58
Big data and data protection
20140728
Version: 1.0
36
simplistic. Research commissioned by the International
Institute of Communications
65
shows that people’s willingness
to give personal data, and their attitude to how that data will
be used, is context-specific. That context depends on a number
of variables, eg how far an individual trusts the organisation,
what information is being asked for, etc. Furthermore, people
use various strategies to protect their privacy when giving their
personal data. The Boston Consulting Group
66
found that for
75% of consumers in most countries, the privacy of personal
data remains a top issue, and that young people aged 18-24
are only slightly less cautious about the use of personal online
data than older age groups.
- Complex algorithms
114.
The view that it is too hard to explain the algorithms perhaps
stems from a misunderstanding of the purpose of a privacy
notice. The DPA does not require the privacy notice to describe
how the data is processed (ie the technical details of how the
algorithms work), but the purposes for which it is processed.
The DPA is also clear that processing cannot be fair if people
are deceived or misled about those purposes
67
.
- Unforeseen purposes
115.
If there is a problem about privacy notices in a big data
context, it is not really about the complexity of the analytics
but rather about uses of their data that individuals concerned
would not expect. The ability to analyse data for different
purposes, such as using the location of mobile phones to plot
movements of people or traffic is an important characteristic -
and a benefit - of big data analytics. If an organisation has
collected personal data for one purpose and then starts to use
that personal data for a completely different purpose, it needs
to update its privacy notice accordingly and ensure that people
are aware of this. Furthermore, the idea that in a big data
context it is not possible to tell people about the possible uses
of their data needs to be challenged. In general terms, big data
65
International Institute of Communications. Personal data management: the
user’s perspective. International Institute of Communications, September 2012.
http://www.iicom.org/open-access-resources/doc_details/226-personal-data-
management-the-users-perspective Accessed 25 June 2014
66
Rose, John et al. The trust advantage: how to win with big data. Boston
Consulting Group November 2013.
https://www.bcgperspectives.com/content/articles/information_technology_strate
gy_consumer_products_trust_advantage_win_big_data/ Accessed 25 June 2014
67
Data Protection Act 1998 Schedule I Part II
56
Big data and data protection
20140728
Version: 1.0
37
analytics allows data to be used in innovative ways, but this
does not mean that an organisation cannot foresee what use it
is going to make of that data, and tell people about it.
116.
If what was originally personal data is being used in an
anonymised form, this does not necessarily mean that the
organisation can ignore this when it is writing a privacy notice.
Given the complexity of big data analytics, the processing is
potentially opaque, and it may not be readily apparent to
people whether their personal data is being used. It may
therefore be helpful in particular cases not only to tell people
what is being done with their personal data, but also to tell
them when their personal data is not being used, ie if the data
is anonymised for analysis. This helps to dispel some of the
mystery surrounding big data, and this openness may help to
build trust in the analytics.
EU General Data Protection Regulation
117.
The proposed EU General Data Protection Regulation
68
contains
a number of provisions that would have a bearing on the use of
personal data in big data analytics. We have published our
detailed comments
69
on the proposed Regulation elsewhere,
here we draw out some specific points relevant to big data. In
particular, these points relate to: data minimisation and the
anonymised data; an onus on data controllers to justify the
processing; the need for transparency; building in data
protection by design and default; a shift in the balance of
power; and a possible extension of data protection duties to
organisations outside the EU.
118.
The principle of data minimisation and the need for
organisations to justify their processing of personal data
emerge strongly in the proposed regulation. Personal data
must be “limited to the minimum necessary in relation to the
purposes for which they are processed” and shall only be
68
European Commission. Proposal for a Regulation of the European Parliament
and of the Council on the protection of individuals with regard to the processing
of personal data and on the free movement of such data (General Data Protection
Regulation) COM(2012) 11 final. European Commission. 25 January 2012
http://ec.europa.eu/justice/data-
protection/document/review2012/com_2012_11_en.pdf Accessed 25 June 2014
69
Information Commissioner. Proposed new EU Data Protection Regulation:
article-by-article analysis paper. ICO, February 2013.
