1 of 30

Collective data governance

Jeni Tennison ▪ @JeniT

2 of 30

2

Is this going to be useful for me?

What else might they use the data for?

How will it affect my use of email?

Should I be worried?

Will I be safe?

How might my choices affect other people?

I recently had to set up a new email address, and that meant having to make some choices about which of Google’s “smart features” I wanted to activate.

I knew that these would involve Google processing data from my email and potentially elsewhere such as my calendar.

I was left trying to figure out not only how it would affect me personally (would it be useful, would they target me somehow with it, how it would affect how I used email) and larger questions such as whether my choices would affect other people.

Even as a well-educated, technically savvy, data-aware person, these choices were difficult to make.

I have no idea if I made the “right” ones for current me, or future me, or the people I correspond with, or the wider economic, societal, democratic or environmental context.

I was left feeling uneasy and concerned that I might have made the wrong choice, and guilty that I didn’t spend more time working out what the right choice would have been.

3 of 30

73% of people in the US �think how companies collect information to target ads is an unjustified use of people's private information (WaPo – Shar)

30% of people in the UK �trust the government to use personal data about them ethically (YouGov – ODI)

3

4 of 30

What’s going wrong
What we need
How we get there

4

5 of 30

What’s going wrong

5

6 of 30

We have individualised decisions about data

6

7 of 30

… but we’re not good at making them

7

8 of 30

8

Kröger, Jacob Leon and Lutz, Otto Hans-Martin and Ullrich, Stefan, The Myth of Individual Control: Mapping the Limitations of Privacy Self-management (July 7, 2021). Available at SSRN: https://ssrn.com/abstract=3881776

This diagram is from an excellent paper by Kröger, Lutz and Ullrich that summarises many of the issues with individualising choices about data:

Despite widespread concern for privacy, people are forced or compelled to widely disclose personal data about themselves via consent. This sustains the narrative that people are not interested in privacy, which influences social norms around their privacy choices. It also leads to unaccounted-for externalities on other people and society.

The informedness and rationality of privacy choices (e.g. consent, privacy settings, permissions) are impaired by data subject time constraints, knowledge gaps and cognitive biases; and by the overwhelming complexity, lack of transparency and practical obstacles to presenting privacy information in modern data collection and processing.

Privacy choices aren't voluntary because data controllers nudge and coerce, offer financial incentives, make non-negotiable agreements for services data subjects are dependent on, and provide uniform privacy practices.

Finally, regulatory blind spots undermine the scope and effectiveness of those choices.

9 of 30

… but data is processed in aggregate

9

10 of 30

10

Viljoen, Salome, A Relational Theory of Data Governance (November 11, 2020). Yale Law Journal, Forthcoming, Available at SSRN: https://ssrn.com/abstract=3727562 or http://dx.doi.org/10.2139/ssrn.3727562

Salomé Viljoen’s paper on a relational theory of data governance spells out how the nature of data processing has changed since individual-focused data protection regulation was first introduced.

It used to be that organisations would just look at data about one individual when making choices about them, such as whether to provide a bank loan. Now, organisations use data about groups and whole populations when making those decisions. They examine what people who are similar to you have done in the past, and use that to make predictions about what you might do in the future.

This means, while we might not realise it, we have become connected by data: that our individual choices affect others.

When we are asked to make decisions about data in isolation, according to our interests, we actually need to care about other people as well.

11 of 30

… but data has collective impacts

11

12 of 30

12

Lisa-Maria Neudert & Philip N. Howard, Ready to vote: elections, technology & political campaigning in the United Kingdom (16 October 2019) Oxford Technology & Elections Commission (OxTEC), Available from: https://oxtec.oii.ox.ac.uk/publication/ready-to-vote/

We know and have seen that the way data is used has broader implications as well: effects on our democracy, our economy, and our environment.

There has been much discussion of the degree to which big political decisions, such as Trump’s election and the Brexit referendum, were influenced by micro-targeted adverts that disrupt the democratic process.

We have seen how our economies are dominated by big tech companies, whose power is supported by the amount of data they have and how they use it. Think about how Amazon uses data to get into an advantageous position in markets for physical goods. Or how the use of data at an individual level in the insurance market affects our ability to spread risk collectively. Or the impacts of personalised pricing on who gets the opportunity to participate in the market.

And we know that data collection and processing has a wider environmental effect, with about 3.7% of carbon emissions being the result of digital technology (see https://theshiftproject.org/en/article/lean-ict-our-new-report/)

These are broader externalities that need to be addressed collectively, rather than hoping that our individual decisions will somehow factor in these collective interests.

13 of 30

What we need

13

14 of 30

Collective data governance

14

15 of 30

… deciding what we do with data

What data is collected
How data is used
Who data is shared with
When data is deleted

15

16 of 30

… determining our choice architectures

What can individuals control?
What are the defaults?
How are the options and controls presented?

