sou · H4B341 · 2016-06-07 00:00:00 — Big data har ännu inte varit föremål för någon närmare gransk- ning utifrån ett integritetsskyddsperspektiv i . Här har data- skyddsmyndigheterna i exempelvis och kom- mit längre. Faktorer som i detta sammanhang är av betydelse för risken för den personliga integriteten, är att big data innebär att uppgifter han- teras för nya ändamål som inte är kända vid insamlingen. Det medför att den enskilde förlorar både kännedom om och inflytande över hur uppgifterna hanteras. Med big data blir det särskilt tydligt att person uppgifter betraktas som en handelsvara med ett högt kommersiellt värde. Det medför en avsevärt ökad risk för spridning av uppgifterna till parter som inte är kända för den enskilde. Kommittén anser därför att big data för med sig en allvarlig risk för den personliga integriteten. måste också beaktas att big data på ett genomgripande sätt kan komma att effektivisera och förbättra verksamheter i många delar av samhället. 3.7.17Biometri (avsnitt 21.3) Användningen av biometriska tekniker innebär flera olika risker för den personliga integriteten. Vissa av de risker som nämns här, be- handlas utförligt i Artikel 29-gruppens yttrande om ut- vecklingen i fråga om biometrisk teknik.54 54 Artikel 29-gruppens yttrande 3/2012 om utvecklingen i fråga om biometrisk teknik, WP 193, antaget . En risk är att biometriska uppgifter behandlas för nya ändamål som är oförenliga med de ändamål för vilka uppgifterna ursprung ligen samlades in. Exempelvis kan biometriska uppgifter om gångstil och ansikte användas inte bara för att identifiera enskilda, utan också för att hitta oönskade beteenden eller särskilda behov hos enskilda. En annan risk är att fler biometriska uppgifter hanteras än vad som behövs för ändamålet, t.ex. att hela fingeravtryck samlas in och lagras när det i själva verket hade varit tillräckligt att bara hantera vissa mätpunkter från fingeravtrycket. Detsamma kan inträffa när uppgifter om DNA inte bara möjliggör identifiering, utan även av- slöjar något om den registrerades hälsotillstånd, sjukdomsbenägen- het eller etniska ursprung. Ytterligare en risk är att biometriska uppgifter inte skyddas till- räckligt och som en följd av detta blir tillgängliga för personer som kan använda uppgifterna för exempelvis identitetsstöld. Det finns också en risk för att biometriska uppgifter kan använ- das utan att den enskilde känner till det eller lämnar sitt samtycke, t.ex. vid publicering av bilder på nätet eller i sociala medier där det finns särskild programvara för ansiktsigenkänning. Det finns slutligen också en risk för överutnyttjande av biometri när tekniken blir billigare, enklare och därmed mer lättillgänglig. Alla sammanhang kräver inte den höga precision som biometri kan erbjuda. En ökad användning av olika biometriska tekniker i samhället, riskerar att göra det mycket svårt att någonstans i det offentliga rum- met kunna vara helt anonym. När kameror och annan utrustning i omvärlden kan läsa av och identifiera den enskildes kropp eller per- sonliga beteende och koppla ihop de biometriska uppgifterna med uppgifter från andra datakällor blir detta avsevärt mycket svårare. Sammantaget anser kommittén att användningen av tekniker som involverar många och detaljerade biometriska uppgifter, innebär en påtaglig risk för den personliga integriteten. måste beaktas att biometriska tekniker kan medföra stora fördelar t.ex. genom att bidra till att höja säkerhetsnivån vid åtkomst- eller tillträdeskontroller och genom att göra identifierings- och autentiseringsförfaranden säkrare genom kombination med andra metoder, men också enkla, snabba och bekväma för den en- skilde. In 2014 the Swedish Government decided to appoint a parliamen- tary committee to survey and analyse the actual and potential risks of breaches of privacy that may arise in conjunction with the use of infor- mation technology in the private and public sector. The Government appointed to chair the committee. is now submitting its interim report Hur står det till med den personliga integriteten? (What is the privacy situation?) This is a translation of the chapter of the report in which the committee sums up the situation with regard to privacy. In this section we attempt to assess what the combined impact will be on an individual of all the collection and storage of personal data, surveying and surveillance in which he or she participates or to which he or she is subject in today’s increasingly digitised society. We also examine the general problems that we have identified as encroaching on several areas of society. In our final report we intend to investigate the steps that could be taken to counteract the risks that we have identified. Here, methods other than legislation may be relevant, such as industry agreements or proactive measures on the part of the supervisory authorities. 4.1The combined impact on the individual In Chapter 5, Privacy, we describe how we use the term privacy. In somewhat simplified terms, we understand privacy to mean every- thing that it would normally seem relevant to safeguard in order for an individual to be assured a reasonable, protected, private sphere. is our mission to show, from the perspective of the individual, the combined impact that recent technological and social developments, in all areas, have had on the privacy of individuals. The development is sometimes termed “the digital revolution”, drawing a comparison with the industrial revolution, or “the third industrial revolution”, drawing a comparison with mechanisation and the development of steam power, followed by the development of electricity and the combustion engine.1 Whatever term or detailed description is chosen, the shift means a comprehensive change to society and the conditions in which indi- viduals live. This trend naturally brings with it a huge potential benefit, but the task of the committee is to focus on actual and potential risks. Today digital personal data is