eID policy in a turbulent environment: is there a need for a new regulatory framework?

Abstract

There is increasing interest in the EU about the central place of eIdentity (eID) in people’s lives. eID is increasingly seen as a bridge between the commercial viability of models based on large-scale provision of e-services and users’ need for privacy and security in online transactions. This paper examines technological, social and legal developments in the field of eID and asks whether there is the need for a new regulatory framework that both preserves users’ identity and enables the provision of advanced services. Firstly, the paper interprets recent market moves in the eID field as a response to a rising regulatory tide. Secondly, it examines some of the challenges arising from Web2.0, and four emerging socio-legal issues associated with eID—behavioural profiling, social engineering, redlining and other unsocial practices. Thirdly, the paper examines the capacity of the current regulatory framework to absorb this turbulence, and finds it wanting. Finally, it advances a novel model of eID regulation that may help regulators create an identity-preserving, transaction-friendly eID environment.

The eID market in the face of rising regulation

The year 2008 marked a turning point when major industrial eID players aimed at positioning themselves favourably in the face of increased attention by policymakers, public worry about personal data and a striking string of data breaches in public and private sector. Google, a major player in the eID field, has become increasingly vocal and apparently proactive on privacy, user control and data retention. A number of large players have joined OpenID after initial scepticism.¹ OpenID has been set as a parallel identification mechanism for HealthVault, Microsoft’s flagship in e-health. Again in 2008, the Information Card Foundation, a consortium of Equifax, Google, Microsoft, Novell, Oracle and PayPal stepped up industry action regarding card authentication. In June 2008 Liberty Alliance made available the Identity Assurance Framework (IAF) and the Identity Governance Framework (IGF) to their members. IAF is a global standard framework for validating trusted identity assurance service providers based on a uniform definition of the security and privacy risks associated with different levels of identity assurance. IGF is a declarative policy framework for managing identity flows within organizations motivated by regulatory requirements, such as those set by the Data Protection Directive;² it creates a standard for defining enterprise-level policies and controls for consumer consent for sharing sensitive personal information, including personally identifiable information (Liberty Alliance 2008). In October 2008 a user-centric ‘identity meta-system’ was proposed by a consortium including IBM and Microsoft which features significantly enhanced privacy and user-control with respect to the original Microsoft vision. The eID industry is fully represented in the EU-funded large scale project STORK,³ aiming at creating interoperable public administration identities across EU member states (November 2008). A consensus seems to be developing that privacy is core to any new developments in identity management (e- and otherwise) and on the need to factor in privacy (social, technical, legal) early at the design stage of systems and applications (Hansen et al. 2008), especially in federated identity environments (Squicciarini et al. 2008).

This consensus hardly bears on identification alone; rather, it aims to shelter the large prospected revenues from the provision of advanced e-services from growing regulatory pressure, uncertainty and threat. Also, it aims to self-regulate and self-organise to overcome some of the industrial and systemic barriers in the identity management system sector to the development of such services (Maghiros et al. 2007). Apparently confiding in integrated technological solutions and counting on users’ willingness to strike a Faustian deal between provision of personal data and fruition of advanced e-services, industry players fear legal barriers the most. Most world e-service companies in healthcare, finance and retail name “compliance with regulations” as the main challenge in the years ahead (Google 2008).

This concern with compliance is not misplaced. Regulators are paying increasing attention to identity, privacy and trust in online and converging environments (Edwards and Fieschi 2008). Understanding and regulating identity in a ubiquitous information environment is a major driver of the future internet economy (OECD 2008). A number of studies were commissioned by policy makers (OECD, Council of Europe, European Commission) to clarify the economic and legal implications of digital personhood (Rundle et al. 2007), of eID profiling for human rights (Dinant et al. 2008) and of self-regulation in the privacy market (Marcus et al. 2007). These domains let envisage an increasingly complex regulation model of individuals’ identity management.

