The Domains of Identity outlines 16 key domains where individual's personally identifiable information ends up in databases. The book enumerates the 16 domains of identity, describing each in detail along with the types of data collected in the domain, the source and key actors among whom information moves.

I wrote this book for several reasons:

• 1) to give journalists and the general public clear simple terms to understand the mechanics of and issues surrounding identity management across a range of societal contexts;

• 2) to support professionals in the fields of identity management and privacy having a common language to understand where and how different types of identity interactions are happening, and from there being more able to solve the challenges that different domains present;

• 3) to support those working in academia and the private sector having a common language to understand the landscape of issues so that academic research actually serves industry and industry work can be better understood by those researching the field; and

• 4) to support government officials and those engaged with public policy issues being able to understand the challenges that exist in different domains and be able to craft better policies to address challenges within those domains.

Everyone in our society participates in identity management on a daily basis. It is so common that we do not really think about it. As a result, the discourse about identity often conflates radically different issues. The illicit market in which personal data are bought and sold is very different from the contemporary data broker industry, but it is not uncommon for people with fears about personal data use to lump these two contexts together—forgetting that one is a legal business market and the other is a result of criminal activity. Likewise, the data from a data breach via an HVAC vendor, such as the Target breach, that end up in an illicit market is different from data from a compromised enterprise identity management system protected by weak authentication (just a password) resulting in employee's authentication credentials being stolen in a spear phishing attack.