Study Hall: Data Literacy is sponsored by Google.
Hey Siri, what’s data privacy?
Siri Voice: Information Privacy is the relationship between the collection and dissemination of
data, technology, the public expectation of privacy, legal, and political issues surrounding them.
It is also known as Data Privacy or Data Protection.
Before downloading an app or accessing a website, sometimes there’s a looong privacy policy
or terms of service.
And maybe there’s a smidge of data literacy guilt as we ignore the fine print, scroll
to the bottom and hit “accept,” but hey -- we’ve all done it.
We hand over a lot of data to a lot of people, often without realizing what we’re doing
or grappling with how it might affect our lives.
Devices and websites and services are working their way into our lives -- and our data.
Up until now, we’ve been focusing on understanding what story data is telling us and evaluating
whether we should believe that story.
But we’ve also seen that we’re part of the data. And so we’re part of the story.
So if researchers and companies are studying our data, we want to make sure we trust how
they’re collecting and sharing their version of our life story.
Some data should be able to be kept private.
I’m Jessica Pucci and welcome to Study Hall Data Literacy presented by Arizona State University
and Crash Course.
Data about our lives should be both private and secure -- and while they’re related,
privacy and security are definitely not the same thing.
Secrecy efforts and restrictions on how data is collected, used, and shared is data privacy.
Data security involves protecting data from those who would use our information against us.
Like say an online retail company collected data from its buyers.
The company may have a series of encrypted databases locked down by intense passwords
to keep that data to themselves, so the data is secure.
But if data on buyers was collected without their consent, like if your keystrokes are
collected to try to identify you if you visit the website again,
the data itself might not follow data privacy requirements.
We’ll talk about data security in the next episode, but for now let’s focus on privacy.
Some pieces of information about ourselves we intuitively know to keep secret, like our
screen name on the latest boy band fan site.
Or in all seriousness, important identifiers the government uses to track parts of our
identity like our national identification number.
So social security numbers in the US or social insurance numbers in Canada.
These ID numbers directly identify us and are part of our personally identifiable information,
or PII.
PII can identify us all by itself or when it’s combined with other pieces of data.
Names, addresses, phone numbers, and even e-mail addresses count as PII.
It’s important to keep PII private because it’s connected to other important things
like our bank account, taxes, and our location.
Sure we give out some of this information to our friends, our doctor, or our boss. But
would we share it with a stranger?
Well, sometimes.
We actually do give out PII when we give a website our address to ship us a product or
sign up for a coupon mailing list with our e-mail.
More and more we also give out specialized personally identifiable information, like
our personal health information,
including medical records, insurance records, and even demographic data.
Doctors probably need at least some of this information, but they’re not the only ones
we’re sharing with.
Wearable technology that collects our step count or heart rate is creeping into personal
health information territory. Which has some pros and cons.
Sometimes sacrificing some of our personal health privacy can come with benefits,
like wearables designed to deliver data directly to doctors or caregivers to help them monitor
patients in real time.
If a sudden drop in blood pressure could be diagnosed almost instantaneously, that seems
like a small price to pay for giving up some data privacy.
And when you know where the data is heading and you trust the receiver, it’s much easier
to give up some data privacy.
And sometimes we can even learn something new from grouping together the personal health
information that wearables collect.
Like in 2014 when an earthquake hit Northern California, the wearable technology company
Jawbone
used data from its fitness trackers to assess how the earthquake affected sleep patterns.
As Jawbone users, maybe we didn’t know that our data would be put into a larger dataset
and the analysis shared publicly.
But if we aren’t personally identifiable, maybe we don’t mind, since the finding could
benefit lots of people.
But sharing wearable data -- even as part of a group -- can have unintended consequences.
In 2018, Strava, a social network for runners and cyclists, released a heatmap of its users’
activities.
Well that sounds cool. I could see where the popular trails are in my area.
But actually, researchers were able to figure out where there were military bases by cross
referencing these heatmaps with news reports and Google Maps.
Even scarier, other researchers thought by isolating certain routes, we could track individual
people.
Our health should always be a priority, and wearables can help us achieve our goals or
just make health tracking more fun,
but we have to think carefully about our location settings and sharing other people’s location
data.
Wearables aren’t the only devices we’re giving data to.
Smart devices and appliances, or electronic devices that can communicate with a user and
connect with other devices wirelessly, are on the rise.
Depending on who you talk to, they’re either the greatest thing to happen to housework
or spying on our every move.
So...ok Google, what data are you actually collecting? Let’s get to it in the Data
Point.
You’ve got the latest everything in your smart house. Front door cameras and phone-controlled
locks and lights may make you feel pretty secure.
Even a “smart” fridge has its advantages; no need to stand in front of the fridge with
the doors open when it shows you a picture of what’s inside AND tells you when you’re
out of milk.
The future is here!
But lots of these devices learn a lot more than your love of mint chocolate chip.
