Data Protection, Perceptions & Trust

The 12 months to June 2022 were unique for many reasons. The end of lockdown restrictions in the UK, the first full period following transition from the EU, and world events including the war in Ukraine, the new visa route for Hong Kong British Nationals (Overseas) and resettlement of Afghans have all contributed to record levels of immigration. In this Blog, ONS’s Jay Lindop examines the impact of these events and looks ahead to what the future holds for international migration estimates.

Better Statistics CIC (BSC) is a social enterprise founded by the three directors Tony Dent, Phyllis Macfarlane and Iain MacKay. As its name implies, the purpose of Better Statistics CIC is to campaign for more reliable statistics, whether produced by private companies or by public bodies. By ‘better statistics’ we mean more trustworthy, useful to more people, of good quality and readily accessible.

The Information Commissioners Office (ICO) has launched a new data analytics toolkit, designed to help those in data analytics roles understand the data privacy considerations they should be thinking about when working in this area. The toolkit allows users to answer a series of questions to generate a tailored report that highlights key areas to focus on from a data protection perspective based upon the responses.

The toolkit doesn’t necessarily introduce anything new, but it’s a set of common-sense principles and a useful tool to get a sense of the issues that need to be thought through, especially if used in early stages of a new data analytics initiative.

In a statement the ICO said: “The Information Commissioner’s Office (ICO) is urging all organisations considering using data analytics on personal data to look at its new toolkit. It is vital that data protection is built in from the start when using data analytics to process personal data. This is not only the law but it’s a crucial step to gaining public trust and confidence in the technology and how your organisation is using people’s data. The ICO’s new toolkit takes organisations through some of the key data protection points they need to think about from the outset of any project they are planning to undertake involving data analytics and personal data.”

This guidance, developed by the Information Commissioners Office (ICO), covers what the ICO think is best practice for data protection-compliant Artificial Intelligence (AI), as well as how it interprets data protection law as it applies to AI systems that process personal data.

An interesting white paper from Bristows law firm to understand the way the UK views AI and robotics to see what the current level of understanding is of the technology. It also explores the privacy and data protection implications of AI. The following are key findings from the survey:

• Public understanding of AI is “broad” but not “deep”


• Expectations are high, but certainly not all positive


• Young people are most optimistic about AI


• Employment concerns exist, but potential workplace benefits are acknowledged


• Privacy and data protection implications are not well understood


• The AI industry should be accountable and responsible to the public

Ipsos MORI was commissioned by the Centre for Data Ethics and Innovation (CDEI) and Sciencewise to conduct a programme of public engagement research to explore attitudes towards Online Targeting. Findings from the research have been used to inform the CDEI’s Review of Online Targeting and their recommendations to government.

Overall, it was clear from the dialogue and survey research that the public do see significant value in online targeting in both the private and public sector; however, almost all participants advocated that some form of change was required to improve the way in which online targeting currently operates.

Perceived harms of online targeting demonstrated a concern beyond issues of data protection. There was greatest concern that online targeting systems could exploit people's vulnerabilities, erode their autonomy, and amplify inappropriate content.

An article from the Data & Marketing Association (DMA) which highlights how the recent discussions about tracking and tracing the coronavirus outbreaks in the UK have been raising concerns about privacy. Data, that once collected, could be incredibly powerful in helping the UK Government to make more informed decisions about how and when we return to something resembling our normal lives. Data protection and people’s right to privacy is equally not something that should be overlooked. In the wrong hands, this data could be easily abused too. Any concerns around data and privacy can only be resolved through dialogue. The key for Governments, whether in the UK or elsewhere, will be having open and transparent conversations with citizens about what will be collected, why and how it will benefit them.

The Secondary Legislation Scrutiny Committee examines the policy merits of statutory instruments and other types of secondary legislation that are subject to parliamentary procedure.

An Act to repeal the European Communities Act 1972 and make other
provision in connection with the withdrawal of the United Kingdom from the
EU.

A National Statistician’s Quality Review
The rapid increase in the detail, volume and frequency of data collected, alongside the diversification of data sources available, presents a real opportunity for the statistical community to innovate. This richer detail will provide better statistics that deepen our understanding of society and better support decision making.

