Executive Summary

• It is now commonly agreed that current approaches to the collection and use of personal data have resulted in endemic invasions of privacy, extreme and unfair imbalances of power and reward, and constraints to innovation and competition. Many harms have been generated while the full personal, social and economic potential of personal data has not been realised.

• Mydex Community Interest Company (CIC) has developed a paradigmchanging personal data logistics infrastructure that addresses fundamental structural, systemic problems relating to the collection and use of personal data. Its new approach has worldwide potential to unleash the full potential of personal data for the individuals whose data it is, for service providers, for communities and the economy as a whole.

• Mydex CIC’s Personal Data Stores and related services help both service providers and citizens radically reduce the friction, effort, risks and costs (FERC) associated with the collection and use of personal data, generate new data assets that foster innovation and economic growth, build in privacy and data protection as the default, and directly improve inclusivity and citizen wellbeing.

• This new approach to personal data is not just desirable. It is doable at scale. Mydex CIC has developed a way to unleash the full personal, social and economic potential of personal data. And it has found a practical, pragmatic way to implement this approach to overcome the obstacles that lie in the way.

• This White Paper explains the scale of the potential benefits, how they can be achieved, and how they can be achieved at scale.

• Mydex CIC is starting where the need is greatest and resistance is lowest - in public and third sector services needing to cooperate with each other to deliver efficient, effective services to individuals.

• It is using personal data store-enabled solutions to specific

• problems to demonstrate the superiority of the personal data store approach - starting with reductions in friction, effort, risk and cost for both bona fide service providers and citizens.

• Mydex CIC has adopted design principles for the new infrastructure that ensure its contribution is neutral, enabling and positive - that it is there to help and benefit all stakeholders, not to exploit or take advantage of them.

• It plans to grow incrementally from a solid base of proof points solutions that are being used operationally by individuals and service providers, adopting a make-once, use many times philosophy.

• It is building the institutional framework needed to provide and maintain this infrastructure in perpetuity: a mission driven Community Interest Company that is legally committed to its social mission; that is financially independent and stable but not profit maximising; that uses this status to resolve collective action logjams generated by conflicts of interest.

• Mydex CIC is not trying to change the world in a day. It is patient, starting with small experiments, testing and learning, and expanding from there.

• There is a way to break the impasse that has made personal data a source of concern and conflict rather than an opportunity for personal, social and economic enrichment. This way forward is already being implemented.

Context: Why what Mydex CIC does is important

Mydex Community Interest Company (CIC) has developed paradigm-changing personal data logistics infrastructure that addresses fundamental structural, systemic problems relating to the collection and use of personal data.

Its transformational, citizen-centric approach to the collection, sharing and use of personal data benefits both citizens and bona-fide service providers. It radically reduces the costs of data handling, improves the quality of public and third sector services, while protecting citizens’ privacy, promoting citizen agency and wellbeing, and providing a platform for ongoing digital innovation, collaboration, and inclusive economic growth.

Mydex’s mission is to unleash the full potential of personal data for the individuals whose data it is and for service providers, communities and the economy as a whole.

The pivotal role of personal data in the modern economy

Personal data is used by organisations for multiple activities including:

• identifying individuals as unique persons
• onboarding them onto services
• processing applications
• assessing needs and configuring service provision
• delivering services, including organisation and management of related logistics
• undertaking related administration (record keeping, billing)
• analytics to generate new insights and target communications

Wherever a service provider is dealing with an individual citizen, customer, employee or volunteer — no matter what industry or service — the collection and use of personal data is involved. This includes public administration, utilities, financial services (banking, insurance, investments, pensions, etc.), health, travel and transport, retail (across every category of goods), education, training, employment, and leisure.

The ongoing shift from manual, paper-based processes to digital equivalent ones has already led to an exponential increase in the volumes of data that is generated, collected and used. It will continue to do so. Much of this data relates to identifiable individuals.

For these reasons, the collection, storage and use of personal data now lies at the heart of our society and economy.

Current uses of personal data: barriers constraints and drawbacks

Historically, the original collectors and users of personal data were organisations using this data to provide services to identified customers (or to identify and deal with identified employees). This natural and inevitable evolutionary trajectory created an organisation-centric personal data ecosystem where the only entities collecting and using personal data at any meaningful scale were large organisations.

