Where Do We Stand on Self-Sovereign Identity?

[Music] good afternoon how how are you how are you doing guys in the audience let us know how how the event is going for you let us know all your thoughts what you've learned so far we have had a lot of finance financial topics so far in the conference now we stopped that part and we have uh an exciting exciting panel discussion around ssi identity what blockchain can do about the identity and for this we have an amazing set of panelists so welcome on board daniel the stage is yours okay good afternoon good morning or wherever you are in the world indeed a warm welcome to this session on i think the next interesting uh use case next to decentralized finance the hottest topic in blockchain town is of course decentralized identity we're not going to do an introduction course on one on one on vcenter guarantee the topic has been raised a few times in this interesting conference i'm happy to have a very strong panel which will discuss the next steps uh what is the status of ssi where are we are we there yet uh what is missing so that will be a bit the topic of today huh i will be your moderator i'm daniel du soy working as a convener for the european south southern identity framework i will do the moderation try to keep your questions in mind and also i challenge a bit to our participants and in our panelists today so i'm very happy to have that strong panel and as mentioned we'll be having a few four topics that is now hot topic into the decentralized identity and of course as you know in europe it is big time but not only europe in the global industry there is a lot of attention on new digital identity so we have a strong important momentum to influence to inspire a new whole set of identity topics that will of course be also the challenge of this panel so with much uh hey not to stake too much in the introduction and go directly the panel list i would like to invite all of them to briefly present themselves present their their expertise their their project their organization and then when we were set up we'll enter into discussion if you have any questions please post them in the chats i will keep an eye on this and if the momentum is there i will pick one somehow but of course with those interesting panelists maybe we'll stick with all those inside things so i wish you a lot of learnings and to do this a bit first ones charles yeah would you present yourself daniel thank you for the introduction and thank you for the conference organizers again i'm i'm charlie walton um i'm i'm part of uh prague based avast um it's a company that's been expert in the cyber security uh arena uh i've just recently joined uh mid uh 2021 um to to lead a new business uh activity within avast in the field of digital identity and trust services ahead of that had been part of mastercard for the past four years uh where i had founded the business called id id services idservices.com um historically i've been involved in in the creation and work related to the trust over ip foundation um which is a linux foundation project and i think doing some very good work in the field and as well uh involved in the early stages of the good health pass collaborative uh which also i think has done some great work i'm a real advocate for uh for decentralized identity and and uh and what i might call the the aspect of this called commercial ssi of beginning to to create uh commercial uh viability in in real real use um certainly cannot think of a a better place for that and where i think we'll we'll begin to see that founding ground is is in europe with with really great work that's going on to date and i know will in this in this coming year um our our company is really uh as a consumer focused company with nearly 450 million people that use our products today we're going to be focused on bringing to market um you know what might be called a digital smart agent uh something that's a little bit beyond a wallet that works on the user's behalf for the user and only under the control of the user to help their digital lives in in authentication in identity and in other privacy matters helping to empower uh and really work for uh work for the user so this is really the focus we're we're taking uh again our businesses is um is relatively new from mid this year um and uh we've just completed in fact last uh uh last week and had had announced the the acquisition of of of us-based uh evernom who's been one of the pioneers in the in the field so i'm really really committed to this area we're thrilled to i'm thrilled to be here today so thank you daniel back to you okay thank you very much charles joao up to you so good daniel good afternoon everyone and uh also thank you very much for the european blockchain convention for the invite and i find myself in a panel um about self-sovereign identity daniel so your turf um so i come from the european commission um as you might know uh i'm working together with daniel on this very important project called the european blockchain services infrastructure so we typically call it ebsi i work with the dg for informatics so it's the digital arm of the commission i work with the member states so daniel represents belgium but we have all member states represented in the project and we have the g connect that is the policy owner um and we are all working together to make ssi uh at least known uh by more people and also working within the framework of the several pilots that we currently are undergoing so we have a pilot on working abroad because we are the commission we like to have cross-border pilots uh with the dg that takes care of all employment matters so the g employer we also have a use case on studying abroad which is about verifiable diplomas and enabling education across europe supported by ssi as an option and i will explain why because there is a question about will this be will this new model be replacing the so-called old models or will it coexist with the current models of identification so i will be talking about that in a few moments okay perfect thank you very much and indeed in europe there's a lot of things happening so very happy that the commission is that active with people like you and this so okay uh then jim sinclair up to you thank you daniel good morning and