PHACKS | Functional Requirements

Here are some of the functional requirements that have already been highlighted by individual organisations, which could be piloted collaboratively within PHACKS. More requirements are expected to emerge.

Address verification

Verifying a claimed postal address is a challenge for all organisations in industry and government. Keeping an address up-to-date is another challenge. Depending on the country, there may be no single legally authoritative source for addresses, although many may have several corroborative sources of varying data quality. Throughout Europe, the most authoritative data tends to be from electricity providers because, unlike telecommunications, their metering systems are physically connected to buildings and they can see the status of every meter connection and the associated bill payer. For companies and consumers, that gives physical and virtual visibility of almost every powered building in a country. As a result, electrical companies are becoming the authoritative source (either defined in law or agreed in the market) for address data in most EU countries. Sedicii has been working to help countries capitalise on this data, but to do so safely and compliant with GDPR.

ESB Networks (ESBN) is a national level, authoritative source for address information in Ireland. ESBN holds the address data for every single building that uses mains electricity from the national electricity grid. ESBN requires that no external party can access this address data from their systems. However, ESBN did agree to become the authoritative source for other regulated parties to validate their customer and citizen address data, but only when using an appropriate and approved Privacy Enhancing Technology. Sedicii’s ZKP platform and technology meet that requirement and the resulting service has been approved by the Irish Data Protection Commissioner.

Using Sedicii’s ZKP technology, ESBN can help others comply with regulations whilst providing added value and benefits to the consumer, resident and citizen, by reducing friction in their interactions around proving their residential and company address data and making it safer and more secure.

Key questions asked in the ESBN address verification include:

Does the claimed address exist?
Is it true that the person claiming to live at that address is the bill payer or can otherwise be linked to that address?
Is the person who they say they are?

Sedicii is leveraging this operational address verification capability by:

Engaging major industry sectors and government in Ireland, who have already expressed strong interest in using the ESBN service provided by Sedicii.
Supporting organisations in their implementation planning.
Starting to engage with similar organisations outside Ireland that need to verify claimed address data in Ireland.
Starting to engage with organisations in Ireland that want to verify claimed addresses in other EU countries, using the same privacy preserving approach. These use cases are primarily cross-border with the EU.

Examples: [house number], [house name], [street name], [town], [post code]

Age verification

There are many regulatory and practical requirements to verify the age of a person or an age claimed by a person, in both physical and online or digital situations. The requirements can be to verify that a person is an exact age, is over an age or under an age.

This seems a relatively simple task, but in reality, it can be highly complicated because current practices on age verification (AV) are easy to spoof or bypass, resulting in a big rise in regulatory violations, financial abuse, social media harms and international concerns. Hence, there is a growing demand for trusted, certified AV services.

GDPR requires the minimum disclosure or exposure of personal information, sufficient to meet the business purpose of the interaction. In some cases, the organisation or Relying Party that is providing a service to the customer, already has other personal information, such as their name and address, which can be verified also. However, in other cases, such as entering a nightclub or buying an age-controlled product such as a knife or tobacco, the relying party is only required to prove that the person is over an age, such as 18 years – they have no right to know a person’s name or address.

In this latter case, the relying party somehow needs to know that the person claiming to be over 18, or whatever, is the person that they claim to be and that the “over 18” is true. This involves some trusted organisation proving the “binding” between the claimed identity, the verified age of the person and the relevant human being. It also requires a proof somewhere that the claimed identity (the data) exists in an authoritative source and is valid today (the person hasn’t died), or that it isn’t fake (also known as synthetic ID) or identified as stolen.

New AV solutions are emerging, but none can yet meet AV requirements in all situations in a privacy preserving manner. Privacy experts involved in the development of international standards for AV recognise that privacy preserving technologies, such as ZKP, are necessary in solutions to increasingly demanding AV situations. As part of the project Sedicii seeks to pilot at least one.

Sedicii is a member of the Age Verification Providers Association (AVPA), which participates in development of ISO standards for age verification.

Examples: [over13], [over 16], [over18], [over 21], [over60], [over65], [over80], [under13], [under55], [under60].

TCP IP address verification

Knowing the original TCP IP address for a device, and sometimes the routing TCP IP address information, can be essential for the detection, prevention and successful prosecution of an illegal cross-border or national interaction, or some other criminal activity, such as the viewing or sharing of child pornography. Readily available Virtual Private Networks (VPN)s are increasingly used to facilitate

Location verification

It is not always possible to verify the address for a person or even to confirm that an address really exists, often because the quality of the data isn’t sufficient. In such situations, it is often possible to verify a person-related static or a real-time location using Lat-Long or a grid system such as Universal Transverse Mercator (UTM) or What3Words. However, authoritative sources for such information may require the use of privacy preserving technology to allow such information to be verified.

How to Participate in PHACKS

If you are inerested in getting involved, please visit our How to Participate page or Contact Us.

Table of Contents