An Imbecilic Constitution Podcast

[audio https://www.joejerome.com/wp-content/uploads/2013/09/WhatsJoeKnow.Levinson.mp3]

September 17th is Constitution Day, a day of government-mandated celebration that some have argued is blatantly unconstitutional. Professor Nelson Lund has suggested that Constitution Day could be used as a day to critically examine our founding document, and inspired by his suggestion, I sought out to interview Sanford Levinson, who’s been a longtime critic of our Constitution.

In the first of what I’m going to call the “What Does Joe Know Show,” I speak to Professor Levinson about the current (or should I say ongoing?) crisis of governance in Washington, how the Constitution is to blame, and what comes next.

Want to download the MP3? Click here.

Whose Hypothetical Horribles?

Released last fall, Rick Smolan and Jennifer Erwitt’s The Human Face of Big Data is a gorgeous, coffee table book that details page after page of projects that are using Big Data to reshape human society.  In a later interview, Smolan suggested that Big Data was “akin to the planet suddenly developing a nervous system” with “the potential to have a bigger impact on civilization than the Internet.” A bold claim if ever there was one, but the advent of Big Data begs the question: what sort of ramifications will this new data nervous system have on society?

Since I began reading about Big Data in earnest last year, I’ve noticed that much of the discussion seems to be focused at the extremes, hyping either the tremendous benefits and terrific fears of Big Data.

Proponents tend to look at data analytics with wide-eyed optimism.  In their recent book, Big Data: A Revolution That Will Transform How We Live, Work, and Think, Viktor Mayer-Schoenberger and Ken Cukier suggest that Big Data will “extract new insights or create new form of value, in ways that change markets, organizations, the relationship between citizens and governments, and more.”

On the other side of the coin, scholars like Paul Ohm argue that “Big Data’s touted benefits are often less significant than claimed and less necessary than assumed.” It is very easy to see Big Data as a giant engine designed explicitly to discriminate, to track, to profile, and ultimately, to exclude.  Technologist Alistair Croll has declared Big Data to be the “civil rights issue” of our generation.

Adam Thierer, who puts his faith in the market to sort these issues out, has derisively suggested these worries are little more than boogeyman scenarios and hypothetical horribles, but I take his point that much of the worry surrounding Big Data is of a kind of abstract doom and gloom.  The discussion could benefit by actually describing what consumers–what individuals are facing on the ground.

For example, in my paper, I noticed two interesting stories in the span of a few weeks.  First, that noted Judge Alex Kozinski had declared that he would be willing to spend $2,400 a year in order to protect his privacy from marketers and miscreants.  Second, that individuals were data-mining themselves on Kickstarter to the tune of $2,700.  One was an established legal figure; the other a poor graduate student.  One could pay.  The other could only sell.

More of the Big Data discussion should center around how consumers are honestly being impacted.  Instead, we’re still talking about Fair Information Practice Principles with the strong conviction that a few tweaks here and there and a renewed dedication to some long-standing principles will “solve” the privacy challenge we face.  In the regulatory regime, there is much discussion about offering “meaningful” user choice, but as the “Do Not Track” process has demonstrated, no one really knows what that means.

I would love to pay for my privacy, but that’s a cost I’m not prepared to cover.  I’d love to make meaningful choices about my privacy, but I’m not sure what any of my choices will actually accomplish.  Perhaps Thierer has a point, that I’m worried about hypothetical horribles, but I’m not sure our planet’s new data nervous system has my best interests in mind.

Buying and Selling Privacy Essay Published by Stanford Law Review Online

My essay on how “Big Data” is transforming our notions of individual privacy in unequal ways has been published by the Stanford Law Review Online.  Here’s how they summed up my piece:

We are increasingly dependent upon technologies, which in turn need our personal information in order to function. This reciprocal relationship has made it incredibly difficult for individuals to make informed decisions about what to keep private. Perhaps more important, the privacy considerations at stake will not be the same for everyone: they will vary depending upon one’s socioeconomic status. It is essential for society and particularly policymakers to recognize the different burdens placed on individuals to protect their data.