http://ico.org.uk/news/~/media/documents/library/Data_Protection/Research_an
d_reports/ico_proposed_dp_regulation_analysis_paper_20130212_pdf.ashx
Accessed 25 June 2014
52
Big data and data protection
20140728
Version: 1.0
38
processed “if and as long as the purposes could not be fulfilled
by processing information that does not involve personal
data”(article 5 (c)). Similarly, personal data must be “kept in a
form which permits identification of data subjects for no longer
than is necessary for the purposes for which the personal data
are processed”. Furthermore, the ‘right to be forgotten’ under
article 17 means that data subjects can obtain the erasure of
personal data if it is no longer necessary for the purposes for
which they were collected or processed. The recent judgment
of the European Court of Justice in the case of Google Spain
70
,
made under the current Directive (which the DPA implements),
also supports this direction of travel.
119.
This challenges the idea that personal data can be collected
and stored in case it might be useful in some future analysis.
Instead, organisations would have to justify why they are
collecting and holding personal data. Furthermore, these
provisions would encourage them to use anonymised data for
the analytics unless it is necessary to use data that identifies
individuals.
120.
The Regulation places a notable emphasis on transparency. We
have already discussed the need for organisations carrying out
big data analytics to be as transparent as possible, including
the role of privacy notices, in the section on Transparency and
privacy information. Under the proposed Regulation, the data
controller would need “transparent and easily accessible
policies” on processing personal data, and communicate with
data subjects in “an intelligible form, using clear and plain
language, adapted to the data subject” (article 11). We expect
this provision would mean that, where big data analytics
involve novel or unexpected processing, data controllers should
actively alert people to this. The privacy notice would also be
expected to contain more detail than at present, including how
long the personal data will be stored and whether the data
controller intends to transfer the personal data outside the
European Economic Area (article 14). However, it remains to
be seen how practicable it would be to communicate all of the
stipulated information in some of the contexts in which big data
is gathered.
70
Google Spain SL and Google Inc v Agencia Espaňola de Protección de Datos
and González C-131/12.
http://curia.europa.eu/juris/document/document.jsf?text=&docid=152065&pageI
ndex=0&doclang=en&mode=lst&dir=&occ=first&part=1&cid=243691 Accessed
25 June 2014
55
Big data and data protection
20140728
Version: 1.0
39
121.
The Regulation also proposes practical measures to protect
privacy rights. It includes a specific requirement to build in
“data protection by design and default” (article 23). Data
controllers would have to implement mechanisms to ensure
that throughout the analytics only the minimum amount of
personal data is used and is kept no longer than needed for the
processing. They would also have to carry out a privacy impact
assessment (article 33). This reflects some of the
developments we have noted in the section on Tools for
compliance and they have an important role in trying to ensure
that the processing of personal data in the analytics is not
unfair, excessive or unwarranted. In terms of practical
measures, the Regulation also refers to data portability and to
certification, which we discuss further in the section on The role
of third parties.
122.
Big data is sometimes characterised as a power relationship
that favours corporations and governments
71
. The Regulation
suggests a desire to shift the balance of power in favour of the
individual by giving them more explicit rights over the
processing of their personal data. The individual would have a
right to object to processing carried out for certain purposes
(article 19) and the right not to be subject to automated
profiling which has “legal effects” on them or “significantly
affects” them (article 20). What constitutes a significant effect
is open to question, but these provisions are potentially
relevant to the processing of personal data in big data
analytics.
123.
This desire is also reflected in the provisions dealing with
consent as a condition for processing personal data. Under
article 7, consent cannot provide a legal basis for the
processing where there is a “significant imbalance” between the
position of the data controller and that of the data subject. This
supports the requirement that consent must be freely given
(article 4), but it is arguable that an imbalance would not
necessarily mean that people cannot give genuine consent.
124.
The Regulation would also extend the scope of data protection
to apply to data controllers outside the EU that are processing
the personal data of people in the EU, if the processing relates
to offering them goods or services or monitoring their
behaviour (article 3). In principle this could extend the scope
71
Richards, Neil M and King, Jonathan Three paradoxes of big data 66 Stanford
Law Review Online 41 3 September 2013
http://www.stanfordlawreview.org/online/privacy-and-big-data/three-paradoxes-
big-data Accessed 25 June 2014
Documents you may be interested
Documents you may be interested
