Which uses of IAM reach beyond the organisation's own access protection, and what questions do they raise?

IAM as a digital enabler of new business models, the passive use of identity data (tracking, behaviour analysis, scoring, surveillance), and identity for digital citizen services. They raise questions of legal basis, control, surveillance and commercialisation.

Three fields reach beyond the classic internal benefits; the first two are the newest:

• Digital enabler: without a reliable digital identity, there is no online banking, no customer portal, no partner integration. IAM makes digital business models with customers and partners possible at all.
• Passive use: once every login is tied to an identity, the identity data can be analysed: tracking across services, behaviour analysis, scoring, surveillance. The person does nothing actively; they are simply observed. The key question here is the legal basis: is this processing of personal data permitted, and did the person consent?
• Digital services for citizens: municipalities, cantons and states offer services online and need identity for them. Two questions dominate: how much control and surveillance does a state identity allow, and should it be privatised and commercialised (run by private companies) or stay a public task? Switzerland lived through exactly this debate: voters rejected a privately run e-ID in 2021 and narrowly accepted a state-issued, privacy-oriented e-ID in September 2025.

The common thread: the same infrastructure that protects access can also be used to watch people. Good IAM design therefore includes data minimisation and clear purpose limitation, not just strong login.

Go deeper:

• Surveillance capitalism (Wikipedia) — how behavioural data collected around identities became a business model.
• e-ID (eid.admin.ch) — the Swiss state-issued e-ID as one answer to the control and commercialisation questions (in German).