generated and used to an ever increasing extent in all areas of society. The number of actors is growing, areas of use are increasing, storage times lengthening, more information is being disseminated and exchanged between actors, further processing of data by the respective actors is growing, and dissemination beyond national borders and the ability to process data in real time are on the rise. We are also seeing that some major actors, as a consequence of the development as a whole and their own business strategies, are gaining access to an ever increasing amount of personal data, so giving them the opportunity to draw increasingly complete pictures of individuals. This trend is due to digitisation and to a gradual change in the way information processing is viewed, both in public administration and in the business sector. The trend can be described using the following simplified image: •Previously organisations had one specific purpose for up a personal data register or a database. Now there is a wide range of purposes. •Previously data was collected because there was a clear need to do so. Now it is collected because it “might come in useful one day”. •Previously it was important, partly for reasons of cost, to keep storage times low. Now major benefits are seen in retaining data. the final report of the Digitalisation Commission, Digitaliseringens transformerande kraft – vägval för framtiden (The transformative power of digitisation – choices for the future), SOU 2015:91, p. •Previously searches and analyses of personal data were done with a particular purpose in mind. Now big data and data mining are a reality. •Previously personal data was gathered through a specific registra- tion process. Now it happens more or less automatically by an individual taking action and using digital tools. •Personal data has increasingly become a commodity. This trend has been made possible despite the fact that basic data protection principles such as duty to inform, obtain consent, erase and what is known as the “purpose principle” continue to apply. From the point of view of the individual, the trend means that knowledge of how the information will be processed, and the oppor- tunity to influence this, is constantly shrinking in relation to the growth in processing of personal data in society. Correspondingly, the individual’s opportunity to decide, in a truly free choice, how information about him or her is to be handled is also restricted. The general conclusion of is therefore that in a number of areas the individual is suffering a gradual erosion of privacy. We can see a shift in influence over how the data is handled – from the individual to the personal data controllers and from the personal data controllers to service providers. Service providers often tend to be large, global companies, even though in a formal sense they are only personal data processors and thereby obliged to follow the instructions of the data controllers. The global companies are very big, but few in number and usually based in the . This shift therefore also means a concentration and geographical reloca- tion of influence, beyond the jurisdiction of and the EU. Regulation of how data may be handled is largely conducted at EU level. National influence from the Government and the Riksdag must thus be exercised through the EU partnership, with the limitations that this involves. On top of this, as stated above, comes the fact that the actual data processing often takes place outside the EU, which in turn reduces the EU’s opportunities to influence it. In this context it is significant that the EU’s data protection provisions tend to provide stronger protection than equivalent rules in other parts of the world, such as the . The overall picture of how data is handled today is a challenge to which individuals may react in different ways. However, it is clear that when knowledge and control are propor- tionally reduced, the conclusion must be that the situation for privacy is getting worse, irrespective in fact of how one chooses to define the concept of privacy. The scenario of the individual’s declining self-determination in this respect is also a challenge that the state may react to in different ways. It can accept the individual’s relatively diminishing awareness and opportunities to exert influence as a given. It may work to increase individuals’ awareness and influence. It may also work to prevent such data processing that is not desirable for some reason. The Swedish state has so far chosen a mixture of all three options. The scenario also raises a question of a different type – are people and their behaviour changed by the accelerating digital processing of their information and their private lives? And if so, how? We com- missioned to produce a systematic review of the literature on digitisation and privacy. It shows that both internation- ally and in , there is surprisingly knowledge of the effect that digital surveillance has on people’s behaviour and their view of the world and themselves. There are some studies indicating a risk that a lack of respect for privacy can lead to lower internet usage and lower political engagement (at least online).2 However, at the mo- ment there is no scientifically valid and empirical evidence that this is the case. Some of the problems are not restricted to any particular part of so- ciety but may be encountered by the individual in many different situations. We therefore wish to highlight these and treat them sepa- rately. 2 See the articles listed in the literature review, particularly in the section on the knowledge and behaviour of young people. There are other reports on this too, such as Global Chilling – The Impact of on International Writers, Results from PEN’s International Survey of Writers (January 2015). 