In the European Union, this model begins to extend to consumer policy, as location and service fruition and trust and privacy are seen as prerequisites for the common digital market to come (Kuneva 2008); to human rights policy, in relation to the consequences of advanced profiling techniques (Dinant et al. 2008) and with issues of surveillance in relation to information society security (Hammarberg 2008); to online safety policy, especially in relation with younger users (EDPS 2008b); and to a set of policies regarding the economic impact of networks to come (OECD 2008). If fully sketched, eID may need a grander, more integrated regulatory framework than the one that to date responds mainly to the identity-theft threat (cybercrime), requiring one that ensures smooth services fruition across the member states (interoperability) and that shields people privacy from intrusion and abuse (data protection).

Partly, the increasing complexity is due to the significant identity-related technological developments. The technological referents of eID are growing in number and complexity; the 2008–2009 work programme of the Article 29 Working Party⁴ plans tackling open questions related to individuals and search engines, social networking sites, behavioural profiling and data mining (on- and off-line), biometrics, ubiquitous computing and Ambient Intelligence, and Radio Frequency Identification (RFID) (Article 29 Working Party 2008). One recent trend in particular presents challenges for the regulation and management of workable eID models: the rise of Web2.0.

Identity and web2.0

Web 2.0 refers to ‘social’ e-applications such as social networking services (SNSs), e.g. Facebook), collaborative filtering (Amazon, Last.FM), social bookmarking (del.icio.us), folksonomies (Flickr), social search engines (yoono.com), file sharing (Emule), mash-ups (BBC backstage), and online multi-player games (World of Warcraft). In recent years, Web2.0 has become very popular especially with young Internet users. In Europe, about a third of Internet users engage in some way with Web2.0. Some 10% provide feedback, post comments on blogs and reviews on Amazon. About 10% share contents on Flickr, YouTube. Only around 3% of Internet users in Europe are creating new contents (Pascu et al. 2008).

Web2.0 raises important issues in relation to identity, trust, reputation, co-operation and privacy. One issue relates to identification, as virtually all Web2.0 systems mentioned require simple email ID and password identification. This leads to the multiplication of identification across multiple sites, limited security of transactions based on password identification, with potential for data loss, impersonation and identity theft as the extreme consequence. Within the sites, plug-ins and applications written by third parties endanger users’ privacy (Felt and Evans 2007). Some providers, such as MySpace.com, are currently considering biometric (fingerprint) technology enrolment and validation systems for underage users of SNS (NA 2008). Overall, there seems to be a movement towards increased security and questioning of the portability of secure identity across multiple domains.

Furthermore, certain ‘special’ characteristics of Web2.0 challenge regulation of behaviour as they are to all effects cultural markets. In short, when people come together to share their knowledge, reputation, consumer experiences and tastes, identity becomes negotiable. Establishing identity, the act of making oneself known, becomes socially bound, allowing multiple presentation of the self across heterogeneous platforms (DiMicco and Millen 2007). Identity also becomes relational (you are what you link, purchase, post), becomes portable, as identity data is becoming increasingly portable. Trust subsumed to transactions also becomes portable (my friends’ friends are my friends, my friends tastes are my tastes, etc). In these Web2.0 ‘places’, masses of user generated contents (hence identity and trust) are manipulated according to different logics (Thomas 2006). User generated content, the source of collective intelligence that most observers consider as a key characteristics of Web2.0 applications is channelled by logics based on proprietary algorithms (Allen 2008). These logics help mould specific regimes of trust, identity and privacy and are perceived differently by different generational cohorts. Examples of these logics span the production / consumption continuum of social computing (see Appendix). In other words, Web2.0 enables distributed systems of trust-making, distributed systems of identity making and complex reputation systems where users interact with rules. The purposeful behaviour of users makes the game a strategic one, even where negative behaviour is discouraged.

Overall, these Web2.0 logics are vicarious both to the legal framework for the fruition of e-services and to the regulation of identity in ‘real life’. To these logics people become easily accustomed. These logics shape suggested morphologies of eID, whereby it is more or less convenient to share information about one’s tastes, identity, personal behaviour, orientation, and relations as well; these morphologies constrain users’ perceptions and behaviour in manifesting identity online (by engaging in the exchange, generation and reception of data flows). Below, we discuss three specific challenges proper to this new environment: personal data proliferation, traceability and unsocial practices.