This system has brought immense benefits. But because of the way it is structured, it also generates multiple drawbacks.

• It creates a built-in imbalance between the powers and roles of what EU Data Protection regulations call ‘data controllers’ (organisations) and their ‘data subjects’ (the individuals whose data is being collected and used). This has resulted in some extreme imbalances in benefits and rewards.

• It constrains potential uses of personal data. Under the current system, each organisation collects and stores the data it needs to pursue its own purposes, holding this data under lock and key (for a combination of security, regulatory and competitive reasons) in a series of separate, isolated organisational data silos. As a result, as the UK’s consultation on its National Data Strategy notes: “the full value [of data] is not being realised because vital information is not getting to where it needs to be.”

• One of the biggest of these missed opportunities is individuals being unable to collect and store their own data for their own purposes.

• It has resulted in system-wide conflicts of interest. To remedy some of the imbalances created by this system, data protection regulations provide individuals (‘data subjects’) with multiple rights. For example, data controllers are required to obtain data subjects’ consent to many data processing activities. Complying with these regulations generates cost, complexity and risk, while limiting what organisations and society as a whole can do with personal data. This creates a perceived conflict between ‘privacy/data protection’ and data-driven innovation, economic efficiency and growth.

• It is extremely inefficient. The siloed, proprietary, non-sharing approach to personal data collection and use means there is widespread, systemic duplication of effort as many different organisations each collect, check and verify many of the same data points.

• flaws at the heart of the system generate multiple negative, knock-on social and economic outcomes including: loss of trust, citizen disempowerment and perceived unfairnesses, along with imbalances and constrained opportunities for innovation and economic growth.

What Mydex CIC’s platform and services do

Mydex CIC has built digital infrastructure and related services that tackle these systemic, structural issues at their source. Based in Scotland, its platform/service is a world first in empowering individuals with their own data: enabling them to collect, store, use and share their own data under their own control via their own Personal Data Stores.

Mydex CIC’s Personal Data Store infrastructure:

• includes and empowers individuals (as citizens, customers, employees, members, volunteers, etc.) to act effortlessly and safely as active participants in the workings of the data economy, enabling them to easily collect and use their own data to manage their lives better.

• equips individuals’ Personal Data Stores to act as data logistics hubs under their control, thereby creating a new national data infrastructure that ensures the safe, efficient sharing of personal data, where the data is no longer trapped inside different organisations’ data silos and can be reused by multiple parties as and when needed (assuming individuals’ explicit permission).

• enables the creation of new, never-seen-before data assets that act as a foundation for far-reaching innovation as individuals aggregate data about themselves, creating rich, rounded pictures of their lives in their own Personal Data Store.

• by putting citizens in control of their own data, transcends the current trade-off between privacy/data protection and efficiency, while building regulatory compliance into the operation of day-to-day data processes.

• reforms the architecture of the system, from one characterised by multiple separate and isolated data silos to a vibrant data-sharing network, with citizens acting as nodes for the permissioned sharing of data about themselves.

In this way, the platform generates new win-wins between citizens and service providers (e.g. social services, healthcare, advice, local authorities, housing, etc.), helping both parties reduce the friction, effort, risk, and costs of gathering, sharing and using data.

Mydex services are free to citizens. The company earns its money by charging fees to organisations connecting to its platform to send data to and receive data from citizens’ Personal Data Stores and thereby access related services and benefits.

For citizens, a crucial value-adding element is the ability to find and share the data they need to share when seeking to access and use services. By enabling individuals to safely and efficiently share their data with bona fide service providers (thereby automating form-filling), the Mydex platform fills a missing link in the nation’s digital infrastructure: the provision of high volume personal data logistics and capabilities. It guarantees the ability to get the right personal data to and from the right people at the right time.

Each Personal Data Store data is stored by the individual independently of the data gathering activities of any organisation and is uniquely and separately encrypted. Each encryption key for each Personal Data Store is held by the individual it relates to, so that only that individual can access the store and exercise control over the data it holds. Mydex CIC itself operates on a ‘zero knowledge’ philosophy and set of practices. It is designed not to see what data is held by individuals or influence what they do with it.

