+Open Data in Society - Don’t Let The Data Revolution Derail Itself
The explosion of data and the power to manipulate it gives intimate insight into people’s lives at a near population scale. This could fundamentally change social policy, just as mapping the human genome has affected medicine. Like medical research this intimate insight at a population scale requires a governance and ethical framework independent of politicians and the executive. It requires radical reform of the existing regulatory institutions and laws and strong international partnerships. With the right framework Britain will have a competitive edge.
It’s salutary to think that we are only at the very beginning of the personal data revolution. The data revolution – call it personalisation, convenience, big data, big brother, my data whatever you will – enables a fundamental change in the relationship between people and organisations. Organisations public and private large and small know what you are doing, where you are, who you are with, how healthy you are and predict what you want and where you are going next in real time. This capability is real today and will only grow in the future. It’s already a commonplace amongst new parents for a social network to show you adverts for baby products before you have told your family you are expecting. Popular new wearable technology can add your heart rate and temperature into the mix - including if rumours are to be believed the next Apple headphones.
The capability is there now and in the future will only increase as we carry, wear and interact with devices connected to networks like the internet. Once this data has been generated by our devices, the power to capture, process, store and share it and create intelligence about a person is readily available in the cloud. It’s hard to imagine where we shall be in five or ten year’s time.
There are huge competitive and societal benefits to be gained for Britain if we can embrace this revolution for the public good. However, rapid, profound, technology driven change across society is always difficult for any political and administrative system to manage. And when people and the media are unsettled by change it’s difficult to maintain people’s confidence as things go wrong unless you have a governance system people can trust.
Britain was, perhaps surprisingly at the forefront of the ‘open data’ revolution. The challenge now is to be at the forefront in it’s exploitation by society in the long term. We already see that the capability of data gatherers, manipulators, processors etc outstrips the ability of the executive and legislature. A series of crass blunders by politicians and civil servants has revealed some very poor decisions about sensitive data that undermine public confidence and that create confusion due to the nuances that lie between open data and shared data.
The ham fisted and at times downright stupid attempts to sell off patient data, HMRC proposals to sell tax data and the largely unheralded sales of pupil data demonstrate an executive and a regulatory framework that isn’t up to the challenges of safeguarding the data revolution in the long term. Public sector actions are at least detectable and politicians can be held to account, but I suspect equally or even more startling data transactions happen out of the public eye and away from scrutiny in the private sector. In the USA Snapchat settled an exchange with the FTC for, according to the FTC, misleading customers on the very core of its service - that pictures were only transitory.
In my view the failings of a largely pre-web, pre-cloud regulatory system at being laid bare. And we need a comprehensive review of the way Britain approaches the benefits and challenge of data in society before confidence is further undermined. It’s an old canard to say that all regulation is bad - good regulation of data that retains public trust can create competitive advantage - if it makes markets more long-term sustainable and creates social benefit.
In the USA President Obama appointed John Podesta (Clinton’s former Chief of Staff) to lead:
a comprehensive review of the way that “big data” will affect the way we live and work; the relationship between government and citizens; and how public and private sectors can spur innovation and maximize the opportunities and free flow of this information while minimizing the risks to privacy.
Podesta reported his first stage recently after 90 days. He has a cabinet level team and is directing work from leading scientists, departments and agencies. In the UK the government’s response to the health data fiasco has been to shuffle the issue into the very long grass of an obscure ‘civil society dialogue’ - see here - and limit discussion to government data sharing not the wider private sector use of data.
Rather than the political leadership on the societal consequences of the data revolution we see in the USA, in the UK the issue is now so toxic no politician will put their name to it.
Yet the government continues to talk up big data as a national priority - David Willets recently announced £73m for academic work and the Turing Institute.
Without a comprehensive review of the data governance frameworks this is like modifying a train to go faster, but without improving its brakes. Eventually it will derail.
A progressive approach to the data revolution would have a reformed regulatory regime and a more active role for government in working with innovators to produce services for social benefit. The focus throughout would be on public benefit, whether generated by companies or government, with a strong ethical dimension and the views of lay people represented. What might a more progressive approach to governance and policy examine in the UK?:
- using public data to empower people, not constrain them. The government’s sales of data to large credit reference agencies, actuaries and market research agencies serves to constrain the options open to citizens and limit their choice. Yet public data can empower people if used by innovators for social good - but the government’s imagination is limited to empty hack days that produce flash in the pan ideas. Ideas that are rarely implemented and almost never at scale - where there is market failure and public intervention a start up in Shoreditch is unlikely to make something in return for coffee and crisps from the Open Data Institute and little else. A progressive approach would be for government to sit down with front line workers and data innovators and fund the building of data driven applications for public good.