Because Everyone Needs Facebook

Facebook has rolled out several proposed updates to its privacy policy that ultimately gives Facebook even more control over its users information.  Coming on the heels of $20 million settlement by Facebook for using user’s information for inclusion in advertisements and “sponsored stories,” Facebook has responded by requiring users to give it permission to do just that:

You give us permission to your name, profile picture, content, and information in connection with commercial, sponsored, or related content (such as a brand you like) served or enhanced by us.

A prior clause that suggested any permission was “subject to the limits you place” has been removed.

This is why people don’t trust Facebook. The comments sections to these proposed changes are full of thousands of people demanding that Facebook leave their personal information alone, without any awareness that that ship has sailed.  I don’t begrudge Facebook’s efforts to find unique and data-centric methods to make money, but as someone who is already reluctant to share too much about myself on Facebook, I can’t be certain that these policies changes aren’t going to lead to Facebook having me “recommend” things to my friends I have no association with.

But no one is going to “quit” Facebook over these changes.  No one ever quits Facebook.  As a communications and connectivity platform, it is simply invaluable to users.  These changes will likely only augment Facebook’s ability to be deliver users content, but as someone who’s been with Facebook since early on, Facebook sure has transformed from this safe lil’club into a walled Wild West where everyone’s got their eye on everyone.

 

Digital Market Manipulation Podcast

[audio http://www.futureofprivacy.org/wp-content/uploads/FPFCast.Calo_.mp3]

The other week, Rebecca Rosen wrote up a fantastic overview of Professor Ryan Calo’s new paper on “Digital Market Manipulation” in The Atlantic.  “What Does It Really Matter If Companies Are Tracking Us Online?” she provocatively asked in her headline.

Conveniently, I was scheduled to speak with Professor Calo about his essay Consumer Subject Review Boards — A Thought Experiment, which looks at how institutional review boards (IRBs) were put in place to ensure ethical human testing standards and suggests a similar framework could be brought to bear on consumer data projects.

I was able to ask him about the concept of digital market manipulation, which seems to move beyond mere “privacy” concerns into questions of fundamental fairness and equality.

Framing Big Data Debates

If finding the proper balance between privacy risks and Big Data rewards is the big public policy challenge of the day, we can start by having a serious discussion about what that policy debate should look like. In advance of my organization’s workshop on “Big Data and Privacy,” we received a number of paper submissions that attempted to frame the debate between Big Data and privacy. Is Big Data “new”?  What threats exist?  And what conceptual tools exist to address any concerns?

As part of my attempt to digest the material, I wanted to look at how several scholars attempted to think about this debate.

This question is especially timely in light of FTC Chairwoman Edith Ramirez’s recent remarks on the privacy challenge of Big Data at the Aspen Forum this week. Chairwoman Ramirez argued that “the fact that ‘big data’ may be transformative does not mean that the challenges it poses are, as some claim, novel or beyond the ability of our legal institutions to respond.” Indeed, a number of privacy scholars have suggested that Big Data does not so much present new challenges but rather has made old concerns ever more pressing.

Read More…

From Cyberspace to Big Data Podcast

In the run-up to the Future of Privacy Forum’s “Big Data and Privacy” workshop with the Stanford Center for Internet & Society, I’ve taken to podcasting again, speaking with scholars who couldn’t attend the conference.  First up was Professor Bill McGeveran, who prepared an essay looking over lessons from the 2000 Stanford symposium on “Cyberspace and Privacy: A New Legal Paradigm?”

Of course, now the buzzword has moved from cyberspace to big data.  McGeveran suggests big data is really seeing a replay of the same debates cyberspace saw a decade ago.  Among the parallels he highlights are (1) the propertization of data, (2) technological solutions like P3P, (4) First Amendment questions, and (4) the challenges posed by the privacy myopia.

Enter the Nexus?

Enter the Nexus?

In 2032, a group of genetically engineered neo-Nazis create a super virus that threatens to wipe away the rest of humanity. Coming on the heels of a series of outbreaks involving psychotropic drugs that effectively enslave their users, this leads to the Chandler Act, which places sharp restrictions on “research into genetics, cloning, nanotechnology, artificial intelligence, and any approach to creating ‘superhuman’ beings.” The Emerging Risks Directorate is launched within the Department of Homeland Security, and America’s war on science begins.

