For avoidance of doubt, I created this video – or rather I wrote the subtitles to add to the original. It’s a parody based on the great movie Downfall, and follows a whole series of parodies made over the years…
Paul Bernal
UPDATE: I wrote a blog about why I created this parody – and why parodies are a good idea, for OpenDemocracy. It can be found here.
The latest piece of health data news, that, according to the Telegraph, the hospital records of all NHS patients have been sold to insurers, is a body-blow to the care.data scheme, but make no mistake about it, the scheme was already in deep trouble. Last week’s news that the scheme had been delayed for six months was something which a lot of people greeted as good news – and quite rightly. The whole project has been mismanaged, particularly in terms of communication, and it’s such an important project that it really needs to be done right. Less haste and much more care is needed – and with the latest blow to public confidence it may well be that even with that care the scheme is doomed, and with it a key part of the UK’s whole open data strategy.
The most recent news relates to hospital data – and the details such as we know them so far are depressingly predictable to many of those following the story for a while. The care.data scheme relates to data currently held by GPs – the new scandal relates to data held by hospitals, and suggests that, as the Telegraph puts it:
“a report by a major UK insurance society discloses that it was able to obtain 13 years of hospital data – covering 47 million patients – in order to help companies “refine” their premiums.”
That is, that the hospital data was given or sold to insurers not in order to benefit public health or to help research efforts, but to help business to make more money – potentially to the detriment of many thousands of individuals, and entirely without those individuals’ consent or understanding. This exemplifies some of the key risks that privacy campaigners have been highlighting over the past weeks and months in relation to the care.data – and adds fuel to their already partially successful efforts. Those efforts lay behind the recently announced six month delay – and unless the backers of care.data change their approach, this last story may well be enough to kill the project entirely.
Underestimating the community
One of the key features of the farrago so far has been the way that those behind the project have drastically underestimated the strength, desire, expertise and flexibility of the community – and in particular the online community. That community includes many real experts, in many different fields, whose expertise strike at the heart of the care.data story. As well as many involved in health care, there are academics and lawyers whose studies cover privacy, consent and so forth who have a direct interest in the subject. Data protection professionals with real-life knowledge of data vulnerability and the numerous ways in which the health services in particular have lost data over the years – even before this latest scandal. Computer scientists, programmers and hackers, who understand in detail the risks and weaknesses of the systems proposed to ‘anonymise’ and protect our data. Advocates and campaigners such as Privacy International, the Open Rights Group and Big Brother Watch who have experience of fighting and winning fights against privacy-invasive projects from the ID card plan to the Snoopers Charter.
All of these groups have been roused into action – and they know how to use the tools of a modern campaign, from tweeting and blogging to making their presence felt in the mainstream media. They’ve been good at it – and have to a great degree caught the proponents of care.data on the hop. Often Tim Kelsey, the NHS National Director for Patients and Information and leader of the care.data project, has come across as flustered, impatient and surprised at the resistance and criticism. How he reacts to this latest story will be telling.
Critical issues
Two specific issues have been particularly important: the ‘anonymisation’ of the data, and the way that the data will be sold or made available, and to whom. Underlying both of these is a more general issue – that people DO care about privacy, no matter what some may think.
“Anonymisation”?
On the anonymisation issue, academics and IT professions know that the kind of ‘de-identification’ that care.data talks about is relatively easily reversed. Academics from the fields of computer science and law have demonstrated this again and again – from Latanya Sweeney as far back as 1997 to Arvind Narayanan and Vitaly Shmatikov’s “Robust De-anonymization of Large Sparse Datasets” in 2008 and Paul Ohm’s seminal piece in 2009 “Broken Promises of Privacy: Responding to the Surprising Failure of Anonymization”. Given this, to be told blithely by NHS England that their anonymisation system ‘works’ – and to hear the public being told that it works, without question or doubt, naturally raises suspicion. There are very serious risks – both theoretical and practical that must be acknowledged and taken into account. Right now, they seem to either be denied or glossed over – or characterised as scaremongering.
