The Digital Citizen - An Impossible Ask, or Not?

As citizens, we do not own or control our own data. Governments and corporations restrict access to it, they exploit it, and the fragmented, complex, and brittle digital systems we are forced to interact with, expose it to anyone who can reach it.

Why Don’t We Own Our Data?

The original legal world: one thing, one owner

For most of legal history, property law rested on a simple physical fact: there is one of each thing. One paddock, one horse, one manuscript. Ownership meant exclusion: my having it necessarily means you don’t. If you take it, I have lost it, and the law’s remedies (return of the object, damages) map neatly onto the loss. Scarcity is what makes ownership meaningful, and physical law enforced scarcity automatically.

Printing: the first technology that broke scarcity

The printing press (circa 1450), and later photography (circa 1850), recording (circa 1950) and the photocopier (circa 1960), created a category the old framework couldn’t handle: things where the content could be multiplied infinitely and cheaply while the physical object stayed ordinary.

A printed book exposed the split. The physical object (paper, ink, binding) behaves like any other chattel: I can own it, lend it, resell it. But the text on it can be copied by anyone with a press, and copying it takes nothing away from my copy. No one has been deprived of anything in the classic sense, so the old property remedies have nothing to grip. If a pirate prints 5,000 copies of my book, I still have my manuscript. What’s been taken isn’t a thing; it’s the value of exclusivity, the ability to control who may reproduce the work and charge for it.

Property law simply could not express that injury. You can’t commit trespass against a text.

Copyright: the legal patch

Copyright was the invention that filled the gap. It took the logic of property and redirected it: instead of protecting the object, it protects the act of copying. The Statute of Anne (1710, England) is the conventional starting point, and the logic is:

The creator (not the owner of any particular copy) gets a limited, time-bound exclusive right to reproduce, publish and sell the work.
Everyone else holding a physical copy still owns that copy. The two ownerships coexist: you own your paperback, the author owns the words.
Enforcement targets reproduction, not possession. Nobody sues you for owning a book; they sue you for printing it.

So copyright is best understood as a workaround: when technology made something valuable non-scarce, the law manufactured an artificial scarcity by legal fiat, making “copying” itself the thing you can own and exclude others from.

Why this matters for data

Data sits in exactly the position that printed text occupied in 1710: infinitely copyable, non-rivalrous (infinitely reusable), and valuable precisely in its reproduction. The law had a ready-made template for this situation. But when the “copyable thing” became facts about citizens, the copyright solution was applied selectively:

Creative works got a rights-holder: the author.
Data about you got no rights-holder: the person the data describes was never granted the equivalent of authorship. Instead, whoever collected the data effectively holds the practical power over it, while the individual gets only procedural rights (access, correction, deletion) under privacy laws like the GDPR, Australia’s Privacy Act, or India’s DPDP Act.

The irony is sharp: the law proved it could build ownership rights over non-physical, copyable things, it did so for novels, songs and software, and it even protects databases as compilations in some jurisdictions. The capability was never the barrier. The choice of who counts as the “author” was. For a book, the law says the writer owns it. For your data, the law effectively says the collector does, and you are the subject matter, not the author. That is why the printing press problem was solved completely for creative works and deliberately left unsolved for personal data.

Why we don’t own our data. Each time technology made something copyable, the law built a patch and named a rights-holder (green). For personal data it named no one (red), so the collector holds the power and the person described holds only procedural rights.

The Digital Era Magnifies the Impact of Us Not Owning or Controlling Our Data

On a daily basis we are assaulted with many examples of data theft. For myself, I see that my personal credentials have been identified in, on average, 1 breach per year. I have no control over these breaches, and by design (unique passwords, MFA, layered protection, revocation by us, etc), I am not impacted personally. The global scale of data thefts is staggering; two citizen data examples include: a single breach exposed 272 million US Social Security numbers, while fake accounts stole up to A$850 million from Australia’s tax system. The list grows every week, and as citizens, we are powerless to stop the theft; but modern, layered, disconnected security habits are remarkably resilient. Identity theft is the visible cost of governments built around the form instead of the person, and Estonia shows it does not have to be this way. This story is really a battle between the outdated ‘form’ versus the modern ‘query’.

I have lived this problem from the wrong side of the form so many times. Since the 1990s I have relocated more than 26 times, nationally and internationally, with 12 work visa renewals. In the last five years alone I have lived and worked in the United States, Australia, Belgium and Spain. Each move meant proving who I am again, to agencies that could not see what another already knew. Each renewal was another round of documents, forms and waiting; with my right to work riding on the outcome. Where I lack citizenship my official category is usually “resident alien”; not even a citizen, and not quite a person either. Generally with fewer rights than a locally grown shrub. This is one person’s sample set, but it shows what happens when the form, not the person, is the key.

