Making an ethically responsible redesign of DigiD with the focus on Privacy.
2020 - Result: 9,2
How do we as citizens know for sure whether the data collected by the corona app will really be deleted? Who protects us from this?
The way the corona app is announced (not neutral, and not with a transparent explanation) that the government does not consider privacy as important as they state. The resistance to the arrival of the app makes it clear that such an app cannot simply be sold to citizens of the Netherlands. In other countries, citizens react differently to the arrival of the app. This also has to do with the different cultures and history within a country in terms of government and privacy.
But now, what if our government wants to come up with a way to make such a "health tracker" mandatory? For them is the best way to get this through. Literally ensure that your citizens cannot ignore it. Do the same as what Apple and Google are doing now, make use of an existing product or service that citizens cannot live without. I am thinking of DigiD.
​
Are governments going to expand DigiD and link such an app to it? A service that everyone "must" use, otherwise they will be excluded?
​
My research has shown that;
1. DigiD excludes an entire target group.
Namely people who cannot / do not want to use a smart device or the internet, such as elderly people or people with disabilities. People are obliged to purchase a digital device, because otherwise they cannot use it create various municipal and government services.
​
2. DigiD is not transparent (secured) about personal data towards citizens or protection towards commercial companies. What happens to the data of citizens if authorities connect to the use of DigiD?
3. DigiD is currently a system that can be misused, because all the data that it contains is privacy sensitive.
(By hackers, criminals, governments, agencies and commercial companies)
There are many different organizations that use DigiD, of which you should ask yourself in the future scenario where DigiD will be used for all login. Why does health insurance have access to my civil behavioral data from the municipality?
​
​
​
​
Light security system
Username and password
Citizens log into companies and agencies in different levels of security
Via these different login protections, citizens can see in which level of security the authorities or companies are located. This creates a kind of transparency and clarity towards citizens about their data and its use.
Medium security system
Two-step verification
Username and password
Well secured system
Two devices (mobile an desktop)
Two-step verification
Username and password
Extra secured system
Biometrically secured
Scan ID card
Pincode
And possibly a combination
with the above
The safety pyramid (system)
In security per instance or "commercial" company (per layer)
​
In this layered system that I came up with in the security of DigiD, it is not just about how you log in per instance or company. The system classifies authorities and commercial companies per layer. These companies or agencies cannot therefore view data that is relevant to another layer. Only the data is visible that is relevant to the layer in which it resides.
Research results: The respondents indicated that they would classify these companies (above in the visual) together.
By looking further at a health tracker from government agencies, I was able to clarify why DigiD is a good product for governments to achieve this. As a result, the DigiD makes privacy even more sensitive and dangerous for citizens in the future. A controlled society could be the result of incorrect use of DigiD.
In order to remove this unethical aspect from DigiD, it is important that DigiD disconnects all new (commercial) companies and institutions from the information from DigiD, which carry the same load of information as that of the tax authorities or DUO, for example. There must be a separation between those many different agencies and companies, for the protection of citizens' privacy in the future.