The sale or misuse of data
The second key issue is that of the possible sale and misuse of data – one made particularly pertinent by the most recent revelations, which have confirmed some of the worst fears of privacy campaigners. Two factors particularly come into play. The first is that the experience of the last few years, with the increasing sense of privatisation of our health services, makes many people suspicious that here is just another asset to be sold off to the highest bidder, with the profits mysteriously finding their way into the pockets of those already rich and well-connected. That and the way that exactly who might or might not be able to access the data has remained apparently deliberately obscure makes it very hard to trust those involved – and trust is really crucial here, particularly now.
Many of us – myself included – would be happy, delighted even, for our health data to be used for the benefit of public health and better knowledge and understanding, but far less happy for our data to be used primarily to increase the profits of Big Pharma and the insurance industry, with no real benefit for the rest of us at all. The latest leak seems to suggest that this is a distinct possibility.
The second factor here, and one that seems to be missed (either deliberately or through naïveté) is the number of other, less obvious and potentially far less desirable uses that this kind of data can be put to. Things like raising insurance premiums or health-care costs for those with particular conditions, as demonstrated by the most recent story, are potentially deeply damaging – but they are only the start of the possibilities. Health data can also be used to establish credit ratings, by potential employers, and other related areas – and without any transparency or hope of appeal, as such things may well be calculated by algorithm, with the algorithms protected as trade secrets, and the decisions made automatically. For some particularly vulnerable groups this could be absolutely critical – people with HIV, for example, who might face all kinds of discrimination. Or, to pick a seemingly less extreme and far more numerous group, people with mental health issues. Algorithms could be set up to find anyone with any kind of history of mental health issues – prescriptions for anti-depressants, for example – and filter them out of job applicants, seeing them as potential ‘trouble’. Discriminatory? Absolutely. Illegal? Absolutely. Impossible? Absolutely not – and the experience over recent years of the use of black-lists for people connected with union activity (see for example here) shows that unscrupulous employers might well not just use but encourage the kind of filtering that would ensure that anyone seen as ‘risky’ was avoided. In a climate where there are many more applicants than places for any job, discovering that you have been discriminated against is very, very hard.
This last part is a larger privacy issue – health data is just a part of the equation, and can be added to an already potent mix of data, from the self-profiling of social networks like Facebook to the behavioural targeting of the advertising industry to search-history analytics from Google. Why, then, does care.data matter, if all the rest of it is ‘out there’? Partly because it can confirm and enrich the data gathered in other ways – as the Telegraph story seems to confirm – and partly because it makes it easy for the profilers, and that’s something we really should avoid. They already have too much power over people – we should be reducing that power, not adding to it.
People care about privacy
That leads to the bigger, more general point. The reaction to the care.data saga so far has been confirmation that, despite what some people have been suggesting, particularly over the last few years, people really do care about privacy. They don’t want their most intimate information to be made publicly available – to be bought and sold to all and sundry, and potentially to be used against them. They have a strong sense that this data is theirs – and that they should be consulted, informed, and given some degree of control over what happens to it. They particularly don’t like the feeling that they’re being lied to. It happens far too often in far too many different parts of their lives. It makes them angry – and can stir them into action. That has already happened in relation to care.data – and if those behind the project don’t want the reaction to be even stronger, even angrier, and even more likely to finish off a project that is already teetering on the brink, they need to change their whole approach.
A new approach?
Finding a way?
Will they be able to do this? I am not overly optimistic, particularly as my only direct interaction with Tim Kelsey has been on Twitter where he first accused me of poor journalism after reading my piece ‘Privacy isn’t selfish’ (I am not and have never presented myself as a journalist – as a brief look at my blog would have confirmed) and then complained that a brief set of suggestions that I made on Twitter was a ‘rant’. I do rant, from time to time, particularly about politics, but that conversation was quite the opposite. I hope I caught him on a bad day – and that he’s more willing to listen to criticism now than he was them. If those behind this project try to gloss over the latest scandal, and think that this six month delay is just a chance for them to explain to us that we are all wrong, are scaremongering, don’t understand or are being ‘selfish’, I’m afraid this project will be finished before it has even started. Things need to change – or they may well find that care.data never sees the light of day at all.
