The United Kingdom is at a crossroads. On the verge of Brexit, it has to decide where it stands in relation to privacy: will it loosen data protection regulation, moving more towards China’s model, or will it guarantee its citizens’ right to privacy, moving more towards a Californian approach and securing a data adequacy agreement with the EU? It would be a mistake to choose the former.
Last month, the UK published its national data strategy. Oliver Dowden, the digital secretary, wrote that under the UK’s strategy, “Data and data use are seen as opportunities to be embraced, rather than threats against which to be guarded.” No one doubts there are welcome opportunities in data, but to overly focus on the potential benefits of data and neglect the threats that the collection and use of personal data entail would be unwise.
One might reasonably start to worry about the UK opting for too insecure an approach when the strategy refers to tackling barriers to data, which, it states, range from “legal barriers (real and perceived) through to cultural blockers and risk aversion”. The worry might magnify in light of No 10 chief adviser Dominic Cummings’ views on data. Not only did he support the vast collection of personal data for the purposes of the Vote Leave campaign; he has also described the EU’s general data protection regulation (GDPR) as “horrific” and “idiotic”.
Countries with poor data protection laws typically fall into two categories: underdeveloped or authoritarian. Given its hard-won reputation of being on the side of progress and anti-authoritarianism, it would be unfortunate if the UK was associated with either of those. But there is a third possibility when it comes to bad data practices that is just as unpalatable. The UK could develop into a data haven, in the way some countries are tax havens.
A data haven would be a country involved in “data washing”, being willing to host data acquired in unlawful ways (eg without proper consent or safeguards) that is then recycled into apparently respectable products. Data washing would be something a host country would do for those engaging in “ethics dumping”, a term used to describe the malpractice of exporting unethical research activities to countries with poor regulation. Data hosted in data havens, in addition to being used for seemingly acceptable products, could also be used for illegitimate or questionable purposes (eg training spyware, such as facial recognition algorithms, which then gets sold to the highest bidder, including authoritarian regimes). Data washing would involve the UK allowing companies and governments the world over to do their dirty data work under its protection in exchange for money. Allowing the UK to develop into a data haven could turn into a privacy catastrophe with huge financial and reputational damage to Britain.
The future is heading towards more privacy, not less. Europe and California are on the right side of history regarding this. The United States is discussing privacy bills and will likely soon develop more stringent federal privacy laws. After many years of unhinged optimism in Silicon Valley and the data economy, we are realising that trading in personal data is much more dangerous than we could ever have imagined. Personal data is poisoning individuals, by exposing us to data harms such as public humiliation, identity theft and discrimination. It is also poisoning societies by undermining equality, autonomy and democracy.
We are not being treated as equal citizens when we are treated on the basis of what our personal data says about us. Privacy is what can blindfold the system to ensure we are treated impartially. Through personalised content and ads, and the trade in personal data, loose privacy laws are enabling algorithms to predict and influence our behaviour, and to make crucial decisions about our life with little if any oversight or accountability. There are good reasons why we have spent centuries developing privacy norms and laws; these are not “unnecessary” barriers. The erosion of privacy in the past two decades has created profound asymmetries of power that are tugging at the seams of our societies.
If the UK doesn’t take privacy seriously…
Privacy 2024 Recap – some significant decisions, slow progress for reform
The past year saw a few court decisions of note as well as halting progress toward privacy…
Schrems II Judgment Day
The Court of Justice of the European Union (“CJEU“) issued its judgment today in …
