Controlling your (personal) data with a Solid-based data vault is reality

9 min read Original article ↗

Philip Smet

Press enter or click to view image in full size

Data sharing while respecting data privacy is a topic high on the agenda of the EU and worldwide. A multitude of use cases are identified. Two examples are sharing of identity information and sharing of sensitive environmental, social, and corporate governance (ESG) information. Technologies to support these use cases are widespread, but the inventor of the World Wide Web Sir Tim Berners-Lee has developed Solid, short for SOcial LInked Data, as a Web 3.0 or semantic web decentralization project enabling to keep control over your own (personal) data. This concept is now spreading towards Data Spaces.

Figure 1 Solid’s focus

Solid’s central focus is to enable the discovery and sharing of information resulting in true data ownership as well as improved privacy.

Drivers for change

Let us first focus on the drivers for change as set out by the European Data Strategy instead of explaining Solid right away. This Data Strategy intends to make more data available for use in the economy and society (named the “single EU market for data”), while keeping those who generate the data in control in an attractive, secure and dynamic data economy. The BBC beliefs that changing the way to manage personal data has broad public value. Research highlighted that:

  • At least 39 different organisations hold personal data on the average UK citizen.
  • 82% of people are unsure of what personal information companies hold about them.
  • Only 1% of people read the terms & conditions.

Use cases and market initiatives

Knowing the drivers for change, let us dive into some potential use cases that can benefit from this innovative technology, while linking them to a growing number of market initiatives supported by different partners and solutions.

Figure 2 Solid’s Growing Ecosystem @ 2023 (Motius)

In October 2018, Berners-Lee launched a commercial venture based on Solid, named Inrupt. The company’s mission is “to provide commercial energy and an ecosystem to help protect the integrity and quality of the new web built on Solid.”

Datavillage, as one of the first projects, identified three use cases in the financial sector and two in the media, which could also be of interest to our sector. The financial sector use cases are automated cash-back, collaborative anti-money laundry (AML) and environmental, social, and corporate governance (ESG) scoring and benchmarking. The media use cases relates to personalised content discovery (Content Recommendations with Solid at the BBC) and cross media performance and analysis.

Athumi, the Flemish Utility Company, is a neutral public company driving the data economy forward in line the ambition for Flanders to be the first region in the world to widely implement Solid by means of Personal Data Spaces (PDS) or Personal Data Pods. As a business accelerator, they stimulate and facilitate secure data exchange and data collaboration between consumers, companies, authorities, and governments. Their initial focus was on HR and Health data sharing. Randstad and Athumi have implemented a first successful end-to-end HR use case in a Solid production environment under the name “My career”. This solution enables to share e.g. diplomas and pay slips in a journey like depicted in the below application process. The process starts with a published vacancy and ends when the diploma is shared based on consent.

Press enter or click to view image in full size

Figure 3 Application process (SolidCommunity.be)

The health data sharing use case enables secure health information sharing when this information is required to start as an example an insurance contract.

Currently, they are preparing a simplified and digital future for death declaration. The “Digital Death Notification” project is executed together with Flemish cities, municipalities, general practitioners and hospitals, funeral directors and Flemish and federal governments.

The existing Belgian identity authentication app itsme will also use the technology and provide data vaults. Through itsme, users will be able to share information from one of the vaults with a third party (Belga News Agency). For example, in itsme, users can give a car rental company a permission to view their driver’s license at the government. The company can rest assured that the data is reliable, since the citizen identifies himself and therefore no falsification is possible (Trends).

Athumi and itsme have marked a milestone in their joint mission to digitize administrative processes by implementing a solution for the digital student certificate. The solution allows students to retrieve their student certificate digitally from a secure digital vault and share it with third parties through the itsme app. Dibbs, a popular app for students, is the first to make this accessible to its community leading to faster hiring process.

More generic document sharing use cases can also be supported by Graphmetrix TrinApp Documents.

A last use case is the Customer Experience of “Life Moments” at NatWest. They used Solid to improve digital interactions associated with customers’ “life moments,” such as a name change upon marriage, or registering a new business.