The community needs to be taken seriously – to be listened to as well as talked to – and its expertise and campaigning ability respected. It is more powerful than it might appear – if it’s thought of as a rag-tag mob of bloggers and tweeters, scaremongerers, luddites and conspiracy theorists, care.data could go the way of the ID card and the Snoopers Charter. Given the potential benefits, to me at least this could be a real shame – and an opportunity lost.
The importance of privacy is often downplayed. It sometimes seems as though privacy is viewed as something bad, something inherently selfish, something that ‘good’ people don’t need or really want – or at the very least are willing to sacrifice for the greater good. To me, that displays a fundamental misunderstanding of privacy and of the role it plays in society. Privacy isn’t selfish – though it is sometimes used for selfish means – it’s one of the crucial elements of a functioning society. We all need privacy – and not just for our personal, individualistic needs, but to be able to function properly in society. We need to have our privacy respected – and we need to respect others’ privacy.
Two current stories exemplify both the importance of privacy and the way that the arguments often get skewed: the debate over mass surveillance of the internet, and the issue of the ‘opening up’/’selling off’ of health data from the NHS (the ‘care.data’ story).
Mass surveillance and selfishness
The argument here (which I’ve discussed before, most recently here) is that the only reason to oppose mass surveillance is to protect your own, individual and selfish personal privacy. As ‘good’ people have ‘nothing to hide’, they’ve got ‘nothing to lose’ by sacrificing this individual, selfish concern for the greater good. As Sir Malcolm Rifkind put it:
“There is a balance to be found between our individual right to privacy and our collective right to security.”
The implication of Rifkind’s words is pretty clear – the collective right to security is more important. It’s ‘collective’ rather than ‘individual’ – and hence altruistic rather than selfish. There are many holes in the argument. Surveillance impacts upon rights that are far from individual or selfish – chilling free speech (and the right of others to hear your speech), limiting rights to assemble and associate both offline and online and more. It creates a power imbalance between those who have the information (in this case the authorities) and those about whom the information is held (in this case each and every one of us) which ultimately undermines pretty much every element of how our society functions. That’s why police states are so keen on surveillance and information gathering – it gives them control. It’s not just selfish to want to avoid that kind of control – it’s for the good of the society as a whole.
Furthermore, the idea that only those who have ‘something to hide’ should be concerned about privacy is in itself fundamentally flawed. People don’t just want to hide ‘bad’ or ‘discreditable’ information – and privacy isn’t just about ‘hiding’ things either. Privacy is about autonomy – about the ability to have at least an element of control over what information about them is made available to whom. Some information you might be happy to share with your friends but not with your parents, your employers or the government. What you might want to share can change over time – even the nicest things are often best held back for your own reasons. It’s not selfishness – it’s humanity.
Health data and selfishness
The parallels between the care.data debate and the debate over mass surveillance may not be immediately apparent, but the two issues are closer than they might seem. The argument goes broadly like this: those who are objecting to the sharing of health data are selfishly worrying about a minuscule risk to their own, individual privacy and should be sacrificing that selfishness to the collective good created by the sharing of health data. Just as for mass surveillance, the balance suggested is between an almost irrelevant selfishness and a general and bountiful good created by the sharing of health data.
Again, I think this argument is misstated – though perhaps not as clearly as with mass surveillance. The first thing to say is that the risk to individual privacy is not minuscule. The suggestion by the proponents of the system is that because the data is ‘anonymised’ then privacy is protected. The problem is that anonymisation, both theoretically and practically, has generally been shown to be ineffective. ‘Anonymous’ records can be deanonymised – and individual, personal and deeply private information can be extracted.
The next question is whether making this data available will actually benefit the ‘collective good’. The assumption that seems to be being made – the image being presented – is that the data will go to research laboratories developing cures for terrible diseases. If we don’t let this data be shared in this way, we’ll stop them developing cures for currently incurable cancers and so forth. The reality appears likely to be quite different – one key aim seems to be to sell the data to drug companies and insurance firms. Both of these aims need to be handled with a great deal of care.