i want to echo charlie's comments on our appreciation for organizing this outstanding session having the chance to be with you this afternoon my name is jim sinclair i'm the executive director of linux foundation public health the linux foundation is a 20 year old us-based international association dedicated to membership organized around open source software tools and digital public goods we have about five or six organizations or projects within the linux foundation that are industry oriented and i lead our effort around health and digital health technologies and open source ecosystems prior to that i worked with charlie as part of the trust over ip foundation steering committee and together we've been working on uh decentralized identity principles specifications and standards uh for almost two years together and in my case specifically focused on the applications of decentralized identity and healthcare which both for the u.s and in europe means the relationship between a patient's their identity attributes uh and their personal health data and how to enforce proactive and uh privacy by design principles for patients to manage their health information how their health information is shared and their relationship to aspects of their identity especially when it comes to to health equity i also worked with charlie on the good health pass which laid a lot of groundwork uh concerning the integration and reusability of covid status covered vaccination status into international travel passes for seamless travel something that i'm finding having just left the conference on travel last year or last week is still uh very much needed in the industry um but uh but the focus on on the ability the individual to to manage their identity manage their healthcare data and their credentials and then integrate that into travel passes fits a lot of european regulatory frameworks such as gdpr the aspects of ei-das and other european commission aspects thank you it's great to be here okay thank you very much and last but not least harvey yes thank you thank you danielle uh good afternoon everyone my name is andrew bernazzi i'm the ceo of archipels uh archipelago the french consortium about uh self-serving identity we were funded by case de depot uh the group lapost edf and ng which are the two major energy providers in france um so this consortium is aimed at building a trusted infrastructure for digital identity in france and across europe so we're one of the those uh european consortia about identity um that that believe that blockchain needs to be deployed across europe to to provide identity submissions um i'm very glad to be on this panel uh we will have a bit of interesting talks about interoperability and what are the main main issues for for for identity in france we we started with a a pragmatic concept we deployed this this permission ledger across our trusted founders which are major trusted companies in france um to to deploy a scalable and and and and gdpr compliant uh uh infrastructure uh to to to support uh the certification and verification of of data so so we we deployed uh earlier this year first use case with with proof of address from energy energy bills all across france and and we provide already services to to kyc to banks in france uh to verify proof of address via uh sub-saharan identity uh concepts uh so uh um yeah very very glad to be with you tonight and thank you daniel okay perfect so i'm very happy that i have a strong panel so let's challenge them in a moment so we have a perfect mix about government private sector also consortia and this so those are indeed the players that we see in this area so let me start after this introduction um with the first question and the first topic that i want to raise and i would like to ask to joao what his view is um i the whole transition model because we are now introducing a new model in an ssi a revolutionary we are all convinced that uh at least in this panel that is an added value but how do we deal with all those other legacy identity systems with all those other building blocks in the case of of ceph where you're also working joao that already established that have been done how do you see that transition model no will be the heart transition a soft one give us your opinion this so i i think you gave me the hardest question because sorry sorry so i will give my own opinion as you mentioned daniel it's not policy or something of the commission i'm participating as john and as i explained i come from the digital side of the commission so i come from digit that we do the implementation side of ebsi uh but the policy maker is of course the dg connect so also the g responsible for uidas um and i don't work for the g connect i work with digit as you know um what is important to me is to frame this discussion in exactly where we stand today and the the the question is about transition right so will there be even a transition so i think that's also a question is there is a transition even needed um and i know i will be eventually a bit conservative in my in my answer but let's frame the discussion then so where do we come from uh we come from the traditional siloed identity model right so where i am a portuguese citizen if i am in belgium which i am and i want to use one of their public services online i have to have some belgium eid means right uh and as you know traditionally in the silos model not only i have to have that but typically you have the different sectors with eventually different eid means so social security of their own and then health at their own and then probably you know you would find many others in different member states so this was the traditional model that started to change with the idea of federating eid means so that idea was happening both at national level but also at cross-border level and this is quite important of course because i'm talking from the commission standpoint and the idea there is what if we have a sort of eid gateway or node where you know upon the choice of the citizen of which eid means he wants to use i can provide them access to the identity provider and then that identity provider can send that information to the requester asking for the identification information so that was the main idea i mean can we federate the