Personal data proliferation

Unprecedented amounts of user information are generated in countless online and offline interactions, most of which is beyond user control. Less than half of the digital universe related to users is accounted for by their activities—pictures taken, phone calls, emails—while “the rest constitutes a digital ‘shadow’—surveillance photos, Web search histories, financial transaction journals, mailing lists” (Gantz et al. 2008, p. 2). If these are systematically harvested, they can return to haunt users along with delivering targeted services via Web and Web2.0 (Story 2008a, b); especially, this may happen when data-points from different sources, such as search engines and Web2.0, are brought together (Zimmer 2008). The Google-Doubleclick merger may open new scenarios and new legal challenges concerning online ‘behaviour tracking’. In short: linking of Internet Service Provider (ISP) data with cookies data, with information from ‘social’ spaces of search engines lead to an unprecedented amount of collated information about single users. The recent case of Phorm well illustrates this point.⁵

Traceability

The linking of digital context and content to physical location is one of the defining traits of Web2.0 (e.g. geo-tagging, geographical data meshing); in fact, mobile social computing is increasingly seen as the next market trend in the mobile field (Feijoo et al. 2009). A number of emerging technologies, such as location-based services, IPv6, third generation mobile phones and RFID establish even stronger links between physical location and digitised knowledge about people. With the integration of sensors in everyday life, the boundaries between physical and digital space will become increasingly difficult to distinguish (Daskala and Maghiros 2007). Mobile phones and mobility present newer challenges for data protection and eID safety, in relation to highly mobile identity, the mobile being a very personal device, easy to intrude and to track. Surveillance problems will be enhanced by IPv6, which links personal digital devices and information/communications. Privacy problems may arise from the creation of networks to manage billions of tags at global level (e.g. EPCGlobal system).⁶ RFID can potentially violate privacy and enable a control of persons (e.g. profiling, verification of tracks, control of geographical position). Overall, the greater dimensionality of digital identity conferred by location and mobility technologies makes it much easier to ‘overkill’ with digital information: not to use proportionate technologies or minimal data for the aims of the personal identity data processing.

Unsocial practices

New media provide enhanced ammunition for social engineering and phishing (Workman 2008), notwithstanding strong technical security as very often the weak link of the chain is human. Through more or less sophisticated persuasion techniques, the social engineer can persuade people to communicate information which—alone or in combination with further information—can give access to sensitive sources such as bank account and credit card numbers. Increasingly, also, unsocial online practices do not infringe the law, but may create a great deal of discomfort to those on the receiving end. Information from social networking sites is increasingly used as evidence to screen job and university applicants, possibly prejudicing future reputation and career (Bennett 2008); cyber-bullying is on the rise, whereby young and older adults are targeted online and offline (Hammond 2007); cases of suicide in relation to SNS campaign of harassment have been reported (Davies 2007). Harassment involving SNS have been before the courts; in one case, a man was cleared of harassing his ex-girlfriend over Facebook, saying prosecutors had not proven that he used a Facebook friend request to harass (Williams 2008). In another case, a man was jailed after a Facebook friend request he made violated a previous restraining order (Clout 2007). In other words, online actions revolving around the boundaries of digital identity may have significant offline consequences, many of which, however, remain uncharted.

The EU legal framework and eID

This turbulence created by technological developments is, of course, mediated and absorbed by existing regulation. Overall, EU citizens enjoy a significant degree of protection of personal data, privacy and ultimately identity. Personal identity is a constitutionally protected right. It is closely linked to the right to respect for private and family life, as it shields people from unwanted external attention and control (Rodotà 1997). The right to personal identity encompasses two of EU Charter of Fundamental Rights: the right to privacy, which prevents public authorities from privacy-invasive measures unless certain conditions are met, and the right to data protection, which establish conditions under which it is legitimate and lawful to process personal data. In Europe, a number of Directives have created a general and technology neutral system⁷ of data protection in all Member States that also protects ‘the fundamental rights and freedoms of natural persons’ (Directive 95/46/EC, Art. 1).

