Anirban Basak – Fellow at MIT Connection Science and founder CEO of FortifID.
getty
As 21st century consumers in an increasingly connected world, most of us share our personal data in countless interactions without thinking twice.
You download a new app and review only the terms and conditions before agreeing to it. You give your name, address and date of birth to your hairdresser so that they can send you a birthday card and discount coupon. You show the store clerk your driver’s license, full of personally identifiable information, to verify that you are old enough to buy a six-pack of beer. The PII you casually share is vulnerable to breaches and constitutes a significant portion of the data required to access your bank account.
Personal data is a valuable asset. It fuels today’s economy and is often collected, used and misused without our knowledge or consent. In the fast-growing data-as-a-service market, there are three types of stakeholders:
1. Data Providers: institutions that collect, aggregate, process and sell data (such as the credit bureaus, the DMV, etc.)
2. Data Consumers: institutions that purchase personal data for business gain (such as banks, credit unions and fintechs)
3. Data subjects: individuals whose personal data is collected, traded, sold and often misused by data providers and consumers
New laws and regulations, such as the EU General Data Protection Regulation and the California Consumer Privacy Act, aim to strengthen privacy protections for individuals. But these rules can only do so much to stop bad actors or actions in the DaaS ecosystem. How can data providers and consumers continue to have access to the insights they need from personal data, but within a consent-privacy-first approach?
Three ways to access personal data
When a data consumer, e.g. a bank, starts a relationship with customer X, they first verify and authenticate the person’s identity and then run an acceptance process by running credit and pricing algorithms on the customer’s credit data. Before offering customer X a loan instrument, the bank wants to confirm its willingness to pay, ability to pay and income stability.
The bank can access Customer X’s data in three different ways:
1. Unauthorized Data Sources: Fair Credit Reporting Act data from credit reporting agencies. Whether the customer’s consent is sought or not depends on whether the data access is a soft (pre-approved) or a hard pull (after application).
2. Allowed Data Sources: Bank transaction data, tax data or utility data obtained directly from the customer’s banking, tax and utility companies.
3. Search Engine Data Sources: Information collected from Customer X’s online search history. This is an emerging area of the DaaS ecosystem.
In 2021, for example Mozilla launched Rally, a “privacy-focused data-sharing platform” that aims to give users more control over how they share their browsing data and how it is used. Users can voluntarily donate specific consent data to public interest studies conducted by Mozilla and partners, including Princeton and Stanford, to investigate issues surrounding misinformation, discrimination, algorithmic bias, ethical AI, and online transparency. This approach is the first to examine how search engine data can be monetized within ethical standards, including how users can be rewarded for accessing their data – unlike the current model, where search engines monetize the unauthorized data with impunity of individuals.
But over the past several decades, the consumer-loan financial services industry has relied heavily on unauthorized data sources. This data helps assess an individual’s willingness to pay, but does not properly determine an individual’s ability to pay and income stability.
A combination of the other two data sources – consent data and search engine data – provides the bank with a much more up-to-date and accurate assessment of the customer’s ability to pay and the stability of income. Allowed data, from customer X’s bank accounts, utility data, and credit history, shows whether they have earned a steady income, paid bills on time, and maintained financial stability. Their search engine data reveals other details about the context of their lives that authorized data may miss. For example, if client X applies for a $20,000 loan and appears to be financially solvent, the search engine data may indicate that he is planning an expensive vacation next summer.
The value of confidential computing
This is where confidential computing comes into play. Confidential computing is a technology that allows sensitive data to be processed within a secure and isolated environment, also known as a trusted execution environment. Confidential computing prevents unauthorized access and ensures a high level of data integrity, data confidentiality and algorithm integrity. It enables institutions to process data subjects information from multiple places in the most confidential format.
The benefits of confidential computing for data providers are:
- Preventing the disclosure and exposure of assets to competitors
- Maintain confidentiality of company assets (as data is deleted within weeks and cannot be compromised by malicious parties)
- Generate revenue through enhanced monetization capabilities
- Providing immutable logs of data records maintained for lawful purposes
The benefits for data consumers are:
- Act as a one stop shop for multiple data providers
- Reducing friction when onboarding customers and speeding up loan decisions
- Minimize operational costs and improve customer acquisition costs
- Reduction of PII storage and regulatory burden
- Provide on-demand raw data when needed
Confidential computing platforms will provide the bells and whistles necessary to drive an ethical ecosystem for computing personal data in financial services, but legitimate individual privacy concerns remain and must be addressed at every stage.
I believe lenders can use confidential computing ethically by implementing the following best practices:
- Shortlisting of data providers and identification of data attributes from global metadata
- Sign commercial agreements with data providers and then perform confidential computer steps
- Record the correct consent of the consumer at all times
The good news is that extensive research is being done on individual data, privacy and consent, including with Mozilla’s Rally project. Monetizing data from search engines that are mutually beneficial is a new concept and time will tell how this area of research will give users more control over their data.
I believe that confidential data processing offers a win-win situation for data providers and data consumers, within a framework that respects the rights of data subjects. Confidential computing gives providers and consumers access to the valuable insights they need about individuals, while complying with data protection regulations and handling individuals’ data securely and ethically.
ukbusinessupdates.com Business Council is the premier growth and networking organization for entrepreneurs and leaders. Am I eligible?