As for mass surveillance, the ultimate result may well be more about a transfer of power from individuals to organisations that may well be far from benevolent. A society where those in control of health care – and in particular access to health care (either to services or to drugs) have complete informational control over individuals is in some ways just as bad (and remarkably similar) to one where authorities have informational control over people. In a society like that in the UK where there is increasing and creeping privatisation of health services this is particularly worrying. Being concerned about this isn’t selfishness.
A more privacy friendly society?
In both cases, it is important to understand that we’re not left with just one choice. This isn’t black and white. It’s not ‘mass surveillance or anarchy’, or ‘complete health data sharing or a collapse in public health’. It really is about balance – but finding the balance should be based on a more appropriate and accurate analysis of the issues. For mass surveillance we need to look more carefully at the impact of that surveillance, and ask for more evidence of the collective benefit.
For health data we need to look more carefully – much more carefully – at the risks of deanonymisation. And, if we can ameliorate those risks appropriately, we need to set the terms of the ‘opening up’/’selling off’ of the data in a way that benefits society. Drug companies should only get access to that information if they make appropriate commitments to make the drugs they develop available in forms and at prices that benefit society – and the NHS in particular. For insurance companies the terms should be even tougher – if they should be allowed access at all.
Most of all, though, we need to have a proper debate about this, and the case needs to be made. Anyone who has received the care.data leaflet through their door (mine came last week) should be shown how much it shows only one side of the argument. This is a critical moment – for both health data and surveillance. What we do now will be very hard to reverse, not just for us but for future generations. To care about them is the opposite of selfishness.
Today, Saturday February 23rd 2013, is International Privacy Day. To mark it, I’ve done a re-boot of an old blog post: ‘Privacy is not the enemy’. The original post (which you can find here) came back in December 2011, after I attended an ‘open data’ event organised by the Oxford Internet Institute – but it’s worth repeating, because those of us who advocate for privacy often find themselves having to defend themselves against attack, as though ‘privacy’ was somehow the enemy of so much that is good.
Privacy is not the enemy
Privacy advocates are often used to being in a defensive position – trying to ‘shout out’ about privacy to a room full of avid data-sharers or supporters of business innovation above all things. There is a lot of antagonism. Those we speak to can sometimes feel that they are being ‘threatened’ – some of the recent debate over the proposed reform of the Data Protection regime has had very much that character. And yet I believe that many of those threatened are missing the point about privacy. Just as Guido Fawkes is wrong to characterise privacy just as a ‘euphemism for censorship’ (as I’ve written about before) and Paul McMullan was wrong to suggest to the Leveson Inquiry that ‘privacy is for paedos’, the idea that privacy is the ‘enemy’ of so many things is fundamentally misconceived. To a great extent the opposite is true.
Privacy is not the enemy of free expression – indeed, as Jo Glanville of Index on Censorship has argued, privacy is essential for free expression. Without the protection provided by privacy, people are shackled by the risk that their enemies, those that would censor them, arrest them or worse, can uncover their identities, find them and do their worst. Without privacy, there is no free expression. The two go hand-in-hand, particularly where those without ‘power’ are concerned – and just as privacy shouldn’t just be something available for the rich and powerful, free speech shouldn’t only be available to those robust enough to cope with exposure.
Privacy is not the enemy of ‘publicness’ – in a similar way, to be truly ‘public’, people need to be able to protect what is private. They need to be able to have at least some control over what they share, what they put into the public. If they have no privacy, no control at all, how can they know what to share?