On the other hand, making more data available raises new concerns and new challenges to protecting privacy and confidentiality of personal information. In this challenging and rapidly changing landscape, the statistical community has a legal and an ethical obligation to protect the confidentiality of data, while at the same time striving to meet evolving user demands for more detailed and helpful statistics.

July 2017 Article
Information Commissioner’s Office rules record transfer from London hospital to AI company failed to comply with Data Protection Act.
London’s Royal Free hospital failed to comply with the Data Protection Act when it handed over personal data of 1.6 million patients to DeepMind, a Google subsidiary, according to the Information Commissioner’s Office.

March 2018 article
Revealed: 50 million Facebook profiles harvested for Cambridge Analytica in major data breach

May 2018 article
Ministers have suspended controversial arrangements under which the NHS shared patients’ details with the Home Office so it could trace people breaking immigration rules.

December 2017 article
In March 2017, a pregnant woman in her 20s went to the Metropolitan Police to report being kidnapped and raped. She was herself arrested, interrogated on suspicion of illegal entry into the UK, and eventually released pending a decision on her case.

This is Britain under Theresa May’s flagship “hostile environment” policy, of which she laid the foundations as Home Secretary, as far back as 2013. Doctors, social workers and teachers are forced to act as border guards. Every job application and health emergency could end in arrest, detention or summary deportation.

Data Detectives: Uncovering systematic errors in administrative databases

Record linkage of administrative and survey data is increasingly used to generate evidence to inform policy and services. Although a powerful and efficient way of generating new information from existing data sets, errors related to data processing before, during and after linkage can bias results. However, researchers and users of linked data rarely have access to information that can be used to assess these biases or take them into account in analyses. As linked administrative data are increasingly used to provide evidence to guide policy and services, linkage error, which disproportionately affects disadvantaged groups, can undermine evidence for public health. We convened a group of researchers and experts from government data providers to develop guidance about the information that needs to be made available about the data linkage process, by data providers, data linkers, analysts and the researchers who write reports. The guidance goes beyond recommendations for information to be included in research reports. Our aim is to raise awareness of information that may be required at each step of the linkage pathway to improve the transparency, reproducibility, and accuracy of linkage processes, and the validity of analyses and interpretation of results.

A Critical Re-examination of Health Data Identification Risks
and Privacy Protections, Then and Now

The 1997 re-identification of Massachusetts Governor William Weld’s medical
data within an insurance data set which had been stripped of direct identifiers
has had a profound impact on the development of de-identification provisions
within the 2003 Health Insurance Portability and Accountability Act (HIPAA)
Privacy Rule. Weld’s re-identification, purportedly achieved through the use of a
voter registration list from Cambridge, MA is frequently cited as an example that
computer scientists can re-identify individuals within de-identified data with
“astonishing ease”. However, a careful re-examination of the population
demographics in Cambridge indicates that Weld was most likely re-identifiable
only because he was a public figure who experienced a highly publicized
hospitalization rather than there being any certainty underlying his reidentification using the Cambridge voter data, which had missing data for a large
proportion of the population

EFAMRO and ESOMAR created a report to  provide a framework to researchers:Understand the basic principles of the new GDPR framework focusing on the data processing and collection principles; determine the appropriate legal grounds to collect, process or further process personal data for all types of research, the conditions that need to be followed and the associated data subject rights; and assess the implications of the different legal grounds for statistical and/or scientific research.

This 2017 Guardian article by Ben Tarnoff explains how personal data is to the tech world what oil is to the fossil fuel industry and that’s why companies like Amazon and Facebook plan to dig deeper than we ever imagined. He speculates that one of the reasons for Amazon’s recent acquisition of bricks and mortar retailer Whole Foods is to extend the powerful analytics of its online world into the analytics of offline retailing by using electronic tracking and surveillance in the bricks and mortar stores.

This discussion paper looks at the implications of big data, artificial intelligence (AI) and machine learning for data protection, and explains the ICO’s views on these. The main conclusions are that, while data protection can be challenging in a big data context, the benefits will not be achieved at the expense of data privacy rights; and meeting data protection requirements will benefit both organisations and individuals. Six key recommendations for organisations using big data analytics are set out.

