Big Data for All

Omer Tene, Concurring Opinions, September 20, 2012

Much has been written over the past couple of years about “big data” (See, for example, here and here and here). In a new article, Big Data for All: Privacy and User Control in the Age of Analytics, which will be published in the Northwestern Journal of Technology and Intellectual Property, Jules Polonetsky and I try to reconcile the inherent tension between big data business models and individual privacy rights. We argue that going forward, organizations should provide individuals with practical, easy to use access to their information, so they can become active participants in the data economy. In addition, organizations should be required to be transparent about the decisional criteria underlying their data processing activities.

The term “big data” refers to advances in data mining and the massive increase in computing power and data storage capacity, which have expanded by orders of magnitude the scope of information available for organizations. Data are now available for analysis in raw form, escaping the confines of structured databases and enhancing researchers’ abilities to identify correlations and conceive of new, unanticipated uses for existing information. In addition, the increasing number of people, devices, and sensors that are now connected by digital networks has revolutionized the ability to generate, communicate, share, and access data.

Data creates enormous value for the world economy, driving innovation, productivity, efficiency and growth. In the article, we flesh out some compelling use cases for big data analysis. Consider, for example, a group of medical researchers who were able to parse out a harmful side effect of a combination of medications, which were used daily by millions of Americans, by analyzing massive amounts of online search queries. Or scientists who analyze mobile phone communications to better understand the needs of people who live in settlements or slums in developing countries.

At the same time, the “data deluge” presents formidable privacy concerns. Protecting privacy become harder as information is multiplied and shared ever more widely among multiple parties around the world. As more information regarding individuals’ health, financials, location, electricity use and online activity percolates, concerns arise about profiling, tracking, discrimination, exclusion, government surveillance and loss of control. From a more technical legal angle, big data challenges some of the most fundamental concepts of privacy law, including the definition of “personally identifiable information”, the role of individual control, and the principles of data minimization and purpose limitation.

In our article, we make the case for providing individuals with usable access to their data. The call for transparency is not new, of course. Rather the emphasis is on access to data in usable format, which can work to create value to individuals. Transparency and access alone have not emerged as potent tools because individuals do not care for, and cannot afford to indulge in transparency and access for their own sake (see one oft-cited counterexample here). The enabler of transparency and access is the ability to use the information and benefit from it in a tangible way. This will be achieved through “featurization” or “app-ification” of privacy. Organizations should build as many dials and levers as needed for individuals to engage with their data.

We expect that “featurization” of big data, harnessing its immense force for not only organizational but also individual benefit, will unleash a wave of innovation and create a market for personal data applications. The technological groundwork has already been completed with mash-ups and real-time APIs making it easier for organizations to combine information from different sources and services into a single user experience. Regardless of lingering questions concerning who – if anyone – “owns” the information, we think that fairness dictates that individuals enjoy beneficial use of the data about them.

Our second proposal would require organizations to disclose the decisional criteria underpinning their data analytics machinery. In a big data world, it is often not the data but rather the inferences drawn from them that give cause for concern. Inaccurate, manipulative or discriminatory conclusions may be drawn from perfectly innocuous, accurate data. Much like in quantum physics, the observer in big data analysis can affect the results of her research by defining the data set, proposing a hypothesis or writing an algorithm. At the end of the day, big data analysis is an interpretative process, in which one’s identity and perspective informs one’s results. Like any interpretative process, it is subject to error, inaccuracy and bias. Louis Brandeis, who together with Samuel Warren “invented” the legal right to privacy in 1890, has also written that “[s]unlight is said to be the best of disinfectants”. We trust if the existence and uses of databases were visible to the public, organizations would be more likely to avoid unethical or socially unacceptable uses of data.

One Woman's Data Trail Diary

Scott Shane, The New York Times, August 31, 2012

As part of The Agenda, The Times’s look at major issues facing the next administration, we have been examining the trade-offs, more than a decade after the Sept. 11 attacks, between security and privacy and civil liberties. Some readers have written in about the electronic data trail that all of us leave as we go about our lives, using the Internet and carrying smartphones.

Heidi Boghosian, a New Yorker and author of a book on surveillance scheduled for publication next year, “Spying on Democracy: A Short History of Government/Corporate Collusion in the Technology Age,” agreed to try to document her own data trail on one recent day. Her account, below, is nothing extraordinary – and that’s the point. It is impossible to live in urban, wired America without leaving clues about ourselves, our movements and our views everywhere. And it is all but impossible to be certain who is looking at the resulting data or video and how much of it is accessible to federal, state or local government.