This is the world that technologist Ramez Naam sets his first novel, the techno-thriller Nexus. Nexus is a powerful drug, oily and bitter, that allows humans minds to be linked together into a mass consciousness. A hodgepodge of American graduate students develop a way to layer software into Nexus, allowing enterprising coders to upload programs into the human brain. It’s shades of The Matrix, but it’s hardly an impossible idea.

Read More…

The Toobin Principle as a Corollary to the Snowden Effect

Jay Rosen has a fantastic piece today on PressThink on what he calls the “Toobin principle“.  In effect, Jeffrey Toobin and a number of media figures have criticized Edward Snowden as a criminal or, worse, a traitor even as they admit that his revelations have led to a worthwhile and more importantly, a newsworthy debate. For his part, Rosen asks whether there can “even be an informed public and consent-of-the-governed for decisions about electronic surveillance”?

I would add only the following observations. First, an informed public may well be the only real mechanism for preserving individual privacy over the long term. As we’ve seen, the NSA has gone to great lengths to explain that it was acting under appropriate legal authority, and the President himself stressed that all three branches of government approved of these programs. But that hasn’t stopped abuses — as identified in currently classified FISC opinions — or and I think this is key, stopped government entities from expanding these programs.

This also begs the bigger, looming concern of what all of this “Big Data” means. One of the big challenges surrounding Big Data today is that companies aren’t doing a very good job communicating with consumers about what they’re doing with all this data.  Innovation becomes a buzzword to disguise a better way to market us things. Like “innovation,” national security has long been used as a way to legitimize many projects. However, with headlines like “The NSA is giving your phone records to the DEA. And the DEA is covering it up,” I believe it is safe to say that the government now faces the same communications dilemma as private industry.

In a recent speech at Fordham Law School, FTC Commissioner Julie Brill cautioned that Big Data will require industry to “engage in an honest discussion about its collection and use practices in order to instill consumer trust in the online and mobile marketplace.”  That’s good advice — and the government ought to take it.

MOOCs and My Future Employment Prospects?

Massive open online courses are a new, rapidly evolving platform for delivering educational instruction. Since their appearance just a half-decade ago, multiple platforms now offer dozens of free courses from leading universities across the country. However, as MOOCs work to transform education, they also seek to find ways to turn innovative educational experiences into viable business models. In many respects, this is the same challenge facing many Internet services today. Yet while many “free” Internet services rely upon their users giving up control of their personal data in exchange, this bargain becomes strained when we enter the field of education.

Education aims to encourage free thought and expression.  At a basic level, a successful learning experience requires individuals to push their mental abilities, often expressing their innermost thoughts and reasoning. A sphere of educational privacy is thus necessary to ensure students feel free to try out new ideas, to take risks, and to fail without fear of embarrassment or social derision. As a data platform, MOOCs by their very nature collect vast stores of educational data, and as these entities search for ways to turns a profit, they will be tempted to take advantage of the huge quantities of information that they are currently sitting upon.

As MOOCs look for ways to turn a profit, they will be tempted to turn to the vast stores of personal data that they are currently sitting upon.  It will be essential to consider the privacy harms that could result if this personal educational data is treated carelessly.

This is already some evidence that MOOC organizers recognize this challenge.  In January, a dozen educators worked to draft a “Bill of Rights” for learning in the digital age.  The group, which included Sebastian Thrun, founder the MOOC Udacity, declared that educational privacy was “an inalienable right.” The framework called for MOOCs to explain how student data was being collected, used by the MOOC, and more importantly, made available to others.  “[MOOCs] should offer clear explanations of the privacy implications of students’ choices,” the document declared.

In addition to Udacity, the leading MOOCs–Coursera and edX–can improve how they approach student privacy.  Most MOOCs have incredibly easy sign-up processes, but they are much less clear about what data they are collecting and using.  At the moment, the major MOOCs rely on the usual long, cumbersome privacy policies to get this information across to users.