“Not only privacy but other rights such as fairness, defence, non-discrimination are to be protected. This vision is especially important in relation to judicial authorities, as in many cases it overlaps and complements other principles enshrined in Article 6 of the ECHR” (Rodotà 1997, pp. 605–606).

National and EU Data Protection institutions monitor personal data processing by public and private institutions and individuals can access Courts to settle issue related to the infringement of their data protection rights.

However efficient technology neutral regulation may be, identity-protection legislation is tested by rapid technological developments and social change, as novel issues and dimensions that remain elusive to ‘hard’ legislation (Daskala and Maghiros 2007). The right to identity implies the “correct representation in each context” and also an “integral representation of the person” (Rodotà 1997, pp. 605–606), also to be intended in a diachronic sense. However, specifically in relation to Web2.0, identity is no longer conceivable as a pre-existing, static datum but rather as a dynamic, ongoing process of manifestation of the self in multiple transactions, interactions and exchanges of data. While strictly speaking digital identity is information about users of an information system and the techniques for their identification (usually protected with an authentication system), in a broader sense it corresponds to the on-line or virtual identity of a person. Especially for young people, ‘being digital’ is more than the mere electronic processing of personal data, it encompasses a distinct online life, often implying multiple different digital identities (for instance through multiple profiles on social networking sites).

As such, digital identity can be endangered by misrepresentation, de-contextualisation, non-transparent flow of information. It can be distorted and fragmented, as personal data are stored in several databases that provide a partial and potentially endangering picture of the person reduced to the sum of its electronic projections (Rodotà 2004, p. 141). More in general, the legal concept of personal identity misrepresentation takes on new nuances that may be difficult to forecast and regulate; digital identity can be under-represented (Frean 2008), over-represented (time-wise), otherwise represented, presented out of context, stolen, concealed via anonymity and pseudonyms (Campbell 2007; Koops 2005; Leenes et al. 2006). Although these issues may not be new, the complexity of data protection in relation to digital identities and the uncertainty regarding its application and enforcement are. We flag here four problematic areas of the current regulatory framework: complexity, uncertainty, responsibility and oversight.

Complexity

Firstly, complexity makes the problem qualitatively different. What is ‘personal’ remains to-date elusive in relation to digital environments. There is a clear problem with contextualising what data requires protection, as law “does not distinguish between personal data that affects or does not affect private life” (Daskala and Maghiros 2007, p. 27). The distinction is important enough to merit detailed discussion by Article 29 (Article 29 Working Party 2007).⁸ Data protection legislation currently struggles to regulate digital tracks and trails, in truth digital fragments of identity, which are left behind unintentionally or unknowingly, such as, for instance, the IP address of origin of users. When it allows tracing a user, Article 29’s opinion is that it constitutes personal data, therefore falling under the provisions of data protection legislation (Hogben 2007). Other instances remain more controversial. Unclear domains include terms searched for in search engines. It is unclear whether search terms are to be considered as data to be protected and who the actual owner of such personal data is.⁹ There is lack of clarity concerning behavioural information stored in cookies and information provided for social purposes and ‘relational’ information, specifically in SNS. All these are remainders of digital transactions that the user has no knowledge about, awareness of or control on, often resulting from the design of the transaction under scrutiny.

Uncertainty

Secondly, there is a significant problem with uncertainty. The growth of person-related information and user generated content make compliance and control more difficult (Gantz et al. 2008; Pascu 2008).Whether identity data controllers should be trusted has been recently questioned, when an increasing number of data breaches are not reported to customers and potentially sensitive data are disclosed to third parties (BBC 2008). Also, checking compliance with privacy and personal data rules in the digital space is problematic, as often there is not enough transparency about the outcome of such activities (Daskala and Maghiros 2007). Although institutions are required to perform compliance audits regarding data protection and prior checks in relation to privacy impact (audits tools are increasingly made available by national Data Protection authorities)¹⁰ there is no guarantee that audits have been performed thoroughly and that results are valid and reliable. National Data Protection officers are confronted with the gigantic task to monitor hundreds of thousands of delegated data controllers, private and public, within their generally wider remit which goes far beyond a bureaucratic interpretation of the Data Protection Directive (Thomas 2008).

