increased tremendously, it didn't stop these kinds of things. I mean, right now, it's all over the newspapers every time that there's elections, it's not if it is influenced by social media. But how much is this influenced by social media? There's a lot of regulation going on out there, but it's good to realize that the foundation for regulation, especially in Europe, was already laid in 2000 where we had the charter of fundamental rights in Europe being accepted, and that included talking about privacy and data protection. So that was quite a long time, it's 26 years ago now, that Europe started to think outlawed about privacy, of course, it's still way before GDPR, the data protection regulation got adopted, that was 2016. But the foundation also already laid in 2000, I don't think that was the approach to privacy back then, or what motivated back then, this regulation of privacy, would you say? how did it come about? It was, it was considered, or it is still considered as a fundamental right. And you could also look at it as a more philosophical or ethical perspective. That even goes back maybe to the Second World War where lack of privacy or basically there were some countries, including also the Netherlands, that had very good registers of its citizens. Those registers were exploited that introduced a kind of a natural fear or anxiety around personal data. And I think that that that foundation with the advent of being more and more digital was also the the core of the of the of the fundamental rights of the European Union, including that that privacy and data protection article. And so it basically comes from from from big incidents, historic incidents, historic events that taught us in a very, very harsh way how sensitive personal data actually is. And I think that that me personally, I'm quite proud of of the GDPR, the data protection regulation that we have in Europe. It's regulation that explains how you can use personal data in a, in a, in a, in a, in a privacy protecting way in a, it doesn't prevent you from using it, but it, it tells you the rules. It explains the rules of data. And that's something that I appreciate very much. It, it explains that you have to do privacy by design. So not as an officer of privacy should be integral in the design of your system. It, it gives you the right to be forgotten, which is great. And it allows you, it gives you the right to, to, to, to bring your data from one service provided to another. So sometimes GDPR is perceived as regulation that tells you what you cannot do. But basically, I think it gives you the rules that tell you how you can do it in a way that we find acceptable in Europe. So would you say it's protecting consumers against businesses? And is that the approach that, that the Europe, that the European Union is taking a more consumer protecting approach compared to other parts of the world? So it's also, it's protection, but it's, it's also empowerment. And the fact that it is combined with, let's say, a fine that can be up to 4% of the global turn-off, or makes it also something that's not only enforceable and principled, that, but it will really hurt if you, if you don't play by the rules. And of course, when Europe introduced this, we were kind of the laughing stock of the, of the world. So that we were so, at least in the eyes of some, some people, because we were so much protecting or empowering our, our citizens. But now we're kind of like a role model in that, in that sense. In, in those days, it led to, to some businesses shutting down in Europe because they didn't want to play or could not play easily by the rules. And that's exactly what you want, I think. Yeah. But also, I mean, our friends from overseas and across the Atlantic would argue that all of our rules in Europe and our regulations, it's killing business. So yeah, all right, we're protecting our consumers. And we are role models of, you know, privacy, et cetera. But he's, he's in all of that regulatory production, slowing our businesses down compared to, I don't know, the US, for example. Yeah, it is. It definitely is. And you see, the same discussion now again happening with the AI Act, telling what rules to play with, with AI and use of, of, of IPR and, and, and rights and, and identity. It's again, slowing down business. But it might be rightfully so. That, that, that there's not, in the world there's not one size fits. So I think if you, if you put it very well, a very coarse view on how the world, you can divide the world in three parts. A little bit of the Europe perspective where we think that the citizen or the individual is important and should be protected or empowered or if you would call it. And then you have the, the US perspective where the individual is less important, but businesses are more important. And then, and they, they're less into protection, but more into a, more liberal market where data is more valuable and generating business from data is more acceptable than in, than in Europe. But then there's also a third world model. And that's, let's say, more the Chinese model, or maybe also the Russian model where the individual is not so much an individual, but is really seen as an integral part of society. So society is the main concept