Addressing non economical externalities

BYTE: Addressing non-economical externalities

Hans Lammerant - VUB

Big data roadmap and cross-disciplinary community for addressing societal externalities

@BYTE_EU www.byte-project.eu

Big data and externalitiesCausal explanation?

How does big data affects interactions between actors?

Big DataInteractions

between actorsExternalities


Categorisation of externalities• Benefits: practices aiming at capturing and maximizing the benefits of big data

• Regulatory practices: practices aiming at maximizing an objective at a societal level by balancing interests, but which are now negatively affected by big data. They show up as negative externalities because their balancing of interests does not deliver the same positive results any more.

• Protective practices: practices aimed at preserving other values or interests, which now get negatively affected.


Categorisation of externalitiesBenefits Negative effects on regulatory

practicesNegative effects on protective practices

Improved efficiency and innovation

IPR Equality

Improved awareness and decision-making

Losing control to actors abroad Anti-discrimination

Participation Private vs. public and non-profit sector

Privacy

Improved political decision-making and participation

Trust (includes fear of capture and competition issues)

Liability, accountability

Political abuse & surveillance


Effect of big data on interactions• Larger amount of interactions between actors

• Higher visibility of actors

• Higher penetration of organisational boundaries → traditional gatekeeping gets disrupted

• Data becomes network good → positive network effects

• Shift in transactions from exchange of goods to delivery of services → shift from momentary transaction to regulating continuous data flows

• Changing role of internet: from market place where actors meet into digital environment in which value creating production processes take place


Effect on regulatory and protective practices• Current regulatory and protective practices reflect old transaction model→ high transaction costs → become disfunctional and result in negative externalities (e.g. rights clearance in copyright, consent in data protection)

• Enlarged visibility and penetration of boundaries: privacy problems forindividuals and for organisations

• Positive network effects: anonymization becomes unreliable, propagation of discriminatory effects


BenefitsKitchin: additional characteristics of big data

• fine-grained in resolution and uniquely indexical in identification;

• relational in nature, containing common fields that enable the conjoining of different datasets;

• flexible, holding the traits of extensionality (can add new fields easily) and scalable (can expand in size rapidly)

=> allows to deal with higher amount of interactions, such that transaction costs get lowered while retaining necessary granularity for more individualised and targeted responses.

=> Results in:

• Improved awareness and decision-making

• Improved efficiency and innovation

• Participation


Capturing benefitsMain focus: interoperability

• European Interoperability Framework (EIF): legal, organisational, semantic and technical interoperability

• Open data: 1) available with open licence, 2) as machine-readable structured data, 3) in non-proprietary format, 4) using open standards, 5) linked to other's data

• Design principles Industrie 4.0: Interoperability, Virtualization, Decentralization, Real-Time Capability, Service Orientation, Modularity


Intellectual property rights, licensing and contracts• Regulatory mechanism: copyright, database protection

→ balances different economical objectives in order to get the best result on the macro-level

• Protective mechanism: protection of trade secrets

→ 'privacy'-rights of companies


Copyright and database protection• Same objectives but different balancing in EU and US

• Protection of investments by sui generis-right in EU, not in US

• Who did struck the balance right?

• Evaluation of database protection by Commission: no positive result

• Evaluation of Spanish Snippet law: negative result

→ conclusion: European legislator tends to be overprotective


Solutions• legal change:• drop sui generis-right on databases

• new exceptions for data and text mining in copyright

• solutions within existing legal framework: collective licensing• lowers transaction costs but preserves remuneration

• shift transaction model to liability model

• extended collective licenses, compulsory licenses and levies

• open licences: patch, no solution

• Conclusion: limiting copyright preferable → market expansion due to network effects


Protection of trade secretsAlso companies have their 'privacy' problems

→ results in reluctance to participate in data sharing in wide networks

→ only uptake of big data when it can be internalised

EU: draft directive for trade secrets protection

• No real IPR, but protection against dishonest practices

• Trade secret: not generally know or accessible information + adequate protection

• Unlawful: breach of confidentiality, …

• Lawful: reverse engineering, disclosure to reveal misconduct, …


Protection of trade secrets• Necessary legal infrastructure supporting new contractual set-ups

• To be further developed in standard contractual arrangements

Best practice: Standardisation of Cloud Computing → includes work on SLA


Privacy and protection of personal data• Higher visibility and penetration of boundaries result in privacy concerns

• Protective mechanisms: extensively developed in data protection law

• Problems:

→ conflict with purpose limitation and data minimisation principles

→ network effects make anonymisation techniques unreliable

→ mechanisms like consent and data subject rights reflect transaction model

• Does data protection still function with big data?