As a citizen I see little difference between data stolen in a breach, data quietly sold and traded between companies, and data used and exchanged by government departments for reasons nobody explains to me. In all three cases I have almost no control over information about me, no visibility of where it goes, and no ownership of it. The breach is only the case where a hack and exfiltration was exposed publicly. Legally this situation won’t change; but as we are now firmly in the digital era, we all deserve better mechanisms around the use, management and treatment of our data.

This post highlights what is broken in the confidentiality, integrity and availability of citizen data. We provide a simple framework for fixing much of this mess. We compare and contrast the standards that underpin the challenges (from the perspective of the citizen), and we evaluate a dozen countries that demonstrate how fragmented and complex this problem space is (form versus query). The current exemplar is Estonia; the best example of contemporary digital identity and data management we have as of 2026. Estonia treats the citizen as the primary key: one persistent identity, with records pointing to the person rather than copying them. The rest of the world treats the form as the primary key.

A visible cost of this mess is too much complexity in credentials we need to manage (cost to citizens0. It is ‘death by a thousand paper cuts’ in terms of lost productivity and no effective means to answer ‘… what is everyone doing with my data…’. There are many who benefit from this unnecessary complexity (the collectors and those who profit from the collectors). But that is another topic entirely. Here we stay focused on the citizen’s perspective.

The cost of the mess. Measured costs (red), fragmentation (orange) and China’s state-facing efficiency (purple), with Estonia as the bookend.

1. The problem: four questions a citizen asks, and one an expat asks

A citizen asks four things of government. Who owns and controls my data? If my identity is stolen, who protects me and who fixes the record? Why is it all so slow and inefficient? And is government working for me, or for whoever lobbies it hardest? I add a fifth question from my own life: does any of it still work once I cross a border? These same questions apply equally to non government entities; but there is no efficient way to ask them. Other than one by one. Another massive productivity hit. Each of us have hundreds of credentials to manage.

How many keys does a citizen carry? Named government logins and identifiers per jurisdiction, with Estonia as the one-key bookend. Red is a separate login, orange an identifier that is also a secret. The bottom band adds the average person’s other passwords, about 120 personal and 67 work. Public examples, not a census.

Who owns and controls my data?

Australia: whoever holds it. Three years after the Optus and Medibank breaches (Kangeson 2024), the consumer-facing Privacy Act reforms still have no date. Robodebt matched tax and welfare data with no consent, no log the citizen could read and no human check, wrongly accused more than 400,000 people, and was called “a crude and cruel mechanism, neither fair nor legal” by the Royal Commission.
United States: no comprehensive federal privacy law. About twenty states have their own, and the rest is private: credit bureaus and data brokers hold and trade the record, and the citizen is not party to the trade.
China: the 2021 Personal Information Protection Law gives rights to access, correct and delete, then carves out state functions and national security. The exchange log faces the state, and the citizen never initiates the exchange or sees it.
Europe: the GDPR gives the strongest rights of the four, but each is exercised one organisation at a time. There is no single place to ask “what does the state hold about me”, and twenty-seven member states run twenty-seven sets of registers and identity schemes.

If my identity is stolen, who protects me and who fixes the record?

The identity credential is where much of the data leaks, because it is the thing worth stealing. Credential stuffing is the primary attraction. If a threat actor can use those stolen credentials to access a higher value service, then they can access many more systems, legitimately. Non reuse of complex passwords and MFA are key mitigations here. Your data also has value, and this is the unnecessary part of this saga. Your data is useful to a threat actor for; identity fraud, phishing and aggregation. These are much harder to deal with, and a symptom of the overused, obsolete and near impossible to manage ‘form’. If we deprecate the form for the query, like Estonia has demonstrated, we reduce the impact of breaches, improve productivity and build trust in government.

The lived experience exists, for Estonia and Australia. We have a direct comparison between the query and the form.

Estonia has faced ongoing nation state attacks but has survived because they have:

No centralised honeypot
Data minimisation and a write once - read many (WORM) policy
Radical transparency as containment
Recoverability over presentation
Institutionalised learning loop

Australia has also faced similar, but less relentless, targeting. The impact has been more significant because they have:

Centralised honeypots
No data minimisation or WORM
No citizen visibility
Governance lag

I am continually reminded of this analogy ‘… auditors read documentation, while adversaries read code - the gaps are exploitable …’

The paper form came first, and it had protections nobody designed. Before the digital era, it was hard to copy, it lived in one filing cabinet, and stealing it meant being in the room. Digitising the form kept its layout and its habit of carrying every detail about a person. It threw away those protections and never adopted the digital-first ones that should have replaced them: a public identifier, a replaceable credential, a query instead of a copy. The result is a record so easy to steal, copy and scrape that any adversary slightly smarter than the technology, process or entity holding it has an easy target.