- supporting front line workers to help people. Charity and public sector workers have to go through agonies to share data between themselves even when there is clear benefit to people in need. There is a stark contrast to the almost blase approach of central government to sell off colossal, badly anonymised data sets to the private sector about school pupils, patients and tax payers.
- giving people concrete, comprehensible control over their data held by the state and by companies, when they want it. If people are to have control of their own data we need to ensure that the tools they are given to use respond to their needs. If it’s too difficult to control your data, people will keep opting out of doing so and trust will be undermined even if the checks and balances are there to establish it.
- tackling the dangerous lack of understanding of the technical challenges of pseudonymisation and the trends that are undermining it. The government has apparently made a series of startling blunders on pseudonymisation and anonymisation. As technology advances in leaps and bounds and more interconnected data is published, anonymisation and pseudonymisation methods are undermined by the power of computing to join the dots between data sets and identify people. Yesterday’s anonymisation is today's privacy breach.
- how data sharing and sales are co-ordinated and controlled across government
The data revolution in the UK is governed by a regulatory system designed in a pre-cloud, pre-world wide web age. This system needs to be recast to serve a new set of national policy objectives. The pace of change in the scale and scope of data gathering and manipulation can’t be governed by tightly prescriptive laws. The system needs to describe broad objectives and constraints interpreted by an informed, empowered regulator as circumstances change.
If a regime is too complex people lose faith in it. The Data Protection Act framework itself needs radical revision and simplification – Igor Judge QC (Lord Judge) said, when writing a foreword to a guide to the DPA for the judiciary that: ‘This legislation is virtually impenetrable’. Igor Judge went on to become Lord Chief Justice - if he finds data protection law hard to grasp, then no one else has a hope.
The new EU Data Regulation, if it happens, moves things forward from the 1990s but still seems inadequate to cope with the complexities of the data revolution. How the UK chooses to implement this directive and whether the government can influence the directive itself will be crucial.
The Information Commissioners Office is staffed and led by good people who try valiantly to help. But they don’t seem to have the right task, capacity nor structure. Singleton ‘commissioner’ regulators are a rarity in regulation these days - a regulator is better served by being a broadly based board able to represent a wide range of interests. In this case it would be great to have a board of equals with representation from data scientists, the law, an ethicist, some lay people, a small and large company etc. but as independent from the legislature as the current Commissioner.
Regulators with a quasi-judicial role as the ICO has are often inhibited in giving open public advice on draft proposals lest it should fetter their discretion downstream. We need a system where a regulator or court can make judgments and enforce the law, but also give clear, rapid, public guidance when it is asked and frequently appear in the media to reassure the public.
The ICO is under resourced for its current task, but also the future. The Justice Select committee has said that that the ICO needs more money - at present about 20% of the ICO’s income is from MOJ in declining grant in aid. In the ICO’s own annual report they say:
‘The ICO is facing future uncertainty in funding, both in respect of the level of funding and its funding model. The office has made it clear to Government that any additional responsibilities given to it have to be adequately funded.
The well-established ‘polluter-pays’ principle suggests that a regulator should be funded by statutory levy on the biggest data manipulators - this provides capacity and independence. It’s not uncommon to find big regulatees want a better funded, more capable regulator who can manage case-loads quicker and provide more advice and lead to better functioning of the market for all. So Google, HMRC, the police etc pay the most and SMEs pay a notional £1 each to register.
I am writing about the need for reform because I think the benefits are huge. We are at the beginning of a long journey towards a data revolution if we just get out the red flag and parade slowly in front of the innovators we could lose out as a society. But if society loses confidence due to crass errors then we may never reach our destination. To get the right result for Britain we need a political exercise on the scale of Podesta’s in the USA but done in a British context - it’s crass simply to drag and drop american solutions across the Atlantic - the European settlement on data is quite different. But Podesta is clear that he sees an important set of trade issues arising from data and calls for international work - the UK needs to take part in this enthusiastically to shape the EU position.
This article only scratches the surface and is very much my opinion - I am interested in gathering views from readers as part of this digital Government Review. Does the system need a radical overhaul? Are the current policy processes sufficient? Do we need a reformed regulator? What do you think a progressive approach might look like?
Join the debate on @diggovreview or send us your thoughts here