Bill Thompson (Cambridge, BBC freelance):With exquisitely good timing given the recent avalanche of public sector data breaches, tomorrow sees the publication of ‘For Your Information’, a new report from Demos marking the end of a nine month research project into the increasing reliance on personal information in the public and private sector.
I’ll be speaking at the launch, along with the report’s authors Peter Bradwell and Niamh Gallagher, Information Commissioner Richard Thomas, and comedian and columnist Natalie Haynes, and I’m looking forward to a discussion which goes beyond well-rehearsed arguments about data protection and identity management and considers the ways that a new balance can be struck between our willingness to hand over personal data and the control that we can exert over how it was used.
We need that debate because the tendency of organisations to ask for – or sometimes just take – data is clearly growing. Earlier this year the University of Hertfordshire wanted a copy of either my passport or my birth certificate before they would send me the money owed after I’d taught a class there.
When I refused, on the grounds that I didn’t trust them with information that could be used to impersonate me, they backed down and handed over the cash, although it did take them several months to do so. I still don’t know what they would have done with the photocopy of my passport, though I suspect it would have sat in a poorly-secured filing cabinet for some years.
I’ve also discovered that my daughter’s school uses a fingerprint scanning system for registration and to control access to the library and other school facilities. Nothing was sent to me in advance to let me know that they were doing this, and I’ve had no information about their plans to delete the relevant data when she finishes her school career or whether, if the police came knocking, they would hand over details of her movements without a warrant.
This sort of data acquisition may not be as pernicious as that practised by private sector organisations like Facebook, which has been secretly gathering information about what its users are doing on other websites, but it is typical of the casual way in which organisations of all sizes are pulling in data about anyone who has any interactions with them. And as we have seen with the loss of CDs containing personal data by Revenue and Customs, data may well be treated carelessly once it has been acquired.
On one level the issue is just one of degree. Herts wanted to be sure that I was who I said I was, but the simplest solution for them was also the one that posed the greatest risk to me. My daughter benefits from the fingerprint readers because she doesn’t need to remember a library card.
Yet the benefits may not be worth the risk, both the practical risk from data disclosure and the longer-term danger that comes from an acceptance of the inevitability of data capture and its use and abuse. I don’t want my daughter to feel that she has to give up her fingerprint or iris pattern or a DNA sample to any organisation that asks for it, and I want ensure that the norms of data collection and use that she inherits are based around self-determination and collective agreement rather than being imposed by either government or private sector enterprises.
As with so many areas in which the affordances of new technology undermine the basic assumptions on which have built civil society, it’s time to start asking some hard questions. It is to be hoped that the Demos research will give us a sound basis on which to begin the discussion.
PS: For more on Facebook and its “Beacon” cross-site advertising service see this excellent if somewhat technical analysis of the issue, as it completely nails the lies Facebook had been telling journalists: Facebook's Misrepresentation of Beacon's Threat to Privacy: Tracking users who opt out or are not logged in by Stefan Berteau on the CA Security Advisor Research Blog
