Category Archives: EDPS

Big Data Ecosystem, Fairness and Enforcement

Big data has become an increasingly scary phrase for all stakeholders in data protection. For privacy advocates, it often means loss of control, asymmetrical power and hidden discrimination. For regulators, it often means regulatory round pegs in operational holes of different sizes, in constantly moving locations, with mismatches that begin with vocabulary. For companies, it often means uncertainties at every dimension, with regulatory uncertainty just one of the most visible.

Over the past two weeks, I had the honour of participating in a roundtable discussion on big data and enforcement co-hosted by the European Data Protection Supervisor (EDPS) and the Bureau Européen des Unions de Consommateurs (BEUC), the European-wide consumer organisation, and in the Privacy Commissioner of Canada’s first stakeholder meeting on consent and its alternatives. In both cases, the room was full of very smart people, trying to figure out how to enforce consumer and human rights in an environment of more touch points, data, math and applications. After spending nine years trying to figure out how to legitimately utilise the knowledge and productivity that is associated with big data, while still maintaining a space where individuals are not completely defined by their digital tracks, I am increasingly frustrated by the confusion of data with processing. Clarity is necessary since big data processes are needed to foster the full range of fundamental rights as well as economic growth. Big data done badly raises issues for all parties. Progress requires breaking the issues apart so they may be fully understood. Thinking about big data as an ecosystem has been helpful to me.

First, big data and humongous amounts of data are not the same thing. Nor is big data the same as faster, more detailed and more diverse data. Rather, big data is the process by which humongous amounts of data, coming from various, often unstructured sources, are brought together to generate insights and increase the efficiency of processes. When I say efficiency, I am not making a value judgement. The efficiency may improve healthcare or facilitate unfair practices. Either way, efficiency constitutes the goal.

Second, big data is advanced math conducted on very powerful systems. Some of that math and processing is world class while some processing is mediocre at best. The quality of the knowledge created is directly proportional to the skills of the of data scientists and programmers.

Lastly, knowledge may be applied in a manner that is legal, fair and just, or it may not be applied in such a manner.

I suggest that for all parties to have a sense of how to approach control of a big data ecosystem, big data might be looked at in the following manner:

  • A Means to Observe: Big data is feed by observational data. Observational data is data that comes from all circumstances where behaviour may be observed. The speed has picked up with smart phones and will continue to accelerate with the Internet of Things, smart cars and even smart medicine. The observation itself is becoming increasingly necessary for things and systems to work. For example, mobile phones cannot operate unless their locations are constantly observed, and smart brakes are not effective if their use is not monitored. Unlike traditional collection concepts, observation requires a governance layer that goes beyond individual control.
  • A Means to Gain Knowledge: Data must be brought together, be prepared for processing and then run against advanced analytic processes in order to generate knowledge. Often this means interim steps where questions are refined by the correlations from the last step. Data must be matched again and again. Questions of obscurity to protect individuals come up against accuracy to, in the end, protect individuals.
  • A Means to Apply Knowledge: Once one has knowledge, one needs to decide whether the knowledge makes sense, is applicable, is legal, fair and just. None of these decisions should be made in a vacuum. They are based on the law, commitments made, and societal standards. What makes sense in one context, may not make sense in another context.

Too often, when discussing big data, participants jump from one part of the ecosystem to the next and the next without considering the analysis which is necessary for each part. The IAF has separated “thinking with data” – the means to gain knowledge – and “acting with data” – the means to apply knowledge in developing assessment processes. (For more information, see overview of IAF Big Data Initiative.) Also, the IAF made the case that policy governance needs to be tied to data’s origin in “The Origins of Personal Data and its Implications for Governance” written for an OECD 2014 discussion on data taxonomy. I believe the data taxonomy work, particularly as it relates to the IoT, needs to be revisited and better integrated with ongoing work on big data governance.

In late September, I blogged about the re-establishment of the accountability dialog. (Link to the blog post.) I hope that dialog will encourage discussion on how the three means view of a big data ecosystem might be taken.

IAF on Data Ethics Panel at IAPP-London

On 21 April, IAF’s Marty Abrams will speak on a panel entitled “Digital Ethics, the EDPS and the Ethics Advisory Group” at IAPP’s  “Europe Data Protection Intensive” in London. Panel Overview The European Data Protection Supervisor (EDPS) has launched a broader discussion, both in the EU and globally, on how to ensure the integrity of… Continue Reading

Restoring Privacy Functionality Through Data Protection Processes

Can data protection, the fair processing of personal data, protect the key values associated with privacy? While many privacy professionals use the terms privacy and data protection interchangeably, European law differentiates the two terms. The Working Party 29 Legitimate Interests opinion from 2014 does an excellent job of explaining the differences. Privacy is a value… Continue Reading

Documents Related to All Hands Privacy Workshop

On Tuesday, December 15, 2015, Marty Abrams will speak at the All Hands Privacy Workshop in Pittsburgh, PA. Below, we have listed documents related to his presentation. Key IAF Documents Referenced at Privacy as a Gateway: Enabling Data-Driven Analytics through Ethical Processes All Hands Privacy Workshop December 15, 2015 A Unified Ethical Frame for Big… Continue Reading

Data Protection is About Right and Wrong

“Ethics has no place in data protection,” an audience member stated during a side event held at the 37th International Conference of Data Protection and Privacy Commissioners (“International Conference”). Although the conference ended last week, I have been mulling over this statement ever since. When I and other privacy professionals began the Global Accountability Dialogue in… Continue Reading

Enhancing the Benefits of Information Through a Values Based Holistic Approach to Information Governance

Businesses today are increasingly using information as a means to create new products and services and to drive the creation of benefits. Access to data and advanced analytical capabilities are enabling new opportunities for both current information-intensive industries and new players, even those traditionally in core product segments or where there is no direct business-to-consumer… Continue Reading

Data Management Ethics in an Observational World

Data ethics is more than data minimisation and purpose limitation. If it was not more, big data governance would be easy. But it is not easy. Giovanni Buttarelli, European Data Protection Supervisor, heightened the big data governance debate last Friday, 11 September, when he issued opinion 4/2015, “Towards a new digital ethics.” In the paper,… Continue Reading

Leading by Example

“Leading by Example” is an incredibly powerful phrase, particularly if an institution intends to live up to that statement of purpose. I believe that Giovanni Buttarelli, the new European Data Protection Supervisor, and his Assistant EDPS, Wojciech Wiewiorowski, intend to turn that statement of purpose into action. The EDPS today released their five-year strategy. It… Continue Reading