Massive amounts of data and increasingly intelligent systems challenge existing data protection principles - from informed consent to opaque decisions and the distionction between personal and non-personal, as well as sensitive and non-sensitive data. Rather than compromising on fundamental rights, this presentation introduces the concept of Data Exploitation and argues that the minimisation of excessive data generation and collection is essential. Presentation delivered at Computers Privacy & Data Protection Conference - PROTECTING INDIVIDUALS IN A BIG DATA WORLD. THE APPROACH ADOPTED BY THE COUNCIL OF EUROPE

1. LIVING IN AWORLD
OF DATA
EXPLOITATION
CPDP 2017
Frederike Kaltheuner | @fre8de8rike
Policy Officer, Privacy International

2. More data, intelligent machines, new
paradigm?
Challenges to data protection:
1. Informed consent
2. Blurring line between sensitive, personal, non-
personal and publicly accessible data
3. Inherent opacity of intelligent systems

3. The Internet of sensors
microphone
Wi-Fi
Bluetooth
3-axis load cells
accelerometer
gyroscope
conductivity sensors

4. DATA EXPLOITATION:
generation
collection
processing
sharing supporting
technologies:
AI
IoT
Big Data
Cloud Computing

5. How to protect individuals (and groups):
devices networks applications aggregate
minimise excessive data generation and collection

6. DEVICES
DATA
GENERATION
DATA
COLLECTION
= we have to blindly trust companies
not to do this excessively
example:The Guardian is instructed by GCHQ to destroy hardware

7. APPLICATION – emotion detection
NON-PERSONAL
HIGHLY SENSITIVE
DATA
PERSONALAND
HIGHLY SENSITIVE DATA
(that may be inaccurate)
= we have to blindly trust
companies not to identify
individuals

8. AGGREGATE - SOCMINT
PERSONAL
NON-SENSITIVE
PUBLICLY
ACCESSIBLE
DATA
PERSONAL
HIGHLY SENSITIVE
PROPRIETARY
INFORMATION
(that may be inaccurate)
= we have to blindly trust that
companies (and government) to not
exploit/misuse this intelligence
example:Walmart using social media to gather intelligence about union

9. GOVERNANCE AND ETHICS OF AI NEEDS
TO ADDRESS PRIVACY!
[“automatic processing” is both too broad and too narrow]

10. LITMUSTEST:
A changing political climate
SENSITIVE
INFORMATIONALL
OVERTHE PLACE
VULNERABLE
CONNECTED
DEVICESAND
NETWORKS
OPAQUE DECISIONS
& DISPARATE
OUTCOMES BY
INTELLIGENT
SYSTEMS
example: STASI-style network analysis

11. How to protect individuals (and groups)
Problem: imbalance of power & informational
asymmetry
1. Individuals must regain control over their data!
2. Data minimisation – generation and collection!
3. Rights violations are not risks that can be
assessed in a cost/benefit analysis!

12. Frederike Kaltheuner
Policy Officer
@fre8de8rike
frederike@privacyinternnational.org