4.2.1Knowledge of how data is handled One recurring observation is that individuals are largely unaware of and have knowledge of why and how their personal data is being processed in equipment and services in different contexts. This is confirmed by a number of surveys. For example, in one work-related survey, only 21 per cent of the employees questioned said that they knew what data their employer collected about their internet use.3 In another survey, 8 out of 10 Swedes questioned considered that they were not in complete control of their data.4 made a similar observation on companies or agencies that are data control- lers. Where these are concerned there are no surveys equivalent to those on the knowledge and attitudes of individuals, but in our con- tacts with different parties and in our overview of the prevailing situ- ation it has emerged that a lack of knowledge is not uncommon among those responsible either. One clear example of this is agencies that purchase cloud services without looking in more detail into how the data is handled and disseminated within the service. 4.2.2Opportunity for the individual to exert influence Several factors make it for individuals to influence how their own data is stored and disseminated. This is firstly made more diffi- cult by the growing further processing of data for new purposes in different parts of society, e.g. through big data. Secondly, it is more difficult for people to have control over their own data because we use equipment that generates and disseminates increasing amounts of personal data – through apps and sensors installed in mobile phones and vehicles, for example. When the individual is unaware of this and is unable to influence how this personal data is handled, the importance of consent is un- dermined. The consent obtained for different types of data process- ing increasingly appears to be chimerical. Even in situations where the way in which data is processed is crystal-clear to the individual and clear consent is requested, in practice the individual may often lack a choice because saying no would demand a high price in terms 3 Report of 26 2014 on a survey of its members carried out by the trade union Unionen. 4 Special Eurobarometer 431, Data Protection, published in 2015 and the Protection Authority’s annual report for 2015, p. of, e.g. ceasing to consume online media, ceasing to communicate using social networks, being unable to use credit cards and unable to contact certain care providers, for example. Humans are social animals and exist in a technological context that it is very difficult to opt out of in practice. Refusing to consent means being excluded, and is thus rarely a realistic alternative. Consent questions are often worded as binary options, i.e. either the individual consents to every- thing that the body responsible wants to do with the data in order to provide a particular service or the individual does not consent and cannot therefore use the service at all. There are rarely graduated options. In some contexts, such as public administration, there is also legislation that does not require consent, and the individual has no legal opportunity to oppose their data being handled in this area. This can have far-reaching effects when information from the administrative sphere reaches the private sector, e.g. through cloud services or the principle of public access to official documents. 4.2.3The individual’s own protective measures The individual’s opportunity to take protective measures requires knowledge of how the data is processed and disseminated by compa- nies and agencies, but also knowledge of how information is dissem- inated by other individuals, e.g. when pictures of individuals are published on social media by other users. Furthermore, in practice it is often time-consuming and compli- cated to protect oneself in ways other than non-participation, e.g. by using encrypted e-mail or other technological solutions available to the individual. This does not seem a realistic option for the vast ma- jority. We commissioned a data security specialist to produce an overview of privacy protection technology. shares the assessment made in the report on the opportunities that individuals have available for protecting themselves against breaches of privacy. Many day-to-day services that rest on modern information technology and are seen as indispensable, often involve an in-depth survey of the individual. (…) It is possible, as an individual citizen, to defend oneself against the breach of privacy that occurs by using these technologies, other than by actively choosing not to use the majority of them. Few people are likely to consider stopping buying electricity or stopping using a mobile phone, however. The alternative, as a consumer attempting to protect their private sphere by various means, is often so impractical and expensive that it rarely seems a realistic option other than for those engaged in gross criminal offences. This group of individuals may well take far-reaching steps to avoid leaving an electronic footprint, including solely using cash, always using anonymisation services on the internet and randomly swapping mobile phones and unregistered SIM cards in different places, as well as turning devices off when they are not needed. 