Like along with sucking up dirt and that cereal you spilled during your midnight snack, that
automatic vacuum identifies your walls and doors to avoid crashes.
Which means over time, it learns the floor plan of your house.
Some of these devices even talk to us.
Smart speakers “listen” to our everyday chatter, waiting to answer our questions...and
pick up keywords that might be useful for personalized ads
ROBOT VOICE: “Did you say “chocolate?” This store delivers!”
...or practicing voice recognition.
No, I said “play next” not “send text.”
We’re trading data for convenience.
Like using a Google Home to turn off the lights when we’re out or turn up the heat just
before we get home is convenient.
The smart lightbulb company knows when you turn the light on and off and whether or not
you were a luddite and used the physical switch.
But it’s unclear what data Google Home gets out of the bargain, and how much privacy you're
giving up.
If a vacuum can figure out a floor plan, can lightbulbs reveal when we’re home or not?
This is the time to break out the terms of service and privacy policy to get the details.
Finding out what information is being collected, how it’s being used, and what your options
are for opting out are important steps
in being a smart owner of smart devices.
Now before you start pointing fingers at your innocent coffee maker, remember that data
is precious and it’s in smart device companies’ best interests to protect that data.
But help them help you by having strong passwords on all “smart” accounts.
In fact, data about its customers or user base is often one of the most valuable assets
a company has.
Like that smart speaker that was such a good listener?
Sometimes devices like that are given away for free because your training data [er, I
mean witty banter] makes up for it.
Like in 2019 when Spotify was giving away Google Home Minis.
Google’s willing to hand out $50 speakers like candy if it means they get to know the
playlists that are the soundtrack to your day.
You know what they say, there’s no such thing as a free lunch [or a free pump up jam].
That data is valuable both in house, and to other people.
Third-party data, or data collected by someone with no relationship to their data points,
is bought and sold all the time and can be profitable.
But there are rules.
Data privacy has actually been a concern since the mid-90s and early 2000s.
In 1996 the US created HIPAA, or the Health Insurance Portability and Accountability Act.
It includes a privacy rule that regulates how health insurance employees and those who
provide medical services share personal health info.
Like one of your doctors can’t really call up another one of your doctors and talk about
you without your consent unless it’s an emergency.
And you can keep track of your steps with some kind of wearable technology on your own,
but if your doctor wants to use that information,
HIPAA needs to be involved in how the data is transferred and used.
Just a few years later In 1998, the EU passed the Directive on Data Protection that prevents
businesses from disclosing personal data.
And Canada’s Personal Information Protection and Electronic Documents Act of 2002 also
governs how businesses handle personal information.
But as data on our lives has gotten easier to collect with the rise of smart devices
and social media and even credit cards, how we think about data privacy has evolved.
In 2018 both the California Consumer Privacy Act expanded data privacy rights, and the
EU directive was replaced by the General Data Protection Regulation.
These regulations strengthen data privacy rights. Now it’s required that we give informed
consent before any of our data is collected.
And consent requests have to be presented in “clear and plain language.”
Both also provide the right to request that any data collected in the past be erased.
In the EU, it’s “the right to be forgotten”.
Other privacy policies are in the works. In India, the Personal Data Protection Bill is
still being deliberated,
although there’s a controversial piece that gives the government broad power to access
private data.
And China is building on its 2017 PRC Cybersecurity Law.
In the summer of 2020 a new draft of the Data Security Law was posted to allow the public
to comment.
So now that we know our rights, let’s go back to that privacy policy and terms of service
we ignored before.
Some companies are taking notice of the call for simpler language.
Maybe you’ve even noticed it in those privacy policy email updates or app notifications.
In 2015 an antivirus software company, AVG, released a one page privacy policy that outlines
what each piece of data it collects is used for and what data is sold if you don’t opt out.
So should we opt out of everything and stick with that toaster that makes you physically
push down your toast?
Well, borrowing from a statistician’s favorite phrase, it depends.
Depending on where we live, we have some control over our online data.
We can parse the terms of service.
We can use an ad blocker or an anti-tracker to prevent advertisers from tracking our digital interactions.
We can also dig into the settings of each of our apps to see what data is being collected
and pick and choose the ones we want to opt out of,
like our location and what our microphone hears.
Data privacy is one of those scenarios where knowledge (of your rights) really is power.
Today we learned what kinds of personal data are especially important to keep private.
Like personally identifiable information is data that can be directly traced back to us
and personal health information includes our health and insurance records.
We saw scenarios when we might want to sacrifice our privacy and when that might not be such
a good idea.
We also learned about data privacy rights around the world and some strategies for exercising
those rights.
Now that we know when and how to keep data private, next time we’ll talk about keeping
that data secure.
Thanks for watching Study Hall: Data Literacy, which is produced by Arizona State University
and the Crash Course team at Complexly.
If you liked this video and want to keep learning with us here in Study Hall, be sure to subscribe.
You can learn more about ASU and the videos produced by Crash Course in the links in the
description.
See you next time!