Protecting Individual Data Isn't Enough When the Harm Is Collective

The Data Delusion: protecting individual data isn’t enough when the harm is collective Author: Martin Tisné, Managing Director, Luminate Editor: Marietje Schaake, International Policy Director, Stanford University’s Cyber Policy Center July 2020 1 driven harms to those of CO2, it becomes The threat of digital clear how impacts are societal, not individual. discrimination My neighbour’s car emissions, factory smoke from a different continent, affect me more On March 17, 2018, questions about data privacy than my own small carbon footprint ever will. exploded with the scandal of the previously This collective threat of climate change is well unknown consulting company Cambridge reflected in environmental law and it underpins Analytica. Lawmakers are still grappling with the (political) logic of emissions reductions and updating laws to counter the harms of big data the Paris accords.3 and AI. Individuals may enjoy short-term benefits In the Spring of 2020, the COVID-19 pandemic from what will harm the collective in the long brought questions about sufficient legal term. Thinking optimistically, the Coronacrisis protections back to the public debate, with could open the path to laws dealing with urgent warnings about the privacy implications collective data-driven harms. More likely, of contact tracing apps.1 But the surveillance the clash between society’s immediate and consequences of the pandemic’s aftermath are understandable healthcare fears will be pitted much bigger than any app: transport, education, against privacy protections. For example, the health systems and offices are being turned into UK health minister said that “no one should vast surveillance networks. If we only consider constrain work on responding to coronavirus individual trade-offs between privacy sacrifices due to data protection laws”.4 Even the “ The collective nature of big data means people are more impacted by other people’s data than by data about them. Like climate change, the threat is societal and personal.” and alleged health benefits, we will miss the European Commission’s Data Strategy focuses point. The collective nature of big data means mostly on empowering individuals with regards people are more impacted by other people’s to “their” data.5 The need for collective data data than by data about them. Like climate rights continues to be ignored. change, the threat is societal and personal. In the era of big data and AI, people can suffer From collective to because of how the sum of individual data is analysed and sorted into groups by algorithms. individual rights, and back Novel forms of collective data-driven harms are Data rights were historically not as appearing as a result: online housing, job and individualized as they are today. Human rights credit ads discriminating on the basis of race law at the end of the Second World War and gender, women disqualified from jobs on focused largely on protecting groups. The Nazi the basis of gender and foreign actors targeting regime had oppressed and massacred Jews, 2 light-right groups, pulling them to the far-right. Roma and other persecuted peoples on the Our public debate, governments, and laws are basis of their belonging to a minority group. The ill-equipped to deal with these collective, as collective harm wrought by a pernicious state opposed to individual, harms. was articulated with the concept of genocide: a new concept to describe crimes committed Data is the new CO “with intent to destroy, in whole or in part, a 2 national, ethnical, racial or religious group.” The As with CO2, data privacy goes far beyond the aim was then to protect groups from future individual. We are prisoners of other people’s genocidal crimes.6 consent. If you compare the impact of data- 2 In the 1970s, the pendulum began to swing in the direction of individual privacy, with Why the individualist the rise of computing. The Organisation for fallacy suits Big Tech Economic Development and Cooperation (OECD) developed a set of privacy guidelines in When media design professor David Carroll 1980. These guidelines popularized the notion sought to retrieve data about him from that individuals should give informed consent Cambridge Analytica, he filed a legal claim under for any information used for and about them. the UK’s data protection law. Prof. Carroll then 7 During the same period, the 1978 French challenged the company’s liquidation, citing the data protection law enshrined the notion that public interest in accountability and independent people’s personal data must be collected and oversight. Court documents show that he processed fairly and lawfully for specified, believed learning more about how his individual explicit, and legitimate purposes, and with the data was being collected and used would consent of the person themselves (referred to shed light on the impact of big data and AI on as the “data subject”). 8 The French law in turn the collective, on democracy. His appeal was inspired the European Union 1995 Directive dismissed.11 The case shows how hard it is for on personal data protection, which inspired individuals to seek remedy for collective harms, the 2018 General Data Protection Regulation as opposed to personal privacy invasions. “ The era of machine learning effectively renders individual denial of consent meaningless.” (GDPR) often called the gold standard of data The value of an individual’s data to Google protection laws. Today, data rights are seen or Facebook is marginal. For companies, the as ‘individual rights’ and individualisation of value lies in the inferences drawn from your data rights has become a cornerstone of data interaction with others.12 In 2018, Facebook protection laws around the world.9 generated $10/year income per active daily user.13 The harms that the individual can The irony of history is that as governments demonstrate are thus minimal. Blending and laws moved from protecting groups to individuals into a class and tracking how that protecting individuals, technology firms were class responds to different stimuli means moving the other direction, from analysing Google cannot say how data about you has individual behaviour towards that of groups. been used. But the value of their processing The era of machine learning effectively renders of collective data is enormous. From those individual denial of consent meaningless. Even $10 per person per year, Facebook generated if I refuse to use Facebook or Twitter or Amazon an annual net income of $22bn in 2018, while - the fact that everyone around me has joined Alphabet generated $30bn. Companies with means there are just as many datapoints about data analytics capabilities were found by PwC me to target. to have higher stock market values than peers within the same industry.14 As engineers and companies began to deploy increasingly complex algorithms, coupled with The laws and thinking developed in the 1970s data gathered at scale, the market has evolved are no longer suited to deal with today’s reality. beyond transacting individual data, towards The issue here is a fundamental mismatch extracting value from collective data. The fact between the logic of the market and the logic that laws remain focused on the individual puts of the law.15 Contemporary technology markets them out of touch with the rapidly unfolding extracts value from collective data. Our laws reality that technology and artificial intelligence respond to individual harms and have not creates. Our societies need collective and changed to reflect changes in technology. individual level data rights, similarly to non- Governments should change legal regimes discrimination law which covers individuals to match the logic of the market. Perhaps and groups.10 urgency has been lacking so far because 3 the nature of the collective harms – much uploading public photos of themselves on a like CO2 pollution – is invisible to the average popular American dating website, as these person. Algorithms are cloaked in secrecy, their were used by researchers controversially effects omnipresent but invisible. The notion developing algorithms to ascertain people’s of injustice, which can lead to awareness and sexuality based on their facial characteristics. 19 legal claims, is evanescent when the injustice Individuals whose photos are used are not the was committed invisibly, by a computer model only ones harmed necessarily. People whose (though designed by humans).16 Collective sexuality is “identified” (however spuriously) action is therefore also less likely to take place.17 via these techniques are the ones harmed via The task at hand is to understand the nature of inferences made as a result of data collected novel harms and make the invisible visible. and processed.20 “ Even if I refuse to use Facebook or Twitter or Amazon – the fact that everyone around me has joined means there are just as many data points about me to target.” Third, there are optimized harms. These are Making the invisible harms suffered as a result of how machine learning systems are optimized. YouTube’s visible: collective algorithm has concluded that people are drawn data-driven harms to content that is more extreme than what they are currently viewing and leads them to a path The more collective the harm, the less people that, as academic and activist Zeynep Tufekci are protected and the less visible it is. The has written, might be harmless (from jogging more the harm is individual, the more visible to ultra-marathons) or damaging (from political its impacts are and the more people are legally rallies to conspiracy theories).21 People are protected. If a person is discriminated against unwittingly profiled by the algorithm. As with because of protected characteristics such as all optimisation systems, YouTube’s algorithm their age, gender or ethnicity, it will be visible to is single-mindedly focused on its users and them and they will hopefully be in a position to does not focus on its externalities on non-users, seek redress.

Load more