Sylvie Vandevelde: From a Centralized Digital ID Towards a Hybrid Model

So indeed we always say that it's me, that the digital society needs a digital identity, and that's what we are doing for a few years now. So I will be go a little bit back in time to tell you where we started. It didn't start with me, but it started with Belgium mobile ID. So it started with a company and that is a consortium of the four big banks in Belgium and the three telecom operators. And actually they gave to Belgium, mobile ID and, and the team at the challenge to build the reference in digital identification authentication.

And also in, in signature, it started for Belgium that they are large, the scope to say that it has to be for, for Europe. So it's quite a great challenge, a great challenge that we started in May, 2017. So almost four years ago, time flies. And we have now reach almost one third of the Belgium population that is using its me as a digital identity. So there were very important milestone during our tragic. And I think that the, the, the first very important one was in January, 2018.

So a few months, almost six months after that we launched where the Belgium government also recognized its me as a digital identity. So it's a little bit particularly in, in Europe because we have a lot of digital identities that are created by public services, by governments. And in Belgium, we do it always a little bit different and they said, well, it will be the private world who will create a solution and who will then be recognized by the government. So it was three years ago.

We had, again the audit a few weeks ago and we passed the test again. So we are again on the accreditation list, the Belgian one for, for the coming three years. And that was also a very important moment because we know that when you can use a digital identity in the private and in the public world will then it's really meaningful for each citizen. And then you see that we started to, to grow step by step. You will always see in Belgium, well, two bubbles in the red line. So that's the, the one that you see the transaction or the action that has been done in Belgium.

So you always see a first bubble around may around a month of me because that's the moment that we have to fill in our taxes online. So it's me, it's used a lot to connect on the, on the taxon web and you have a second one in October because then it's for the business part that do the, have to do the same exercise. So that's why you see these moments where always some peaks in Belgium and a good anniversary. We were very happy because we reached 1 million users that we doubled actually one year later in may, 2020.

Another important moment is end of 2019 because there we were recognized on European level as a level of assurance high in terms of identification means. So Belgium has the Belgium E I D card, and has ease me as the two recognized digital identities on the European level. Our third anniversary, of course we were in 2020, it was a in, in lockdown that we celebrated it.

And there, you can see also that, of course, because of the pandemic, we saw a huge boost in, in the number of users. And, but also in the number of transactions with its me today, we are reaching 2.8 million users. So I think for our fourth birthday, we will have the magical number of three millions. And last year we had almost well, a little bit more than 90 million actions with its me that has been used at around hundred 50 partners in the partners that we have for us is the government one partner, because it's also one connection.

We have a single sign down for all Bel e-government applications. And the other partners are in the banking world, in the insurances, in the health sector, in the document signing. So we have a lot of use cases where it can be used first when you create a digital identity doing its with the right rules on the right moment and the right way is very important. So these are the different guidelines and accreditations that we have. The first one of course was a 27,001. We also follow the financial guidelines.

So the one of IML where also in IML five digital identities also named to do the KYC and the C D D processes in the onboarding of clients in banks. We have also well changed a little bit, our, our identity. So it can be a strong consumer authentication within the open banking world of PST two, as I said, for ADA, we are at one side, we are a level of assurance high for our identity, but we are also a qualified trust service provider because we deliver a qualified, qualified signature towards the market and being GDPR compliance.

Of course, I think it's part of our DNA and it may be one of the easiest parts to handle in the whole ecosystem when we created the digital identity. Well, it was for the society to make sure that it has a reliable tools so that they can transfer data in a secure way. And it was between individuals or companies or, or public services. So it was sharing the data in full transparency where, and the person who sends the information. So me as an individual, but also the one who receives it is identified.

So when you want to share data with it's me, me as an end user, I will see in my app that I share for example, five or seven fields of my E I D card of my digital identity with that bank. So it's always very transparent. I know what I do with who I share and what data that I share it's means also used to grant access because it's a two factor authentication in, in one app. So it's me, it's used not only in the banking sector to access your bank account, but also in the health sector, we saw that it's me was the number one login on the public health services for, for health information.

So there is to grant access with very sensitive data behind it's means also used to confirm or to give consent most of the time confirm banking transfer, but sometimes also to give consent when you want to change, for example, a subscription, or when you want to change something in your, your accounts that you have at your insurance or another partner, and last but not least is of course also the signature of documents with the qualified electronic signature.

So in Belgium, we can do it with our EIT card and we can do it also fully mobile with its me, well, it's me in the future, what would it be? So there are, are two topics where that we are working on the first topic is how to make sure that we can go a little bit broader than only Belgian citizens. So today all Belgian citizens can create their SME account and it goes actually in three steps. So the first step is you download the app and you give your phone number, but the most important step is the moment where we retrieve your identity.

So it can be done with your E I D cards where you need to have a computer to do it because we have connected card readers, or you can also do it with your bank cards because what we do we have with the four big banks, we have a connection. So that's, we can retrieve the readout of your E I D at your bank card with your consent, of course, to create your IME account. And at the end you have a verification code, you choose your IME code and then you are ready to use your IME.

