The privacy-first solution for personal identification in a digital world

You probably recognize it when you order something online; You create an account with a webshop and check all boxes: yes I agree with the terms and conditions, yes I am over 18 years old. Then click on agree and you can order. But who guarantees the merchant that everything is correct and that an account has not been created with fraudulent data? With the growth of identity fraud and the arrival of the GDPR in 2018, it is becoming increasingly complex to identify people in a "Business to Consumer" world. Whereas in the past you still physically went to a counter with your passport or driver's license, this is now done for 90% digitally. This creates a complex challenge. A challenge that the CIS Foundation (Central Information System) has taken up in collaboration with AMIS Conclusion.

CIS is an organisation of and for insurers and their authorised agents. An important role of CIS is to manage the collective memory of the insurance market with regard to claims and fraud registration.

The GDPR requires that only relevant data of a person be processed. For the insurance world, this means that the personal number (BSN), which is unique in the Netherlands, may not be used and therefore not registered. This presents a challenge. From the moment you as a consumer want to request data from a data processor, they may only provide your data to you. To ensure that the data processor shares the data with the right person, the consumer is usually asked to send an identifying data by post or e-mail. Think of a copy of an identification document where of course the BSN number must be made unrecognizable. There is a lot involved in manually checking and safeguarding this identifying data.

What if we automate this process and let the consumer perform the entire retrieval including identification via an app or website, without the need to manually assess the identifying data? Something like DigiD, but available to non-government institutions.

To answer this question, CIS started working on the inspection process and the way in which it should take shape. Yivi (formerly known as IRMA) has been chosen.

The Privacy by Design Foundation has developed the Yivi identity platform together with SIDN. Yivi stands for "Your digital life" and is pronounced Yivi. Yivi is the digital wallet for your identity data where on the one hand the consumer can reliably determine which personal data he wants to share with the "digital merchant" and where on the other hand the merchant can check the shared personal data for accuracy.

The process

For Stichting CIS, it is important that the consumer identifies himself with his name, address, place of residence and date of birth (NAWG details). This data is also called the attributes. If the consumer wants to request access to CIS, he can log in via the Yivi app and make himself known by sharing the attributes that are required. The Yivi server, which is located within the application landscape of CIS, then checks and handles the identification without storing any data. The identification is possible without the use of BSN and with the same reliability as DigiD. This allows the inspection process at CIS to be handled automatically and it is no longer necessary to send copies of driving licences or passports. The processing of the inspection can continue immediately. The consumer has faster information and the time-consuming work of checking, storing identifying data and manually processing the request for access is accelerated. A win-win situation for all parties involved.

The Yivi app is widely applicable. Any situation where digital identification is required, Yivi can be deployed within the application landscape.