Written evidence submitted by Big Brother Watch (BIG0006)

About Big Brother Watch

Big Brother Watch is a civil liberties and privacy campaign group founded in 2009. We produce unique research which exposes the erosion of civil liberties in the UK, looks at the dramatic expansion of surveillance powers, the growth of the database state and the misuse of personal information.

Specific to this consultation Big Brother Watch has produced several reports on the protection of personal information, including NHS Data Breaches and Local Authority Data Losses.[1][2]

Big Brother Watch has previously submitted written evidence on big data to the Competition and Markets Authority and the Science and Technology Committee. We have also given oral evidence to the Committee covering the use of social media data and the future applications of biometric data.

Key Points

1. Whilst big data can have benefits there are also a number of risks.
2. Safeguards and deterrents need to be increased to prevent the misuse of personal information.
3. The public have a basic understanding that their personal data is collected, but more clarity is needed. Especially regarding terms and conditions and privacy policies.

Terms of Reference as outlined by the Select Committee

1. The opportunities for big data, and the risks.
2. Whether the Government has set out an appropriate and up-to-date path for the continued evolution of big data and the technologies required to support it.
3. Where gaps persist in the skills needed to take advantage of the opportunities, and be protected from the risks, and how these gaps can be filled.
4. How public understanding of the opportunities, implications and the skills required can be improved, and ‘informed consent’ secured.
5. Any further support needed from Government to facilitate R&D on big data, including to secure the required capital investment in big data research facilities and for their ongoing operation.

Big Brother Watch’s response will focus on points 1, 2 and 4. An informed response to points 3 and 5 would require specialised knowledge that is not within our remit.

Response

1. The opportunities and risks posed by big data

Overview

The term “big data” is a coverall expression lacking a definitive definition. Big Brother Watch understands a common definition to be:

A large and potentially complex collection of data for which normal data processing would not work. 

However, there is also reference to big data as a term used to describe data collection with the intention of further analysis, insights and interpretation.

The Information Commissioner’s Office provides the following definition:

“Big data is a way of analysing data that typically uses massive datasets, brings together data from different sources and can analyse the data in real time. It often uses personal data, be that looking at broad trends in aggregated sets of data or creating detailed profiles in relation to individuals.”[3]

Whether big data poses opportunities or risks depends on the intentions of those manipulating the data.

The volume of personal information gathered and stored on databases is set to increase due to the development of the Internet of Things. This presents possible opportunities for larger datasets, data mining and data analysis to researchers, planners, advertisers, governments and business. Considering the risks, as well as the opportunities that big data presents, is critical for big data to be a privacy safe and useful analytical tool.

Opportunities

The perceived opportunities created by big data are well documented. In 2014 the Parliamentary Office of Science and Technology identified a number of sectors which they felt could benefit from the use of big data, including business, crime and security, and biomedical research.[4]

As with any new technology, the utility and benefits can be overstated. The Big Data Opportunity: Making Government Faster, Smarter and More Personal notes that “big data is not a silver-bullet solution for all the difficult economic, statistical and analytical challenges governments face”.[5]

Risks

The collection of big data raises a number of concerns, particularly in relation to data protection, privacy, consent, and the quality of the data.

Data Protection:

As soon as data is collected it has to be stored. Risks associated with data storage include:

• Whether the data be encrypted.
• Whether it be held in secure servers in the country of origin or in cloud facilities outside of the UK. 
• What access will be permitted to the data and to whom and for what purpose.
• How long the data will be retained for

The Data Protection Act 1998 (DPA) sets out the legal requirements for data controllers and data processors. The DPA lists eight data protection principles which govern the processing and handling of data on identifiable living people.[6] With regard to big data, the ICO published a document entitled Big Data and Data Protection[7] which sets out their position on the issue. They state that:

“One key data protection requirement is to ensure that processing of personal data is fair, and this is particularly important where big data is being used to make decisions affecting individuals. Fairness is partly about how personal data is obtained. Organisations need to be transparent when they collect data, and explaining how it will be used is an important element in complying with data protection principles. The complexity of big data is not an excuse for failing to obtain consent where it is required.”

