Privacy and Identity in a Networked Society

Refining Privacy Impact Assessment

Stefan Strauß

• Publisher: Routledge
• Year: 2019
• eBook ISBN: 9780429836442
• Edition: 1
• Topic: Politica e relazioni internazionali
• Subtopic: Informatica generale

This book offers an analysis of privacy impacts resulting from and reinforced by technology and discusses fundamental risks and challenges of protecting privacy in the digital age.

Privacy is among the most endangered "species" in our networked society: personal information is processed for various purposes beyond our control. Ultimately, this affects the natural interplay between privacy, personal identity and identification. This book investigates that interplay from a systemic, socio-technical perspective by combining research from the social and computer sciences. It sheds light on the basic functions of privacy, their relation to identity, and how they alter with digital identification practices. The analysis reveals a general privacy control dilemma of (digital) identification shaped by several interrelated socio-political, economic and technical factors. Uncontrolled increases in the identification modalities inherent to digital technology reinforce this dilemma and benefit surveillance practices, thereby complicating the detection of privacy risks and the creation of appropriate safeguards. Easing this problem requires a novel approach to privacy impact assessment (PIA), and this book proposes an alternative PIA framework which, at its core, comprises a basic typology of (personally and technically) identifiable information. This approach contributes to the theoretical and practical understanding of privacy impacts and thus, to the development of more effective protection standards.

This book will be of much interest to students and scholars of critical security studies, surveillance studies, computer and information science, science and technology studies, and politics.

1 Introduction

Is privacy suffering from a digital disease?

Privacy is a heavily threatened socio-technical concept and among the “endangered species” of our digitally networked society. The creation and use of information and communication technologies (ICTs) essentially transformed the organization and functioning of society which, their numerous benefits aside, enabled novel forms of privacy intrusion. As, e.g., Wright and De Hert (2012a: 3) put straight: “If privacy is a cornerstone of democracy, then democracy is in trouble.” This critical appraisal addressed the numerous threats to privacy resulting from technology and surveillance practices, one year before whistleblower Edward Snowden informed the world about the yet unknown extent of mass surveillance. Since the Snowden revelations in 2013, there is hard evidence for surveillance programs at a global level exploiting personal information writ large (Greenwald 2014). Since then, the US National Security Agency (NSA) has become more or less synonymous with surveillance in public discourse. The case as such raised many serious questions which have yet been explored and addressed in only a rudimentary fashion: e.g., the legitimacy of surveillance practices and privacy intrusion for law enforcement, their effectiveness and threats to human rights, the accountability of security authorities and national intelligence and so forth. Irrespective of its explosive political impact, the Snowden case teaches the important lesson that contemporary technology provides numerous ways to intrude into privacy, which evidently serves various forms of surveillance. Apparently, though, privacy threats are not limited to the NSA or other security agencies mentioned in the Snowden files. In fact, privacy-intrusive practices exploiting digital technology were a critical issue long before the files were published. However, the revelations brought these issues to the wider public and intensified the societal demand to reinforce privacy protection as well as transparency and accountability of information processing. There is thus a certain “Snowden effect” observable as privacy awareness seems to have increased since then: for instance, privacy issues have gained importance in science and research: a simple search on the Web of Science¹ on privacy (conducted on September 17, 2018) leads to more than 28,600 results from 2000 to 2018. Nearly the half of these results (more than 14,200) concerns the years between 2013 and 2017. But among businesses as well as among the public, privacy issues increased in importance: companies started to invest more in protecting their data by, e.g., fostering encryption of online services (see, Finley 2014; Kuchler 2014) and several studies indicate increasing public concern about surveillance (see, Kerr 2015; Lyon 2014; Madden 2014). On the other hand, privacy and security experts observe a certain fade out of the Snowden effect (see, Weinger 2016) as surveillance practices continue and serious privacy threats are as-yet unsolved.

Hence, the Snowden case notwithstanding, protecting privacy is still often ineffective and increasingly challenging in our digitally networked society. Recent cases like the Facebook/Cambridge Analytica scandal, where more than 80 million personal user profiles were misused, leave no doubt that privacy is seriously threatened, which ultimately causes considerable damage to democratic processes (Hern and Pegg 2018; Nicols 2018). Despite the severity of this case it is just the tip of the iceberg or a symptom among many, indicating a serious “disease” that privacy protection suffers from in the digital age. But is there any chance for healing, at least in the longer run? Obviously, this question is far from being easy to answer and requires a closer look at the course of this “disease” of privacy and its consequences. Or is privacy trapped in a dead end? The short answer to this question is clearly NO. Privacy is neither dead and nor has it become a “walking dead”, though, indeed, considerable action is needed to revitalize it. In other words: medication is not enough—there is need for intensive therapy and the will to recover, not least because ultimately nothing less is at stake than a free, democratic society. Imaginings of a post-privacy era without protection are thus rather illusive and fatal in this regard.