Privacy is not the enemy of law enforcement – privacy is sometimes suggested to be a tool for criminals, something behind which they can hide behind. The old argument that ‘if you’ve got nothing to hide, you’ve got nothing to fear’ has been exposed as a fallacy many times – perhaps most notably by Daniel Solove (e.g. here), but there is another side to the argument. Criminals will use whatever tools you present them with. If you provide an internet with privacy and anonymity they’ll use that privacy and anonymity – but if you provide an internet without privacy, they’ll exploit that lack of privacy. Many scams related to identity theft are based around taking advantage of that lack of privacy. It would perhaps be stretching a point to suggest that privacy is a friend to law enforcement – but it is as much of an enemy to criminals as it is to law enforcement agencies. Properly implemented privacy can protect us from crime.
Privacy is not the enemy of security – in a similar way, terrorists and those behind what’s loosely described as cyberwarfare will exploit whatever environment they are provided with. If Western Law enforcement agencies demand that social networks install ‘back doors’ to allow them to pursue terrorists and criminals, you can be sure that those back doors will be used by their enemies – terrorists, criminals, agents of enemy states and so forth. Privacy International’s ‘Big Brother Inc’ campaign has revealed the extent to which surveillance products developed in the West are being sold to despotic and oppressive regimes – in an industry worth an estimated $5 billion a year. It’s systematic, and understandable. Surveillance is a double-edged sword – and privacy is a shield which faces many ways (to stretch a metaphor beyond its limits!). Proper privacy protection works against the ‘bad guys’ as well as the ‘good’. It’s a supporter of security, not an enemy.
Privacy is not the enemy of business – though it is the enemy of certain particular business models, just as ‘health’ is the enemy of the tobacco industry. Ultimately, privacy is a supporter of business, because better privacy increases trust, and trust helps business. Governments need to start to be clear that this is the case – and that by undermining privacy (for example though the oppressive and disproportionate attempts to control copyright infringement) they undermine trust, both in businesses and in themselves as governments. Privacy is certainly a challenge to business – but that’s merely reflective of the challenges that all businesses face (and should face) in developing businesses that people want to use and are willing to pay money for.
Privacy is not the enemy of open data – indeed, precisely the opposite. First of all, privacy should make it clear which data should be shared, and how. ‘Public’ data doesn’t infringe privacy – from bus timetables to meteorological records, from public accounts to parliamentary voting records. Personal data is just that – personal – and sharing it should happen with real consent. When is that consent likely to be given? When people trust that their data will be used appropriately. When will they trust? When privacy is generally in place. Better privacy means better data sharing.
All this is without addressing the question of whether (and to what extent) privacy is a fundamental right. I won’t get into that here – it’s a philosophical question and one of great interest to me, but the arguments in favour of privacy are highly practical as well as philosophical. Privacy shouldn’t be the enemy – it should be seen as something positive, something that can assist and support. Privacy builds trust, and trust helps everyone.
———————————-
Over the time since I first wrote this post, privacy has if anything become bigger news that it was. If Facebook launches a new product (e.g. Graph Search, about which I wrote here and here), it makes privacy a centre-piece of the launch, regardless of the true privacy impact of the product. Apple has now put privacy settings into iOS for its iPhone and iPad. Privacy is big news! Let’s mark International Privacy Day by reminding ourselves that privacy is not an enemy – the opposite….
I wrote a piece for the Open Rights Group’s online zine, ORGzine, about the right to be forgotten…. a kind of ‘right to be forgotten for dummies’…
You can find it here:
http://zine.openrightsgroup.org/features/2012/the-right-to-be-forgotten
I attended the Oxford Institute event ‘Anonymity, Privacy and Open Data’ yesterday, notable amongst other things for Professor Ross Anderson’s systematic and incredibly powerful destruction of the argument in favour of ‘anonymisation’ as a protection for privacy. It was a remarkable event, with excellent speakers talking on the most pertinent subjects of the day in terms of data privacy: compelling stuff, and good to see so many interesting people working in the privacy and related fields.