What we will do in a few weeks is that what will open up actually the its meet to the Netherlands and to Luxembourg in the first step to the Netherlands. And they're actually the way of creating an it account is slightly different because in the Netherlands and in Luxembourg, they have ID cards that is NFC based, what we don't have yet in Belgium it's coming, but we still need to be a little bit patient. So we are using also that kind of technology to create an NSME account. So you will scan your ID, then you will put it against your phone. So it will be an NFC.

And the last step we will of course check that you are the one holding your passport and the liveness check happens. So the first and the last part is exactly the same as in Belgium, but with the middle party, slightly different, that allows us to open up the SME app to, to, to the Netherland and the Luxembourg. It was actually our partners that asked it because they're offering its meat to their clients, to their Belgian clients. And we are small countries.

So we cross borders very often, especially online today, but we are most of the time on Benny looks level and they wanted to offer the SME also to their Dutch Alexei of bird clients. What can happen in a few days, actually the data that will be available through the, the, the other connections. So the other identities are almost the same as in Belgium. We need to be very honest that we are quite comfortable in Belgium. Thanks to the E I D cards because we have a lot of data that is on the E I D card.

As you can see it for the Netherlands and the Luxemburg is almost the same only the legal address and the place of birth won't be available, but that will give us the opportunity to share almost the same kind of data with, with the other countries then for the Belgian citizens. So that's the first step that we will do in, in the coming weeks. So open up Belgium for other countries and for other citizens. And another track that we are working out today is to see how we can open up the ecosystem that we've built as you know, with digital identity.

Of course, we always talk about the digital identity about the trusted digital identity, so that the core identity that you have on your E I D card that you have on your passport, but actually a digital identity is much more than that. And the other information that is around our trusted identity, we call them internally the attributes. So it can be a lot of things. And the attributes are, for example, a driving license that can be financial information that can be certificates that you have, or roles or mandates that you have in a company or diplomas.

And we, today we manage of course, the digital identity in a centralized way. That is almost the only way that we could do it to have the different accreditation that you just so, and to offer convenience and security to, to our end users. But we do know that if we want to do that with other attributes, it was almost impossible. We had a lot of use cases from our clients popping up to say, for example, in the banking world, we would like to solve the KYC process where the identity, the trusted identity is one part, but there are still a lot of other attributes that need to be collected.

We had in other sector, for example, in the mobility sector where we had car sharing companies saying, well, I want to have the identity, but I also want to know if the person has a driving license. So then we should add the driving license to, to, to our identity or other ones that were asking for even number and so on. So you can imagine that each partner that we met had some other attributes on the list and on their wish list. So we decided that all these attributes, we would manage it in another way, because there are too many attributes and they all also all have their own life cycle.

As for example, I was talking about the, the driving license. Well, sometimes it happens that you can't ride for, for, for a few weeks. And so can I ride at the moment that I want to rent the car? It's something that's me. We cannot manage. So it was very important for us to keep the attributes in the ecosystem where they are, but to connect with them, same for mandates. I can have a mandate for a company. And if I leave the company, I'm still myself, but I lose the mandate that I have or the role that I can fulfill.

So the life cycle management of these attributes are complex, but very important. So what we decided to do is to create actually a hybrid model. We didn't change, and we will not change the way that its me work today. So in a very centralized way, but with it, let's keep these attributes to place where they are, because most of the time they're very well managed and in a secure way, but to see how we connect them. And we decided to call all these different attributes, actually our data islands. So we know that its me has been created to interact with these different platforms.

We also know that the data needs to be stored and also manage in each ecosystem. As I said, DD guidance, they also all have their own rules, so they need to stay where they are. But with its me, we can actually make the connection work and it can happen in different ways.

So first, as as said, before, we will manage the core identity data. So we manage the trusted identity, but we can also act as an authentication hub. I go back to my driving license when I connect to the database of the driving license, I can say that I'm CV and it can be connected to my driving license because of course the database of the driving license want to be sure that it's not someone else who will connect to my, to my driving license or to their database. Once the connection has been made, actually SME can also be used as a consent tool to share that data with someone else.

So again, I think my, my use case about a company who want to share a car or to rent a car, they want to have my data and actually with its me, I could give the consent that also my driving license is shared during the onboarding of, of that use case of the car of the company we have, that's the one of the driving license, but we have exactly actually the same use case in the interim sector or in the HR sector where diplomas need to be shared or do they have the right accreditations to enter to a job or to, to, to start at a company in the banking sector?

I think the KYC process is still a very heavy one and they're also to connect the right dots to make the onboarding very smoothly is important. And in the health sector too, we have a lot of use cases now that are popping up in the health sector. We also saw on the, because part of our connection in Belgium are through the public interface for the eHealth. And it's means is there the first way to log in? So they're also, there are a lot of questions that I ask, how can we share also some data health on the correct way with the right tools? So this is still very new.

There are a lot of discussions. We will also create a first proof of concept in, in the coming month.

So, so if you're interesting to know how we will make it work and how we look at the future about the fact of sharing data and sharing attributes, don't hesitate to reach out not only about new data islands that we need, but also the way of connecting all these data islands together. So that is what's the future of its would look like in, in the coming month. Actually it goes much faster than, than we thought. So at one point we will open up to new identities, but we also make the connections to new data attributes.

So don't hesitate if you have questions about all the stories that I just shared with you, or maybe some, some, some remarks like the way that we do it can be something different based on hesitated. Always very welcome.