Basically, the recent data protection reform of the European Union (EU) is a strong indicator that society is trying to cope with privacy issues to ease this “disease”. The newly created General Data Protection Regulation (GDPR), effective since May 2018, enforces private and public institutions to take data protection much more seriously. This paves the way for a reinforced privacy regime in Europe and may have stimulating effects on a global level to strengthen privacy as a fundamental human right. However, although updating legal frameworks is highly important, the effectiveness of regulation depends heavily on its practicability in socio-technical practices. Furthermore, even activities which do not violate data protection laws can be ethically problematic. A core problem of contemporary society is that the processing of personal information is often opaque and it is often unclear to what extent privacy is really affected. To improve the quality of protection measures thus essentially requires a deeper understanding of privacy impacts and of the very mechanisms inherent to socio-technical practices enabling privacy-intrusive activities. Today, digital information flows can include not merely one but various applications, often appearing as a conglomerate of multiple, interwoven technologies. Given the complexity of digital technology, there is a certain risk of getting lost in technological conflation when analyzing privacy impacts. Therefore, it can be very challenging to grasp the extent to which a technology, application or service bears privacy risks. As a consequence, it is equally difficult to implement effective protection mechanisms. Overall, privacy suffers from its generally abstract conceptualization and a broad range of socio-technical threats. A basic motivation of this book is thus to shed light on the theoretical understanding of privacy impacts. This can facilitate privacy impact assessment (PIA) as well as the implementation of privacy safeguards in the realm of privacy by design (PbD). Both issues are of utmost importance for the GDPR, and in particular the former—PIA—is an essential precondition for the latter. In accordance with the new regulation, new approaches are necessary to implement PIA and reinforce levels of privacy protection. This requires an analysis of the core functions of privacy and the main issues challenging their effectiveness. This book ties in here by putting emphasis on the interplay of privacy and (digital) identification, because privacy and identity are essentially linked, sharing a naturally close relationship. The extent to which this relationship is affected by ICTs and the related socio-technical practices is explored, to grasp the emergence of privacy impacts as well as approaches to improve corresponding safeguards. Based on the results, a novel framework for PIA is proposed to contribute to the theoretical understanding and practical implementation of privacy protection. This framework focuses on identifiability and includes a typology of the basic types of identifiable information. The typology supports the analysis and mapping of identifiable information flows. This can contribute to improving the quality of privacy protection and corresponding standards in the longer run.

Digital identification in a networked society

In the early days of the internet and the World Wide Web, a popular cartoon² from Peter Steiner, published in 1993, claimed that “on the Internet, nobody knows you’re a dog”. Today, this cartoon may be reworded to “on the Internet, everybody knows you and your dog, as well as why, when and how you got him”. In fact, online anonymity, as the cartoon implicitly hints at, is far more complicated than it used to be during the 1990s. From a wider view, the popularity Steiner’s cartoon gained is a good example of the powerful modalities of the internet and ICTs to spread information across multiple contexts, enriched with a vigorous self-dynamic. Today we would say that Steiner’s cartoon got “viral” so to speak. While spreading a cartoon online differs significantly from distributing personal information, the very mechanisms are the same, resulting from the dynamics of ICTs: information is easily reproducible, more or less unbound from spatial and temporal limits. These dynamics accelerate, not least because today’s technologies are nearly—if not already—ubiquitous. This has consequences for the ways our identities are represented and processed.

Cyberneticist Norbert Wiener once stated: “We are but whirlpools in a river of ever-flowing water. We are not stuff that abides, but patterns that perpetuate themselves. A pattern is a message, and may be transmitted as a message” (Wiener 1954: 96). In line with Wiener’s notion of humans as self-perpetuating patterns, our identities may be perceived as unique patterns representable by information. This is not to be misunderstood as a reductionist approach (as partially suggested by classical cybernetics assuming analogies between human beings and machines). Apparently, identity is more than a unique pattern of (computable) information. Identity is a multifaceted phenomenon with various meanings and functions in society, hardly explainable by machine analogies or similar mechanistic views. But irrespective of its multiple functions, the peculiarities of an identity are representable by unique pieces of information enabling recognition that one entity differs from others. Against the background of an increasingly digitized, networked society, co-shaped by technology, the notion of identity as a pattern represented by information is of special relevance. ICTs created new ways of gathering and processing information about individuals serving a variety of social, economic and political purposes. Substantially, every use of ICTs may generate various forms of information suitable for identifying a particular person.

