Taking back control
- 1. Taking back controlA rights-based approach to the gathering, processing and holding of personal data in the online environment
- 2. Two questions:To what extent is the Internet a ‘public’ space to roam and enjoy?To what extent is personal data ‘ours’?
- 3. Three connected issues:The gathering of personal dataThe processing and utilisation of personal dataThe holding of personal data
- 4. Data gatheringWithout our knowledge?Without our permission?Without our understanding?
- 5. Data gatheringThe beginning of a solution:The right to roam the Internet with privacy
- 6. A change in assumptionsA new default: no data gatheringThe fundamental tools of the Internet should be available without data gathering
- 7. How could this work?E.g. for a search engine, two search boxes:‘Basic’ search, without data gathering‘Super’ search, with data gathering and tailoringOne big questions:What are the ‘fundamental tools’ of the Internet?
- 8. Data processing and utilisationInstant utilisation – tailored advertising, tailored contentSubsequent utilisation – the impact of profiling
- 9. Data processing and utilisationThe beginning of a solution:The right to monitor the monitors
- 10. A change in approach to consentConsent is not one-off, but continuousData gatherers must continually alert you to the fact that gathering is taking placeThe opportunity to turn the monitoring OFF and to revoke consent must be providedLinks to information and options to gathering and use must be provided
- 11. How could this work?A little alert box, flashing up to indicate when something is happening, allow the option to click on/off, or link to further informationUse the communicative opportunities of the internet – and its immediacyConsent in ‘real time’.
- 12. Data holdingThe beginning of a solution:The right to delete data
- 13. A change in assumptionsThe default: data CAN be deletedHolding data is a privilege, not a rightPutting data minimisation into the hands of the individual
- 14. When can data NOT be deleted?Paternalistic reasons – e.g. medical dataCommunitarian reasons – e.g. criminal recordsAdministrative reasons – e.g. tax records, electoral rollsArchival reasons – but strictly controlledSecurity reasons – strictly controlled
- 15. How could this work?Immediate access to data held should be provided – with the option to deleteData deletion should be simple and direct – not complex or opaqueCould be combined with the monitoring of monitors
- 16. Three connected rightsThe right to roam with privacyThe right to monitor the monitorsThe right to delete
- 17. Why rights?What is needed is not detailed law, but a change in paradigmChanges in the net are driven by business models more than by lawBusinesses are sensitive to the perceptions of the publicInternet businesses are cross-jurisdictional, but can set worldwide standards
- 18. Rights in balanceThe needs to business and governments must balance with those of individualsAll these rights are subject to balance - and where necessary may be overriddenBoth businesses and individuals need to be able to trust and use the net - clear and appropriate rights can help build that trust
- 19. Business models in balanceWith rights in place, business models will changeIf data gathering must be notified and may be refused, models reliant on secret gathering won’t be createdIf a user can delete data, models reliant on long-term holding of data won’t be usedIf businesses have to gain consent, then users must be gaining benefits if they are to gain that consent
- 20. Taking back controlA rights-based approach to the gathering, processing and holding of personal data in the online environmentPaul Bernal: p.a.bernal@lse.ac.uk