or object that should be protected or we grew up. And that, that means that so that the, the, the, the individual is less important than society as such, where here in Europe we say the individual is more important than society or part of it, but you're, you're, you're, you're more important society. And so those are three different perspectives. And you cannot simply move one service or one trust concept from say Europe to the to China or vice versa. I mean, that doesn't work either. So exporting, well, digital signatures or digital identities or wallets from Europe to China would not work like exporting TikTok from China to Europe. It doesn't work in my opinion. Let's, let's, we, we talked a bit about 2016. Let's move towards happening now. And TikTok is introducing TikTok shop in, in the Netherlands now. And that, that, that raised big debate because TikTok shop allows TikTok users to see, to buy items when they see them in, in, in, in the TikTok movies. And so it really allows you to impulse buying. And I mean, I had that when I was on Kickstarter, I bought way too many Kickstarter projects. But the brain of a, of a minor or a very young adult is very vulnerable to, to, to, to those impulse type of things. And the consequences of what you do are less, less simply, from a brain perspective, harder to oversee. And I see that on a regular basis also with my kids, by the way. But getting that TikTok shop from, which we should have developed in China into the European TikTok users can be, I would almost say lethal because in principle, yes, it's protected by age verification. But what's age verification now in Europe? It's, it's, it's just a ticket in a box. It's not really enforced. And the weird thing is that, so we, we introduced that, that, that, that, that drug that buying drug into the infrastructure of all our teenagers, now in, in, in the Netherlands. Whereas in the Chinese context, using that TikTok shop is very much regulated way more than us, they do have age verification. They, they, they do look after decades and they even have rules that tell how long a kid can use those social media apps. And that comes from the perspective that society is more important than, than the individual. So society determines what's good for you. And then you transport that TikTok shop into, let's say, the Netherlands. And then suddenly, we say, well, yeah, you're important, but, wow, the, the, the business can regulate itself. And it will take care of this. No, they don't, they don't, they make our kids exploitable. They, they, they, they, so they, they, they, they, you have that conflict of models. Yeah. In a very, in a very nasty way. So how I understand what you just described is the philosophies or the priorities of a given state or region don't necessarily match the priorities of another region. And so it's, it's very hard to use the trust frameworks of a certain region in another region because it doesn't align with the priorities of one another. Yeah, from the mentally different principles. So it's a principle based approach. So, and yeah, play by this, this would be a match between the services, the trust services, and the principles that the, that the region has. And that's a, that's a challenge. And I think that if we move now to what's, what's currently going on, I think with EES, as a trust framework in Europe, where we are, are moving in the right direction. So GDPR was about personal data and privacy. That's your individual rights. But didn't in doing transactions, it's also very important to talk about can I trust you? Can I trust you Lucy? Are you Lucy? If I open a bank account with a new bank that I don't know and I have a savings account and they promise me great interest, can I trust them? And can they trust me as being the only answer? Well, I put my money in there and it's illegal money. It's not money laundering going on there or money muting. So we're now GDPR, personal data settled, kind of, quite OK. Now we're in the area of trust and we need to define those trust rules. And it is a interesting step in that direction. Is it the right step? Is it, yeah, it has the right step. Well, I think it's so with the objectives of the European Union to create a single market where people and goods and services freely circulate in order to grow our GDP really. It certainly works quite well. Why? Because it creates, well, at least, the aim of the idea is to create a single rulebook so that people would know how to trust one another regardless of their country of origin as long as they're in EU rights. So in that sense, Yadass is a great tool to promote exchange and growth in the EU which aligns perfectly with the objectives of our region. Now, it's obviously not all perfect because as you create new rules, you always create new problems, push back from certain states, certain states. Does a group of the rules or try to create new layers of rules on top of the harmonized rules creating, in turn, more fraction in the rules and friction in between people and the way it's changed in the provinces, et cetera? So you're quite positive about Yadass. But let's face it, Yadass won. So we're not Yadass 2.0, Yadass won. Come on, from 2016, 2018, cross-border operation, it was a big failure. It