16

17 of 30

Participatory processes

Independent boards

Data institutions

Democratic data decisions

17

Collective data governance approaches will look different in different places.

We already have decisions that are made democratically about data: things like the fact that data protection laws say data should be shared in life-or-death situations (vital interests), or that we should participate in the census every 10 years. However imperfectly, these decisions should reflect societal norms because democracy.

There are also already approaches that use “independent” research and ethics boards to determine who can get access to data and what they can do with it. These boards should have representatives that can at least give some input on behalf of the communities affected by the use of data. We see this most in health, where patient representatives are often included on such boards.

People are also experimenting with participatory processes such as citizen juries and assemblies to gather information about how the public feel about different kinds of uses of data. The challenge here is how the findings of those exercises are mapped into changes in practice. All too often it seems that citizens say one thing and the organisations who should listen to them do another.

Finally, there are new forms of institution being set up – institutions such as data trusts, unions, cooperatives and so on – which aim to provide a collective locus for decisions about data.

All of these work in different ways and have different advantages and disadvantages: citizen juries are out of reach for many small organisations, for example, and not all decisions can be made at a parliamentary level. There is no one-size-fits-all answer, but these are approaches to experiment with and try out.

18 of 30

Good governance for legitimacy

Transparency about process and results
Accountability with third-party scrutiny
Routes for appeal around decisions
Routes for redress around impact

18

19 of 30

How we get there

19

20 of 30

Putting community at the heart of data narratives, practices and policies

21 of 30

Changes to the narrative
Changes to practice
Changes to public policy

21

22 of 30

Changes to the narrative

All the public �knows to ask for is �control and ownership

22

23 of 30

Messages and metaphors

What ways of talking about collective data governance will resonate?

Making it personal
Retargeting the blame for the privacy paradox
Creating analogies with other domains

23

The big challenge is how to make the collective data governance story resonate when the intuitive response that people have is towards individual ownership and controls.

At Connected by Data we’re working on the messages and metaphors that we hope will resonate with the public. A nice example is the Vox piece https://www.vox.com/future-perfect/22916602/ai-bias-fairness-tradeoffs-artificial-intelligence

We need to find stories that make the collective impact personal, because personal stories are what resonates. Stories have to turn collective impacts, for example based on race, into specific discrimination of individuals.

The prevailing narrative makes the privacy paradox – the gap between what we say we want and how we act – our responsibility as individuals. We need to retarget that:

Highlighting the choice architectures of privacy controls, and the length of T&Cs
Highlighting when individuals don’t have choices, for example with the Crisis Text Line, or with access to government services
Drawing the analogy with climate action, where companies have pushed responsibility onto individuals to avoid it themselves

We can also create analogies with the way that we govern other aspects of our life, such as food or housing, to show that in a lot of places where there might be important negative consequences from us making the “wrong” choices, the bad choices are taken off the table through regulation.

24 of 30

Changes to practice

Organisations don’t know how to do effective public participation

24

25 of 30

Good practices

How can organisations involve the public in �data governance?

Using appropriate approaches for the context
Using the results to change behaviour
Communicating to give legitimacy

25

Organisations need to have guidance and tools to help them to adopt good practices for involving the public.

They need to know which approaches are appropriate in their particular context. The type of data governance question being asked (eg its granularity), the size and capacity of the organisation, and the established governance mechanisms already in place are all going to affect what’s needed.

The ineffectiveness of current approaches is highlighted by how hard it is to follow the thread of public participation exercises into practical changes to organisational behaviour around data. Not having these clear pathways undermines trust in these approaches.

There’s also a challenge of communication. Even when decisions are made by effective representative bodies such as ethics committees, they are easy to question.

26 of 30

Changes to the public policy

UK data protection changes provide �an opportunity

26

27 of 30

Legitimate interests

How can we insert�collective interests and increase legitimacy?

Broaden scope to consider community and societal impacts
Require community participation in balancing test
Require transparency around balancing test

27

One opportunity is around the legitimate interests lawful basis for processing. This lawful basis enables organisations to balance their interests in processing data against individual privacy interests.

There is an opportunity to both make legitimate interests a more legitimate lawful basis (ie one that is recognised as trustworthy, rather than being thought of as a way organisations cover up what they’re doing with data) and to enable it to incorporate other interests than the organisation and the individual.

We could broaden its scope to enable organisations to consider community, societal and other wider interests.

We could require organisations have community participation when they are performing the balancing test, so that it isn’t just the organisation making the decision on its own behalf.

And we could require transparency around both the decision making process and the results of the balancing test, to build trust with those affected by it.

28 of 30

Cross-sector learning

How are individual and collective interests balanced and protected �in other sectors?

Food safety
Consumer goods
Housing development
Public health
Stewardship of the commons

28

29 of 30

For discussion…

How should we talk about collective data governance, particularly with politicians?
What participation practices work well?
How can collective data governance be encouraged through public policy?

29

30 of 30

Thank you

@JeniT ▪ jeni@connectedbydata.org