Taking back control

Taking back control

• 1.
  Taking back controlArights-based approach to the gathering, processing and holding of personal data in the online environment
• 2.
  Two questions:To whatextent is the Internet a ‘public’ space to roam and enjoy?To what extent is personal data ‘ours’?
• 3.
  Three connected issues:Thegathering of personal dataThe processing and utilisation of personal dataThe holding of personal data
• 4.
  Data gatheringWithout ourknowledge?Without our permission?Without our understanding?
• 5.
  Data gatheringThe beginningof a solution:The right to roam the Internet with privacy
• 6.
  A change inassumptionsA new default: no data gatheringThe fundamental tools of the Internet should be available without data gathering
• 7.
  How could thiswork?E.g. for a search engine, two search boxes:‘Basic’ search, without data gathering‘Super’ search, with data gathering and tailoringOne big questions:What are the ‘fundamental tools’ of the Internet?
• 8.
  Data processing andutilisationInstant utilisation – tailored advertising, tailored contentSubsequent utilisation – the impact of profiling
• 9.
  Data processing andutilisationThe beginning of a solution:The right to monitor the monitors
• 10.
  A change inapproach to consentConsent is not one-off, but continuousData gatherers must continually alert you to the fact that gathering is taking placeThe opportunity to turn the monitoring OFF and to revoke consent must be providedLinks to information and options to gathering and use must be provided
• 11.
  How could thiswork?A little alert box, flashing up to indicate when something is happening, allow the option to click on/off, or link to further informationUse the communicative opportunities of the internet – and its immediacyConsent in ‘real time’.
• 12.
  Data holdingThe beginningof a solution:The right to delete data
• 13.
  A change inassumptionsThe default: data CAN be deletedHolding data is a privilege, not a rightPutting data minimisation into the hands of the individual
• 14.
  When can dataNOT be deleted?Paternalistic reasons – e.g. medical dataCommunitarian reasons – e.g. criminal recordsAdministrative reasons – e.g. tax records, electoral rollsArchival reasons – but strictly controlledSecurity reasons – strictly controlled
• 15.
  How could thiswork?Immediate access to data held should be provided – with the option to deleteData deletion should be simple and direct – not complex or opaqueCould be combined with the monitoring of monitors
• 16.
  Three connected rightsTheright to roam with privacyThe right to monitor the monitorsThe right to delete
• 17.
  Why rights?What isneeded is not detailed law, but a change in paradigmChanges in the net are driven by business models more than by lawBusinesses are sensitive to the perceptions of the publicInternet businesses are cross-jurisdictional, but can set worldwide standards
• 18.
  Rights in balanceTheneeds to business and governments must balance with those of individualsAll these rights are subject to balance - and where necessary may be overriddenBoth businesses and individuals need to be able to trust and use the net - clear and appropriate rights can help build that trust
• 19.
  Business models inbalanceWith rights in place, business models will changeIf data gathering must be notified and may be refused, models reliant on secret gathering won’t be createdIf a user can delete data, models reliant on long-term holding of data won’t be usedIf businesses have to gain consent, then users must be gaining benefits if they are to gain that consent
• 20.
  Taking back controlArights-based approach to the gathering, processing and holding of personal data in the online environmentPaul Bernal: p.a.bernal@lse.ac.uk