These policies are both broad and unclear.  For example, Coursera states in its Privacy Policy that it “will not disclose any Personally Identifiable Information we gather from you.”  However, it follows this very clear statement by giving itself broad permission to use student data: “In addition to the other uses set forth in this Privacy Policy, we may disclose and otherwise use Personally Identifiable Information as described below. We may also use it for research and business purposes.”  More can be done to offer clear privacy guidelines.

Beyond providing clearer privacy guidelines, however, MOOCs also should consider how their use of user-generated content can impair privacy.  A potential privacy challenge exists where a MOOC’s terms of service grant it such a broad license to re-use students’ content that they effectively have the right to do whatever they wish. EdX, a project started by educational heavyweights Harvard and MIT, states in its Terms of Service that students grant edX “a worldwide, non-exclusive, transferable, assignable, sublicensable, fully paid-up, royalty-free, perpetual, irrevocable right and license to host, transfer, display, perform, reproduce, modify, distribute, re-distribute, relicense and otherwise use, make available and exploit your User Postings, in whole or in part, in any form and in any media formats and through any media channels (now known or hereafter developed).” Coursera and Udacity have similar policies.

Under such broad licenses, students “own” their exam-records, forums posts, and classroom submissions in name only. The implications of a MOOC “otherwise using” my poor grasp of a history of the Internet course I sampled for fun is unclear. This information could be harnessed to help me learn better, but as MOOC’s become talent pools for corporate human resource departments, it could bode ill for my future employment prospects.

At the moment, these are unresolved issues.  Still, as MOOCs move to spearhead a revolution in how students are taught and educated, providing students of all ages with a safe-space to try out new ideas and learn beyond their comfort zone will require both educators and technology providers to think about educational privacy.

Buying and Selling Privacy Paper

Judge Alex Kozinski has offered to pay $2,400 a year to protect his privacy. Meanwhile, Federico Zannier started a Kickstarter to “data mine” himself and ended up making $2,700. One’s rich and can pay to protect his privacy; the other’s not and is selling every bit of his info. I’ve posted my paper on this subject to SSRN.

Privacy Protections from FISA Court May Not Compute

This is cross-post on the American Constitution Society’s blog.

After the events of the past few weeks, a discussion presented by the American Constitution Center on the search for privacy and security on the Internet posed many questions but few answers. In an article on The Daily Beast, Harvard Law Professor Lawrence Lessig has noted that the “Trust us’ does not compute,” but after a contentious, technical discussion of both the NSA’s PRISM program and the cellular metadata orders, a panel of privacy law scholars were forced to concede that “trust us” is today’s status quo when it comes to programmatic government surveillance.

It wasn’t supposed to be this way. When the Foreign Intelligence Surveillance Act was first passed in 1978, the law was designed to “put the rule of law back into things,” explained Professor Peter Swire, co-chair of the Tracking Protection Working Group at the W3C and the first Chief Counselor for Privacy at OMB. The emergence of the Internet, however, changed everything. Intelligence agencies were faced with a legal framework that could not account for situations where “games like World of Warcraft [could be] a global terrorist communication network,” he said.

But even as communications technology has been made to serve bad actors, it has also ushered in a Golden Age of surveillance. Modern technology today can easily determine an individual’s geolocation, learn about an individual’s closest associates, and connect it all together via vast databases. Within the federal government, without strong champions for civil liberties, the availability of these technologies encouraged government bureaucracy to take advantage of them to the full extent possible. Absent outside pressure from either the Congress or the public, “stasis sets in,” Swire said.

Yet while service providers collect vast amounts of data about individuals, a combination of business practicalities and Fair Information Practice Principles which stress retention limits and data minimization mean that businesses simply do not keep all of their data for very long. As a result, the government has used Section 215 of the PATRIOT Act to collect and store as much information as possible in the “digital equivalent of the warehouse at the end of Indiana Jones,” said Professor Nathan Sales, who largely defended the government’s efforts at intelligence gathering.

The difficulty is that these sorts of data collection projects present important Fourth Amendment considerations.  In his passionate dissent in the recent Maryland DNA collection case, Justice Antonin Scalia joined three of his liberal colleagues to explain that the Fourth Amendment specifically protects against general searches and demands a particularity requirement.  However, a general search is exactly what an order permitting the collection of anyone and everyone’s cellular metadata appears to be.

