The need to win the trust of citizens and consumers over the use of their data is critical to the transition of the Australian economy to the next phase of industrial development.
How do we demonstrate that data aggregation has widespread benefits for citizens and consumers — and can empower a wide suite of personalised and customised services?
A panel discussion facilitated by Harley Dennett, editor of The Mandarin, brought together the following three experts to explore this question:
- Yvonne Cunnane, Associate General Counsel on Data Protection, Facebook
- Dr Sascha Callaghan, Sydney Law School, University of Sydney
- Miguel Carrasco, Managing Director at Boston Consulting Group
In the final of a four-part series, The Mandarin reports on the discussion and issues of consent, trust and social licence.
Understanding consent
In general terms, people need to have the capacity to consent. As Sascha explained, “They have to have enough information to make the consent meaningful, and they need to be able to make consent in a way that is free. So without force being applied or coercion.”
VIDEO: PANEL DISCUSSION
Join the editor of The Mandarin, Harley Dennett as he facilitates a panel discussion on privacy and consent with Facebook’s associate general counsel on data protection, a privacy lawyer and a business consultant.
At the same time, technology is advancing quickly and traditional approaches to privacy and consent aren’t keeping pace. “The online services that businesses and governments provide are based on a contract between the data subject and the data user, and you agree to the terms and conditions. It assumes that the data subject understands the contract and assumes that the data user can know in advance all the uses of that data. Unfortunately, neither of those two assumptions really hold in today’s modern technology and data and analytics driven world,” said Miguel.
“We really need to think about how can we modernise and update our privacy frameworks and our consent based model to reflect the reality of the world we’re living in.”
Yvonne pointed out the impact of the General Data Protection Regulation (GDPR) in Europe which has been prescriptive about its approach to consent. “It contains a lot of the factors that Sascha mentioned,” said Yvonne. “But it also allows for alternative ways to ensure that the people who we are collecting and processing data from understand what it is we’re collecting and how we’re using it.”
A new environment
For Sascha, the impact of advancing technology means navigating a new environment. “The ability for people to understand the uses of information has increased exponentially, so much so that the old principles have strained to the point of breaking.” She questioned whether a private consent model is the best way of regulating or perhaps there’s scope for a different approach to regulation where we agree on the principles of privacy as a community.
Miguel raised the issue about the global nature of digital platforms and data sitting offshore. “I think the mistake is to try and focus on regulating data as opposed to the uses of data or focusing on the traditional role of government, which is protecting its citizens from harm. We should focus on the potential for harm or the risk, and how you mitigate the risk of harm as opposed to trying to get into the ins and outs of regulating specific bits of data or metadata and who has access to it.”
“People care about harms and benefits not the nuts and bolts. If we’re having a consent model, let’s make it meaningful for people rather than 20 pages of terms and conditions that nobody understands.”
Risks versus benefits
Harley posed the question about how government can best communicate the risks and benefits of data use, particularly in light of the public response to My Health Record.
“The narrative and the public discourse around this didn’t really focus enough on the main benefit of a health record and our ability to analyse and draw insights from all of those health records and see what’s working, what’s not working, which parts of the medical system or the health system should we focus on.” said Miguel. “I think governments need to do a better job of explaining to the community why they are doing the things they’re doing.”
“We need to get that conversation right. And I think the more and more that governments are willing to do that openly and transparently with the public, the more trust they will build.”
Building trust and confidence
For Miguel, the more trust government builds, the more confidence users have that their data is being used appropriately. “At the end of the day, the digital economy is going to be powered by data. If people lose trust and lose confidence, then we’ll miss out on the benefits.”
Sascha saw it as a social process. “When we have a new kind of opportunity which also carries risks, people are naturally wary. And the first part of the process is working out what social expectations are around benefits and harms. There are social norms around what level of risk is acceptable. At various points in history, those risks have become too great to handle and then governments have stepped in.”
Miguel questioned whether trust could in fact become a source of competitive advantage in the same way as trust in consumer pro. “Can we move more to a market based model where companies compete on the basis of the trust that they have been able to build up, that they safely look after the data of the consumers that are interacting with them?”
Putting control in the hands of the user
At Facebook, the emphasis has been to put control in the user’s hands at the right time. “A person goes through a journey when they sign on to Facebook,” said Yvonne. “You’re brought through a number of screens that explain to you about what data we collect, why we collect it, how we’re going to use it. That controlled journey stays throughout your experience on Facebook. We have for a long time been using just in time online notifications.”
“For a long time, we have had a tool that allows you to access the information that we have about you. It’s called subject access rights. We make sure that we allow you very easily in a cost free manner, but also in a secure manner to access the information that we have about you.”
Developing social licence and the need for engagement
According to Sascha, developing social licence needs to involve the community as a whole. “We’re now at the start of a conversation, which is about establishing new social norms and expectations. It’s an amazing opportunity apart from anything else to build a new world of regulated use of the internet where we’re both able to enjoy all of its great benefits, but we also feel safe.
Facebook undertook a series of design jams involving wider stakeholders in preparation for the GDPR. “We had people from the regulatory community, the data protection authorities, other government stakeholders, academics, service users. It brought all of these diverse views together to realise that there’s no one easy solution and that you have to take everyone’s view on boards to come up with a solution that would work best for society. And the best way to do that is to sit down and talk to each other.”
It was the first time Yvonne had experienced this approach. “I’m actually quite proud of where we landed it because it was quite challenging. For us lawyers, it’s very easy to write pages of documents and feel like we’ve done a great job. But to get it into a short form that meets all of the legal requirements is an achievement.”
Government needs to keep pace with other industries in developing trust and social licence especially when it comes to personal identity data. At the same, any approach from government needs to be inclusive and not leave people behind. “An opt-in model where you have to actively manage your privacy settings and give is by its very nature going to benefit the educated, the literate, the digitally savvy. And probably not protect perhaps the people who most need it.” said Miguel.
“People talk about the fourth industrial revolution. It is a fundamental step change. And we have to face that and say, well, how are we going to make sure as a society we are building the community that we want, that we’re building the economy that we want, and building in fairness?