And yet, at one point, one of the audience asked a question about whether a group like this was not too narrow, and that by focussing on privacy we were losing sight of other ‘goods’ – he was thinking particularly of medical goods, as ‘privacy’ was seen as threatening the possibility of sharing medical data. I understood his point – and I understood his difficulty, as he was in a room to a great extent full of people interested in privacy (hardly surprising given the title of the event). Privacy advocates are often used to the reverse position – trying to ‘shout out’ about privacy to a room full of avid data-sharers or supporters of business innovation above all things. A lot of antagonism. A lot of feelings about being ‘threatened’. And yet I believe that many of those threatened are missing the point about privacy. Just as Guido Fawkes is wrong to characterise privacy just as a ‘euphemism for censorship’ (as I’ve written about before) and Paul McMullan is wrong to suggest that ‘privacy is for paedos’, the idea that privacy is the ‘enemy’ of so many things is fundamentally misconceived. To a great extent the opposite is true.
Privacy is not the enemy of free expression – indeed, as Jo Glanville of Index on Censorship has argued, privacy is essential for free expression. Without the protection provided by privacy, people are shackled by the risk that their enemies, those that would censor them, arrest them or worse, can uncover their indentures, find them and do their worst. Without privacy, there is no free expression.
Privacy is not the enemy of ‘publicness’ – in a similar way, to be truly ‘public’, people need to be able to protect what is private. They need to be able to have at least some control over what they share, what they put into the public. If they have no privacy, no control at all, how can they know what to share?
Privacy is not the enemy of law enforcement – privacy is sometimes suggested to be a tool for criminals, something behind which they can hide behind. The old argument that ‘if you’ve got nothing to hide, you’ve got nothing to fear’ has been exposed as a fallacy many times – perhaps most notably by Daniel Solove (e.g. here), but there is another side to the argument. Criminals will use whatever tools you present them with. If you provide an internet with privacy and anonymity they’ll use that privacy and anonymity – but if you provide an internet without privacy, they’ll exploit that lack of privacy. Many scams related to identity theft are based around taking advantage of that lack of privacy. It would perhaps be stretching a point to suggest that privacy is a friend to law enforcement – but it is as much of an enemy to criminals as it is to law enforcement agencies. Properly implemented privacy can protect us from crime.
Privacy is not the enemy of security – in a similar way, terrorists and those behind what’s loosely described as cyberwarfare will exploit whatever environment they are provided with. If Western Law enforcement agencies demand that social networks install ‘back doors’ to allow them to pursue terrorists and criminals, you can be sure that those back doors will be used by their enemies – terrorists, criminals, agents of enemy states and so forth. This last week has seen Privacy International launch their ‘Big Brother Inc’ database, revealing the extent to which surveillance products developed in the West are being sold to despotic and oppressive regimes. It’s systematic, and understandable. Surveillance is a double-edged sword – and privacy is a shield which faces many ways (to stretch a metaphor beyond its limits!). Proper privacy protection works against the ‘bad guys’ as well as the ‘good’. It’s a supporter of security, not an enemy.
Privacy is not the enemy of business – though it is the enemy of certain particular business models, just as ‘health’ is the enemy of the tobacco industry. Ultimately, privacy is a supporter of business, because better privacy increases trust, and trust helps business. Governments need to start to be clear that this is the case – and that by undermining privacy (for example though the oppressive and disproportionate attempts to control copyright infringement) they undermine trust, both in businesses and in themselves as governments. Privacy is certainly a challenge to business – but that’s merely reflective of the challenges that all businesses face (and should face) in developing businesses that people want to use and are willing to pay money for.
Privacy is not the enemy of open data – indeed, precisely the opposite. First of all, privacy should make it clear which data should be shared, and how. ‘Public’ data doesn’t infringe privacy – from bus timetables to meteorological records, from public accounts to parliamentary voting records. Personal data is just that – personal – and sharing it should happen with real consent. When is that consent likely to be given? When people trust that their data will be used appropriately. When will they trust? When privacy is generally in place. Better privacy means better data sharing.
All this is without addressing the question of whether (and to what extent) privacy is a fundamental right. I won’t get into that here – it’s a philosophical question and one of great interest to me, but the arguments in favour of privacy are highly practical as well as philosophical. Privacy shouldn’t be the enemy – it should be seen as something positive, something that can assist and support. Privacy builds trust, and trust helps everyone.
Paul Bernal's Blog 