The resulting platform has the added benefit of improved data security. Because each Personal Data Store is uniquely and separately encrypted, the Mydex CIC platform does not create a new centralised database that becomes a honeypot for hackers. A centralised database holding the data of one million people only has to be hacked once for the hacker to hack all the data. For that hacker to access a million records on the Mydex CIC platform, they would have to conduct a million separate successful hacks.

The platform is live, operational, ISO 270001 accredited for information, security and management. It is approved as a bona-fide supplier of public services, listed on government procurement platforms (Dynamic Purchasing System in Scotland and the G-Cloud and Digital Outcomes and Specialist Framework in the UK).

The benefits Mydex CIC brings

The Mydex data logistics platform unleashes multiple benefits for individuals, organisations, society and economy as a whole.

Reducing service providers’ risks and costs

The biggest immediate benefits of the Mydex approach are the system-wide reductions in friction, effort, risk and cost it generates for both bona-fide service providers and citizens. The Mydex CIC platform enables data that has already been collected, generated, checked and verified to be shared with the individuals whose data it is (held in the individual’s Personal Data Store), to be used directly by these individuals and to be onwardly shared to other service providers.

In doing so, it eliminates the need for large amounts of data processing that were previously necessary, e.g. manual processing of data that can now be automated; work previously undertaken by service providers to gather, check and store data that has already been gathered, checked and stored by somebody else. In addition, by improving the quality and accuracy of data that is used, it reduces rates of error and their related costs, thus helping service providers further reduce data processing costs.

From pilots and projects already undertaken the platform is delivering up to:

• 95% reductions in cost of processing an application
• 55% reductions in time to process an application
• 62% increase in timely interventions and access to services
• 45% increase in quality of outcomes
• 62% reduction in fraud and error

The cost and risk-reducing benefits of this approach to handling personal data is one of the main reasons why the Scottish Government is now procuring a Mydex CIC-recommended Scottish Attribute Provider Service ^[1] based on the provision of Personal Data Stores.

Reducing citizens’ costs and risks and improving outcomes

Citizens’ benefits are similar to those of service providers. Citizens no longer have to repeatedly find, present and prove information that has already been found, presented and verified elsewhere - thus reducing the time and effort needed to apply for and use services. Eliminating form-filling is a major benefit in its own right.

Individuals as information managers

Individuals and households undertake all the tasks that large organisations do, except at a smaller scale and without professional help. They:

• Source inputs from suppliers (‘shopping’)
• Buy capital equipment (homes, cars, washing machines, ovens etc)
• Use this capital equipment to achieve desired outcomes
• Undertake maintenance of their capital equipment
• Make plans, set priorities and timelines, allocate budgets
• Undertake administration, dealing with public authorities, the tax man etc.
• Face logistical challenges of moving things and people to and from the right places at the right times
• Employ people (e.g. services like plumbers, physiotherapists, decorators, keep fit instructors, child care minders)
• Develop human resources: teaching and learning skills and capabilities
• Develop and manage relationships with suppliers
• Plan and deploy financial resources, making savings, taking out loans, managing cash flow, paying taxes.
• Manage and juggle the multiple different ‘life’ departments (e.g. money, health, home, transport, career, etc)
• Make decisions about all the above
• Search for, organise and use the information they need to make these decisions and undertake all the above tasks efficiently and effectively

Unlike large organisations and corporations however, individuals and households do not employ large armies of professional staff to manage these operations and they do not (yet) build and deploy large databases and information management systems to assist them. The result is a significant market and value gap: a wide range of needs and wants that are not being addressed.

By providing every individual with their own personal data store it is possible to establish the data infrastructure that enables individuals to undertake all these tasks much better and more efficiently. This infrastructure will act as a platform for far-reaching service innovation and inclusive economic growth.