Responsibility

It is becoming increasingly harder to identify responsibility in complex identity environments, due to the large control gap between data subjects and data controllers. Users have limited control on their data when these are uploaded to a electronic database system and transferred trans-nationally¹¹ and limited control over their data and connections in relation to data merging from different sources (Kirkpatrick 2008). While about 70% of the online information is created by individuals, companies are responsible for the security, privacy, reliability and compliance of 85% of the digital universe (Gantz et al. 2008). Even the deletion of personal data and trails left is problematic (Hogben 2007). The question may be raised of whether links and relations are part of the self, or whether they belong to the context where these are generated. The issue of whether people can rightfully ‘export’ their online social graph (their online friends, tastes, writings) to other sites in currently unclear. Overall, it is unclear to what extent people can be held accountable for the accuracy of their digital identity, whether one may posit a burgeoning duty of care of one’s digital identity (e.g. maintain it safe) or to maintain an accurate digital identity, alongside established rights of protection by institutions. In other words, whether users are to some extent data controllers of their digital identity.

Oversight

Furthermore, as oversight ensures efficacy of any regulatory framework, further thought should be devoted to identifying what is the most appropriate supervision source. The recent case of SNS regulation in Britain highlights a number of competence criss-crosses, whereby the communication watchdog Ofcom¹² is concerned with safety and privacy of media contents of the sites, the Home Office is concerned with safety for younger children and safety guidelines, the national Information Commissioner’s Office is concerned with data protection, identity and privacy matters, and courts are concerned with all that falls between the lines. Furthermore, member state Data Protection Authorities operate in very different business and political cultures and sensitivities, witness the Phorm case in Britain, the biometric passport case in France,¹³ and the Italian tax disclosure case.¹⁴ At EU level, the competence boundary between European Data Protection Supervisor and European Ombudsman has been contentious for some time, partly addressed by a memorandum of understanding (European Ombudsman & European Data Protection Supervisor 2007). Furthermore, EDPS is now involved in assessing the privacy and personal data consequences of project funded under the Seventh Framework Programme for Research and Technology Development (FP7); the main aim is the promotion and reinforcement of the ‘privacy by design’ in all stages of Information Technologies EU-funded research (EDPS 2008a).

Is there a need for a new regulatory framework?

So far, we have identified a number of key challenges for eID. These revolve around the need to re-assess identity to arrive at effective solutions to the turbulence introduced by new developments. Overall, the principle challenge for regulators is to enable the effective management of one’s own and, for businesses, one’s customers’ identity in a climate that tends to fragment its definition, use and regulation. Not surprisingly, a key research challenge identified in the European Commission vision of Future Internet relates to “Managing and protecting the ‘identity’ of billions of networked persons, devices, “things”, services and virtual entities connected in the Future Internet” (European Commission 2008b, p. 111).

To assist policy-making in managing and protecting eID, a more integral approach to the problem may be required, one that takes into account users’ identity across platforms and life activities. Research funded by the European Commission under the FP7 IST programme include projects that favour a holistic view of identity management, such as PRIMELIFE, SWIFT and PICOS¹⁵ (European Commission 2008a). Primelife aims to “fundamentally understand privacy-enhancing identity management ‘for life’ (practical life, throughout life & beyond), to bring privacy to the Web and its Applications, and to develop and make tools for privacy friendly identity management widely available—privacy live”. These are valuable, necessary R&D steps towards developing technologies that factor in privacy and personal data protection at the earliest possible stage of design.

