Improvement means deterioration
I am, sadly, pessimistic about how effective organisations will be in assuring authentication before people access their own data. Given how the banks struggle with non-standard customers e.g. the visually impaired, or people who have more than one abode (which may be in different countries), I shudder to think how organisations will make life difficult - it's bad enough requiring original copies of utility statements when many organisations have gone 'paperless'.
Some people will really struggle to prove they are who they say they are: many have no passport, and utility bills are all in their spouses name, some have no driving licence either. Not everyone is well known to someone on the list of professions that are allowed to witness that a photograph is a good likeness of the bearer: "be ‘a person of good standing in their community’ or work in (or be retired from) a recognised profession"
I have always thought that a test of a good process is how well it handles valid exceptions. Unfortunately, many processes stop at the 'computer says "no" stage', leaving people with little recourse other than an inefficient and arduous complaints 'process'.
It is also instructive to see how organisations handle recovering from mistakes. Admitting that a mistake can have been made is a good start - and some organisations have exemplary mitigation processes that give you confidence in doing business with them in future. Others, well, not so much. I currently have two financial organisations who have data problems. One pays me dividends approximately every 6 months from shares held in an ISA with them, but when I call them, claim to have no record of me, despite voluminous documentation supplied by me. The other is unable to prevent physical letters being sent out to me telling me that my account has not been accessed for <x>-months, even though the account has been in regular use. I am sure GDPR will not improve things.
Biting the hand that feeds IT