4.2.4What do individuals think? The fact that individuals – without having any real alternatives – give away their personal data and do not to any major extent take the measures and steps that do nevertheless exist to protect their data, does not mean that individuals in general care nothing for their privacy. In several surveys respondents answer on the contrary that how their data is handled is important to them, that they would like a clear regulatory framework that is upheld and that their trust in different actors varies considerably in this respect. In a major survey conducted in 2015 on public attitudes to privacy, 52 per cent of the Swedish respondents disagreed with the statement “providing personal information is not a big issue for you”.5 In another survey, carried out by a trade union, a clear majority of the members questioned answered that they were neither concerned about breaches of privacy at work nor had ever experienced such breaches.6 When, on the other hand, they were asked to read some examples of surveillance and then state whether they thought the union should push for stronger privacy protection, an equally clear majority thought that the union should do so. Supervision of how personal data is handled covers only a fraction of all the phenomena that pose a risk in terms of privacy protection. The greatest responsibility for supervision lies with the Protection Authority, whose job has largely remained the same since the agency was founded in 1973. Today the authority has a 5 Special Eurobarometer 431, Data Protection, published in 2015 and the Protection Authority’s publication Integritet i fokus (Privacy in focus), no. 4, 2015. 6 Report of 26 2014 on a survey of its members carried out by the trade union Unionen. workforce of approximately 45 people, who are also charged with exercising supervision over debt recovery and credit information. The size of the agency and its mandate means that many new phe- nomena and actors, for obvious reasons, are not examined or assessed at all from a privacy protection point of view, or that this only hap- pens once they have been on the market for a while. In recent years the situation has been affected by the fact that the Data Protection Authority has gradually cut back its supervisory activities. This is partly explained by a marked increase in the number of reports and documents submitted for consultation by the Government, which has taken resources away from its supervisory operations.7 In this area supervision can be said to be particularly important. Firstly, new phenomena arise at a very rapid pace. There is reason to assess many of these from a legal perspective. Secondly, the regula- tions are relatively imprecise and intentionally general. It is therefore only once the supervisory authority has assessed a new phenomenon that suppliers and users receive any guidance. The result of the su- pervision can then be used in the outward, proactive work of the su- pervisory authority to disseminate awareness. has said that it has experienced certain difficulties exercising supervision in the digital environment. The problems partly concern digital and individually tailored mar- keting, e.g. on social media, based on more or less detailed profiling. The phenomenon has not been subject to supervision by the . Similarly, user conditions for social media have not yet been examined by the . In its survey the committee found that supervision of privacy to- day is split between several different agencies. Besides the Protection Authority and the , su- pervision in the privacy arena is also carried out by the Authority, the Swedish Commission on Security and Integrity Protection, and the county administrative boards. su- pervision can result in a loss of efficiency regarding supervision overall. However, we have refrained from addressing this issue in any greater depth at this time, as it is currently being analysed in Utredningen om tillsynen över den personliga integriteten (the Inquiry 7 Protection Authority annual report for 2015, p. into supervision of privacy).8 With the aim of strengthening protec- tion of privacy, the inquiry will consider how more coherent privacy protection could work within a single agency structure by gathering all supervision of the processing of personal data within one agency. A general issue for the whole area is that the sanction system, both in criminal law and tort law, does not appear to be used to any great extent. few cases reach the courts in any case. For example, in the period 2012–2015 we have found only five disputes that came before the district courts in which the case involved damages under the Act. The situation in criminal law is no different. In 2014 in as a whole, a decision was reached in a total of only four cases of breach of the Act (by a judicial rul- ing, imposition of a penalty or decision not to prosecute). When the system is used at all, it concerns mild punishments and low amounts of damages. In summary, the sanction system cannot be said to work to its full capacity, as it has not had the effect that was intended when the pro- visions were introduced. Another general observation is that digital services are increasingly characterised by globalisation. Many different actors in different countries work together, for example, in providing all the compo- nents and programs in a mobile phone. Personal data about the user can sometimes by processed by those who manufactured the phone, the operating system, or the apps it contains. It is not uncommon for the different manufacturers to be located in different continents. The apps in turn are often cloud-based and it is the nature of cloud services that data is moved between different data centres across the world. This also leads to the legislation of these countries being ap- plied to how the data may be handled, which may involve provisions that provide considerably poorer data protection than that in the 8 Ju 2015:02. rules in and the EU, e.g. on the right of the state to access the data. Processing in other countries also means that it is usually impossible in practice to exercise control over and supervise how the data is actually being handled. Another consequence of globalisation is that agencies need to give out information to companies that are based in other countries, where accordingly it is the other country’s laws that regulate how the data may be handled and disseminated further.9 4.2.8Journalistic purposes under the Act One question we do not address in further detail in the examination is that today’s Swedish framework legislation, the Act, sets out that significant parts of the regulations do not need to be applied in certain situations as this would restrict freedom of ex- pression.