A platform for innovation and economic growth

The scale of this opportunity is still largely unrecognised. In advanced western industrial nations, the average citizen is now managing over 100 different data relationships with as many different organisations across all aspects of their life e.g.:

• dealing with public administration (e.g. in the UK, HMRC, DWP, local councils)
• managing their homes (e.g. electricity, gas, water, internet, phone companies, media and entertainment companies and specialist home services)
• managing their money (e.g. service providers providing current account/s, savings accounts, loan accounts, mortgages, insurances for car, home contents, buildings, life, travel etc, investments, pensions)
• managing their health
• managing their mobility
• managing their education and employment
• managing their general purchasing activities (e.g. relationships with online and other retailers)
• managing their leisure activities

Achieving systemic change

Barriers to adoption

While the above benefits are compelling, widespread adoption of a personal data store infrastructure faces many barriers. It requires shifts in thinking that challenge many common assumptions and mental models along with sometimes far-reaching changes in ways of working, business models and perceived vested interests. For many service providers this adds up to one thing: a high level of perceived risk.

That is why Mydex has chosen to focus on practical real world proof points, working with innovators who are demonstrating the potential. These innovators include the Digital Health and Care Institute, Macmillan Cancer Support, Blackwood Homes and Care, the Scottish Government and Glasgow City Council.

Most of the private sector continues to demonstrate active resistance, mainly because businesses believe that by building up large proprietary data assets under their exclusive control they can advance competitive success and profit maximisation. In addition, IT vendors who currently serve the public sector with large applications and broad contracts are focused on sustaining traditional models that enable them to sell their solutions and maintain control.

Even amongst those not intrinsically hostile, the citizen centred approach that Mydex delivers may be met with scepticism and caution for many reasons, including low levels of awareness and understanding, constraints imposed by legacy IT systems, and risk aversion. Other barriers to adoption include simple inertia and habit, and competing priorities amongst potential adoptees.

For all these reasons, even though the potential benefits of adopting the new approach are huge, Mydex does not expect or plan for large scale adoption in the short term. This is a journey that requires patience.

Overcoming the barriers

Establishing proof points

Mydex CIC’ plans to spread by the adoption of personal data stores by progressively dismantling and overcoming these barriers and building the momentum of the new approach.

It is doing this by focusing efforts on those areas - where:

• The needs and benefits are greatest. Specifically, in ‘clusters’ where a number of different organisations are all seeking to serve different aspects of the same individual’s overall need and where there is a strong need to share data to deliver a joined-up, integrated service.

• The barriers are lowest. Where, because of their public service ethos, these organisations are not actively resistant to the notion of citizens being empowered with their own data.

• It is clearly possible to create live and compelling real world proof points - where seeing can be turned into believing.

• These use-cases can be easily, widely and rapidly replicated.

By demonstrating operational practicality and benefits, this ‘proof points’ approach reduces risk for new adopters and builds awareness of its benefits. By creating widely re-usable use-cases, we open the door to rapid scaling.

Examples of current projects

Examples of Mydex CIC’s current ‘proof point’ work includes the following.

Scottish Attribute Provider Service - We have been working with Scottish Government to build and test systems for the safe, efficient sharing of verified attributes to improve public service provision and enable citizens to access and use services easier and quicker. Mydex CIC has already trialled and tested the technical underpinnings needed for this service in its Verified Attribute Prototype^[3] along with a practical implementation and roll-out strategy in its Smart Entitlements strategy^[4] report. These recommendations have been largely accepted by Scottish Government and embedded into a procurement that is currently underway^[5].

‘Inclued’ - a citizen engagement platform. Working with Glasgow City Council, Mydex CIC has piloted a new citizen engagement platform called ‘Inclued’ that helps the Council deliver personalised notifications and service offers via an easy-to-use web-based app to their citizens. The platform is designed to work for any city/town/village/community.

Because the data used for, and generated by, every interaction and transaction is automatically stored in the individual’s Personal Data Store, it is always available for reuse, and service providers are able to constantly refine their insights and improve the targeting of their messages. At the same time, citizens experience increasing convenience dealing with service providers as the data aspect of interactions (e.g. proving identity, status and entitlements removing the need for form filling) are increasingly automated by using the data stored in their Personal Data Store (PDS).

Improving cancer journeys- Working with Macmillan Cancer Support in Glasgow and West Dunbartonshire ^[6], Mydex CIC is developing the data sharing infrastructure that enables all the many different parties (organisations, friends and family, carers) assisting cancer patients through their cancer journeys to share the data they need, via the individual’s Personal Data Store. This helps ensure that available services are as integrated and joined up as possible and minimises the friction, stress and duplication of effort that patients currently incur when services are not joined up.

