̶̶ Citizen data ̶ Governments ̶ Regional data systems Evidence ̶ Regulations ̶ Global trends ̶ Technologies and ̶̶ COVID-19 ̶ 2030 scenarios scenarios for global data systems September 2020 The Future of Citizen Data Systems Ministerial foreword The world is in the middle of a data revolution. With every passing second, the volume of digital information that flows between businesses, governments and people is expanding rapidly. Data now increasingly underpins our everyday lives: we use it to shop online, to monitor our exercise regimes and personal bank accounts. It has been a crucial weapon in the battle against coronavirus, and has become an increasingly important aspect of international trade and global relations. This digital transformation represents a huge opportunity for the UK. By harnessing the power of data, we can boost growth and productivity, drive innovation, improve public services and inform a new wave of scientific research. Our upcoming National Data Strategy is an ambitious bid to make the most of this moment, so that data’s value can be felt across the entire UK. But we also need to understand the growing risks associated with the data boom, including cybercrime and disinformation. This report helps us identify those threats, and the government has been careful to reflect its findings in our own National Data Strategy, so that we can protect members of the public while they experience data’s many benefits. At the same time, we can’t shape our own data regime in a vacuum. Emerging technologies, socioeconomic shocks, geopolitical changes and global crises – such as the pandemic we are tackling today – all have the ability to significantly alter the facts on the ground. That is why it is crucial that the UK uses its international influence and leadership, both to drive the global attitude to data while ensuring our own strategy is adaptable enough to respond to the inevitable shocks of the future. We also want members of the public to be active agents in the thriving digital economy, and have confidence and trust in how data – including citizen data – is used. This will be especially important as we transform government’s use of data to drive efficiency and improve public services – with a clear understanding that it is our duty to use data to deliver better outcomes. A successful data system will need to be flexible and react quickly to changes. In future updates, we will lay out the steps that we will take to implement the strategy, and the way that engagement and evidence will have shaped our approach. The UK is already one of the most competitive digital nations in the world. Through its recommendations and the evidence base it affords us, this report will help us build on that position of strength, fuelling a new era of growth and unlocking benefits for society as a whole. The Rt Hon John Whittingdale OBE MP Minister for Media and Data Department for Digital, Culture, Media and Sport 1 This is not a statement of government policy Preface Information is a powerful and growing force in society. The collection and use of information about individuals and groups of people – citizen data – is accelerating particularly sharply. More than ever, we leave a digital footprint whenever we browse the internet, travel and shop; in virtually every aspect of our daily lives. Citizen data presents enormous potential value to consumers, businesses and public authorities. In the digital age, a range of information about citizens can now be used far more easily for a wider set of purposes, and for purposes which were not initially anticipated. These can also involve malicious intent and, without careful management, harm to individuals, society and national security. This report highlights how regional citizen data systems, and the business models that reflect them, have emerged across the world. Governments have taken, at times, strikingly different approaches to balancing their economic, social and national security goals when governing data. With strengthening links to global trade, these regional systems interact to create a ‘system of systems’, bringing complexity, uncertainty and risks of fragmentation. Demographic and technological trends can be powerful drivers of change. Conflict and political or economic shocks may also shape the future of these systems. The COVID-19 pandemic already looks set to have profound impacts on the use and sharing of citizen data with public authorities and others, and public attitudes towards this. This report sets out four future scenarios for 2030, illustrating how global norms, business models and government approaches to citizen data could develop. In some scenarios there is convergence in governance of data, and it moves more freely around the world. In others, countries or regions take more divergent and often restrictive approaches, and data becomes increasingly localised. We need to forge a path that best serves the interests of our society, whilst recognising that international collaboration and leadership will be crucial to success here and globally. The UK is well-placed to show such leadership, with a developed research system and strengths in emerging data-driven technologies which mitigate risks, preserve privacy and protect against misuse of data. This report highlights the importance of having a clear vision for what we want to achieve with citizen data, and building understanding and confidence among citizens in how we will achieve it. It highlights opportunities and risks in the context of globally different approaches to citizen data. Given the inherent uncertainty described by the scenarios, it is clear that we will need to adapt our approach methodically when the situation changes and as new evidence emerges. This report has been informed by a wide range of academic, government and industry experts. I am very grateful for their time and insights. Sir Patrick Vallance Government Chief Scientific Adviser 2 This is not a statement of government policy Executive summary Data about people, here referred to as citizen data, is increasing rapidly in volume and variety. The effective use and sharing of such data has the potential to bring huge benefits to the economy and society as a whole: boosting productivity and trade, enabling innovative products, improving public service delivery and informing scientific research. However, the shifting data landscape is challenging for policymakers to navigate. Data collected for one purpose can be used many times over for a range of other ones, and government policy in one area can have unintended impacts elsewhere. Restrictions of data sharing can sometimes mitigate risks of privacy breaches and misuse. However, the linking together of new types of citizen data – across the boundaries of industry, government, and our personal lives – offers some of the greatest opportunities. Data is internationally mobile, and increasingly tied to the provision of goods and services. This means data is an important consideration in international diplomacy, collaboration, and trade. The effectiveness of regulation and data security measures depend on enforcement activity which may involve agencies in other countries. Meanwhile malicious actors including hostile states are developing more advanced ways to use citizen data for their own interests. This report therefore aims to inform public debate and government decisions with an international and whole-system view of citizen data. It considers interactions between data governance frameworks, public values and behaviours, technologies, and data-focused business models. We consider these components to form a ‘citizen data system’. We contrast the evidence of how three major regional data systems reflect and determine developments in economies, security and societies. Finally, the report explores factors that might drive future changes. We use this to build four plausible scenarios for the landscape of data systems across the world in 2030. These are intended to help decision-makers form ambitious strategies that are resilient to the uncertainties that prevail. Data systems today Governments can use several levers and policy stances to shape domestic data systems. These include regulation on privacy and data protection; competition policy; use of data for national security and law enforcement; and the use and sharing of public sector data. Regional approaches have tended to develop organically, building on existing norms but aligning with forward-looking geopolitical aims: o China has prioritised national economic and social security, with strong government coordination and control of citizen data combined with restrictions on international transfers. These values are demonstrated by the Chinese Social Credit System, which is intended to aggregate financial, law enforcement, commercial, social media and other data in order to monitor citizens’ compliance with various obligations, determine sanctions and encourage certain behaviours. o In contrast, the EU has prioritised citizen rights and competition within the internal market, with variation between member states in national security approaches. Individuals can legally challenge the data practices of large international companies. Privacy campaigner Max Schrems’ legal challenge to Facebook’s policy of transferring user data to the US resulted in the invalidation of the entire EU-US Safe Harbour commercial data sharing agreement, and the adequacy decision for its replacement, the EU-US Privacy Shield, 5 years later. The EU has often been a first