different identity providers upon this idea of eid gateways or the id nodes the member states started work on these since 2008 we cannot we should not forget that so we are talking about um work that started in 2008 as part of the stark large scale pilot if you remember well that then led to stock 2 and then finally to the legal basis that allowed mutual authentication of eid means across europe which is working today which is known as yagas so that was i would say revolution already at the time which meant that i could for the first time use my portuguese id card to access a belgian service so i no longer have the silos i can actually interconnect the different member states and i can use eid means from you know one member state in another member state online so federation i think was the idea and it is still under implementation so there was no transition from one model to the other as you know not all member states have enabled eithers and some of them have partially enabled eitis however it's already working in most member states and mostly for public services so it was not an amazing uptake from the private sector um we have to be fair about that the others revision is online as well if you want to consult it but the federated model is a model that has this idea of saying why don't we interconnect eid gateways with each other and have the identity providers behind and able to exchange information about identity using a common secure protocol now so we went from the traditional silo model to a federated model that is still being built and being improved and now it emerges i would say the self-sovereign model so what is the self-sovereign model according to our understanding of course is instead of having the identity provider sharing information with the requested for identification why cannot that be done by the citizen why do i need to go through this first step of being redirected to the identity provider that then does the authentication and sends the identity information back to the trusted requested through this protocol and that idea i think it's mainly coming out of you know three technologies i don't think it's only blockchain uh we have the verifiable credentials technology which is quite important w3c verifiable credentials uh and why is it important because unlike common documents verifiable credentials have this other way of looking at verifiability so they are very easy to verify and very very difficult to fake and that's thanks to the standard of w3c because typical documents it's the opposite right they're easy to fake and difficult to verify here the thing is turn around and it it uses electronic signatures of course to make sure that we can identify the issuer and we can identify the holder um and there's a lot of things that you should know if you are interested to use w3c virtual credentials but i will not go into details then the second element of course is blockchain that makes possible the support of the verification um in a sort of real-time way and we are using blockchain not to store the identity but to allow the verifier to fetch the public keys necessary for the verification and also to verify if that identity means for example or that identity uh verifiable identity has not been revoked so that you are sure of course that when you give access to your service that that identity was issued by a trusted party that is sold by this person through student loan so through w3c dids and we can go then into the technical part but we don't store personal information on the blockchain or at least the only personal information that you start are deeds and that's the let's say the bare minimum that is there nothing else where is the verifiable id on the wallet so you need the three you need first the w3c verifiable credential then you need what you need the blockchain and you need the wallet and of course this has impacts throughout i would say the three actors so it implies impacts on the issuers that now have to issue something that in the past was not even there doesn't exist which is a verifiable credential it it goes through a specific format we enroll these issuers in a specific way so it has impact on the issue on the holder because he has to now have a wallet a smartphone eventually not everyone has it actually the penetration rate in europe is about 75 to 78 as far as i could see so personally i've been looking at this figure so and then thirdly of course the verifiers so the verifiers also will need to have a verification app we know it's quite easy to actually the verification should be the easiest because that's the point but also has an impact there my conclusion personally is that this is a change of paradigm that requires time because issuers verifiers and holders will now find themselves in this journey together right and they kind of are interdependent of one another and therefore as we saw that the federated model is still being built i believe that the same will happen with the new model and we will most likely co-exist with the other two models that are still around so i don't think we can talk about the transition what we can envisage is of course that we together meaning the ecosystem together really evolved to make this new paradigm um as easy as possible a commodity uh which is still not the case because not everyone knows even where to start when looking for a wallet supporting verifiable ids and also uh accepted by both public entities and private entities and i think that that's the let's say the goal that you wanted to to to ask as as commissioner of course we are working on that model as part of epsi with your support and support of several member states experimenting with it making it part of our pilots but we are not only relying on that model we still support of course the federated model the common ivis that has a legal basis and that works well so i hope okay thank you very much indeed it was a hard question sorry for that but you've managed to do that so you don't see a real hard transition from one model to another have a maybe i can't put the the question to you how you see those uh in your ecosystem in france do we have to also the same opinion or do we see it differently that transition model yeah yeah the the challenge in fact is the adoption of the technology to