Enabling assisted independent living - As part of Blackwood Homes and Care’s Neighbourhoods for independent Living project, Mydex CIC is providing the personal data infrastructure, including the Inclued platform for two-way community engagement, to combine age-friendly homes with technology and products that enable people to live independently, stay connected, and have choice and control in how services are delivered.

First stages of the project are focused on three Scottish neighbourhoods (clusters). The infrastructure ensures that all related personal data is shared safely in a privacy protecting way that removes friction, effort, risk and cost. The service will help people to stay well and physically active as they age, as well as exploring new financial products to support them.

Streamlining and improving debt advice - Working with Advice Direct Scotland, Mydex CIC has been developing mechanisms by which advice workers can help individuals access the data they need from various financial service providers. This data is aggregated in the individual’s Personal Data Store so that advisors can obtain a fully-rounded picture of the individual’s circumstances. A triple benefit results. It:

• significantly reduces the cost and hassle of accessing the data needed;
• enables the provision of better advice;
• enables data re-use, so that data that has been collected once can be used many times over when, for example, the individual makes applications for consolidated loans or reaching agreements with creditors and applying for financial support from a range of sources e.g. hardship funds.

It thus makes debt advice (and acting on this advice) better, cheaper and easier.

Reimagining the provision of health and social care - Working with the Digital Health and Care Institute, Mydex CIC is involved in a multi-year collaboration to improve the delivery of health and social care services in Scotland. Its citizen-centred approach is based on an untethered personal health record (e.g. a Personal Data Store separate to the data held by different service providers) to drive apps and services that provide real time support and guidance for citizens, creating a sense of coherence and easier access to the support they need.

One aspect of this work is enabling citizens to hold Covid vaccination and test certificates (examples of ‘verified attributes) in their Personal Data Stores and to present these certificates to other parties as and when needed.

Involving citizens in the design of their public services - Mydex CIC is working with the Office of the Chief Designer and the Connecting Scotland programme to build a Digital Public Service Design platform - an adaptable, easy-to-use platform (based on our Inclued platform) for citizens to co-design services with service designers and service providers. Its main purpose is to improve citizens’ experiences of accessing and using public services, but it also helps citizens learn from one another in the process.

Achieving impact at scale

Mydex CIC Personal Data Stores have a stem cell like nature. Stem cells use the same basic information, but recombine it in different ways to undertake a wide range of tasks e.g. bones, blood, livers, kidneys, hair and hearts. Mydex CIC’s Personal Data Store platform has similar stem cell characteristics: the same core platform enables a core set of information to be collected and recombined in different ways to undertake a wide range of tasks. It’s a bit like a Swiss army knife: the same tool has many different uses.

For example, the projects described above deploy widely re-usable, replicable service/technology modules that:

• enable previously checked and certified information to be shared safely and efficiently to eliminate duplicated effort, cut costs, speed up processes and improve service providers’ capacity
• use improved data sharing to deliver improved citizen engagement and relevance in service provision
• use improved data sharing to help multiple different service providers coordinate and integrate activities to deliver coherent, joined-up outcomes for their services’ recipients
• use aggregation of appropriate, relevant data to improve the targeting and configuration of specific sets of services
• use the generation of rich aggregations of data about an individual to undertake much higher quality diagnostics and advice at much lower cost
• enable data analytics to generate new insights and target communications

Crucially for the company’s ability to deliver change at scale, these use-cases have near universal applicability when it comes to the processing of personal data. Once created, they can be widely applied and replicated. They are a springboard for rapid adoption.

Why is Mydex a CIC?

Mydex is legally constituted in Scotland as a Community Interest Company limited by shares: a limited company which conducts a business for a community benefit and not purely for private advantage.

There is strong strategic business logic to the company’s founders/Board’s decision to opt for CIC status.

Financial logic

As a Community Interest Company, Mydex is a business that can earn income from sales. It is not a charity or foundation that relies on benefactors and donations. This is crucial to its mission. Organisations that rely on benefactors and donations risk being sucked into a constant struggle to raise funds that diverts attention away from actually delivering their mission while creating pressure to bend their missions to the whims of rich benefactors. To achieve its goals Mydex needs to maintain its independence over the long term. It can do this by earning revenues from its operations.