Privacy and protection of personal dataCritique on data protection principles: plea for risk-based approach

WP29: risk-based approach is possible within existing DP

→ modulate compliance obligations according to risk, not protection

Purpose limitation principle: further use: when not incompatible with original purposes


Purpose limitation principleCompatibility assessment:

• relation between original and new purposes

• context data collection and the reasonable expectations of the data subjects

• nature of data and the impact further processing

• safeguards applied by the controller

- additional technical and organisational safeguards

- goals data security (availability, integrity and confidentiality) + data protection (transparency, isolation, intervenability)


Technical safeguardsRespondent privacy: statistical disclosure control

Anonymisation

• linked with applicability of data protection framework

• identifiability = singling out, linkability and inference

• reasonable effort-test

Randomisation and generalisation techniques

Re-identification research: all fail to guarantee anonymity


AnonymisationHow to deal with weaknesses anonymisation?

• anonymisation remains useful as safeguard

• less dissemination-based access and release-and-forget approach of datasets with personal data

• query-based access and differential privacy

• access limited to specific users with data use agreement

→ assessing whole of technical and organisational safeguards


Technical safeguards• Owner privacy: privacy-preserving data mining (PPDM)

• User privacy: private information retrieval (PIR)

• Privacy-preserving computations

• Technical measures for access control


Privacy by Design• Mainstreaming privacy into design process

• Cavoukian: PbD principles

• goals data security (availability, integrity and confidentiality) + data protection (transparency, isolation, intervenability)

• design patterns


Organisational safeguards• functional separation → organisational limiting of access and data use

• limiting access with data use agreements

• privacy-by-design approach: risk assessment & privacy impact assessment

• risk assessment in general derived from IT security

• examples: CNIL, LINDDUN → threat modelling

• literature: PIA as a regular process involving stakeholders


Data protection principles and big dataConclusions:

• existing data protection principles can be applied with big data

• mix of technical, organisational and legal means

• in full development:

→ specific attention for big data needed

→ mainstreaming through standardised approaches


Accountability and data subject rights• Data protection are not only rules on use of information

• accountability framework

• informational control through data subject rights

→ necessary to establish trust

→ based in transaction-model: e.g. consent

• shift to liability-model through stronger role regulators


Transparency• Obliged by data protection framework, but rarely implemented

• transparency of data used, of processing and of use results

• need for standardised auditing and evaluation tools: e.g. privacy seals

• technical tools for transparency: e.g. Google

• standards for transparency and data portability

→ avoid user lock-in

→ allows aggregated views on data use by data subjects

• traceability across several actors?

• Implementation of transparency and data access needs attention and further development


Equality and discriminationDiscrimination:

• prejudice

• rational discrimination

• unintended discrimination

Legal:

• principle of equality

• prohibition of discrimination → direct discrimination / indirect discrimination


Discrimination in data miningsources of discrimination:

• definition of the objectives and problem → target variable and class labels

• training data → assumption: nothing changes• under- or over-representation in sample

• choice of input variables

• attributes as proxy for discriminatory grounds

• historical discrimination reflected in labelling

• masking


Anti-discrimination & algorithmsTechnical measures

• discrimination discovery

• discrimination prevention through discrimination-free classifiers

• conditional non-discrimination methods

Trade-off accuracy and anti-discrimination → effective methods exist

Recent area of research → in full development


Anti-discrimination frameworkLegal framework:

• legal redress

• equality bodies: support legal redress + mainstreaming of policies

• Less developed as data protection framework → need for integration towards common accountability framework

• Anti-discrimination by design → anti-discrimination objectives alongside data protection objectives in safeguards, risk and impact assessment, auditing procedures, etc.

• Equality bodies have a task to address anti-discrimination in big data as part of their mainstreaming efforts → coordination needed between DPAs and equality bodies


Political externalities: Relation private vs. public and non-profit sector- lock-in

→ standardisation

→ open source

→ data portability

- rent-seeking and need for public funding

→ Benkler: open source: commons model as result of positive network effects

→ is this also true for open data?


Political externalities: Relation private vs. public and non-profit sectorOpen data often concerns data from public sources, while users are private sector.

→ Costs and benefits fall with different actors.

Data revenue models: subsidized, licensing, subscription, advertising, commission, traffic, branding

→ closed options like licensing or subscription can generate direct revenue, but limit users

→ subsidy is only open model available

Evaluation similar to IPR: what is macro-effect?

• when only a few users which make commercial applications → closed model

• lot of users: open model → indirect return


Political externalities: loss of control to actors abroad• economical concern: traditional tension between protectionism and open market

• political concern: ability to regulate

→ Range of conflicts: extraterritorial application of law is an issue both in EU and in US

Solution: International legal harmonisation

→ varies from mutual recognition mechanisms to fully developed legal framework


ConclusionsCapturing positive benefits:

→ improving interoperability on several levels

→ restoring trust and legal certainty

Dealing with negative externalities

→ data = network good → refrain from overprotection as property

→ adapt legal frameworks from transaction model to liability model: • collective solutions• regulation of overall process and mainstreaming in design• mix of technical, organisational and legal measures


QUESTIONS

Any questions?

Technology

Addressing non economical externalities