The Power and Perils of Data focuses on the potential for data to improve the way people live their lives, as well as exploring public views on some of the risks this greater reliance on data brings.

This report describes the findings from a public dialogue on administrative data commissioned by the Economic and Social Research Council (ESRC) and the Office for National Statistics (ONS). The overall objectives were to explore public understanding and views of administrative data and data linking.

Research for the Royal Statistical Society carried out by Ipsos MORI reveals that the media, internet companies, telecommunications companies and insurance companies all come at the bottom of a “trust in data” league table. Only between four and seven per cent say they have a high level of trust in these organisations to use data appropriately, compared with 36% trusting the NHS, and 41% trusting their GP.

Globally, the UK currently ranks a distant second behind the US for data breaches. Software vulnerabilities, lost hard drives and CDs, malicious insiders, poor security - the UK's most important data breaches reveal just how many ways data can be put at risk.

NatCen Social Research has today published the results of a survey of public confidence in official statistics, commissioned by the UK Statistics Authority. 

The Information Commissioner’s Office annual report includes a brief section on the work done by the ICO with regard to in-vehicle telematics. It describes how the ICO engaged with this issue in its early stages to ensure that safeguards were designed in from the outset, meeting with the Association of British Insurers and insurance companies to discuss developing industry guidelines.

This article by Paul Peachey in the Independent Newspaper reports the warning by the Government’s Surveillance Commissioner that the public face “a very real risk” to their privacy from the huge roadside surveillance network that captures millions of motorists every day.

Privacy International’s mission is to defend the right to privacy across the world, and to fight surveillance and other intrusions into private life by governments and corporations. Its vision is a world in which privacy is protected by governments, respected by corporations and cherished by individuals. PI was founded in 1990 and is the oldest international privacy organisation in the world.

Big Brother Watch was set up to challenge policies that threaten personal privacy, freedoms and civil liberties, and to expose the true scale of the surveillance state. Founded in 2009, it researches the erosion of civil liberties in the UK, looking at the dramatic expansion of surveillance powers, the growth of the database state and the misuse of personal information.

A series of three programmes on BBC Radio 4. Steve Hewlett describes the extraordinary amount of information which can be gleaned from our online behaviour and smartphones. Is new technology, he asks, having a profound effect on our notions of privacy?

In a Report on Communicating Statistics released on Wednesday 29th May 2013, entitled “Not Just True, but Also Fair” the Commons Public Administration Select Committee (PASC) recommends that departmental press officers and government statistics staff should work together much more closely to ensure that press releases give an accurate and meaningful picture of the truth behind the figures. Read the full report here:

In a recent report, the Commons Public Administration Select Committee (PASC) concluded, despite the positive steps implemented by the Statistics and Registration Service Act 2007, there remain issues and concerns about the way government statistics are produced and disseminated which remain a genuine risk to public confidence in the statistical system and must be addressed. Visit the website below for access to the article and supporting reports:

A series of reports from a project run by ONS and the Statistics Commission. Improving trust and public confidence in official statistics - demonstrating that they are produced to the highest standards and are free from political interference is a key objective of National Statistics. The aim is to better understand the nature of this trust by exploring peoples’ views on statistics and what those views are based on.

This report prepared for the COI on behalf of the Information Commissioner's Office is based on a qualitative research survey involving a series of discussion groups in different parts of the UK.  It examines the extent of public awareness and the concerns felt about surveillance, data sharing and other privacy and data protection issues.

This is a link to a key page of the Information Commissioner’s website.  It provides full details of the Data Protection Act, codes of practice and technical guidance notes, as well as links to other relevant sources such as the National Audit Office report on managing information risk.

Developments of a frontier free Internal Market and of the so called 'information society' have increased the cross-frontier flows of personal data between Member States. In order to remove potential obstacles to such flows and to ensure a high level of protection within the EU, data protection legislation has been harmonised. The following page sets out what are your rights as an EU citizen.

This survey by YouGov for identity fraud prevention specialists GB found that only half (52%) of consumers in Great Britain trust their high street bank or building society to protect their personal details from identity thieves.