ICTs are not merely technical tools but integral parts of society serving various societal functions; they represent socio-technical systems which shape society and vice versa. With their rapid progress and widespread diffusion, ICTs deeply pervade a broad array of societal domains and everyday-life contexts. This pervasion entails what Moor (1998: 15) called “informational enrichment” (or informatization) of societal activities as well as their conceptions. This means that ICTs enabled new options to digitally represent and process information about societal entities such as organizations, domains, objects, or people and the activities involved. Consequently, ICT usage also affects the representation of identities, which today can be easily embedded in networking structures. This can reinforce identifiability because contemporary technology offers various methods of direct and indirect identification. In this regard, increasing identifiability is an important side-effect of the (digital) information age. In the “age of identification”, as Hildebrandt (2008: 56) once stated, our personal identities are embedded in and exposed to a magnitude of digital environments. Technology alters the way identities are represented, organized and handled by individuals as well as groups and institutions (Whitley et al. 2014). These developments are phenomena of the “network society” as described by Manuel Castells (2000: 5) as a “social structure characteristic of the Information Age”, triggered by globally networked ICTs. The structural setting of society changed with technology, adding a specific informational layer to the social structure. As “information processing is at the source of life, and of social action, every domain of our eco-social system is thereby transformed” (Castells 2000: 10). Castells realized early the deep structural shifts in society resulting from informatization. Today we may speak of a networked society as networking structures occur within and between offline and online environments in many respects, enabled and reinforced by ICTs. Hence, these shifts did not merely affect how information is structured and processed in digital environments. Society has increasingly entered a stage of convergence between analog and digital environments with information as a driving force in our whole ecosystem (Floridi 2010; Hofkirchner 2010). This ongoing socio-technical transformation proceeds quickly and is hard to grasp; or in other words: “Our technological tree has been growing much more widely, rapidly and chaotically than its conceptual, ethical and cultural roots” (Floridi 2010: 5). Floridi uses the term “infosphere” to describe this transformation embracing the (ontologically) powerful nature of information. The infosphere “denotes the whole informational environment constituted by all informational entities (thus including informational agents as well), their properties, interactions, processes and mutual relations” (Floridi 2010: 6). This infosphere constantly alters with ICTs and describes a highly dynamic environment comprising analog and digital settings,³ linking online as well as offline domains. Hence, socio-technical change reaches a new quality including an incremental shift of the boundaries between society and technology, physical (or analog) and digital environments. As Verbeek (2011: 30ff.) pointed out, humans are “profoundly technologically mediated beings” and “technology is part of the human condition”. Technologies basically represent socio-technical systems that affect the human condition and vice versa. ICTs highlight and enforce this interplay: their rapid diffusion and usage entails increasing connectivity and permanent availability of always-on computer devices, employed in various domains. There is an observable dramatic increase in digitally networked environments, reinforcing further growth in the amount of digital information. While in the year 2001 the number of global Internet users was about 500 million, today there are over 3.5 billion Internet users worldwide (ITU 2017). Network providers predict the amount of global internet traffic will soon exceed one zettabyte per year (10²¹ bytes and about one trillion gigabytes). Mobile computing in particular is on the rise. In 2016, about 50 percent of global Internet traffic resulted from wireless and mobile devices. By 2021, over 60 percent is expected. The number of networked devices is assumed to be three times higher than the world’s population, i.e., more than 27 billion devices (Cisco 2017). Against this background, visions of a globally networked information society including classical notions of pervasive or ubiquitous computing, ambient intelligence, etc. (Weiser 1991; ITU 2005) take more concrete shape with developments in the realm of “smart” technologies, the Internet of Things and similar trends. The general boost in digital networks is accompanied by a further expansion of digital information processing. With these developments, individuals and thus their identities are increasingly interconnected and represented by their digital information, prominently highlighted by, but not limited to, Web 2.0 and social media platforms. Digital identities are already involved in a broad variety of interactions (e.g., information exchange, communication, collaboration, sharing and creating content), among others fulfilling (and stimulating) the societal need to communicate and exchange with others. But this also entails further growth in the amount of personal information, personalization and uncontrolled information disclosure. Trends in the realm of big data, machine learning and so-called artificial “intelligence” (Mayer-Schönberger and Cukier 2013; Strauß 2015, 2018), aiming to exploit data from everyday life for novel se...

Table of contents

• Cover
• Half Title
• Series Page
• Title Page
• Copyright Page
• Table of Contents
• List of figures
• List of tables
• Acknowledgements
• List of abbreviations
• 1 Introduction: is privacy suffering from a digital disease?
• 2 A systemic perspective on privacy and identification
• 3 The interplay between identity, identification and privacy
• 4 Identification practices and the digital transformation of society
• 5 The privacy control dilemma of digital identification
• 6 How to regain control? Assessing privacy by design and privacy impact assessment
• 7 Toward an identifiability-based framework for privacy impact assessment
• 8 Is effective treatment of privacy possible? Summary and concluding remarks
• Index