Western Australia: a stolen driver’s licence number cannot be changed. Decades ago a state system was built with an unfixable one-to-one link between a person and their licence number. Other systems have since copied that design and now depend on it.
United States: replacing a stolen Social Security number is a last resort that severs the person’s credit history. Javelin put identity fraud losses at $27.3 billion in 2025 across 18 million victims, just in the United States.
Australia: more than A$557 million was claimed through fake myGov accounts linked to real taxpayers’ files, a figure the Tax Office later put at A$850 million (Office of the Commonwealth Ombudsman 2024).

Why is it so slow and inefficient?

The common cause is the artifact: every certificate, printout and proof of address needs a system to produce, store, check and secure it, and a vendor to run it. Government supply chains institutionalise duplication, fragmentation and built-in obsolescence in these ’not fit for purpose’ systems. The cost is staggering:

United States: about 12 billion hours of federal paperwork a year, roughly $430 billion.
Estonia: once-only is the law, more than 900 institutions connect through X-Road, and the state reports saving 2,589 working years in 2024.
China: 890 million registered users on the national services platform by 2024, and licensing took over 40 per cent less time.
Australia: over roughly a decade, failed or troubled federal identity and data systems (digital ID/myGovID, Robodebt, visa processing and border systems, the 2016 online Census, My Health Record and NDIS systems) have cost an estimated AU$6.0–6.5 billion in one-off outlays (Australian National Audit Office 2024; Harding et al. 2017), plus about AU$350 million a year to run My Health Record. That is roughly AU$6.4–6.9 billion including one year of running cost. But much of Australia’s systems are online and more productive than the legacy face to face visit. Access is improving year by year, but productivity, security and consolidation is not.

How does Government think about Citizen Data?

United States: the federal privacy fight is over whether a federal law should override stronger state laws, which industry wants and California opposes.
Europe: the Digital Omnibus proposed in November 2025 would loosen parts of the GDPR, and a LobbyControl analysis found seven of its eight main changes track positions of large technology companies, whose EU lobbying it put at about €151 million a year.
China: the state is the interested party, and its log faces the state.
Estonia: every query is signed, tied to a purpose and logged where the citizen can see it.

That visibility is what lobbying and state interest both have to get past. I want to own my data, control who accesses it, and trace what it is used for. I’m ok with Google and Facebook providing valuable services for free, where my data that I share with them is monetised for advertising and service improvement. Where I have issues is being forced to hand over unnecessary amounts of my data to government and commercial entities that deliver low value services and then subject me to spam, unwarranted marketing and an increase in information overload - and much of this indistinguishable from identity fraud, phishing and aggregation. Many government and commercial services have poor user interfaces, unknown vendor branding and weblinks that are unfamiliar. I can’t identity what is legitimate or fraudulent in email, in the post or via the telephone.

Does any of it work once I leave one country for another?

When we need to work and travel outside of our national borders the scope and scale of the problem magnifies; and it is the wall I hit most often, as an expat and traveller. A digital credential is almost always bound to residence, not to the person. It is:

attached by a letter to a domestic address, or in person;
proven with domestic documents;
unlocked by a code sent to a domestic mobile number;
delivered through one or several apps in the national app store;
and sometimes served from a site that refuses foreign IP addresses, refuses my mobile number, or is built on technology that does not work outside the country.

Leave one country and the credential decays one dependency at a time. The SIM lapses, the card is cancelled with the residence permit, the app will not install, and the fallback is a phone queue in another time zone, or a number inaccessible from overseas, or a letter to an address you no longer have.

The digital nomad is the canonical edge case, and I have been one, many times. Living on a sailboat in the United States and in Spain, I had no land address. The application asked for one before I knew where I would be berthed. I could not give the true address, because a marina berth changes as often as weekly and each change would have sent my work visa back to the start, with months of waiting outside the country. In the United States I used a mailing-service address, which the government does not recognise but accepts. In Spain a one-person local rural office converted the marina into a form-compliant address, while the large Barcelona offices had no answer at all.

