Regulation of Big Data: Perspectives on strategy, policy, law and privacy

The article reflects papers delivered at “Regulation of Big Data”, a panel discussion held at Deakin University, Australia, August 3rd 2016. While the support of the Data to Decisions Cooperative Research Centre is acknowledged, the views expressed in this article do not necessarily reflect the views of the Centre or of other members of the Law and Policy Program.

Douglas Laney is a VP and Distinguished Analyst with Gartner’s Chief Data Officer Research team.

[1]: “There are many definitions of “Big Data” which may differ depending on whether you are a computer scientist, a financial analyst, or an entrepreneur pitching an idea to a venture capitalist. Most definitions reflect the growing technological ability to capture, aggregate, and process an ever-greater volume, velocity, and variety of data.”

School of Business and Management, Lappeenranta University of Technology, Finland.

See for example [2]: “Big Data refers to both large volumes of data with high level of complexity and the analytical methods applied to them which require more advanced techniques and technologies in order to derive meaningful information and insights in real time”.

The Canadian component was led by Dr. Alana Maurushat of UNSW Law.

The division of participants among the three countries is as follows: 38 participants were from Australia (interviewed from 25 March 2015 to 13 November 2015), 14 were from the UK (interviewed from 24 February 2016 and 18 March 2016) and 11 were from Canada (interviewed from 15 October 2015 to 26 February 2016). For the methodology employed, see [13].

Discussions in sub-sections 1.3, 1.4 and 1.5 are largely based on [14].

See the discussion between J. Cannataci, C. Nyst, F. Patel and L. McGregor at Geneva Academy [17], and G. Greenleaf’s comments on the Report [18].

In 16 c. England, the visitations commenced in 1535, the inventory powers were granted by Parliament in 1536, and the process might have carried on for a few years. See for a cultural analysis of the ambivalent political roles that lists and cards can play, Werbin [65]. The author traces the history of Big Data “back to the earliest forms of punch cards, sorters and tabulators emerging in the late nineteenth century when these technologies of population control were first developed by Herman Hollerith (founder of IBM) while working at the US Census Bureau “.

Open Knowledge International is a global non-profit organisation “focused on realising open data’s value to society by helping civil society groups access and use data to take action on social problems”. Cf. https://​okfn.​org/​about/​

Former Information and Privacy Commissioner for the Canadian province of Ontario serving from 1997 to 2014. She is currently the Executive Director of the Privacy and Big Data Institute at Ryerson University.

Senior Analyst, Information Technology and Innovation Foundation.

See the seminal and influential white paper published in 2008 by the still unidentified author (or authors) under the pseudonym of ‘Satoshi Nakamoto‘ [25] .

Including Regulation of Investigatory Powers Act 2000 (UK), Police Act 1997 (UK), Justice and Security Act 2013 (UK), Counter-Terrorism and Security Act 2015 (UK), and Data Retention and Investigatory Powers Act 2014 (UK).

The United Kingdom, Australia, and Canada belong to the common law family of legal systems; are constitutional monarchies; they are bound by the multilateral United Kingdom – United States of America Agreement for cooperation in signals intelligence, known as Five Eyes.

To access data from computers, smartphones etc. by the security and intelligence agencies, law enforcement and the armed forces.

“a) obtain information from the equipment in pursuit of intelligence requirements;

b) obtain information concerning the ownership, nature and use of the equipment with a view to meeting intelligence requirements;

c) locate and examine, remove, modify or substitute equipment hardware or software which is capable of yielding information of the type described in (a) and (b);

d) enable and facilitate surveillance activity by means of the equipment;

“Information” may include communications content, and communications data.”

(a) a person who is the head of an intelligence service; (b) the Director General of the National Crime Agency; (c) the Commissioner of Police of the Metropolis; (d) the Chief Constable of the Police Service of Northern Ireland; (e) the chief constable of the Police Service of Scotland [separate warrantry regime]; (f) the Commissioners for Her Majesty’s Revenue and Customs; (g) the Chief of Defence Intelligence;

(h) a person who is the competent authority of a country or territory outside the United Kingdom for the purposes of an EU mutual assistance instrument or an international mutual assistance agreement.”

Warrants made under the relevant mutual legal assistance treaty to which the United Kingdom is party for the purpose of gathering and exchanging information/data.

Appointments of Judicial Commissioners will be made by the Prime Minister after consultation with the Lord Chief Justice of England and Wales, the Lord President of Scotland, the Lord Chief Justice of Northern Ireland, the Scottish Ministers, and the First Minister and deputy First Minister in Northern Ireland.

Judicial Commissioners have the power to approve both, warrants issued by the Secretary of State and those issued by Scottish Ministers under s 23 of the Investigatory Powers Act 2016. (1) In deciding whether to approve a person’s decision to issue a warrant under this Chapter, a Judicial Commissioner must review the person’s conclusions as to the following matters— (a) whether the warrant is necessary on relevant grounds (see subsection (3)), and (b) whether the conduct that would be authorised by the warrant is proportionate to what is sought to be achieved by that conduct. (2) In doing so, the Judicial Commissioner must— (a) apply the same principles as would be applied by a court on an application for judicial review, and (b) consider the matters referred to in subsection (1) with a sufficient degree of care as to ensure that the Judicial Commissioner complies with the duties imposed by section 2 (general duties in relation to privacy). (3) In subsection (1)(a) “relevant grounds” means— (a) in the case of a decision of the Secretary of State to issue a warrant, grounds falling within section 20; (b) in the case of a decision of the Scottish Ministers to issue a warrant, grounds falling within section 21(4).” The Advocate-General for Scotland (Lord Keen of Elie) [31].

