Each proposed pilot focuses on a single jurisdiction and class of transaction, with a closed group of participants large enough to test whether the technical architecture, institutional model, market mechanisms and regulatory treatment can work together in practice. The pilots follow a common framework to allow meaningful comparison of their results, while building on the existing capabilities and arrangements of each jurisdiction.
A bounded demonstrator of regulated personal-data intermediation: one sector, one class of transaction, and a closed initial ecosystem of individuals, data providers and relying organisations assembled for the purpose. The aim is to determine whether Scotland can serve as an incubator for a new regulated data-infrastructure model.
Can Scotland demonstrate, in one carefully selected domain, that valuable decisions can be made using personal data without requiring the organisations making those decisions to possess the underlying personal record?
A bounded demonstrator built on infrastructure Estonia already operates: X-Road, strong electronic identity, the consent service and the Data Tracker. One transfer of state-held data to private companies is replaced by a query to a licensed custodian of the person's choosing, with credit affordability as the lead use case.
Can Estonia demonstrate, on infrastructure it already operates, that a lender can make a lawful credit decision based on an answer instead of a record, where the record is held by an independent custodian that the prospective borrower chose and can change?
A bounded demonstrator under laws Vermont has already enacted: a licence for personal-data custodians with a fiduciary duty, a statutory standard of proportionate collection, and rules on privacy-minded age assurance. Age checks are answered by a licensed custodian of the person's choosing instead of an identity document.
Can Vermont demonstrate, under laws it has already enacted, that a business can establish a person's age from a one-bit answer instead of an identity document, where the record is held by an independent custodian, licensed by the state, that the person chose and can change?
All three pilots are judged against the same four questions. The constituent technologies largely exist, so the more difficult questions are institutional and economic.
Can a Databank derive and release useful information while preventing disclosure of the data underneath it?
Can an independent custodian hold a credible structural separation between custody and exploitation?
Will individuals use such an intermediary, and will organisations accept a constrained output in place of the raw information?
Can Databank outputs, controls and accountability mechanisms be made robust enough to be treated as trustworthy?
All three pilots model the same ecosystem, with explicit responsibilities and liability boundaries between its participants.
Regulators and independent auditors sit above these four as a governance layer.
Nine research questions run through all three proposals: query leakage, computation scrutiny, correctness and provenance, identity binding, liability and dispute resolution, coercive authorisation, concentration and resilience, interoperability and portability, and economic sustainability. The Estonian proposal adds a tenth, audit visibility, which the Data Tracker makes measurable, and the Vermont proposal adds fiduciary custody, which Vermont's licence for personal information protection companies makes testable. Several are open research strands in their own right.
All three start from a closed initial ecosystem rather than a public launch, and proceed through the same five phases, from scoping and consortium formation to an evidence-based expansion decision. All are judged by the same three propositions: individuals entrust the data to the custodian, relying organisations accept the minimal output instead of the record, and the custodian is economically sustainable while remaining independent of commercial exploitation of what it holds.
The Scottish pilot assembles a closed network inside UK law. The Estonian pilot adds the custodial layer to infrastructure Estonia already runs, inside EU law, and concentrates on the parts of the model that no existing system tests. The Vermont pilot uses a custodian licence already in state statute, under new state privacy laws and in the absence of a general federal privacy statute.
| Scotland | Estonia | Vermont | |
|---|---|---|---|
| Legal setting | UK law | EU law, including the GDPR, the Data Governance Act, the European Digital Identity framework and the Consumer Credit Directive | Vermont law, including the licence for personal information protection companies, the Data Privacy and Online Surveillance Act and the Age-Appropriate Design Code, with no general federal privacy statute |
| Starting point | A closed initial network of individuals, data providers and relying organisations, assembled for the pilot | Infrastructure already in production: X-Road, strong electronic identity, the consent service and the Data Tracker | A custodian licence in statute since 2018, and new privacy laws taking effect in 2027 and 2028 |
| What the pilot adds | The ecosystem as a whole: the custodian, and agreements with the data providers and relying organisations that use it | An independent custodian, competition between two custodians, account portability and the person's share of each access fee | The Databanking conditions on a licensed custodian, competition between two custodians, account portability and the person's share of each access fee |
| Custodians | One Databank, with multiple interoperable Databanks as the longer-term direction | Two Databanks from the start, so that choice and switching can be observed | Two Databanks from the start, each licensed by the Department of Financial Regulation |
| Lead use case | Selected jointly with participants; candidates include age and identity verification, financial eligibility, professional credentials and health information | Affordability for consumer credit, using Tax and Customs Board income records | Age assurance, with 21 or over as the running example, using motor vehicle records |
| Emphasis | All four forms of viability at once | Institutional and market viability, since existing infrastructure settles most of the technical question | Institutional, market and regulatory viability, under statutes already enacted |
| Audit visibility | An audit framework designed within the pilot | Every query shown to the person on eesti.ee through the Data Tracker | Every query shown on the person's account statement |
| What it would take to start | A small interdisciplinary group to identify the strongest Scottish use case and the institutional and funding structure | A scoping meeting with the Estonian authorities, access to the X-Road test environment and the Data Tracker, a supervisory contact, and four requests of the European Commission | A scoping meeting with the Vermont authorities, licence applications to the Department of Financial Regulation, an Attorney General's Office contact on age assurance, verification by the Department of Motor Vehicles, and a briefing for the legislative committees |
Further pilot proposals will be listed here as they are prepared. The model itself is set out in the Databanking whitepaper, and the FAQ addresses the objections it most often meets. Enquiries about hosting or joining a pilot are welcome at contact@databanking.org.