The analytical benefits of big data pose questions about how the requirements of the DPA, namely that data only be processed for the purpose with which it is acquired, are adhered to.  It is vital that any organisation or individual who wishes to acquire or work with large data sets for analytical purposes, are fully trained and understand the data protection laws.  Too often data breaches occur due to a lack of understanding or poor training within organisations.  As the UK currently offers no provision for punishment beyond the threat of a fine, the risk of large scale data breaches of big datasets occurring with no adequate punishment, is of concern and requires urgent attention.

Adequate safeguards are addressed further in response to question 2.

Privacy:

An attraction of big data is the opportunity for data comparison, correlation and analysis which requires access to more than one dataset.  When comparing multiple datasets, if the data has not been anonymised this runs the risk of identification occurring.  The threat to an individual’s privacy is ever present where data gathering and data correlation is concerned.

Take the honeypot effect for example.  The term “honeypot” is regularly used in relation to large scale and centralised databases and the temptation for potential misuse particularly if the data is sensitive and if security of the database is lax. 

Rt Hon David Davis MP warned of the risks of large scale databases particularly with regard to the care.data scheme. Mr Davis highlighted that by putting the sensitive and highly personal medical records of all citizens on the internet could lead to the “the Department for Health [being placed] in a position where they have a honeypot of data”.[8]

Without proper consideration, any collection of big data can provide temptation for exploitation.

Anonymisation and re-identification

To prevent the temptation of abuse towards big data sets, anonymisation is often used to reassure the public that their data is safe. Yet even where anonymisation has been used the data is not 100% secure from re-identification.  The term anonymised therefore is a red herring, only implying protection, but little to no protection of privacy is actually guaranteed.

Taking an anonymised dataset and linking it with another anonymised or open data set can lead to individuals or groups of individuals being re-identified with relative ease. As even the most basic dataset can often contain personally identifiable information, including name, address, date of birth, gender, ethnicity and/or personal information, including health data, financial data, and social networks, analysis and correlation of these data sets can lead to re-identification which raises serious privacy concerns.

Re-identification and research

There have been numerous calls for our medical records to be digitised, anonymised and stored centrally so they can be made available to third parties when requested. The argued benefit being improved medical care and health research.

At the same time that the Health and Social Care Act 2012 was proposing changes to how our medical records are stored and accessed, the Royal Society published Science as an Open Enterprise, which warned that “the security of personal records in databases cannot be guaranteed through anonymisation procedures” and that “computer science has now demonstrated that the security of personal records in databases cannot be guaranteed through anonymisation procedures where identities are actively sought.”[9]

An example of the ease of re-identification was made in the 1990’s when the Massachusetts Group Insurance Commission in the USA released the data of every hospital visit made by employees of the state to researchers.  They claimed the data was “anonymised” as personally identifiable information like name, address and social security number had been removed.   The move was supported by the then Governor who publicly assured the employees that their data was protected and that their privacy was guaranteed.

However a computer science student decided to test the anonymity statement.  By purchasing the voter roll she simply combined the data, including name, address and social security number, with the medical records released by the Commission.  By establishing the date of birth of the governor she was able to whittle the records down to six people, half of which were men and only one of which had the same zipcode as the Governor.  Using this simple method she easily identifed the supposedly anonymised data of the Governor, including the diagnoses and prescriptions he had received.[10]

Re-identification and commercial interest

One commercial interest in big data is targeted advertising and the potential to increase revenue through analysis of people’s online habits.  Examples of individuals being identified with varying degrees of accuracy are becoming increasingly common in the commercial world. 

Target, the American chain of shops, correlate the shopping habits of their customersbefore using “predictive analytics” on the data in order to target a customer with advertising of products they may wish to buy in the future.  Famously they sent a teenage girl marketing materials relating to pregnancy which were based on a series of seemingly disconnected purchases she had made, including vitamins, soap and cotton balls.  By correlating the data Target predicted that the girl was pregnant.  They knew of her pregnancy before her father, who discovered he was about to be a grandfather when he saw the coupons for baby products Target had sent to his daughter.

