Nomidio: Sensitive information of average Brit owned by 39 organisations

By Sunniva Kolostyak

At least 39 separate businesses, charities and public sector organisations hold the Personally Identifiable Information (PII) of the average UK consumer, an analysis by digital identity specialist Nomidio has found.

According to Nomidio’s State of Identity 2020 Analysis, which was undertaken by Opinium, a quarter of consumers in the UK have no idea how many organisations hold their personal information – a number which is found to be at least 39.

The number of organisations holding sensitive information is only likely to increase as lockdown measures are pushing an additional 3.5 million people to use digital services for the first time.

Furthermore, the increased move to digital services coincides with a proliferation of large-scale data hacks.

Ben Todd, VP of Worldwide Sales at Nomidio, said the situation is completely back to front, as it is the individual that should be able to present their identity to the different organisations they choose to interact with.

“Why are we issued with a new digital identity every time we register with a new service provider?”

Todd continued: “Every time we allow a business to store our date of birth or mother’s maiden name, we’re expanding the attack surface and making it more likely our personal credentials will be lost forever. We need to centralise people’s identities, encrypt them and then give individuals the power to decide which organisations their data is shared with.”

The analysis noted that the public has become desensitised to major data breaches, which have increased by 67 per cent overall since 2014. Moreover, major hacks often stay hidden for several months, and the average time to identify a breach in 2019 was 206 days.

More than half of the UK population (53 per cent) are using the same password to access multiple services. This means that every time a password is compromised there may be 39 separate opportunities for hackers to benefit. Even companies with comparatively strong security protocols are left exposed to this type of ‘credential stuffing’ attack.

Data hacks have also become more sophisticated while company defence against them are lagging. In fact, 77 per cent of the survey respondents ‘feel vulnerable’ about multiple organisations holding their data. Even the introduction of GDPR has not brought about the necessary mindset shift with Nomidio’s research highlighting the need for an altogether new approach to digital identity.

Todd added: “Our own approach is significantly different to the norm. We believe in a ‘Unified Identity’; one that stores personal data on behalf of the individual and allows them to manage which companies get access to that data. This neutral data Guardian is held to account by a cryptographically executed and provable consent mechanism, which is based on over a decade of cryptographic R&D work to secure the world’s internet from the threat posed by quantum computers.”