On the “Identity Oracle” and Improper Disclosures

I have been following with great interest the thread of discussions about the business concept of “Identity Oracle” and related posts by Bob Blakley, Kim Cameron (here and here), Jeff Bohren and Phil Hunt.

I wondered for a while about business models and business scenarios for “Identity Providers” (e.g. see here and here): the idea of the Identity Oracle can have some good, interesting potential.

However, there is one thing, about the Identity Oracle, that is puzzling me, based on what Bob Blakley wrote in his post:

“… The Identity Oracle charges GiCorp and other relying-party customers money for its services. The asset on the basis of which the Identity Oracle is able to charge money is its database of personal information. Because personal information is its only business asset, the Identity Oracle guards personal information very carefully.
Because disclosing personal information to relying-party customers like GiCorp would be giving away its only asset for free, it strongly resists disclosing personal information to its relying-party customers. In the rare cases in which relying parties need to receive actual personal data (not just metadata) to do their jobs, the Identity Oracle requires its relying-party customers to sign a legally binding contract stating what they are and are not allowed to do with the information. This contract contains indemnity clauses – if GiCorp signs the contract and then misuses or improperly discloses the personal information it receives from the Identity Oracle about Bob, the contract requires GiCorp to pay a large amount of cash money to the Identity Oracle, which then turns around and reimburses Bob for his loss. …”

How are (in practice) improper disclosures of personal data going to be detected? And what would be (in practice) an “improper disclosure”? Some misuse of credit card details? Spamming emails?

I guess that to be a viable business, the Identity Oracle needs to have relationships with many Relying Parties – which themselves might have relationships with other parties. How to track the source of improper leakages/data misuses? Wouldn’t the cost of “forensic analysis” be potentially very high for the Identity Oracle (which I assume it must make the first steps in investigating the incident and in finding the source of improper disclosure)?

Wouldn’t this also be a potential source of frauds against the Identity Oracle, paradoxically generated by some of its own “customers”, trying to get money/compensations back by orchestrating “improper disclosures” and relying on the fact that it will be hard to pinpoint the culprit?

How would the legal framework help the Identity Oracle in these situations? I am afraid this might end-up with very restrictive “terms & condition” imposed by the Identity Oracle (to protect its own interests) that eventually won’t be of any benefit to honest users (the very large majority) in case of genuine identity misuses.

I would be very interested in getting opinions and views about the above aspects.

--- NOTE: my original HP blog can be found here ---