drive mass adoption we need to to have something intuitive easy to use you know and the experience for the user is key so of course um wallets and blockchain technology like it can be a bit rude for the beginning but but the challenge is to to make it very easy to use and i believe the addition adoption will come from the the benefits for the users having a password-less experience on the internet is is really a step forward that will drive user adoption so in france um we we need to to to to say that france is has been late in a digital identity uh but but a lot of new initiatives uh are are coming um lapost is deploying a digital identity for all citizens um and uh it allows uh to to to log in in many many uh services uh in france you have a federated model with france connect which has a tremendous success with 30 million users that that use this way of of connecting to various public services all administration but also private private services now what we will what we want to bring with our keepers is uh more usage you know um um your your core identity is something which is useful for many use cases but it's not enough so so what self-serving identity brings is biafra variable credentials which which are not only uh uh identity as a your your civil names etc which are various various credentials multiple credentials that will drive adoption and drive used cases so we believe that adoption will come in vertical industries by use cases with each credential which is needed for this use case so that was we that's why we we started with the proof of address at our keepers because it's uh it's it's uh it's needed in many use cases in fact uh alongside your your your your names and and proof of identity to a burner bank account to to to play online um you need to prove that your your your french resident in official gaming systems in france so so all the scaling of case uh comes from the use case what we need for for distributed what kind of credentials do we need and how do we empower our users to to and how do we simplify the the user experience for this particular use case that's why it will be uh it will take time in fact to to to to change each industry because it will need a a very deep digital transformation in the systems of the banks of the the major online platforms to accept and enable this new kind of of uh of credentials uh so uh it will take some time um but uh but hopefully uh we will see it in in a few years and and the the the the other thing that is really important to to uh to to deal with is governance all the all the benefits of sub-saharan identity is about the decentralization it's about the governance of the the identity systems so uh and and and that's and and to enable all those use cases you you have to to have a governance between public sector and private sector because private sector will we take a a a big part of it issuing credentials and receiving credentials and and and so you have to mix all those actors into a transparent and public governance that's what we are trying to do in france that's what is is done also on the european level and and i i believe that uh the next uh the next uh uh objective is to to have a framework across the world uh to to to govern all uh those identity systems that will be talking about in a moment yeah we'll come back in a moment and that's you're happy keep that in mind that i you have also said something important of course and also joao you mentioned okay it will not be a heart for this transition will be both having you on the other hand mention also yeah there will be of course uh a deep transition so i costing money and trying to have implement so a question to you guys and that is also towards the next question what kind of business model could support this ssi are we all seem to convince this is an opportunity but how do you see this what kind of role or incentive to public sector needs to play in this and what kind of right private sector you initiatives that need to be done and what kind of business models are behind it to make it sustainable what's your opinion on this uh charles you're still new to this community very sorry hoy and irve had begun to touch on this point and it's a really important one and i i i'd say one um government the commission and member states clearly have a a very very important role to play but i think the comment made that the private sector is as well important when we think about use cases and verifier adoption and and as well issuer uh participation um certainly in a very rich uh self-sovereign um uh infrastructure we we have private sector issuance that that has to occur as as well uh my my uh uh my my role in a in a uh in a in a membership organization my certification as a as a pilot or as a as a doctor uh my university degree and so on so there's there's much that government can do by way of issuing and and there's much that private sector can do is issuing we've then got government adoption and private sector adoption as as we've pointed out now the real question is how do they how do they begin to come together and and and truly i think one of the big advantages uh if the right balance can be gotten within private sector is that private sector can invest and and and this will be um uh you know a cost to set up a very vibrant infrastructure to achieve the vision that many of us have seen that is a digital identity wallet or an agent that that works for me that that's under my control uh and allows me to deal with many of the things that i deal with every day every week uh in a verifiable fashion so um i i think to the extent that private sector can be provided with the right frame and the in the guidance the fundamentally the the spirit and the standards uh to implement um that that can work really really well now maybe i'll shift gears a little bit and and and i think garvey was was speaking to governance which i think is exceptionally important and and when we rewind back several years ago um we all heard and talked about this idea of issuers issuing uh verifiable credentials and holders holding them and then using them with verifiers and it was all going to work uh just fine the practical reality is how do you get to that state and and i'm not of a of a belief that that can just happen naturally by issuers