The methodology used by Target was raised in the study Big Data and Due Process: Toward a Framework to Redress Predictive Privacy Harms, which highlighted two areas of concern. Firstly, that customers would not know or provide consent for their data to be used in this way and secondly, that new personally identifiable information was being created by Target’s datasets.[11]

Consent:

Consent is critical.  When an individual signs up to a service or agrees to hand over personal information it must be made clear what the data will be used for and by whom.  Whilst there has been some improvement in this area with companies being more precise with terms and conditions and privacy policies, a great deal more work is required. 

The issue of consent is addressed further in response to question 3.

Quality of the data:

Finally it should be noted that data quality remains a concern. IBM notes that there are four criteria which lead to data quality. They argue that this is “an essential characteristic that determines the reliability of data for making decisions”:[12]

• Complete: all relevant data is linked
• Accurate: common data problems (typos, misspellings) are cleaned up
• Available: required data is accessible on demand; users do not need to search manually
• Timely: up to data information is available

Placing all the eggs in one big data basket may in the long term produce data solutions which are questionable at best and entirely inaccurate at worse.

2. What more needs to be done to support the development of big data?

Trust

It is vital that people can trust that the information they provide will be kept secure and will be handled correctly. Should something go wrong; should the data be lost, breached, hacked or stolen it is important that the data controller and the data processor demonstrate that appropriate action is being taken quickly.  It is critical that the individual is informed of the problem as soon as it is identified.  This is not always the case. 

Adequate Safeguards

The current safeguards, namely the Data Protection Act 1998 (DPA) are severely outdated.  If big data is to evolve in a privacy friendly way, it is vital that the government properly considers how to mitigate any potentially harmful incidents. This is being addressed by the EU Data Protection Regulations and Directive, which is currently going through the trialogue process. However, if the preliminary schedule is adhered to, the earliest that these changes will be made is 2018. In the meantime data will continue to grow exponentially.

UK law in this area focuses on Section 55 of the DPA.  Section 55 provides no real deterrent to those seeking to misuse personal information as the largest penalty which can be imposed is a financial fine.

In addition, Section 55 infringements are currently civil rather than criminal offences, meaning any penalty would not result in a criminal record. This has raised concerns that an offence could be committed by an individual and future employers would be unaware of the fact.

A solution would be for custodial sentences to be an available punishment for the worst data offences.  This measure is already on the statute book in the form of Section 77 of the Criminal Justice and Immigration Act 2008. 

If enacted, Section 77 would introduce prison terms of up to 2 years for this type of crime.

Whilst we acknowledge that there are concerns from journalists about this measure, enacting Section 77 has garnered support from the Information Commissioner’s Office,[13] the Home Affairs Select Committee, [14]the Justice Select Committee,[15] Lord Leveson[16], the findings of the Shakespeare Review[17] and the Joint Committee on the Draft Communications Data Bill.[18]

In a data concentrated world, the current penalty arrangements do little to deter and/or provide an appropriate punishment for a data breach, loss, hack or theft.  As the world moves to ever more connected devices and data being the fuel of technology, a change should be considered with urgency.

Anonymisation standard

Anonymisation of data needs to be addressed comprehensively.  Whilst acknowledging that this is complex, there are methods which deal effectively with anonymisation and protecting people from re-identification when data is analysed, correlated and linked. 