Of course, a mission-driven business that earns its revenues faces other risks. For example, it may become beholden to customers (organisations) who pay for its services and/or to investors. To address these risks Mydex CIC has done two things.

First, it has structured the ways in which it earns money so that there is no financial incentive to attempt to see, influence or exercise control over individuals’ data. Organisations pay a fee to create Mydex CIC hosted data sharing connections with individuals. That’s all. Mydex has no knowledge, interest or incentives relating to the data that flows through these connections.

Second, by choosing Community Interest Company status, it is legally committed to pursuing its social mission of empowering individuals with their own data. As a CIC, the company is:

• asset locked. This means the assets it develops cannot be sold to another entity that is not also asset locked and equally committed to pursuing its community purpose. It is not seeking a trade sale or ‘exit’: it is committed to continuing the operation and extension of its platform as permanent infrastructure to benefit its community (citizens).
• dividends capped. Only 35% of any surplus generated (profits) can be returned to shareholders in the form of dividends. The remaining surplus must be reinvested in furthering the community benefits for which it was established.

At times, adopting CIC status has sometimes made life difficult for the company. It has closed the door to traditional private sector investments whose raison d’etre revolves around maximising profits, usually via asset sales. It has also revealed the so-called ‘social investment’ sector to be not fit for purpose as currently constituted: overly focused on short-term debt for specific focused projects rather than long term equity for general purpose infrastructure.

As a result, the company has had to largely bootstrap its own funding: living within its means, from whatever it earns from existing projects. This has meant it cannot indulge in expensive attention-grabbing dashes for growth. It has to focus instead on slow but sure incremental growth that maintains its independence and protects its mission.

Nevertheless, its internal financial logic means that each step forward gives it accelerating momentum and increasing returns. This logic is illustrated by Figure 3.

A core characteristic of the Mydex CIC business model is that it has low operational gearing. The costs of maintaining and operating the platform are broadly the same whether it is serving one person, one million people or ten million people.

It costs a certain amount of money to make a Personal Data Store available to an individual. If one organisation connects to this Personal Data Store it earns a certain amount of income. If ten organisations connect to the same Personal Data Store, revenues from the same basic piece of infrastructure grow tenfold, while underlying costs do not.

As more and more people and organisations connect to the platform revenues grow faster than costs, thereby assuring the business’s financial - and therefore - strategic independence.

Strategic logic

But Mydex hasn’t chosen CIC status solely for financial reasons. CIC status is essential to demonstrating the trustworthiness that is needed to recruit the people and organisations needed to deliver its mission.

As part of its preparations for the development of a new National Strategy for Data, the UK Treasury drafted a paper on the Economic Value of Data. The paper contains some important insights, particularly that “innovative uses of data can generate powerful positive externalities (i.e. benefits) that may not always accrue to the data creator or controller. This can result in data being under-exploited or under-shared.”

In other words, private companies focused only on profit maximisation have no reason to embrace ways of collecting, sharing or using data that benefit other parties, including citizens. By adopting CIC status, Mydex formally turns this challenge into its core purpose: to enable the data sharing that generates powerful positive social and economic externalities.

But achieving these positive externalities requires the resolution of a critical collective action problem: it would greatly benefit all parties if investment was made in the infrastructure necessary to ensure the safe, efficient, privacy protecting sharing of personal data. But it’s not in the immediate interests (or role) of any current data controllers (e.g. organisations collecting and using personal data) to take on the cost, risk or responsibility of making this investment.

Only a new, neutral, independent, non-threatening, non-competing body whose purpose it is to connect these parties in new, permanent win-wins turns can break this collective action logjam. Mydex’s CIC status formally confirms and signals to other parties that this is its permanent, positive, enabling role.

In nature, we find many strategies for survival. There are predators and prey, parasites and hosts, foragers, scavengers, hunters. Locusts flourish by devouring the value other organisms have produced. Bees flourish by helping plants flourish - to flower and fruit.

Today’s personal data ecosystems are dominated by locusts, intent on extracting as much profit as they can from individuals’ data. In choosing to be a Community Interest Company Mydex is declaring to the world that we have chosen to be a bee. We have chosen to flourish by helping others in our ecosystem to flourish. That, we believe, is why in the long term we will be successful.