Professor Susan Freiwald pointed out that the plain language of Section 215 is incredibly broad.  50 U.S.C. Sec. 1861 permits surveillance wherever “reasonable grounds” exist that surveillance could be “relevant . . . to protect against international terrorism or clandestine intelligence activities” where any individual, American citizen or otherwise, is “in contact with, or known to, a suspected agent of a foreign power.”  According to Freiwald, the plain language of the statute “doesn’t limit government investigations in any meaningful way.” What checks that exist are limited: Congress appears at best half-informed and the ISPs that are hauled before the Foreign Intelligence Surveillance Court (FISC) have been incentivized not to fight via the carrot of immunity and the stick of contempt sanctions.

“We’re waiting on the courts,” Freiwald said, suggesting that these programs “cannot survive review if the court does its job.”

Professor Sales countered that the FISC was already placing minimization requirements into the its orders, though he conceded he couldn’t know for sure if this was accurate.

Former U.S. District Judge Nancy Gertner interjected:

As a former Article III judge, I can tell you that your faith in the FISA Court is dramatically misplaced. . . . Fourth Amendment frameworks have been substantially diluted in the ordinary police case. One can only imagine what the dilution is in a national security setting.

What little we do know about the FISC suggests that it, too, is wary of the government’s behavior.  In a letter to Sen. Ron Wyden (D-Ore.) last fall, the Director of National Intelligence conceded that on at least one occasion the FISC found that the government’s information collection was unreasonable under the Fourth Amendment, and moreover, that the government’s behavior had “sometimes circumvented the spirit of the law.”

Unfortunately, the FISC’s full legal opinion remains classified, and the Department of Justice continues to contest its release.  This fact reveals the core challenge facing any sensible debate about the merits of government surveillance: our current understanding rests on incomplete information, from secret court decisions to the “least untruthful” testimony of government officials.

Louis Brandeis, who along with Samuel Warren “invented” the right to privacy in 1890, also wrote that “[s]unlight is said to be the best of disinfectants.”  A discussion about the future of privacy online that forces our best privacy scholars to repeatedly profess their ignorance and rests on placing our trust in the government simply does not compute.

The Rhetoric and Law of Government Surveillance

Two weeks ago, after the President’s national security address, I was left with little reaction other than the speech sounded good.  The President made overtures to “refining” and ultimately repealing the AUMF.  There was some measured rhetoric about drone warfare and a frank discussion about GITMO.  The President even tolerated a heckler, but nothing about the speech appeared to suggest a serious re-evaluation of American national security policy.  But as this week suggests, positive words, whether in a speech or in law, can easily be used to obfuscate more alarming acts.

This week, of course, came news that our government is collecting metadata of the phone calls of millions of (if not all) Americans.  The time, location, and duration of our calls are being recorded, aggregated, and transformed into a vast network of personal information.  Last night came the further revelation that the NSA has continued a vast data mining enterprise with the participation of every major tech company–Google, Facebook, Apple, Microsoft, Yahoo, Skype, YouTube, AOL.  Whether through ignorance or an intentional gag orders, these tech giants have been forced to hem and haw about what exactly they know and what exactly they’re giving away.

As a number of people have recalled, then-Senator Obama cautioned against this sort of intelligence dragnet. “We have to find the right balance between privacy and security, between executive authority to face threats and uncontrolled power,” he said.  “What protects us, and what distinguishes us, are the procedures we put in place to protect that balance, namely judicial warrants and congressional review. These aren’t arbitrary ideas. These are the concrete safeguards that make sure that surveillance hasn’t gone too far. That someone is watching the watchers.”

Speaking to reporters today, the President has inverted his priorities:  “You can’t have 100 percent security and then also have 100 percent privacy and zero inconvenience.  You know, we’re going to have to make some choices as a society.”  The problem is that “society” hasn’t made this choice; a small collection of government officials have.

