The four uncomfortable questions for anyone working with Personal Data Markets
By: Sanna Toropainen
Tags: Data Monetization, Privacy, Data Protection, Data Governance, Gdpr

The four uncomfortable questions for anyone working with Personal Data Markets

My lessons learned after a year of building a tool that allows individuals to monetise their data. Sanna Toropainen Apr 7·8 min read

Photo by Fred Moon on Unsplash

Privacy lacks tangibility. It is easy to say that privacy matters. It is harder to say — how do you protect your privacy online and what concretely is the harm of being tracked online.

As a privacy start-up founder, intangibility complicates the advocacy work. When individuals care about their privacy but don’t take action to protect it, the question is also — will anyone use our product? Even when we think it is going to give you so much good. More control over data. More privacy. More money.

We founded Muna.io at the beginning of 2020. The year was a challenge in so many ways. Personally and professionally. Our pilot partners paused projects, and progress came slowly.

The slow moments are, nevertheless, good for self-reflection. Is our progress slow because the economy is suffering, and business is slowing down? Is it because our value proposition is a nice-to-have, not a must-have? Did we understand what the job-to-be-done is for privacy?

Here are the four uncomfortable questions that we are now asking ourselves.

1. Do we know the best way to live?

The debate around the sale of personal data goes something like this. If you are for it, you believe it is time for individuals to get their fair share of the data economy. And have their legal claim over data they produce. The opponents, however, believe that selling personal data will only erode human dignity and democracy. An infamous quote by a former European Data Protection Supervisor equates trade in personal data with organ trade. Even if there is a demand for it — it should not exist.

We believe, if you sell your data, you don’t lose your right to privacy and data protection. On the contrary, you uphold human dignity and freedom. You choose what you can do with your data. Be it selling or not selling it. Still, privacy is also a cultural concept that varies by place and time.

For example, in the US, privacy has been considered an economic right, and consumers are used to thinking about the benefits they get in transactions. In the EU, individuals are more privacy-conscious, and privacy is codified, as a fundamental human right (enshrined both in the ECHR and EUCFR). The different macro schools of thought are visible in the way people respond to the idea of selling personal data.

The cultural divide is also visible in a study commissioned by Okta, Identity Cloud Provider, on consumer readiness to monetise personal data. The results show that in the US people between 18–24 years, are ready to share their data with companies for financial compensation. Only 24% responded that they are unwilling to do so. In Europe, especially in the Netherlands and Germany, 45% and 42% of the respondents older than 24 years say that they are unwilling to share their data for profit.

Our privacy attitudes also change over time. The philosopher Hannah Arendt writes that in the beginning, the word privacy had a negative connotation of being deprived of the ability to take part in the public sphere. The meaning of privacy started to change due to modern individualism and enrichment of private life that gave birth to the ‘social realm.’ Privacy, according to Arendt, was discovered as the opposite, not to political life, but social life. Furthermore, among the first philosophers to uncover the need for privacy was Jean-Jacques Rousseau, who talks about it as ‘the rebellion of the heart’ when the society ‘intrudes to the innermost region of the man, which until then had needed no special protection.’

What is the need for privacy in 2020? How has the area of social media changed our need for privacy? Or are we, on the contrary, getting used to living with less privacy and more in the public? As entrepreneurs building tools for individuals potentially exposing them to greater risk by selling their data, we need to believe that the individual is making a conscious choice on what privacy means to them.

As Allen writes: “As society changes, what seems right and wrong may change or seem unfathomable. The ethical novelty introduced by technological innovations leaves us uncertain about how best to live.”

Thus, we need to listen to individuals and their experiences on privacy — before giving our opinion on how they should live their life. We can bring awareness and propose tools for them. However, we should avoid telling people how they should live or how much privacy they need. Since maybe the future is not private — but something else.

2. What is harm done?

What happens when I lose my privacy? What happens when my data is exposed? Most of the time, the harm is not explicit nor immediate.

In the case of identity theft, you can tangibly see that someone has access to your credit card details when your bank account balance is going down. But where is the harm done when you know that your personal data was exposed, as a result of a data breach, like in the case of British Airlines, but nothing happened. Nobody made purchases in your name. No other than yourself used your logins.