Ms. Boghosian is executive director of the National Lawyers Guild, a group of self-described radical lawyers and law students founded in 1937, and between her day job and her book research, she thinks far more than most people about surveillance and privacy. But the exercise of documenting her day was nonetheless informative, she said.

“Definitely, for me, going through the process reinforced my sense of the role corporations play in our daily lives,” she said. “And I don’t think most people realize the extent to which corporations cooperate in turning over personal information to the government.”

Here is the record she made:

A Day of Surveillance:

(1) 8:30 a.m.: Closed Circuit Television (CCTV) in hallway permits private landlord to monitor departure of tenant from apartment building at 173 Avenue A, New York, N.Y. A sign is posted alerting tenants that their actions are being monitored.

(2) City-owned video surveillance camera, mounted atop a streetlight pole, records pedestrian and vehicular traffic on corner of Avenue A and 11th Street.

(3) 9:45 a.m.: Internet Protocol-based, closed-circuit television CCTV/video surveillance camera at Chase Bank A.T.M. on Second Avenue and 10th Street records clear image of person withdrawing money. I.P. video surveillance footage probably transmitted to a central monitoring room and digitally stored (allowing for advanced search techniques), or viewed over the Internet. Intelligent I.P. cameras with video analytics such as motion sensors, facial recognition and behavioral recognition are used to identify abnormal activity in and around banking locations.

(4) 10 a.m.: Customer Loyalty Card at East Village coffee shop Café Pick Me Up, Avenue A and 9th Street, likely allow the business to track and predict customer spending habits.

(5) 10:30 a.m.: iPhone (with G.P.S. tracking) in owner’s back pocket allows phone owner’s movement and location to be tracked (by government, if cellphone provider gives access) through day and evening, even if phone is turned off, as phone owner walks to Astor Place subway stop.

(6) 10:45 a.m.: Passed by “smart sign” (digital billboard with cameras that gauges demographics of passers-by) that delivers ads tailored to the demographics of the passer-by.

(7) 10:45 a.m.: CCTV in NY subway system monitor boarding #6 subway line to work.

(8) 11:11 a.m.: CCTV in elevator records ride to ninth-floor office in office building. Building security guard has four cameras behind front desk showing elevator, stairways and hallways.

(9) 11:20 a.m.: Facebook software tracks user activities on sites on Internet after logging in and reading a few comments. “Tag Suggestions” feature employs facial recognition technology and suggests name tags after uploading photos.

(10) 11:30 a.m.: Cookies on Internet monitor all Internet searches throughout day on range of subjects; ads appear on screen related to items purchased on line (athletic shoes, face cream).

(11) 1 p.m.: Credit card at Macy’s Department store, used for quick purchase, has embedded RFID (Radio Frequency ID) chip, tracking consumer spending habits and providing that information to big business.

(12) 1:15 p.m.: Shoes in Macy’s new shoe store all have RFID chips (unique identifier linked to database) in them.

(13) 1:30 p.m. Downloaded iTunes onto iPhone. Online music providers may share personal information with third parties.

(14) 2 p.m.: Video cameras and motion detectors in local supermarket track physical movements of customers (allegedly to aim for improved customer service) as customer drops in to pick up some fruit for lunch.

(15) 2:30 p.m.: Social security number and driver’s license information, required by Fulton Street Verizon cellular store winds up in Verizon’s digital database, as customer switches from AT&T. Allegedly needed Social Security number to conduct credit check even though customer has had a landline account with Verizon for many years.

(16) 3:30 p.m.: I.P. address may have been included on a bar code on a digital coupon while registering for at hotelcoupons.com to get a discount hotel deal.

(17) 4 p.m.: Continuous, systematic desktop monitoring surveillance of personal use of business computer to access site to order shoes could have been conducted had employer installed software to monitor my real time actions, purportedly to avoid discrimination and sexual harassment lawsuits that may result from inappropriate e-mails sent within company.

(18) 6 p.m.: Dropped by anti-fracking protest on West 14th Street. Unmarked police van with tinted windows probably had NYPD Technical Assistance Response Unit (TARU) personnel recording protest activities, especially because several Occupy protesters were present. TARU provides investigative technical equipment and tactical support to all N.Y.P.D. bureaus and also provides assistance to other city, state and federal agencies. The unit employs several forms of computer forensics.

(19) 7:30 p.m.: CCTV cameras inside East Village restaurant while meeting friend for dinner after the protest.

(20) 9:30 p.m.: Surveillance cameras on several buildings passed on way home is captured on tape.

(21) 10 p.m.: Final check of Gmail, and a few Google searches, allow Google to collect even more data on consumer habits and personal interests.