Published on the 28/03/2023 | Written by Heather Wright

From data privacy to data responsibility…

There’s a chance we’ve got our ideas on the handling of data all wrong.

Deloitte Access Economics partner Deen Sanders, who with CSIRO senior research consultant Rob Hanson and Peter Evans-Greenwood, fellow at The Centre for the Edge Consulting, say traditional concepts of ownership don’t work for data because, by its very nature, data resists being owned.

In A New Narrative for Digital Data, the trio say the tension of ownership – which puts the focus on data users and holders – propels the debate around privacy but it’s a tension they believe requires a relook at the concept of data as property, rather than ‘an endless contorting of the principles of privacy’.

“Data’s meaning and value, and so our data privacy, is defined within the context of a relationship.”

The question of data ownership has long been debated as the amount of data captured, created, replicated and consumed soars – IDC the ‘global datasphere’ is expected to more than double in size between 2022 and 2026, with the enterprise datasphere growing more than twice as fast as the consumer datasphere.

In congressional hearings in the US several years ago, amidst the Cambridge Analytica uproar, Mark Zuckerberg repeatedly said Facebook users ‘own all their own content’.

Consumers, meanwhile have been clear that they feel they own their data – a KPMG survey on corporate data responsibility found 30 percent of those surveyed said they wouldn’t share their data with businesses under any circumstances, while 75 percent wanted greater transparency around data use.

It’s prompted increasing data regulations, such as the GDPR and California’s Consumer Privacy Act, and Notifiable Data Breaches privacy amendment in Australia.

But in the Deloitte Insights piece, the trio say it’s time to do away with the idea of data as private property and consequently exchangeable, tradeable and ownable – a concept that makes data a commodity and creates tension in the free flow of information.

“Framing the story of data in this way invariably leads to discussions on digital privacy based on a narrative of ‘rights’. When is it permissible to collect data associated with an individual? Who has the right to say how a particular data set can be used? How are these rights enforced? Under what circumstances must rights be ceded to others?”

It’s also an approach which requires application of tools to manage property rights to digital privacy, and which makes an individual arbiter of how their data should, or shouldn’t be used.

And it’s just not working, the authors say.

Instead, according to the trio, it’s time to take a new approach – one built around how Indigenous Australian cultures view the world, with relationships between actors, rather than the actors themselves, defining the world.

“All things in the world – people, property and the country itself – are considered actors with a role to play. Social norms are framed in terms of responsibilities – actors’ obligations to each other within their web of relationships. All actors have responsibilities, and so all things are designed to support all other things in meeting their responsibilities. One’s agency – the capacity to act – is determined by the intersection of these responsibilities,” they say.

The trio argue that applying the Indigenous metaphor to better understand relationships and responsibilities of actors in data privacy will enable progress to begin to be made in finding ‘a more productive path forward’.

“Like all actors in Indigenous Australian culture, data is also relational. 

“Data’s meaning and value, and so our data privacy, is defined within the context of a relationship. Data that is private, personal data in the hands of an individual, may be marketable property in the hands of a data aggregator and a set of design inputs in the hands of a company using data to create a product or sell a service. It changes shape and function as it moves through different systems which have different relationships with both the individual and each other.” 

They say it’s time to find value in data responsibility – something they suggest could alleviate the complexity around digital privacy with its regulatory and legislative solutions, high compliance costs for companies.

Comparing data to a river they suggest organisations interacting with data rivers and pools through sourcing, transmitting, aggregating or consuming data, should be considered custodians of data, rather than owners, whose job is to support the river to achieve its purpose.

“An organisation collecting or transmitting personal data has a responsibility to ensure that the data is accurate. It should be possible, for example, for an individual to indicate in their credit history that they have no intention of applying for a loan. Or to remove themselves entirely. 

“A firm relying on personal data to provide a loan is responsible for ensuring that the application is valid, and they are providing the loan to the person they think they are. Similarly, a firm using bias-prone analytic solutions is responsible for ensuring that the analytic model is accurate and matches the intent and community norms of those if affects. Firms are also responsible for ensuring that their partners, suppliers, and clients, are meeting their responsibilities.” 

Rather than data being the source of value, they see an opportunity for responsibilities to be the source of value. 

“Meeting one’s responsibilities means that a firm has the opportunity to act, to find and capitalise on opportunities. If we all meet our responsibilities, we create a safe and productive environment for business. Hoarding or misusing data, ignoring one’s responsibilities, should be a liability. 

“An unpolluted digital marketplace is one where it’s easy to do business—one where the data is pure, where we are aligned in our responsibilities to the clarity and flow of the river and its purpose, so that the river provides opportunity for every participant.”