Person Centred Services for Citizens in Scotland

Scottish Government Data Vision for Scotland


The Data Management Board proposes a Data Vision for Scotland in 2020 where:

Data are used to support the delivery of outstanding public services.

Citizens feel confident that personal data are being shared responsibly to create better and more responsive services which meet their individual needs.

Citizens readily know how to and can access personal information held about them, allowing them to confirm accuracy and to choose if they wish to create their own personal data store.



The Person-centred Ecosystem

A wide range of personal/customer/citizen services require the input of data from multiple providers. The way customer/personal data is currently organised and managed – by separate organisations each in its own silo – works against providing truly ‘joined up’ services. It is often difficult, expensive and time consuming to combine multiple sets of information to provide services in this ‘joined-up’, unified way.

This problem can be solved via a citizen/person-centric approach, working with organisations. Each individual holds their own data in a personal data store where they can provide organisations with permissioned access to this data as and when it is needed.

But a personal data store in isolation is not enough. To work effectively it needs a surrounding personal data ecosystem which enables the data to be managed and shared by the individual.

This includes three interoperable layers contributing different functions:

▪ an independent identity layer where individuals can access services online using an

identity credential that can be supplied with the required amount of information (from

the data management layer below) to qualify the individual to access that service

▪ an independent communications layer enabling secure transmission of data – an open

internet with the addition of secure encryption that’s not reliant on proprietary


▪ a data management layer that enables individuals to collect and curate their own data and to share this data under their own control. This includes a consent management layer giving individuals simple, easy, ‘one-stop-shop’ tools to manage all their consents in one place (and not one by one for each different organisation or transaction). This data sharing and consent management layer is what is needed to interact with the different models for data storage, access and the underlying public sector and commercial models that go with them.

There are many challenges in developing a workable personal data ecosystem, many of them arising from the diversity of different types of data that can be created, collected and shared. But the potential benefits of a thriving, functioning personal data ecosystem are too great to ignore.

These include significant reductions in cost (through the elimination of duplication, human error and the need for evidence provided via physical channels), improvements in data quality and security leading to better quality services and reduced risk, along with much higher levels of trust.

The personal data ecosystem is effectively a platform for innovation, enabling the creation of many new services adding value for both individuals and organisations and driving economic growth.

Data Delivery and Collection / Data Sharing - Person centred services and trusted, person centred data attribute exchange as opposed to offering individuals portals or data sharing solutions controlled by the organisations. In most cases client organisations would seek to
connect systems to our platform for the delivery and collection of
data. We provide individuals with a Personal Data Store which is totally
under their control. This also comes with the ability for individuals to
make connections to organisations using our API services layer to collect,
deliver verified and unverified data across any aspect of their life with
organisations who are verified themselves and connected to the Mydex Trust
Framework and Platform.

Why the contribution is important

Architecture of collaboration – person centred services

  • Organisations e.g. Local Authority / NHS / Third Sector provide the front end user experience
  • Mydex is a set of back end components for identity services, data and consent.  We deliver everything through API’s, and call them application components as a service ( ACaaS ).  For us it is about independent layers and interoperability.
  • Mydex is a platform for attribute exchange and data sharing. Individuals can collect, receive and store data about any aspect of their life and share with anyone they wish. Individuals can feed in, store and curate well being data in their personal data store, or local authorities and third sector organisations can send and access permissioned data in a PDS which XX /  Client as a front end can access and use in the citizen journeys it manages.