was conceptually maybe nice, but nobody used it. So Y would either 2.0 become make impact. Why? I mean, it's nice fishing that you put on the table in one European market. But Y would either be a success or can it be a success? What's-- From Yadass 1.0, yes, we were using e-signatures. And some states in Europe had launched their EIDs with more or less success with certain states having really, really high levels of adoption of their EIDs. Others not so much. Obviously, Yadass 1.0 organized the mutual recognition among EU states of all of those trust services, the EIDs be it signatures. So in that sense, it was a first step towards making cross-border exchanges, facilitating those cross-border exchanges. But you're right in saying that Yadass 1.0 hadn't gone far enough. So we have the same signatures. But behind the signatures, one state has rules on identity verification, which allow somebody to be verified through a video call online with an agent. And another state allows their trust service providers to issue signatures based on an NFC verification. And they won't accept that the identity be verified remotely with an agent in a call. So we had really, for example, the same signatures, but not the same understanding of what the underlying identity should be. So that didn't promote trust between states. And it was slowing down cross-border exchanges. Which is the point-- is there changing now with either Stupendor, do you think? Well, at least this is what I understand. The commission and everyone that worked on Yadass 2.0 wants to achieve, right? It's to improve or solve this problem of what is the underlying identity, what should the identity fabric be of all the trust services that we have under Yadass? I think it's getting a bit better. Because obviously now, I'm sure everyone that listens to this knowledge that we've integrated an identity standard into Yadass, namely Etsy19461, V2. So to cut it short, yeah, we have unified rules on identity for trust services, but we're seeing, and we're noticing some pushback from European states that are trying to add a new layer of national roles on the top of the roles that were decided by the EU, which could create new division in the way we can provide trust services. You mentioned that one market vision, but I think for Europe, one market, I mean, it might be efficient, but it's also fiction. I mean, it's good that Yadass harmonizes a lot of things and creates common standards and common terminology as well. So that we understand each other better, but thinking that it will lead to one standard and one more than whatever, and one type of identity and data. I think that's something that we won't see in the, you're my active working life still. Because I mean, Europe is diversity, but on the other side, I don't mind diversity in many ways, but diversity in a multicultural region like Europe, let's embrace it. Why flatten it out? I mean, I mean, this is your French. I mean, I just visited France again for my holiday. I had French on notorious for being slightly different, but the Germans are different as well, and Dutch are lakes, and the Norwigs are way more transparent. So there is diversity and let's embrace that, and let's also make sure that businesses can deal with that diversity by introducing right services based on those new standards and those new rules. But the rules on, let's say, identity verification in Yadass do allow for some flexibility. So there are many ways you can verify who a person is according to Etsy19461. There are many ways that consumers can prove who they are according to Yadass, you know, they can use the IDs or UGI bullets or QEAs, et cetera. So I do think there's quite some flexibility. I respect also that states have their own views of how we should verify people and trust each other online. But yeah, we should not forget what our objective is in the EU to be able to exchange borderless and frictionless. But I do really like the ambition level that the European Commission has shown with this Yadass do regulation and the vision of the underlying ecosystem. So let's see how Yadass do it or indeed will, will evolve and if it will become a success. I have more reasons for being a little bit skeptical maybe in this area. You mentioned the concept of wallets. It was in 2000. and four, so 22 years ago that we already developed the concept of wallets, not called wallets at that time, even basically before widespread use of smartphones. But it was the same concept, which you call citizen files, that we developed for a group of government agencies in the Netherlands, called the manifesto group. And it had the same principle. So you would define who would see the data, you could revoke access. It would really be on the control of the citizen to share your data and also to make services better. And we also invited those government agencies to actually do it in a public private collaboration, which is now also the idea of the wallets. And at the end of the session where we presented them, they were really enthusiastic and they said, okay, we'll great, great that you develop this, we want this. How long will it take you and how much will it cost? We're now 20, 30 seconds. And what happened? Well, in the end it led to a concept