Jan 2017 article
Pete Stokes discusses how ONS makes data available for research, while protecting confidentiality at all times

This Code produced by UKSA and The Office for Statistics Regulation aims to provide the framework to ensure that statistics are trustworthy, good quality, and are valuable – that they measure the things that most need to be measured.

This instrument addresses deficiencies in retained EU law relating to statistics arising from the withdrawal of the United Kingdom from the European Union.

An Act to establish and make provision about the Statistics Board; to make provision about offices and office-holders under the Registration Service Act 1953; and for connected purposes.

This is a link to 'Getting lost in the crowd: The limits of privacy in location data' iapp's blog written by Ali Farzanehfar and Florimond Houssiau. 

Before the introduction of the EU General Data Protection Regulation and other modern privacy regulations, there was growing evidence that histories of human mobility containing detailed location data are vulnerable to simple reidentification attacks. This line of research may have eventually led to the GDPR specifically singling out location data that is pseudonymized (i.e., does not include obvious identifiers, such as a name or phone number) as not anonymous. However, given how useful this data can be, academics and industry practitioners have been asking whether there is a simple fix to privacy in these datasets. Namely, if the dataset was big enough, would individual records become anonymous by being “lost in the crowd”?

Lack of trust and trustworthiness could lead to less data sharing. But how do we decide what organisations and datasets are trustworthy? This is a beta guidebook developed by the Open Data Institute, and includes some useful pointers to help make your organisation more trustworthy and trusted when collecting, managing, using and sharing data. By operating in a trustworthy way, organisations should be able to create value while limiting harms; and are more likely to be trusted by the people, organisations and ecosystems they interact with and rely upon. Trust and trustworthiness are therefore key – both to data having societal and economic value; and to companies and organisations realising the value of their services, products and ecosystems.

 In March 2021, Culture Secretary Oliver Dowden outlined how he wanted the Information Commissioner’s Office to take a “bold new approach that capitalises on all we’ve learnt during the pandemic, which forced us to share data quickly, efficiently and responsibly for public good”. This report, commissioned by the Department for Media, Culture and Sport (DCMS), examines the levers at the disposal of government and advocates a package of measures to smooth the path to greater data sharing which include improving knowledge and understanding of data sharing, improving or demonstrating incentives, supporting ways to address risk, reducing the cost of sharing, reducing the regulatory burden, and mandating data sharing.

Consultancy Frontier Economics carried out the research alongside Cambridge economist Diane Coyle, who co-directs the university’s Bennett Institute for Public Policy.

In March 2021 the Information Commissioners Office (ICO) published their guidance on the use of personal data in political campaigning to support campaigners through the upcoming elections and beyond. The guidance reflects the UK GDPR and takes into account the use of personal data in modern campaigning practices. The new guidance covers the full lifecycle of a campaign; from collecting and processing personal data of the electorate to using targeted messages during a campaign, to what to do with that data once a campaign is concluded. It includes useful examples on ways campaigners can carry out common political campaigning activities whilst complying with their obligations under data protection law. It also gives specific advice on complex areas such as the processing of sensitive categories of data that need special protection, for example data that relates to racial or ethnic origin, health or political opinions.

Deloitte’s 2020 Digital Consumer Trends survey explores the impact of macro trends on consumer relationships with digital devices, content and the wider connectivity landscape. In recent years, the conversation around data privacy has grown following the advent of GDPR and major instances of data misuse. COVID-19 catapulted the conversation to the front of the agenda, and has acted as a catalyst, increasing the deployment and variety of data gathering. What remains to be seen is if it will have a permanent impact on consumer attitudes to data privacy.

A European Union plan to regulate artificial intelligence could see companies that break proposed rules on mass surveillance and discrimination fined millions of euros. Draft legislation, leaked ahead of its official release later this month (April 2021), suggests the EU is attempting to find a “third way” on AI regulation, between the free market US and authoritarian China. As presently worded, the rules would ban AI designed to manipulate people “to their detriment”, carry out indiscriminate surveillance or calculate “social scores”. Much of the language is vague enough that the regulations could cover the entire advertising industry or nothing at all. In any case, the military and any agency ensuring public security are exempt. Full article by Matthew Sparkes in New Scientist magazine.