and and verifiers uh deciding right we there's a market-making function there's a there's a a hand there's an involvement that that needs to occur um so that's kind of kind of one if we begin to think about this evolution from self-sovereign identity to maybe what i term commercial self-sovereign identity right there's a there's an entity involved or entities involved to to create this this hand of market making um there's uh then a a rule set around well how might you monetize for sure verifiers are gaining economic benefit today through through um identity data of of vetting uh you know gym or rv in opening a new bank account or creating a new insurance arrangement or so on so there are certain types of transactions for which monetization can occur and and so that's important to recognize in having the the mechanism in place to do that um and then i would say that whilst this technology is is going down a a track of integrity and so on problems could happen how do you manage disputes and and issues associated with it and then lastly as how i described we're not going to have a revolutionary shift where everything is turned off and all of a sudden the world will be wired to this really important new key paradigm it's going to be an evolution and so how do you manage the technology evolution in a manner that abstracts it frankly from from the user right the user shouldn't see this they should see the benefit of a of a of a wallet of an agent that serves them but we may have issuers that that are verifiable credential ssi issuers meeting the standards and others that may not we may find traditional idps that are participating in to old tech standards but that over the fullness of time are evolving in so what i bring to bear is this this idea of a of an entity uh not not a not a transactional entity but an entity that might set up rules and framework governance and deal with these commercial ssi matters that that type of role has been uh work going on within the trust over ip foundation at what's called level four i think there are some very good learnings uh there with that respect i'd say also and jim jim can probably talk to to this even further but within the the development of the good health pass collaborative blueprint work done as well in in thinking about how do we how do we certify an issuer um for a credential health pass how do we certify that how do we begin mapping policy how do we begin bringing the community all together and i think this this notion of a governance authority can begin to meet or uh implement many of the almost regtech oriented functions that have to have to occur to set the table really to set the table and to get to get the the market going so daniel that that might be my view and i i think the the thing that that likely needs to be developed or worked on collaboratively are are how can the the involvement of the commission member state governments and then private sector how can those partnerships be set so that we've got all the spirit all the drive within the commission for the good of of the european community in ways that don't take advantage of of people with their data and and and provide a an economically appropriate right an economically appropriate environment how can that partnership be set to get the best of government the best of private sector where private sector will naturally want to invest if there's an ability to to see funds revenue flowing perfect indeed and i will use indeed your a bit assist to jim because i think within indeed what you mentioned the health aspect how do you see this evolving gym how what kind of view do you have on the business model supporting that health credentials yeah absolutely danielle and i think my colleagues have covered a lot of the aspects of legacy versus transition very well especially charlie's comments on governance i'd add one thing that we look at uh quite a bit that we haven't mentioned so far is the issue of socio-cultural trust and that is just cultures building trust amongst themselves the culture of healthcare delivery for instance whether in u.s or europe just the traditional relationship that you have with your physician with your provider many times the tendency is that your doctor knows best and and you know needs to know all of your information in order to make assessments or to provide a diagnosis of a problem and how does that model start to change when the individual is empowered using regulations we already have with gdpr hipaa or others to say well you know i'm here to see you about this issue and i don't think you need to know more about me than this issue and this is especially sensitive when there's uh issues of gender identification gender equality um freedom not to disclose certain aspects of what you consider to be personal about your identity but they can influence how you uh receive medical care and at the end of the day being able to manage that identity and consent for that data to say i'll share it with you but i don't want it to go anywhere else without someone else knowing um you know in the u.s and coordinated care processes there might be information moved all around that you're not even aware of and trying to change that model you know means putting in these sorts of components and i think going back to discussion this discussion about transition from legacy or federated systems to self-sovereign identity there's probably lots of agreement where components of legacy systems have continued to work well and they still meet the requirements for identity management for access management and will remain in place but then as we adopt new concepts of governance and new concepts of trust frameworks uh then we would uh we would implement or overlay aspects of self-sovereign identity into that to better empower people for how their data is managed how their identity is managed and how that changes a business process uh charlie mentioned about the good health pass and and you know a challenge that's going on right now within health passes as they exist is that we literally have travelers who are showing up at a border control point at 7am on a tuesday only to find that this particular piece of paper they've been issued around their credentials and their information isn't valid for where they're at that