The common law test of proportionality differs from the EU formulation of proportionality. Lumsdon & Ors, R v Legal Services Board [2015] UKSC 41; [2015] 3 WLR 121; Bank Mellat v HM Treasury (No 2) [2013] UKSC 39, [2013] 3 WLR 179.

Under s 227 of the Investigatory Powers Act 2016, the complex process of appointment is as follows: “Investigatory Powers Commissioner and other Judicial Commissioners (1) The Prime Minister must appoint— (a) the Investigatory Powers Commissioner, and (b) such number of other Judicial Commissioners as the Prime Minister considers necessary for the carrying out of the functions of the Judicial Commissioners. (2) A person is not to be appointed as the Investigatory Powers Commissioner or another Judicial Commissioner unless the person holds or has held a high judicial office (within the meaning of Part 3 of the Constitutional Reform Act 2005). (3) A person is not to be appointed as the Investigatory Powers Commissioner unless recommended jointly by— (a) the Lord Chancellor, (b) the Lord Chief Justice of England and Wales, (c) the Lord President of the Court of Session, and (d) the Lord Chief Justice of Northern Ireland. (4) A person is not to be appointed as a Judicial Commissioner under subsection (1)(b) unless recommended jointly by— (a) the Lord Chancellor, (b) the Lord Chief Justice of England and Wales, (c) the Lord President of the Court of Session, (d) the Lord Chief Justice of Northern Ireland, and (e) the Investigatory Powers Commissioner. (5) Before appointing any person under subsection (1), the Prime Minister must consult the Scottish Ministers. (6) The Prime Minister must have regard to a memorandum of understanding agreed between the Prime Minister and the Scottish Ministers when exercising functions under subsection (1) or (5). (7) The Investigatory Powers Commissioner is a Judicial Commissioner and the Investigatory Powers Commissioner and the other Judicial Commissioners are to be known, collectively, as the Judicial Commissioners”.

In the Investigatory Powers Act 2016 (UK), s 1, Parts 2 to 7 and Part 8; as well as by virtue of the Human Rights Act 1998 (UK); Data Protection Act 1998 (UK), s 55 (unlawful obtaining etc. of personal data); Wireless Telegraphy Act 2006 (UK), s 48 (offence of interception or disclosure of messages); Computer Misuse Act 1990 (UK), s 1 to 3A (computer misuse offences).

This discussion is based on Casanovas [32] and Casanovas et al. [33].

http://​www.​gartner.​com/​technology/​research/​hype-cycles/​

See GHENT 2015, ibid. “A data scientist can be defined as a person who creates or generates models that leverage predictive or prescriptive analytics but whose primary job function is outside of the field of statistics and analytics.”

http://​www.​gartner.​com/​technology/​research/​hype-cycles/​

Vice president at the Information Technology and Innovation Foundation (ITIF) and director of ITIF’s Center for Data Innovation.

Research analyst with The Information Technology and Innovation Foundation (ITIF).

This discussion is based on Casanovas et al. [33].

http://​wiki.​dbpedia.​org/​Datasets, http://​wiki.​dbpedia.​org/​

http://​wiki.​dbpedia.​org/​about

https://​www.​wikidata.​org/​wiki/​Wikidata:​Main_​Page

https://​learn.​canvas.​net/​courses/​4/​pages/​creative-commons-licenses

http://​ontologydesignpa​tterns.​org/​wiki/​Main_​Page

These semantic tools are constructed within a cooperative and collective work of knowledge engineering (with end-users’ cooperation). Semantics, constructing ontologies and ODP, means eliciting and sharing knowledge, making it explicit. See some examples [45] [46].

See the work by Renato Iannella et al. at https://​www.​w3.​org/​community/​odrl/​

Differential privacy aims to provide means to maximize the accuracy of queries from statistical databases while minimizing the chances of identifying its records.

Cfr. https://​en.​wikipedia.​org/​wiki/​Differential_​privacy

See Dwork [47]: “Differential privacy is a strong privacy guarantee for an individual’s input to a (randomized) function or sequence of functions, which we call a privacy mechanism. Informally, the guarantee says that the behaviour of the mechanism is essentially unchanged independent of whether any individual opts into or opts out of the data set. Designed for statistical analysis, for example, of health or census data, the definition protects the privacy of individuals, and small groups of individuals, while permitting very different outcomes in the case of very different data sets”.

As stated by Dwork and Roth [49]: “Differential privacy describes a promise, made by a data holder, or curator, to a data subject: ‘You will not be affected, adversely or otherwise, by allowing your data to be used in any study or analysis, no matter what other studies, data sets, or information sources, are available.’ At their best, differentially private database mechanisms can make confidential data widely available for accurate data analysis, without resorting to data clean rooms, data usage agreements, data protection plans, or restricted views. Nonetheless, data utility will eventually be consumed: the Fundamental Law of Information Recovery states that overly accurate answers to too many questions will destroy privacy in a spectacular way. The goal of algorithmic research on differential privacy is to postpone this inevitability as long as possible.”

On 8 April 2016 the Council adopted the Regulation and the Directive. On 14 April so did the European Parliament. On 4 May, the official texts were published in the EU Official Journal (in all the official languages). The Regulation entered into force on 24 May, and it shall apply from 25 May 2018. The Directive, on 5 May 2016, and the EU states should transpose it into their national laws before 6 May 2018.

https://​ec.​europa.​eu/​priorities/​digital-single-market_​en

This American judicial tradition of property under some constraints to protect individual rights has been interpreted by Morton Horwitz [56] as a benefit for the economic development of entrepeneurs and companies, creating the legal conditions for 20 c. liberal capitalism.

Two different Western cultures: “On the one hand, a European interest in personal dignity, threatened primarily by the mass media; on the other hand, an American interest in liberty, threatened primarily by the government” [60].