Still, Elias Aboujaoude has studied the mental health impact of a data breach. He has recognised that even when there are no physical or material damages after a data breach, a person can suffer anxiety, depression, and post-traumatic stress. In other words, the consequences of a data breach should not be taken lightly even though they are not immediate or in your face — oh this hurts so much.

One can also ask what is the harm done when companies like Facebook and Google use your data and sells advertisement with the help of your data? Is it the social manipulation that happens as the platforms aim to influence your behaviour — to view more advertisements or to spend more time on the platform as showcased by the recent Netflix documentary, the Social Dilemma?

Even before the Social Dilemma, professionals have tried to warn us that individual judgment is by nature open to biases and heuristics, and these biases are predictable. Predictability makes it easy to guide human behaviour and manipulate our actions. And if the big tech companies do not know what prompts action, they can find out about it by testing. For example, Google has reported testing 40 different shades of blue to determine which shades encourage more clicks. A click is a small action, but when multiplied by billions of users, it can generate 200 billion dollars additional profit. … but, is it such a big deal? I have spent countless hours studying this, still, I use Google and Facebook — and I spend most of my day online. How can I then ask others with less tech know-how to do any different?

In both cases, nevertheless, it is tough to pinpoint why losing privacy hurts and why we should change our behaviour. For people advocating privacy tools, this complicates the marketing efforts. How do you address people about the pain that they don’t really know that they have? Especially if you want to help them to avoid the pain that they don’t really know they have. Do you see what I mean?

3. Do your customers really understand what they consent to?

If you have an application or browser extension that allows individuals to sell their data to third parties, how do you ask for consent? The GDPR and European Data Protection Board has given detailed requirements to what constitutes valid consent. These are the minimum standards any company dealing with personal data must uphold. The question is, nevertheless, do individuals honestly understand what happens after they give their permission to forward data to a third party?

Eoin Carolan raises the concern. First, what are our capabilities to make informed consent that is free from external influences? Laws can force companies to provide us the right level of detail about the data processing activities. The problem is, however, the human mind is still weak in understanding how technology works. Take, for example, statistics from the consumer electronics companies that report users never touching most of the buttons provided to them. When we do our laundry, in general, we use (always) the same two programs. Knowing this is it too much to ask from us to give consent for a company to process my data on a cookie banner? Let alone to sell personal data? Are we going against our human nature on this?

4. What happens to the data after you sell it?

One of the requirements for valid consent is that you should be able to withdraw it at any time. However, data also has a slippery nature. Within a second it can be joined to a data lake that is used for company-wide data analytics to identify unanticipated correlations. On our application, we are helping individuals to send a request to companies with a simple click. Please delete my data. Even if that happens after a second they exchanged their data for a company reward. But is this enough?

Often the analytics do not start with a specific question in mind, but rather, it is a fishing expedition to find something of interest. The unexpected results can, for example, reveal a behavioural pattern that you did not know you have — and when disclosed, is embarrassing. The bottom line is, how can we subjectively anticipate the results of data analytics?

Because of this reason, I think it is important that individuals exchange raw data not anonymised data. There are a few reasons for this. First, it is problematic if individuals only feel comfortable sharing their data when it is anonymised. Exactly for the reasons mentioned above. The anynonisation is never 100% guaranteed, and talking about it as it would be, gives a false sense of privacy. Secondly, if you sell anonymised data, you lose the connection between the individual and a company. Both sides become unknown. The company buys data from an unknown set of consumers, and consumers do not know who got a piece of their data. In our solution, we facilitate exchange where the buyers and sellers of data know each other by the name. Thus individuals can enforce their rights immediately and keep the companies accountable for the processing of their data.

Conclusion

Personal data markets are a niche that has existed already for more than ten years. The questions about the validity of the sale and personal data protection are still as burning as ever. We hope to keep the conversation around the markets honest and transparent — as we hope, the EU regulators would do too. With the upcoming Data Governance Act — we wish to see more explicit references to Personal Data Markets so that there is a clear legal framework to rely on when consumers comes asking.