The obligations do not leave with you. A final tax return, a pension record, a bank demanding fresh proof of who you are: all sit behind the credential that just died, and banks and employers copy the pattern because they anchor on the same documents and phone number. Inside the EU, mutual recognition of national eIDs has been law since 2018, yet most services still want their own country’s login. Estonia, once more the exception, has issued its state credential through e-Residency to more than 140,000 people who have never lived there, because it is bound to the person and the issuer, not to an address.

Four places, four legal systems, one gap: none of it travels.

2. The comparison: one model, twelve countries

The data reference model I include here has eleven parts. A citizen holds a credential issued by an identity provider, grants consent, and can delegate a mandate. A service that needs information sends a query to the one registry that is the authoritative source, rather than demanding a document. Every query writes an audit record the citizen can read. The citizen is the primary key, and every other box points to them. Two boxes carry the risk. The artifact (the ‘form’ that is at the root of this problem space) is there to be removed, because a service that asks the source never needs to create it (the WORM principle). The credential is where the data leaks, so it should be issued once, replaceable when stolen, and bound to the person rather than to an address. The credential is seriously broken almost everywhere, and this is the easy fix: strong unique passwords and MFA.

The data reference model: the citizen (blue) as primary key, the artifact (red) to be displaced, and the identity credential (orange) where the data leaks. The dashed box is today’s credential: one number copied into everything, which is what makes it worth stealing.

Rated against the model

I rated each entity of the framework for twelve countries from the citizen’s standpoint: green (works, answers to the citizen) scores two, yellow (partial, or answers to a regulator) one, and red (missing, or answers only to the state) zero, for a maximum of 22. A published rule sorts the scores into groups. The ratings are my judgment from public sources.

The same shape coloured per country, from the citizen’s standpoint. Green works and answers to the citizen, yellow is partial or answers to a regulator, red is missing or answers only to the state.

Five groups

Citizen-facing: Estonia (21), Singapore (19), Denmark (18), Ukraine (15). The paperwork is gone, and the log, the consent or the data location answers to the person. Singpass reaches about 1,700 services, Denmark’s MitID covers 96.6 per cent of adults, and Ukraine’s Diia kept working through an invasion. Even Estonia has a soft spot: consent is a legal basis built into each query, not something a citizen grants and revokes.

State-facing: China (10). Efficiency is high and protection is zero. Benefits are pushed without a request, but the access log faces the state. It is Estonia’s machine, pointed the other way.

Identity built, fabric missing: Belgium (14), India (13), Spain (12). Strong logins, but nothing that forces one government to answer another’s queries, so paper returns at every boundary. I have lived in two of the three, and the research matches the experience. India made the most original contribution on consent: a machine-readable, revocable, time-limited object the citizen issues.

Tools bought, grammar unbuilt: Germany (10), United Kingdom (5). Germany has a high-assurance eID on every identity card that barely gets used. The United Kingdom has a well-known front end with no population register or governed exchange behind it.

Document bureaucracy: Australia (2), United States (1). No national identifier, no authoritative registries, no exchange. A card serial number does the work of a person identifier, and leaks accordingly.

Efficient is not the same as accountable. Efficiency (is the paperwork gone?) against protection (does the machine answer to the citizen?). Each axis is the mean rating of the parts that drive it.

What the quadrant says

Efficiency and protection are not a trade-off, and the top right is occupied. What every green panel shares is mandate power: a legal duty on agencies to answer the query and stop asking for the form. Denmark needed twenty-five years of binding joint strategies to get there. Asking for the form generates the time tax; guessing who someone is generates the fraud and the harm. We need to measure the inefficiencies and then legislate away from legacy supply chains, technologies and architectures.

3. No single global fix is coming. What can be improved now?

A global design is the obvious answer and probably unattainable. The United Nations has not made this a priority, and more than 200 countries each want to own their own citizens. Twenty-seven EU states cannot yet agree on one wallet, the United States cannot agree whether federal law should override its states, and China’s design serves a different purpose. The pragmatic question is what one country, agency or builder can do alone, using what exists.

Close the gap in the model: four record shapes

Tested against eight questions a citizen, a service or a regulator would ask, the model above answered one: who has the right to ask. Not who looked at what, under which agreement, or what a withdrawal cancelled. Four record shapes close the gap. None needs new technology; each is a decision about what to write down.

The four record shapes, with today’s attack and theft vectors (red, numbered) and how the citizen-centric model mitigates each (blue).

A permanent record of every grant and withdrawal of consent. Today consent is a yes or no flag, so when it stopped, and what that should have invalidated, cannot be shown. An append-only history makes each grant, change, withdrawal or expiry a dated entry, and decisions carry the consent version they relied on. A stale cache serving a revoked permission becomes detectable, and a purpose that quietly widens is not consent without a fresh grant.

