We entered the age of surveillance capitalism blindly over the last decade, without understanding what we were doing to ourselves, and almost without the conceptual tools to understand it either. Now we have woken up to the situation where a handful of giant companies have grown unfathomably rich by processing and then selling on our personal data. We are increasingly conscious of all the ways in which the big data companies know more about us than we know ourselves, and certainly more than we would willingly expose to anyone. Social networks have come to be seen as a way to turn personal information into money, but the data is yours and the money is some squillionaire’s in Silicon Valley.
The data protection bill, which is back in the Lords now, is an attempt to redress this imbalance, or at least to give teeth to the idea that we own our own data. It originates in the EU’s general data protection regulation, which will become law in 2018. We are going to have to adopt the data protection regime of our neighbours if we want to do business with them – 75% of the UK’s data transfers are with EU member states.
The data protection bill views the imbalance of power between the unwitting suppliers of data – us – and its various processors primarily through the lens of privacy rights. This turns out to raise some tricky problems: there is no single analytical framework that will make sense of all the possible competing interests in the field. Privacy online looks simple but is in practice hard. As Martha Lane Fox said in the Lords debate on the bill: “Giving people rights is meaningful only if they know that they have them, what they mean, how to exercise them, what infringement looks like and how to seek redress for it.”
In this context, it is vital that the government adds to the bill the right of third parties such as the Open Rights Group to seek redress on behalf of people whose rights have been infringed. Of course, that will cause friction and inconvenience – but those are part of any process in which real rights are hammered out. The privacy of individuals is not the only issue at stake. There is also the ownership of data that is collected by public bodies but exploited and monetised by private monopolies. And we need the Information Commissioner’s Office to interpret the law’s intention and keep pace with technology, as the Human Fertilisation and Embryology Authority does for human reproduction.