There are a number of methods that are presented as solutions to protecting anonymised datasets. One method which is seen as being more tried and tested than the others is differential privacy.  Differential privacy aims to ensure that the results derived from a dataset would look the same whether a person’s data was included in the dataset or not. This is achieved by adding noise to the dataset in a way which does not interfere with the accuracy or outcome of results.[19]

In 2011 a research paper written by Microsoft stated that "Differential privacy thrives because it is natural, it is not domain-specific, and it enjoys fruitful interplay with other fields". It went on to say "this flexibility gives hope for a principled approach to privacy in cases, like private data analysis, where traditional notions of cryptographic security are inappropriate or impracticable."[20]

Despite the academic enthusiasm for differential privacy it is a system that is rarely deployed.  Whilst differential privacy may not be a silver bullet, it certainly requires greater research and further exploration to establish it as a method aimed at addressing privacy concerns.

3. Public understanding of big data and informed consent.

Public Understanding

Polling commissioned by Big Brother Watch in 2015 showed that a large proportion of the public believe they are being harmed by the collection of their data by large companies. 46% of people were of this opinion, compared to 19% who disagreed and 14% who didn’t know. This would indicate that people understand that their data is being collected but see little personal benefit.[21]

The same polling showed a significant support (74%) for individuals having robust control of their own data. The principle of ‘informed consent’ also gained support, with 58% of those sampled stating that companies should ask permission every time they want to use personal data.[22]

Those polled were also damning of the current data collection practices of companies, with 79% being either very or fairly concerned about their privacy online.[23]

Clearly, prior to data being collected people need to be informed of what data will be involved, what will happen to it and who will have access to it.

Informed Consent

Terms and conditions are the primary mechanism for obtaining consent, with some companies also producing a privacy policy.  There are a number of examples which show that these documents are more often than not lengthy and confusing.

The length and jargon contained in these documents confuses customers, meaning they are rarely read and in turn leave people unaware of what they are giving their consent to.

Gamestation, a computer game shop, used customers’ acceptance of incomprehensible terms and conditions to include a clause permitting the company to collect the souls of their customers. 88% of customers agreed to the terms, presumably having either not read them or having failed to fully understand them.

F-Secure, a security and cloud storage provider, launched a campaign in September 2014 to highlight this problem, by creating several Wi-Fi hotspots around London. Buried within the terms and conditions was a so-called ‘Herod’ clause which, despite meaning that they were promising their firstborn to F-Secure, was accepted by a number of people.[24]

There has been a backlash against this, with projects like Terms of Service; Didn’t Read summarising a number of terms and conditions from popular websites and giving them a ranking based on how beneficial they are to the consumer as well as how understandable they are.[25]

Recent developments indicate that some companies are addressing the issue. Facebook has updated its privacy policy, cutting the word count by 70%[26]. Simplenote, a company which provides digital note taking services, has ensured that its terms and conditions are only 140 words written in plain English.[27] Although the length of a policy will be dictated by the service, it should be best practice to word them as simply as possible.

Simplifying these documents should not, however, mean continuing bad privacy practice.  Companies must understand that simple agree or disagree options are no longer reasonable. As we become more dictated to by technology, it is unlikely to be as simple as a yes or no to using an essential service.  It is critical that the user is presented with a more granular level of choice; offering options regarding what data can be shared, with whom, and providing more detail on what impact those choices will have on the product/service.  We note that many mobile apps are making the user options clearer but more work should be encouraged in this area.

A report commissioned by US President Barack Obama emphasised the importance of clarity on the use of data. The report’s author John D. Podesta, then Counselor to the President, called for an extension of privacy laws to ensure that data is used only for specific purposes.[28]

Conclusion

The increased use of big data presents a number of opportunities to improve services and assist innovation. The associated dangers however cannot be ignored; all of which will be easier to solve sooner rather than later.

An education campaign needs to be undertaken to ensure the public understand how big data works and what the implications are for them and their personal information. Ensuring that terms and conditions are clear and easily understandable is a start, but more needs to be done to encourage companies to be more granular with the options and for consumers to engage more with what the choices are and what they mean.

The public need to be able to trust that their data will be kept secure and that there is adequate provision to deal with data breaches when they occur, this will require a comprehensive look at existing legislation and decisions to be made about the possibility of enacting Section 77 of the Criminal Justice and Immigration Act 2008, or discussion on drafting an alternative.

September 2015