Balancing data for good and data for profit

The July edition of PL&B UK Report highlights the tension between the economic value of data and the constraining influence of data protection law (1). The context is the UK’s Data Protection and Digital Information (No. 2) (DPDI Bill) which is currently at the Report stage in the House of Commons.

The art and science of data modelling and analytics has experienced substantial growth even before considering the impact of Artificial Intelligence on everyday operations. Many business models are built on the foundation of personal data. Organisations can now gather more information about people’s behaviour leading to the creation of datasets, increasingly powerful predictive data models and analytics.

With emerging AI capabilities, what was once personal data of millions of users is ingested by advertising platforms to deliver tailored content and trained algorithms which are influencing everyone’s lives.

Some data use has a clear public benefit, such as using smart meter data in the utilities sector to optimise energy supply to households, helping achieve the Government's carbon net zero targets. However, few consumers realise the potential of their consumption data and its economic value, which organisations exploit commercially. Privacy enhancing technologies exist, but their implementation is uneven.

The UK government’s innovation strategy: In March, despite growing concerns about the technology, the Government declared that it does not intend to further regulate AI over the next 12-24 months to avoid stifling innovation, job creation, scientific research and economic gain (PL&B UK Report May 2023). In addition, the Government is proposing to weaken safeguards against automated decision-making in the UK GDPR. The ICO25 strategic plan sets out the regulator's new approach to enforcement designed to empower organisations to innovate in their use of data. Increasingly, data privacy is on the political agenda.

A legal basis for data analytics: Energy companies deploy smart data analytics but there are questions on the legal basis for its collection and use. Business is lobbying the Government to broaden the research exemption in the DPDI Bill. The proposed reform amends the definition of "personal data" to make it easier to render data non-personal, and so avoid compliance requirements. Such an amendment would potentially remove the training of AI from the scope of the UK GDPR.

As the government wishes to retain its EU adequacy status, the Bill aims to achieve a balance between legitimate business activities and people’s right to privacy. Earlier this month, the government’s policy staff at PL&B’s conference explained the rationale for revising their approach to “legitimate interests” maintaining a balance between keeping the UK GDPR's rules and giving consumers the right to opt-out. Of course, the legitimacy of each data collection will depend on various factors. Household devices, for example, doorbells, thermostats, personal assistants and listening devices, are capable of collecting a vast amount of sensitive household data, and might fall outside the threshold and trigger the consent requirement. These devices provide companies with household and individuals’ data which can be sold for Real Time Bidding, beyond the knowledge of ordinary members of the public.

The role of data scientists: Data scientists are at the centre of analytics with their ability to break down and re-assemble data in the optimum way to achieve value-added insights and actions. Data protection law is usually someone else’s responsibility.

Data scientists might operate under the assumption that the data they handle is not Personally Identifiable Information, and so the UK GDPR does not apply. However, most of the data they handle will constitute personal data. Without a thorough risk assessment, consumer data could be misused.

Data scientists tend to maximise the collection of granular data while Data Protection Officers have a restraining role to try to ensure that collection of personal data and sensitive data is within the perimeter of data protection law. They have to advocate the principle "Just because we have the data does not mean we should process it as we please." This ethical principle is harder to apply with the increasing complexity of analytics, data modelling, and AI tools.

Harnessing Data, Valuing Privacy Workshop, 14 September, London

This workshop, in association with law firm, Wedlake Bell, and with speakers from the ICO and Oxera, will explore how to assess the value of data and move towards harnessing data in legally defensible and ethical ways, while valuing privacy.

This workshop is for data lawyers, Data Protection Officers and data scientists who will consider these issues from commercial, regulatory and data protection law perspectives. Take this opportunity to exchange experience with your peers on identifying an optimum path which works commercially while respecting legal constraints.

We look forward to meeting you there.

Best regards,

Stewart Dresner

Publisher, Privacy Laws & Business

July 2023