However, we argue the need to move beyond discussions about privacy and move into full fledge discussion of identity in relation to eID. The legal concepts of privacy and data protection struggle to regulate citizens’ conduct in the new information space. Both are remote from people’s practical understanding of the new environment. They are subject to a well-known paradox (recently, see The Gallup Organization 2008), whereby people declare to value them highly instants before selling them cheaply. They are hard to define and enforce, both legally and practically, in the new complex information space.

Of course, privacy is indispensable to protect the core of citizens’ identity, sensitive data or the safety of users. People possess an understanding of privacy as a defensive right to control access to one’s own person and personal information (Palen and Dourish 2003). Privacy in this sense helps one define the criteria that would dictate ‘opacity’ of data (Gutwirth 2002) while data protection is defining the conditions for the ‘transparency’ of data; data protection is indispensable in ensuring that personal data are processed fairly, efficiently, to the benefit of the user. The Data Protection Directive framework is successful in ensuring a technology neutral high level of protection of personal data (European Commission 2007).

However, if privacy and data protection are stretched to intend and regulate zones of personality that do not require or even invite opacity and procedural fairness, such as an increasing array of citizen online and offline activities, then they display visible stretch marks. The current regulatory framework is inefficient in dealing systematically with the enlarging digital data shadow harboured by the Internet; the challenges faced by Data Protection authorities in patrolling data controllers’ behaviours point to the natural, one-sided ‘opacity’ of a growing Internet. Further regulatory mechanisms could prove beneficial in ordering the invisible as well as the visible transactions involving personal data.

We propose an alternative eID regulation regime to privacy and data protection, one which we name the Autonomy regulatory framework; Autonomy places different emphasis on the principles, object, and focus of eID regulation. Data protection and privacy are not discussed here, as they have been discussed extensively elsewhere in this journal issue.

In as much as users’ identity is tied to where they go, who they are with, what they do, who they know, and what they think, the regime has multiple advantages for the understanding and regulation of eID in turbulent times. Normatively, the new regime stresses the need to regulate behaviour, rather than procedures or access. Away from the privacy paradox, what deserves attention is users’ actual behaviour rather than intentions. Overall, the Autonomy regime may be considered as an enactment of ‘decisional privacy’, whereby citizens can take decisions for themselves and act on those decisions free from external interference, truly creating a space for autonomous action (Rössler 2005). It underlines the importance of user control, transparency and responsibility in relation to personal data in the new environment; these facets of identity have been long disregarded in the discussion of eID. This does not mean focusing only on use, quite the contrary; attention is required to structural properties of a regime based on the praxis of identity, on increased transparency and on distributed responsibility.

Firstly, regulation is required in the lived domain of actual activities carried out online which have identity implications. That of identity is a special market, one which requires closer scrutiny of a larger number of variables. In the new environment, it is hardly sufficient to balance security and privacy, as convenience, trust, reputation, location, transparency and responsibility are crucial variables. The evolution of eID will ultimately depend on user negotiation and acceptance (Backhouse and Halperin 2007) of a complex model of regulation of their online and offline eID behaviours. We need to address the user perspective and regulate extant behaviour as society’s values limit the practical viability of identity management systems (McKenzie et al. 2008). The difference between stated preferences and actual practice in relation to privacy has been documented over time in numerous studies (Acquisti and Varian 2005; Gunther and Spiekermann 2005).

Secondly, regulation needs to increase the overall transparency of the new environment, balancing the clear imbalance in favour of data controllers. Transparency is in line with the call for greater transparency in public policymaking and life,¹⁶ and is consistent with developments in ubiquitous computing (Hildebrandt and Koops 2007). Also, it works in relation to the configuration of identity in relation new internet developments such as the Semantic Web and the Internet of things. Two-way transparency and reciprocity may enhance users’ experience by reducing the gaps between privacy, personalization and transaction discrimination, beyond the information privacy paradigm where this rapprochement has been recently proposed (Acquisti 2008). Finally, increased transparency resolves the tension inherent in the practical application of different principia of EU regulation: freedom of information and data protection (Hustinx 2004).