isn't necessarily the responsibility of the individual that is the responsibility of one border agency in conjunction with one health organization trusting what another border agency or health organization has said and that goes back to governance and simple agreement around that uh that trust framework for how organizations work together that pertains the same between hospitals and and providers uh it certainly pertains to governments and commercial organizations and sometimes just getting that simple framework of agreement that trust framework can be the most challenging parts of the process in my opinion okay thank you very much jim and you indeed touched the very interesting point and bringing us to the next topic indeed you have that governance model in europe we try to do that together with pepsi without all the partners but maybe harvey what is your view on yeah the more global governance that needs to work at it that jim can also come to belgium and share credentials how how do you see this uh heavy on interoperability or international governance aspect and how to solve those kind of things yeah that's uh that's uh that's the main question and main issue so that's a difficult topic well well in europe uh he does too uh will force uh interoperability and that's that's great because we see that that now with the common toolbox uh to to build let's do android could talk about that uh probably more details um you have working groups all across europe uh with people from each member states working together to define governance to define technical specifications and to define the legal framework of the future regulation this is a a way to to build together and to ensure interoperability across member states and across systems because we will still have a side load system in each member state even if a common standard and technology standards will we will uh will be adapted so we but we will we'll have to to to build a framework to to to make a system uh trusted from the other system so that that's where it has uh come and and and solve the the problem but it's it's uh it's a european framework so the difficulty will will be across across uh uh all over the world so we we we we are occupiers we we participated in in many workshops with with canada for example uh with the dg connect initiative discussion between europe and canada on a self-serving identity framework all of this shows that we are all building first on on the same technologic standards so thanks to ww3c now we have global technical specification and recommendation to adopt and and since the the adoption of the the recommendation for various available verifiable credentials and for the ideas we see all over the world initiative that deploy this this this technology so this is the first step as verifiable credential will be understandable by all uh systems but then you you have to to to build the the trust framework um to to to make all issuers i mean how do you do you ensure that this issuer had the right to to to issue and and that it can be recognized by by this other in this other part of the world that's that's the whole problem and here i believe that blockchain can can help in this manner because it has the ability to to to build a global system um with this kind of of ledger to to to ensure uh all participants are well identified i mean issuers and every system so the blockchain here can can bring a trust across across peoples and and like in another use case for for blockchains technology is now mature to have a cross blockchain uh interoperability um so i believe that that that self-serving identity will use the same mechanic mechanism to to ensure interoperability across across the system which is which will be a kind of technically it's the same as interoperability across blockchains so uh so that's the way but uh okay but yeah that's a difficult uh that's a difficult topic sorry sorry i'm only asking a difficult question uh i'm very happy to learn also from us or i'm using this for my personal gait sorry for that that indeed uh rv you mentioned in the other probability between member states within also with continent joao if i can ask you also because i we had some interoperability nightmares or challenges between all those kind of things what is your view on this well it's nothing new i mean i don't think that this specific standard is more challenging than the others it's not because two projects use double receiver travel credentials that they will be interoperable and we know about that so uh the spec for example that was mentioned here um the good the healthcare pass make some choices uh on the way that they implemented they would receive their travel credentials that are different from several other projects that are also using the would receiver file credentials um we are currently in ebsi having our own what we call a playbook so we have made the necessary choices for wallet providers to implement um w3c verifiable credentials uh open id connect for because we don't talk about that but there's also the exchange protocol between the verifiers and the issuers there are many cryptographic decisions to be made so it's not easy to even think about interoperability at european level when we scale that up to global level it's even harder and blockchain will not be the only element because there are many choices inside of the wood receiver held credentials and then there are many protocols that are supposed to be used by the wallets to exchange with issuers and exchange with verifiers and we know that there are several initiatives competing and evolving and more will come so in definitely a challenge and we know that with federated systems it was exactly the same we had many protocols that promised to be secure that were implemented by different regions but not by others so we will continue to have a lot of fragmentation in my opinion which is normal but i think things will probably stabilize as we start to have uh mass adoption and and that probably will take some time but i think only then we will have some sort of de facto way of implementing w3c verifiable credentials which is widely accepted as being you know the most accepted way by most wallets and indeed the wallets in my opinion are the ones that eventually are currently uh scratching