The more of our lives we move online, the more often we have to prove who we are. Name, surname, date of birth, gender – how much does a system really need to know about us to verify our identity? The answer depends on the situation, but we rarely see the rules governing this process. Yet these rules can determine how much we have to disclose about ourselves and how much of our data remains private.
For example, when we use ride-hailing or food-delivery apps, we leave a digital trail of our everyday lives. These service providers may collect information about where and when we travel, where we order what food from, and at which addresses it is delivered. But does a service really need to retain all this information for years to get its work done? And does a system always need to know more than is necessary to provide the specific service?
A Technical Foundation Is Essential
Prof. Dr Kai Rannenberg, Convenor of the ISO/IEC JTC 1/SC 27/WG 5 working group on Identity Management and Privacy Technologies at the International Organisation for Standardisation (ISO), says that privacy always requires a technical foundation; legislation alone cannot guarantee it.
The General Data Protection Regulation (GDPR), which for most data processing in the EU and sometimes also internationally defines the protection of personal data and privacy, as well as how personal data are collected and processed, is central to Rannenberg’s work.
“Society needs technical measures to ensure that data are deleted on time and not stored for too long. We also need established standards specifying what data are necessary to identify people in particular situations. Sometimes there is no need to provide a person’s first and last name; knowing their age may be enough to determine whether they are entitled to access certain resources,” Rannenberg says.
Today’s environment nevertheless presents new challenges: the rapid spread of artificial intelligence (AI), growing cyber threats and the increasing number of digital services are changing how we understand identity, privacy and trust in technology.
AI Is Shaping New Standards
International ISO and IEC standards are particularly important across different countries and organisations. For example, they can provide greater reassurance when travelling around Europe or elsewhere in the world, where service providers process personal data.
“If you see a standard referenced in a company’s terms and conditions, you have a better understanding of what is going on,” Rannenberg notes.
Prof. Dr Šarūnas Grigaliūnas, Head of KTU’s Cybersecurity Centre of Excellence, says that AI has had an impact over the past few years that nobody anticipated.
“These technologies have fundamentally changed the business landscape. Since standards development is a slow process, the impact of AI, its use, data collection and AI-based systems are especially pressing issues today. Many new areas need to be incorporated into standards,” he notes.
Protecting Individual Rights Is a Growing Challenge
Experts point out that AI makes it possible to collect and analyse ever larger volumes of data. But does this change the very concept of privacy, or merely the practices used to protect it?
“Opinions differ on this issue. Our working group will ultimately have to agree on what combinations of measures are needed to protect privacy in such situations. Some aspects and consequences of AI’s impact we will probably understand only in a few years,” Rannenberg says.
According to Grigaliūnas, the development of EUDI wallets (digital identity wallets) is also becoming increasingly important, raising new questions about consistent identification and access to data.
AI trends and the risks they bring are undoubtedly among the most important issues, but Schallaböck urges people not to overlook other pressing topics.
“One of them is how to ensure that digital societies genuinely protect individual rights. This becomes more difficult every time a new invention or application emerges. Take platforms such as Bolt, for example: how can we ensure that Bolt does not retain data about where I have travelled over the past few years? Of course, it needs some of this data to provide its service, but I may not want that information to leak,” Schallaböck says.
Helping Strengthen Critical Infrastructure Protection
The 57th meeting of ISO/IEC JTC 1/SC 27/WG 5, the international standardisation working group dealing with identity management and privacy technologies, was held at KTU this year. It was organised by KTU’s Cybersecurity Centre of Excellence together with the Lithuanian Accreditation and Standardisation Agency (LASA).
Important standardisation projects were discussed and developed at the meeting, covering digital identity wallets, AI and privacy protection, ride-hailing services and privacy, privacy and the metaverse, privacy information management systems, information security, age-verification systems, and online privacy notices and consent.
According to Prof. Dr Kai Rannenberg, working in an academic environment makes international standardisation more visible and tangible to both students and researchers.
Rannenberg notes that Lithuania’s historical experience may also be of interest to the international community. It serves as a reminder that freedom is not easily won. “Privacy is essential to preserving freedom. It enables citizens to express their views freely and defend democracy,” he says.
The resilience of systems that safeguard national security is equally important. According to the head of KTU’s Cybersecurity Centre of Excellence, international standards help strengthen the protection of critical infrastructure. “We must protect information systems in line with these requirements and follow the world’s best practices. This would help prevent incidents such as the recent data theft at our Centre of Registers,” Grigaliūnas says.
