Taking Privacy to the People

1
Taking Privacy to the People

• Richard Thomas
• UK Information Commissioner
• 25th International Conference of DP and Privacy
  Commissioners
• Sydney, September 2003

2
Impertinence of a new Commissioner

• 18 years representing and advancing the
  interests of consumers
• 12 years advising commercial organisations
• Only 9 months as Information Commissioner
• Raising questions without knowing all the answers

3
Consumer / Citizen Sovereignty

• Consumers best judges of their own interests
• Choices assert strong economic power
• Well-informed, demanding consumers necessary,
  but not sufficient, for markets to deliver
• Regulation needed in cases of market failure

• Citizens good judges of their own privacy
  interests and must influence standards and confer
  legitimacy
• Protection will be provided for well-informed,
  demanding citizens with choices
• But citizens not always best-placed to judge
  longer-term or societal interests
• Regulation needed to provide necessary privacy
  safeguards not deliverable by demand alone.

4
The demand for Privacy

• Need to measure its nature and extent
• Perceptions and preoccupations of the people
  not just those of experts, policy-makers or
  regulators
• Demand must influence but is not conclusive for
  - strategic direction and priorities
• Informs how regulation should identify and
  address areas of greatest risk
• Demand also vital for Communication strategies

5
Taking Privacy to the People

• Title too paternalistic?
• Prefer Ensuring People get the Privacy they Want
  and Need
• ICOs qualitative (2002) and quantitative (2003)
  research

6
Qualitative Research July 2002

• Widespread, prevalent and increasing concerns
  about
• Intrusion Type and Amount of personal
  information collected
• Abuse Processing of that information after
  collection

7
Intrusion Type and Amount of information

• Type Clear distinction between Primary and
  Secondary information
• Need to know valid and necessary
• Nice, but not essential
• Private sector Mainly for marketing
• Public sector Cover their back-sides
• Amount Correct/About right or Excessive

8
Perceptions of Intrusion

• Primary
• Secondary

9
Abuse

• Most concerns relate to Private sector Public
  sector is trusted much more.
• Except for those with direct experience or
  knowledge of the Public sector (e.g. social
  security claimants police suspects and public
  sector workers.)

10
Black hole A widespread view

• Where personal information is deposited, stored
  and accessed by many organisations
• No-one knows who holds or manages it, but it
  simply exists
• There must be a central point where data is kept
  central archives. If not, there will be in the
  future. Each Council feeding in to a central
  point

11
Quantitative Research

• Segmentation of data subjects
• To identify clusters with similar perceptions,
  concerns and beliefs about personal information
• With a view to developing key messages and media
  vehicles
• And informing strategic priorities
• Results awaited August 2003

12
Emerging Findings

• Five distinct cluster groups, by reference to
  concerns about
• quality of personal information
• potential for mishandled information to threaten
  health or safety
• transfer of information to other organisations or
  countries
• collection of excessive information
• potential for mishandled information to cause
  financial loss
• security/confidentiality of information
• potential for mishandled information to cause
  distress, annoyance or inconvenience
• potential for mishandling PI to cause indignity 

13
A targeted approach

• Addressing the demand for protection
• Availability of other pressures to safeguard
  information Varies according to context
• Seriousness of actual or potential detriment

14
Pressures vary accounting to Context

• Competitive Market-place eg financial
  institutions, direct marketing, retail loyalty
  cards
• Public Sector e.g. law enforcement, education,
  social welfare, taxation
• Regulated market-place - eg health, telecoms,
  transport, media.

15
Competitive market

• When we were looking to invest some money in a
  bank savings account, the questions they asked
  salary, pensions we felt they were vetting us.
  Surely if investing money with them, they should
  not require all this. We walked out as the
  information they required was far too personal.
  emphasis added

16
Public sector

• At the job centre You name it, they asked for
  it. Are you married? Have you a girl-friend? Is
  she pregnant? There was far too much of the
  stuff. I found it very personal, asking about my
  wife. I was surprised they didnt ask for the
  colour of her hair.
• My son accepted a caution from the police for
  speeding. He asked What does this mean as I am a
  school-teacher? But they said it was no problem.
  Three months later the headmaster at his school
  called him in and said we believe you have
  received a police caution. It was on his personal
  file. It could have jeopardised his career.

17
Northern Ireland

• In Northern Ireland the State can find out
  anything about you.
• I was stopped in the street. The police knew my
  name and even, so as to make a point, they told
  me stuff like what make of washing machine I
  owned and the colour of my bed clothes. We know
  everything about you.
• Im a police-woman and I have to say that I dont
  trust either the public or the private sector. I
  know from my job that information gets passed on.
  Government departments are as leaky as hell.

18
Detriment and Risk

• Life, health, safety
• Loss of liberty
• Threat to livelihood or career
• Financial loss
• Unacceptable intrusion
• Reputation
• Other indignity, distress, annoyance,
  inconvenience

19
Serious Detriment
Strong Market or other Pressures
Low Market or other Pressures
Minor Detriment
20
Priority Implications

• Target enforcement
• Exploit enlightened self-interest
• Business efficiency and economic pressures in
  competitive markets
• Political, social, cultural and other pressures
• Risk to corporate reputation
• Helping organisations to help themselves
• Minimum complexity and bureaucracy
• Build demand for privacy safeguards
• Targeted and user-friendly communications

21
Autumn 2003 Advertising Campaign

• Information held about you may be wrong

22
(No Transcript)
23
(No Transcript)
24
(No Transcript)
25
(No Transcript)
26
Ensuring People get the Privacy they Want and
Need

• Promoting good information-handling
• Avoiding intrusion and information malpractice
• Priorities and targeted regulatory response
• Concentrating on safeguards, not regulatory
  burdens
• Encouraging enlightened self-interest
• Understanding and building demand