their hats because if they have you know five projects uh to which they can eventually uh try to be conformance tested again so ebsi provides a confirmed testing service so if you are a wallet you can prove that you support the would receive our credentials according to our playbook you can also prove that you interpret well the exchange with issuers and with verifiers but eventually a wallet might have five six other projects that have you know different choices so of course that is always a challenge and we understand that and this is why we want to work as the european union as you know all member states to uh try to assemble as many uh use cases and as many let's say needs as possible and lower the burden on the ones that are currently doing the work on the wall on that use cases i we have also i want to pick up a question on the chat somebody is also asking you know will be we're having solutions wallet solutions or even broader ssi agreements domain specific or do you see that okay i have an educational wallet i have my business wallet a bank i want it how do you see this uh uh i can only talk about the bsi so in the bsm you uh of the two so you can have so we have education specific wallets being performed as tested and then we have wallets that are supposed to be uh let's say usable by uh every use case uh we don't have a preference and i don't think that uh there is an absolute answer to that i mean is it one better than the other can one be avoided i mean i i don't think that is the way that the market will go right i mean it's it's more charles maybe your opinion on this how do you see this i i completely agree with oa that that this is uh this is going to be market driven market force and and we're going to see multiple answers ultimately users may choose to say well gee i'd like to keep my health care data over here with my health care provider and all of my e-commerce or other other merchant related stuff over here or a traveler may may choose a certain way and then you may have other behaviors that say i'd like to organize my digital life around around a broader structure so this is this is also daniel where i think the private sector can bring some innovation can bring other value adds to people that may give a richer environment in a vertical or may give a broader a broader environment but i don't think there ought to be prescription and i think it's uh very difficult to predict that this is going to happen over over a number of years for sure okay and then is i think a perfect bridge to the last question and the most difficult one sorry i keep it the last question difficult one it's about privacy of course many advantages that we gave on ssi are indeed okay we gonna empower the citizens he will be having more control of his data implicitly we argue that it will be having more privacy but without that be the case will technology alone enforce that so i would like to hear your opinion jim you are indeed on a very sensitive topic about health data do the technology protect itself or do we need a bit more harsh rules i you know that we like to regulate things in europe so do we need even harder things than what is currently doing so what's your opinion jim sure great question daniel and i think uh coming from the healthcare perspective in particular uh and the concepts of new technology i think the challenge we have is how much privacy do we think that we should have we want and that's regardless of whether it's a european regulatory framework or the u.

s certainly i know with charlie's background and myself you know both of us encounter more and more that artificial intelligence machine language machine learning has the capability to compile uh data sets and provide analytics that regardless of individual structures around privacy or regulations around protecting elements of information are getting recompiled re-analyzed and what we call de-ide re-identified so even if i have healthcare information that my personal name and information has been identifying information has been taken out there are processes to use ai and ml to be able to to recompose those as well as just the collection of information that your phone and your mobile device provide that your computer provides that your internet connection provides and how those are being collected and potentially analyzed where do we see as cultures as countries as societies break points and privacy that we need to take into account and there are other ways that we now uh introduce these principles of self-sovereign identity as part of privacy that that aren't just a matter of providing more privacy than before but in some cases trying to at least maintain a status quo for privacy given new surveillance and uh and data science techniques that are compiling more information about the individual than ever before from a health care perspective where we have a challenge is that we you know we feel that there are there are those folks that have behavioral health difficulties or uh elderly population and the others and to an extent those those still require surveillance we consider ethically that to protect those people they need to be they need to have adequate coverage of what they're doing and what their identity is in order to give them care because they need to be taken care of just like children but at other levels of adult populations how do we manage that information and how do we empower those individuals to opt out of that information so they're not under that same sort of surveillance structure and then of course there's the commercial implications in between so it's as much a fight to keep privacy as we understand it or as we desire it now as it is to try and add any new privacy going forward to the future okay thank you very much maybe charles i would like i have asked this of course the company securing r but now also reflecting is there also a market for wallets that would provide us more privacy or not go into aspects or are you thinking in that kind of direction or what i've con consumer thing is privacy an issue or an topic in that product launch you know i i would say and again our our thinking around this is that um you know a digital smart agent becomes the the user tool the consumer tool and and that reflects aspects of digital identity