When you have no right to privacy, Data Protection law governs the organisations respect for your information. It should not be Data Utility vs Privacy, but Data Protection and Data Utility.
The terms data protection and privacy are often used interchangeably. Recently I have seen a high number of articles about “COVID-19 Symptom tracking Apps” and in the privacy community they all say the same – “is the loss of our privacy worth it?” It’s tempting to look at it this way, and as Data Protection legislation is based on fundamental human rights legislation and principles, these are indeed worthy questions.
It is always a societal balancing act, when considering the needs of the many vs the few, or the one.
It is clear in times of emergency, civil liberties can sometimes be suspended for “the greater good”, and the current “lockdown” with Police powers to enforce it is a clear example of this. We all accept that it is for our protection in the “greater good”, but no one wants to awake from a subsided pandemic into a “new normal” of a Surveillance led Police state similar to an Orwellian 1984 Big Brother. Power, once shifted and obtained is no easily set aside by Governments. It only takes a look at the US Government “Patriot Act” that was passed for a limited time in response to the 9/11 terrorist attacks, that has been consistently renewed by successive governments ever since. I’m reminded of Star Wars, where the Empire began with an unscrupulous Chancellor using emergency powers granted during a time of war to create an oppressive power hungry regime. Yes, fantasy, but if our fiction is a mirror to our society, it is clear these are concerns that we all share.
As soon as I see technological surveillance being normalised, such as workplaces monitoring employee attention on remote web conference calls, or CCTV and Drone use being utilised to keep individuals in their place, I naturally recoil, and the libertarian in me seeks to object to the direction that our new surveillance society is taking.
But where does the law stand? “Privacy” is not really mentioned in our current law, and instead we use the term “Data Protection”. Often I see these terms used incorrectly as synonyms. Privacy is not the same as Data Protection law. Why?
The answer lies in this simple statement:
Data Protection law still applies, even when you have zero right to Privacy.
Let’s take it back a bit. Privacy, and your human right to it, is more of a synonym for “Secrecy”, or your right not control if your personal data is disclosed or not. Clearly we can’t live in a society where we live in Secret. We have to transact our personal information in order to contract with businesses, lead productive social lives, contribute to society, pay our taxes etc etc. This means our right to privacy changes depending where we go and what we do. Clearly we have a large amount of privacy surrounding sexual practices in the privacy of our own home. We have much less expectation of privacy in a busy high street, acting in our business capacity at work, or if we hold public office, or we use our persona to cultivate a celebrity status. Privacy is changeable and varied, and it depends where we are and what context we do it in. It is also not consent based in the majority of cases, as we cannot say “no” to having our data collected for tax, for a legal obligation, or deny law enforcement access where they have genuine need to investigate crime. In the majority of cases, we may have little or no right to privacy or real choice over our data collection.
This is actually why Data Protection law is so important, as it sets rules and principles for when our privacy should be respected or when it should not.
It does this by requiring organisations to have a legal basis for holding personal data, which defines the strength of the power between them and the organisation. Clearly if a law requires the company to hold the data they have little rights to privacy, but if relying on something like consent, the individual holds much more power – but either way, the organisation still needs to comply with their data protection legal obligations. Most importantly where we do not have a right to privacy Data Protection law sets up responsibilities for those that hold it. Data Protection law goes far beyond the scope of Privacy, but defining the safeguards in place for the proper use of the data for those that hold it. Let’s consider some key parts of Data Protection Law, summarised as follow;
- Use Justification (legal basis)
- Transparency (privacy notices)
- Collection Limitation (minimum necessary to the purpose)
- Use Limitation (only used for the purposes notified)
- Accuracy (ensuring data is up to date and
- Storage Limitation (held no longer than necessary)
- Security (appropriate technological and organisations controls)
- Individual Participation (allowing individuals rights such as access to a copy, rectification etc)
- Transfer limitation (kept in countries/organisations with appropriate safeguards)
- Accountability (appropriate documentation kept to demonstrate compliance)
There is much more to Data Protection law obligations than just these (controlling third parties, privacy impact assessments, privacy by design, etc etc), but I would argue, these have less to do with Privacy itself and more to do with practical Information governance and data management, examining the flows of the data and ensuring appropriate controls and safeguards have been designed in to ensure peoples data is treated with respect and only the minimum used where strictly necessary.
So let’s return to our examples of these “COVID19 symptom tracking apps”. Clearly I can think of public interest reasons where we need to sacrifice individual privacy for the greater good, and wider public health. However, trust is key. We must all be cautious to ensure that any of these solutions is carefully planned out in accordance with the principles above, with properly conducted Privacy Impact assessments giving rise to controls that protect our personal data, and by extension – us. The data should be used only where strictly necessary, with minimum data collected, appropriate safeguards to minimise risks to the individual, deleted when no longer strictly necessary, and used for no other purposes that those originally identified and specified at the time of collection. This is a far greater challenge than a simple “Yes/No” to the invasion of privacy, but instead reasoned justification and practical data management measures will win the day, providing great societal benefit and protection g the individual simultaneously.
It is not therefore Privacy vs Benefit, but Data Protection and Benefit. A positive sum, win win solution, that benefits everyone, both individually and society as a whole.
Ralph T O’Brien, Principal, www.reinboconsulting.com