The techie’s side of things

Figure 4 Solid’s Data Pods

Most important concepts in Solid are identity, storage and data. It is an open W3C standard based on a set of open interoperable standards, like Linked Data, Resource Description Framework (RDF), Open ID Connect, WebID and others.

In computing, Linked Data is structured data which is interlinked with other data, so it becomes more useful through semantic queries. With Solid, a user stores personal data in “Pods” (personal online data stores, aka data vault). These Pods are hosted on Solid servers in a decentralised way via a Pod Provider or via a self-hosted server.

You can think of Pods as “containers” for data, or even “digital twins” of users. It allows citizens to choose what data they share with others and for how long. Solid supports storing Linked Data in a Pod, which can be any kind of data, from structured data to regular files. People can grant or revoke access to any slice of their data as needed.

Press enter or click to view image in full size

Figure 5 Solid’s Pod and Authentication Architecture (Source)

Solid authentication is built on OpenID connect. Individual resources (aka pieces of data) in the Solid Specification are identified using known vocabularies (aka ontologies) which are written using RDF turtle syntax. This creates a unique URL for each piece of information within a user’s Pod to which ACL’s can be associated (Ippon Tech Blog).

As an example always tells more than thousand words, you can get an idea of how data from a Pod can be consulted via this profile viewer. You get access to the data in the Pod via the WebID, a way to uniquely identify a person, company, organisation, or other agent using a URI. The example uses the WebID https://ruben.verborgh.org/profile/#me, the identifier of Ruben Verborgh, to show his profile.

For those interested, if you want to create your own Pod, this can be done here or via one of these other Pod-providers. I also suggest reading the article Hands on With a Solid Web App from Motius. They state “Linked data is not yet as mature as these other technologies [relational and document databases], and the tools are not yet as sophisticated as what we are accustomed to. So, our initial progress was slow.” They also demonstrate the difference between the JSON and RDF turtle and the corresponding code to get the formatted name of the user in the vCard:

const getName = async () => { 
 const dataset = await getSolidDataset(webId) 
 if (dataset) { 
   const profile = getThing(dataset, webId) 
   if (profile) { 
     return getStringNoLocale(profile, VCARD.fn) || 'Unknown' 
   } 
 } 
 return 'Unknown' 
}

The link to Data Spaces

The Open Data Institute (ODI) has embraced Solid since 17 October 2024 in alignment with the ODI 2023–2028 strategy. The Solid project, protocol, and community became part of ODI’s activities to promote secure, ethical data sharing and build a more transparent, secure, and user-centric data ecosystem.

Web 3.0 Data Space returns ownership of data to the people, organizations, and machines (IoT) that own it, taking it back from platforms (like Uber, Facebook) that hinder transparency and competition. The Post-Platform Foundation (a non-profit organisation), which is behind this concept is collaborating with the International Data Spaces Association (IDSA) and builds upon Solid.

Want to know more?

The community is organising a regular Solid World and is participating in different events. The last Solid World has taken place 14 December 2024. Ruben Verborgh explained how Solid-powered Active Wallets enable innovative ways to share and manage data.

In Belgium and especially in Flanders, we also have the SolidLab Vlaanderen, a consortium of three of Flanders’ universities (UGent, KU Leuven and VUB) led by the strategic research centre IMEC. For more information, check out the Flemish Solid Community, a platform for academia, governments, citizens and industry to collaborate on the development of Solid.

More references to deep dive into this interesting technology:

A closing note

The Personal Data Store ecosystem has taken its first promising steps. Personal Data Stores appear to be worth familiarising with. Next to this, keep investigating use cases, monitoring implementations, and monitoring development of government initiatives in this space driven by the EU Data Strategy.

But we also need to take a critical view on the potential future viability and success. Critics exist at least from two sides. The IT sector states that these types of services shouldn’t be offered by a government, while government offerings will greatly improve user’s trust in the solutions. And users will rightfully argue that they still don’t know what the consumers do with their data once they are granted access.

Solid, now part of ODI, and its ecosystem (including Post-Platform Foundation and IDSA) will continue to mature over the next years and provide opportunities for banks to access qualitive first-hands data, reduce data duplication, improve their customer’s experience, while improving data ownership and data privacy.

Thanks for reading.