Thirdly, regulation needs to harness responsibility (according to some: accountability). The autonomy regime proposed is underpinned by a strong ethos of personal responsibility, which is in line with recent thinking about personal data portability, self-regulation of online experience, alternative methods of dispute resolution and, overall, much greater user control on their own data and experience (LaRose et al. 2008). More responsibility may have positive behavioural effects. Young people, who display little to no relationship between online privacy concerns and information disclosure (Tufekci 2008), adapt intuitively in privacy-oppressive environments by over-informing their peers about their whereabouts, thinking and sexual preferences. They adjust profile visibility and use nicknames but do not restrict information within their profile, with little regard for issues of persistence, searchability, and cross-indexability (Tufekci 2008). The trick is thus to envisage (design, regulate) identity environments that capitalise on such propensity to disclose, bargain, transact. This may have positive economic externalities in business markets. By stressing accountability, open declarations and users’ duties, responsibility reduces some of the burden that derive from sub-optimal game results in an environment where privacy would limit the flow of information.

Conclusions

In this paper we argued that technological developments such as Web2.0 pose novel challenges for the regulation of eID. We identified and discussed four such challenges: complexity, uncertainty, responsibility and oversight. Policymakers are only beginning to address the consequences of these challenges for consumer protection, data protection and privacy, safety and economic growth and competition. We claimed that industrial players are increasingly vocal on the issue of privacy; there is a perceivable movement towards greater industry co-ordination aiming at shielding large prospective revenues of eID-enabled services from increasing and uncertain regulatory pressure. This is especially important with an incoming European Commission and forthcoming European Parliamentary Elections (June 2009).

In this context, we asked whether there is the need for a new regulatory framework that both preserves users’ identity and enables the provision of advanced services. We examined the capacity of the current regulatory framework to absorb this turbulence, and found it wanting. We thus advanced a novel model of eID regulation, the Autonomy regulatory framework, that may help policymakers create an identity-preserving, transaction-friendly eID environment.

Overall, effective regulation of the new environment requires putting in place a range of market-enhancing rather than market-limiting regulations in relation to advanced interactions in complex, multi-layered digital spaces. Although (or because) eID industry integration is proceeding at full steam on the privacy track, led by market players to remove some of system barriers to eID, much more remains to be done at individual and project level (Maghiros et al. 2007). What may be required is a set of identity management principles to guide users and companies in an environment in which the application and policing of data protection principles is increasingly problematic. Possibly, one could take as a point of departure OECD privacy principles as received in the Data Protection Directive. Obviously, significant research is required which envisages and examines the behavioural, legal and economic consequences of any such alternative regulatory model. Depending on the results of research based on a relevant set of concepts to the emerging new environment—user-centricity, transparency and responsibility—a policy mix of soft-regulation, transparency by design, self-regulation, semiotic guidance, guide lining, safeguarding, cross-regulation or other regulatory mechanisms of the eID economy may be advisable.

Appendix

Web2.0 application	Logic
eBay	Consumer-to-consumer auction site based on user-generated reputation feedback and comments; identity is chosen and managed, often strategically, by the seller; recently eBay has tried to tag real-life information to the seller, to improve trust.
Amazon	Market site where users rate and provide feedback on different products; this is complemented by behavioural tracking of users’ purchase behaviour and attention; identity is implicit in purchasing/browsing behaviour (culture of consumption) and further commoditised by the website’s algorithms.
PatientOpinion	Heath system rating site, where patients pass comment on or rate the performance of public health system practitioners and structures; identity in this case is related to personal medical information shared with other users of the system; there are clear concerns for professionals’ privacy and reputation.
Radio 2.0—Last FM	A musical taste-sharing system. More user-centred, it uses a recommendation system to build profiles of each user’s musical taste based on songs listened to, linked to a webpage. User can tag, annotate, and share their tastes via social networking features.
Other Web2.0 platforms such as Linkedin, social networking sites (Facebook, Myspace), WIKIs, Technorati and GNU (communities of software developers) operate alongside different logics, concerning identity, trust and privacy.