wallets as we've talked about today helps me with authentication into into traditional in traditional manners but importantly becomes uh the agent that helps me with my privacy um we're of the belief that that this is an incredibly important area the user just doesn't have tools on their side uh digital businesses have got data analytics a lot of data collection and so on and the user has has very very few tools to help them to help them interrogate the the privacy policy of a of a digital destination and help to interpret what that means the user really should be in the control of their data and increasingly as as the world begins going more to decentralization not just with identity but with data services we begin to see transactional services that require less data to be held by digital businesses so to the extent daniel if you and i had a had an exchange i as a consumer and you in a business and i was able to bring my own account all right the notion of bring my own account when i transact with you that also is good for you and that it helps you become more compliant with really good regs like gdpr meeting more of the spirit and it also lessens your cyber security risk profile and let's have to keep in mind that organizations that are holding lots and lots and lots of data almost have to be thinking about that as a bit of a toxic asset that that will ultimately bite them they'll get attacked and so to the extent that they've got less data and we've got a frame where the user is empowered with tools to bring their own account data when they come in we've got a better deal not just for people but but also for businesses and so this notion of a shift to more decentralized application services is actually really really key to privacy as well so we think tools for people are critical critical critical critical and you know you look at the numbers around the globe identity theft it's growing card not present fraud it's growing the extent of the devices i have the device i've managed that i'm managing the data and the account relations that stuff's all growing so the complexity and what's at stake here is only growing and with a decentralized identity and decentralized services we can begin taking some of that back get a little bit better control of our of our data privacy and it's in my view absolutely critical it's a big driver to how i'm thinking about our business that invest okay perfect heavy i don't know if we have a different view from in europe and this or indeed no no i completely completely agree with charles um yeah i believe privacy is is is needed and we need to to to force this with technology with zero knowledge proof technology for example because because ssi could be used as a as a tool of surveillance if not well implemented and well designed and and we nee we really need to ensure with technology and with the legal and governance framework that uh we will we'll do it right we'll do it right for for for the citizens so i completely agree charles sharks we lost daniel myself sovereign panel yeah because he's in the dark yeah sorry i needed to switch the power sorry for this uh indeed oh we have two three months left um as somebody in the chat always mentioned yeah this is when privacy comments we tend to be in a philosophical debate but indeed it is more than technology it's more than aspects we need to see how we see society in this and how we empower those aspects i would like to close this session because we are almost running out of time with your maybe best wishes for 2022 so charge you out jim and and heavy what do you see in the next year as an important evolution so charles may be up to you so briefly one minute your prediction daniel i think we've been in a in a mode where we've been experimenting and looking at decentralized techniques the standards are coming to bear and i think we're at a moment right now going into 2022 to start serving users well with the technology uh i think this is the year for real use cases and real utility okay perfect joao what's your view on 2022 worldwide ssi yes my wish is that all the pilots that are ongoing on the european uh blockchain services infrastructure in vsi give let's say enough results for people to become really interested to look into everything that we are doing uh since 2018 and that of course we will have more pilots and more involvement of this great ecosystem perfect heavy your wishes yeah well my wish is that in 2022 we will deploy uh major pilots in france uh across south sudan identity and mainly that ea dash ii uh we will will come up with a great solution for europe uh this is the the um phenomenal uh initiative from the european commission to deploy at the european level this kind of concept and i wish that it will become true in 2022. okay perfect and jam to close it yeah i would just echo harvey's comments with regards to either two in europe and at the same time the advancements of the pan canadian trust framework uh the government of the province of ontario's trust framework and digital identity work the british columbia the new zealand trust framework and new south wales and australia implementing a new strategy for consumer-centric identity services i think the core tenets that we've talked about in terms of governance and architecture and trust frameworks are embodied in all of those so to see you know several companies countries at once moving in that direction shows that we may have some good momentum going through 2022 and certainly into 2023. okay so that's from promising on the global side so let's stick together let's uh meet each other in uh next year uh hopefully and then the extra european blockchain convention to see where we are and we are finally landed so thank you very much evie charles and joao and jim for this uh great conversation and i learned a lot and hopefully the audience also had some interesting insights to be shared by international experts in this to you daniel thank you very much to all panelists thank you for this update on ssi it looks like 2022 will be a busy year on identity so thank you once again for finding time and being with us and i invite the audience to stay up for a few months more sessions we have three sessions still of the second day and i'll see you in the chat so thank you bye [Music]