There is little question that the letter of the law has been followed here.  Both judicial review and congressional oversight are in place, but can anyone say whether they are effective?  It’s impossible, because it’s all secret.  Few members of Congress were aware of the breadth of these programs, and those that were legally prohibited from discussing them.  Our congressional oversight effectively amounts to a handful of members, having access to sensitive documents within tightly controlled conditions without the resources to effectively “oversee” anything.

Meanwhile, to be blunt, our Foreign Intelligence Surveillance Court is a judicial rubber stamp.  In 2012, 1,789 applications to conduct electronic surveillance for foreign intelligence purposes were made to the FISC.  One was withdrawn.  None were denied.  A further 212 applications were made to the FISC to access business records.  None were denied.

In February, I attended an address by Rajesh De, General Counsel of the NSA, wherein he attempted to disabuse the audience of several “myths” about the National Insecurity Apparatus:

False Myth #1: NSA is a vacuum that indiscriminately sweeps up and stores global communications.
False Myth #2: NSA is spying on Americans at home and abroad with questionable or no legal basis.
False Myth #3: NSA operates in the shadows free from external scrutiny or any true accountability.

At the time, I remember being struck by how much of his remarks focused on procedure and structural legalese.  As Jennifer Granick put it today, however, the complexity of our national security laws are such that it allows officials to offer “non-denial denials” that mask the truth and obfuscate the bigger concerns.  For example, it may well be true that the NSA neither sweeps up nor stores “communications.”  But if collecting every phone number you dial, long your call last, and where both ends of the call came from are not legally “communications,” I imagine that might come as a surprise to most average people.The government’s initial response–both in the Administration and in Congress–have been dismayed and outraged at the “magnitude of the leak” involved.   Jack Clapper, director of National Intelligence, has called this “unauthorized disclosure” utterly “reprehensible and risks important protections for the security of Americans.”  Or perhaps these officials are more worried about a political backlash:

If so much information is being gathered about almost everyone to figure out patterns, then it’s not as though you’d be tipping off a particular target that we were on to him. Would publicizing the order that this information be collected have given away technical secrets to our enemies (or rather, at this point, has publicizing it done so)? I don’t see how. I can see why the government might want to keep this data-mining program secret to avoid a political backlash, but that is of course not a good reason for concealing it.

No laws have been broken.  No single politician or political party alone should be blamed for this state of affairs, but we ought to become more mindful about the disconnect between the rhetoric surrounding government transparency and personal privacy and the actions of our society when these principles are at stake.

Would Could Facial Recognition Privacy Protections Look Like?

Concerns about facial recognition technology have appeared within the context of “tagging” images on Facebook or how it transforms marketing, but these interactions are largely between users and service providers. Facial recognition on the scale offered by wearable technology such as Google Glass changes how we navigate the outside world.  Traditional notice and consent mechanisms can protect Glass users but not the use by the user himself.  // More on the Future of Privacy Forum Blog.

Parsing the Purpose Limitation Principle

Last month, the European Union’s Article 29 Working Party (WP29) released an opinion analyzing the data protection principle of purpose limitation. That principle, which aims to protect data subjects by setting limits on how data controllers use their data, conflicts with potential Big Data applications. In the wake of efforts by a number of parties to tweak the “legitimate interests” ground for processing data, this opinion demonstrates how Big Data fundamentally challenges European privacy law.  The opinion itself seems geared toward addressing Big Data; the WP29 specifically notes that current business trends are of particular relevance to its opinion, which it put forward as a way to balance the risks and rewards of data processing in our increasingly data-intensive society.

Under Article 6(1)(b) of Directive 95/46/EC, the purpose limitation principle consists of two fundamental building blocks:

  1. that personal data must be collected for “specified, explicit and legitimate” purposes (purpose specification);

  1. that personal data not be “further processed in a way incompatible” with those purposes (compatible use).

The challenge posed by Big Data is that much of the new value of information comes not from any original, identified purpose but rather from secondary or derivative uses. As a result, both building blocks of the purpose limitation principle are in tension with the how Big Data works, presenting a challenge for pursuing innovative data uses in Europe.

