EDPS Opinion: Effective data protection needed for “big data”

On 19 November 2015, the European Data Protection Supervisor published an Opinion on the challenges of “big data”. The Opinion is entitled “A call for transparency, user control, data protection by design and accountability”. The title alone shows how extensive and complicated the issue of big data really is, and squeezing all of these issues into a 21-page document was clearly a major challenge.

The Opinion recognises the significant environmental, social and economic benefits that the collation and analysis of massive amounts of data can bring. However, this brings privacy challenges, even for “anonymous” data, as the flood of data makes it increasingly possible to re-identify individuals in datasets previously believed to have been “anonymised”. This meta-problem sits on top of a set of significant challenges:

• How is it possible to have transparency in a world where the algorithms used to analyse big data are considered to be trade secrets?
• How do we redress the information imbalance between organisations that hold vast amounts of data and the individuals whose data is being processed?
• How can we respond to the demands of big data advocates, who want to store as much data for as long as possible, to permit yet-undiscovered data processing?
• How do we retain the principle that data must be accurate, when much big data processing is about making guesses about what is probably going to happen – in relation to health, possible criminal activity, credit worthiness, etc.?
• Faced with extensive invisible data processing, what will be the chilling effect on creativity and innovation? The dangers of the chilling effects of non-transparent and unpredictable discrimination against non-standard behaviour are described in some detail.

With regard to transparency, the Opinion makes the crucial – and frequently overlooked – point that “the personal data processed in big data contexts are no longer primarily comprised of information that individuals knowingly give to organisations”. In that context, the Opinion argues that the individual must have the right to have access to information in an intelligible form, including the logic on which any output data is based.

The Opinion also goes into a brief but useful description of the nature of consent and opt-out mechanisms which, while relevant in this context, also provides a helpful overview of the issues at stake in wider data protection law. The Opinion argues that the ability of the data subject to use the collected data more meaningfully, this could change the relationship between the individual, their data and the data controller. This would also permit a fairer balance of benefits between the companies and individuals. Furthermore, more data portability would lead to more accountability and more competition and innovation. In the same context, the Opinion also argues that the same innovation effort that is put into data exploitation should be put into user-friendly data controls for the individual.

Under the banner “data protection and privacy by design” the Opinion maintains the privacy-by-innovation theme, arguing that laws, procedures and privacy policies are no longer enough and that a more innovative approach generates a “win-win” situation: “Privacy-friendly engineering can also be invaluable in helping develop new business models for generating value from for example, data stores”.

Finally, the Opinion addresses the question of accountability and, in keeping with the general approach of the document, it stresses the need to have ongoing processes in place, rather than seeing accountability as a one-off exercise.

The Opinion is written in a very compact way, it is very much a summary of a great deal of complex issues and questions. It is certainly a valuable contribution to a debate that is urgently needed.

EDPS Opinion: Meeting the challenges of big data – A call for transparency, user control, data protection by design and accountability (19.11.2015) https://secure.edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/Documents/Consultation/Opinions/2015/15-11-19_Big_Data_EN.pdf

EDPS press release: EDPS encourages a new debate on Big Data (19.11.2015)
https://secure.edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/Documents/EDPS/PressNews/Press/2015/EDPS-2015-11-EDPS_Big_Data_EN.pdf

EDRi paper: An introduction to data protection
https://edri.org/files/paper06_datap.pdf

(Contribution by Joe McNamee, EDRi)