Technical / Functional

  • How does the Mydex Platform work - open standards, open API's, interoperable, wrapped up in a trust framework to ensure clear terms and conditions for participants
  • What features do Mydex offer 3 Services - Identity, Data and Consent services to underpin your services.     Individuals get a personal data store, a portable privacy friendly MydexID that supports multiple identity protocols, a set of tools and utilities to help manage their life


  • What is the range of scope of data that can be held in a personal data store - Extensive, please see our Schema information
  • How does consent management work to access and use data - API driven using data sharing agreements. See an example in our simulations and video it is based on informed consent and privacy by design
  • How is data delivered - via connection API's using open standards
  • How is data verified - using cryptographic means that ensures authenticity in transit and storage
  • Can data held in personal data stores feed into big data - Yes, with explicit consent of the individual
  • How can PDS-held data underpin Apps you want to develop so we take the processing to the data not the other way around -  using the APIs we offer, your apps just need to focus on the value add they want to offer, we do the identity, data and consent layers for you fully certified


  • What does Zero knowledge platform mean - Mydex CIC has no access to or rights to any of the personal data individuals collect, or share. It is end to end encryption, neutral layer.
  • How secure is it - please see our security model
  • What external certifications do you have - ISO27001 certified, Fair Data, tScheme and a long list of associations and memberships, we are contributor to many communities
  • Where is the data stored - In the UK, in Data Centre, each personal data store is individual and uniquely encrypted using a Private Encryption Key only the individual knows
  • How can you reduce the risk of cyber threats to our online systems and increase protection of customer data - by allowing you to protect your systems and not expose them to the internet, you distribute and collect all personal data from the personal data store over encrypted channels and your portals and apps run directly against the customer's personal data store, no exposure of large customer systems to the outside world

Customer Journeys and use cases

Set up and activation


What is PDS video -


Application Components as a Service for Identity, Personal Data (collection, storage, and
distribution) and consent management. These are part of what is being called
the Personal Data Ecosystem, or Personal Information Economy in the private
sector. Mydex is constituted as a community interest company, asset locked
and committed to ensuring individuals are able to be active participants in
managing their own lives and the data that underpins it and how that data
is being used.

In the context of Health and Social Care we enable local clusters of
organisations serving the same cohort of individuals to streamline their
customer journeys and experiences and address the challenges of secure data
sharing between organisations using a person centred approach.

by AlexStobart on November 21, 2016 at 03:57PM

Current Rating

Average score : 3.0
Based on : 2 votes


  • Posted by sroebuck November 21, 2016 at 20:39

    I was not aware of MyDex until I read this idea now, but the idea of what I call a "citizen data vault" and you refer to as a "personal data store" seems to me to be a very powerful way of addressing a lot of the issues of digital transformation and Scotland would be well suited to take this idea forward.

    I was keen to put forward an idea like this but without the practical exemplar I felt that the task of persuading Government of the central importance and practicality of the idea was going to be challenging and probably fruitless. With MyDex it seems that a lot of groundwork has already been done.

    For years the public sector has been trying to cut costs by data sharing between systems and trying to establish complex legal agreements to share data that is fundamentally data about individuals. In Estonia they have made the significant step of saying that data about an individual is owned by them and that any piece of data should not be duplicated. However, their technical model still involves sharing data grouped by function into traditional large SQL database systems. The personal data store is the next step in this journey and a step that sidesteps some of the social and organisational complexities of data sharing that are getting in the way of user focused innovation.

    I thoroughly endorse this idea and very much hope that the Scottish government will have the courage to embrace it.
  • Posted by joecar December 02, 2016 at 14:34

    This system works but requires system level cooperation around data sharing - blockchain and some other technologies would support Estonian for Scotland too
  • Posted by StuartLaw December 06, 2016 at 14:48

    Hi Alex

    Many thanks for submitting the background to personal data stores. We have found it very helpful discussing this with you and hope to continue engagement into 2017. Best wishes for the forthcoming festive season.

    Kind regards

    Stuart Law
  • Posted by KBG December 14, 2016 at 17:11

    Several ideas put forward in the forum have related to data sharing and it is certainly one worth investigating along with the various solutions put forward on the forum.
    As an IT project it would certainly keep people in business, and/or government, occupied for a good while and perhaps could be compared with the NHS database mergers for complexity and success.
Log in or register to add comments and rate ideas