First, WP29’s understanding of purpose specification requires that before data collection that purposes “must be precisely and fully identified.”  Many of the secondary ways in which data can provide value, whether to security, safety, or health, may not be easily identifiable. This problem cannot be cured by providing a broader purpose specification because the Working Party is critical of “vague or general” purposes such as “improving users’ experience,” “marketing purposes,” “IT-security purposes,” and “future research” as being generally inadequate to meet this test.

Limited in this way, the benefits of Big Data are effectively cabined by whether or not they satisfy the compatible use test.  The onus falls on data processors in Europe to determine whether or not a secondary use is compatible with how the data was originally collected. The WP29 opinion recognizes that actually applying the compatibility test is problematic within the context of Big Data, and suggests developing a “rigorous but balanced and flexible application of the compatibility test” to new data applications.

The compatibility test does provide some flexibility to data processors.  For one, because the test itself prohibits incompatibility rather than requires compatibility, the lack of any affirmative requirement that a data processor show further processing is compatibility appears to provide some wiggle-room.  Compatibility still must be assessed on a case-by-case basis; the following criteria are put forward as particularly relevant to any compatibility assessment:

    • the relationship between the purposes for which data has been collected and the purposes of further processing;
    • the context in which data has been collected and the reasonable expectations of the data subjects as to its further use;
    • the nature of the personal data and the impact of the further processing on the data subjects;
    • the administrative and technical safeguards adopted to ensure fair processing and prevent any undue impact on individuals.

These are important criteria to consider, but the WP29 specifically discusses the implementation of safeguards as being important to Big Data processing.  It distinguishes between two different “Big Data” scenarios: one where organizations seek to uncover “trends and correlations in the information” and another where they “specifically want to analyze or predict the personal preferences, behavior and attitudes of individual customers” in order to “inform ‘measures or decisions’ that are taken with regard to those customers.”

As described, this second scenario has the larger personal privacy implications for individuals. The WP29 explains that “free, specific, informed and unambiguous ‘opt-in’ consent” would be required, which may be easier said than done.  The division of the Big Data world into projects that seek out merely correlations in disparate information and those that directly target individuals is simple and easy to grasp, but it does not necessarily reflect how Big Data is reshaping how data is now processed. In a paper released in February, the Centre for Information Policy Leadership (CIPL) discussed some of the concerns surrounding Big Data, and one of the paper’s key takeaways is that Big Data is largely an iterative process. If many of the benefits we’re deriving from data come from secondary uses of that information, these insights appear across applications that cannot be as easily divided as the WP29 suggests.

More problematic, insisting on consent for any potential Big Data application that could impact individuals may not be tenable.  As CIPL noted, data analytics relies on “increasingly large data sets obtained from such diverse sources that obtaining consent may not be practicable.”  The WP29 seems to recognize both the limitations on consent and that insisting on consent could eliminate some legitimate benefits.  In a footnote, it admits that some exceptions may exist “in some cases, based on an informed debate of the societal benefits of some uses of big data.” (While the WP29 remains wedded to our current notice-and-consent framework, some of their proposed safeguards are exactly what is needed to alleviate Big Data fears.  The opinion encourages the disclosure of decisional criteria and providing consumers with insight into how their data impact decision-making algorithms.  In many ways, the opinion comes close to encouraging some of the same mechanisms to get users’ engaged with their data that I recently discussed.)

Fortunately, consent is one of six lawful bases for processing data in Europe. Article 7 of the Directive permits personal data to be processed where it is necessary for the “legitimate interests” pursued by the data controller, except “where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.”  Arguably, as notice-and-consent requirements have become ever more legalistic and procedural, the legitimate interest ground increasingly becomes the default posture of data processors.

Indeed, as Europe debates its new data protection law, the legitimate interest ground has seen considerable discussion.  The  Civil Liberties, Justice and Home Affairs (LIBE) Committee Report issued in December proposes that the legitimate interest provision could only be relied upon in “exceptional circumstances.”  The more industry-friendly Commerce Committee suggests that the European Data Protection Board should “set out comprehensive guidelines on what can be defined as ‘legitimate interest.’”  All of this activity suggests once again how challenging Big Data applications may be for European privacy law, and tweaking how we understanding principles such as purpose limitation do not resolve the benefits and business realities of Big Data.

1 … 3 4 5 6  Scroll to top