in the Netherlands, which was called the personal information pages, which has now become my government, mygov.nl, which is actually used a lot. And also we have an EID that is ubiquitously used. But there's still no information sharing in a good way in there, and still far from the concept that's both efficient by the European Commission, as well as what we envisioned in 2004. So more than 20, it took about 10 years to get mygov.nl realized with a way lower ambition level, not a public private collaboration. Still, the public private collaboration is a very hot topic in the Netherlands. Let's see how that will evolve with the wallets, because the Dutch EID cannot be used by private companies. So there's still a lot of dust to settle before things will actually work. On the positive side, the ambition level that European Commission put out with either soap or oil and the wallets, and affected everybody in Europe should have it. So it's a regulation. It's not a directive that they're actually pushing this. I find very positive, and I also, after EID was won, but I could also have said, "Well, EID was a failure, so let's stop." Instead of that, they said, "No, okay, this didn't work because it had very little use cases. Let's go level up in ambition." And that's something that I do appreciate, and also because that I do hope it will become a success. I'm not positive, but I do hope it will become a success, so that that 2004 fishing will actually become reality throughout Europe, and that it won't take another 10 years. I mean, yes, but not again 10 to 15 years. If it is a success and the wallets, then are we still going to need companies like Signicat? Will it actually warrant it kill our business? Will it instead create more work for companies like like Signicat? What's your take on this? Well, in an ideal world, there are real standards, and standards that are embraced by everybody that lead over local or national flavors, and that make life simpler. Life's not simpler. It will never be. We're in a complex world. There will be EIDs, there will be wallets, there will be their first team wallets, and they all buy to the same standards, but two standards are never the same. We have the same thing with our, for example, our NFC product based on a really good standard, the possible standard. It's a standard, and everybody uses it when you travel. But making that really work and making software that builds upon it is incredibly complex, because a standard is never standard. There are always exceptions to the rules, a bit to the left, a bit to the right, a bit interpret it differently. So we are in a complex world, and I think that's also something that we'll learn from this podcast series. Life isn't simple. Rules make it simple, or at least more transparent and clearer, and more consistent, but they don't make life simple. Yeah, so we create rules to facilitate life, but instead we create new problems. But how boring would the world without complexity be? I mean, let's face it. People are complex, so we'll probably always be complex as well. And everybody says that they can make life very, very simple. I wouldn't believe them, if I'd say. In terms of simplicity, you ask me for that one word. What's your one word? The one word about trust rose. In the end, I think it's love. Oh, I love rules. So, I mean, rules bring clarity. I'm a nerd. I'm a mathematician. Mathematics is all by rules, and you can even define your whole world with your own rules. I love rules. I love logic. So yes, we need trust rules, and I love them. They could be once in a while slightly better than they have been developed. But I mean, it's still human work, but I love trust rules. I love rules, maybe. Yeah, well, my take is, I would say it's like you a bit connected to love. What comes to mind for me when we talk about trust rules is Dylan Ovela. You have a group of people, a bit like a group of member states in the EU, and they're all trying to live with each other as a big family. They hopefully love each other, benefit from each other, a bit like in the EU, but there's always something that happens, something that you think the plot is now over, and although the problems have been solved, like the EIDAS 2, and little did you know something happens? One breaks away from another and new problems emerge with this cliffharinger. I think it's very nice to conclude this first episode of trust rules. We look forward to the next episode talking to people like Jon Alnus, our EIDAS and the Etsy expert, longtime veteran in getting the rules in place, and people involved in the water deco system that we'll be talking to as well. Lucy, thank you very much. Much appreciated this dialogue with you again. Super nice chatting with you this morning about trust rules and really looking forward to the next episode and speaking to our next guests. Thank you also to our listeners and see you back on trust rules. We are all building digital trust together. You can think of a colleague or partner who'd find this episode helpful for their work. Send it to them or post it in your team's channel. Trust rules is brought to you by SIGIGAT, the European leader in digital identity, learn law and act with us through the links in the episode notes.