Consent as a lifecycle, with the attack vector at each state and its fix. A superseded consent is not a grant for the new purpose.

A record of every authorization decision. One entry per query, never edited, with the consent version, policy version, mandate and outcome. “What ran without valid consent?” becomes a filter on one table.

An access log tied to the person, not the service. If each entry carries the citizen directly, “who looked at my data” is a lookup, not a reconstruction. Estonia’s log faces the subject; most do not.

A link from each person to everywhere the state holds data about them. A pointer, never a copy, so “show me everything you hold about me” is answerable. It is also a map of everything held about everyone, so it must hold references not values, readable only by the person, their delegates and an auditor.

Use what the standards already give you

The obvious objection is that this needs a standard. Most of it already exists. Where data crosses a boundary there are open standards:

W3C Verifiable Credentials 2.0 for the credential, including revocation lists;
ISO/IEC TS 27560 and the Kantara consent receipt for the consent record;
OAuth rich authorization requests (RFC 9396) for what a request asks for;
health-sector audit event formats for the access log.

The identity and metadata standards give field lists, not the rule: what a person record holds, not that the identifier is public and never a secret. Mostly our governments are stuck with standards that describe symptoms that can be architected away. Australia’s Essential Eight is a prime example: a government-mandated cyber framework built around incident-response symptoms in the style of the 1990s, not a causal analysis. It gives little weight to confidentiality, the most important topic for citizens and their data.

Estonia beside the standards, on the same shape. Estonia is green where the standards are yellow.

The standards supply the shape. Estonia supplied the rule and the law behind it. What remains is policy, not format: naming the authoritative registry for each element, the citizen’s own record, and who may be an identity provider. Ideally my government is the identity provider, running modern, open-source, distributed systems rather than decades-old legacy software.

This is also where the complaint I opened with lands. Today a thief, a data broker and a government agency hold my data on the same terms: I did not see it move, and I cannot make anyone answer for it. The four records do not stop the holding. They make every use of my data something I can see and something a named party has to justify, in formats no country has to invent. Control, visibility and ownership stop depending on who got caught. The CIA triad defines what is needed: confidentiality, integrity and availability, at national scale and aligned to open standards.

A pragmatic order of work

Not every country can build Estonia. Each step stands alone, costs far less than a platform, and answers one of the questions.

Stop creating new artifacts; the poorly structured digital forms that exist everywhere. Every new service must ask the source, not demand a form. This is a policy decision, not a build.
Treat the identifier as public and the credential as replaceable and portable, so a stolen credential is reissued without severing the person’s history, and a working one does not die at the border.
Give the citizen the log. It is the cheapest piece and the one that most changes the relationship.
Record consent as history and delegation as a mandate, so “who permitted this” is a lookup, not an argument.
Make one registry authoritative for one data element, mandate it, then repeat. The unit of progress is one once-only use case, not a platform.

All five depend on someone with the power to mandate, which is why they are hardest where the state benefits from the opposite. Doing this requires open-source cryptography, open architecture and open data, all of which are the antithesis of most government procurement norms. Compatibility between countries comes from reusing the same open formats at the border, not from agreeing a single technology design or vendor solution first.

What to take away

The citizen is the primary key. China and Estonia both removed the paperwork, so efficiency is not what separates them. What differs is whether the log faces the citizen or the government. Where the form stays the key, you get the time tax and the harm. And the moment you move, you get neither the service nor the protection.

Four record shapes turn a diagram into something a citizen can hold the state to. None requires a breakthrough, only a decision to write them down. The standards cover the plumbing; each country still has to publish the rules.

The ratings are my judgment from public sources, weakest for the United Kingdom, Germany and Ukraine. If you work in one of these countries and think a rating is wrong, tell me where. And if you have carried a government credential across a border and it kept working, I would especially like to hear which one.

References

Australian National Audit Office. 2024. Procurement of My Health Record. Australian National Audit Office. http://www.anao.gov.au.

Harding, Sandra, Lisa Jackson Pulver AM, Peter McDonald AM, Peter Morrison, Dennis Trewin AO, and Anton Voss. 2017. Report on the Quality of 2016 Census Data. Census Independent Assurance Panel to the Australian Statistician.

Kangeson, Gowri. 2024. “Australian Information Commissioner v Medibank Private Limited Concise Statement.” Australian Information Commissioner, June 5.

Office of the Commonwealth Ombudsman. 2024. Keeping myGov Secure: An Investigation into Services Australia’s Response to myGov Fraud Arising from Unauthorised Linking to Member Service Accounts. Office of the Commonwealth Ombudsman.

Also published on LinkedIn.