- [Craig] In this video, we discuss the ethical and legal issues with the collection of personal data.
(uplifting piano jingle)
The rise of computer technology has caused some to question
the implications for individuals' privacy.
Cameras and surveillance systems have perfected number plate and face recognition
so that people can easily be tracked.
There are clear benefits such as crime prevention,
but it's also open to misuse.
Electronic tagging can identify where convicted criminals are with GPS tracking.
Black boxes in cars can monitor how people drive for insurance and accident investigation purposes.
Mobile phone signals can be tracked,
which also allows technology such as Find My iPhone
to enable you to find a lost phone or tablet.
In addition,
GPS technology is used to automatically tag date, time and location where photographs are taken,
and social networking tools allow this data to easily be shared with friends and family.
Schools will monitor internet and computer activity of their students,
and this logging also extends to the workplace,
where work patterns and phone calls are routinely recorded.
Modern browsers record a history of sites visited
and have options to retain passwords and credit card details to make browsing easier.
This may give rise to piracy issues if other computer users access this data.
Big data and data mining is slightly outside the scope of the course but is fascinating.
It's a process of looking for patterns and trends from very large data sets,
which can be used to make strategic business decisions as well as targeting advertising.
Data is now a very valuable commodity.
There are therefore many avenues to explore when considering privacy.
Sir Tim Berners-Lee,
inventor of the World Wide Web,
criticised moves by legislators in the UK and the US,
which he saw as an assault on the privacy of web users.
He has criticised the UK's Investigatory Powers Act,
saying that the idea that all ISPs should be required to spy on citizens
and hold the data for six months is appalling.
In the United States,
he is concerned that the principle of net neutrality, which treats all internet traffic equally,
could be watered down by the Trump administration and the Federal Communications Commission.
The web's creator also said he was shocked by the direction the US Congress and Senate had taken
when they voted to scrap laws preventing internet service providers from selling users' data.
He said privacy online was as important as the trust between a doctor and a patient.
We're talking about a human right.
My ability to communicate with people on the web
and to go to websites I want without being spied on
is really, really crucial.
An increasing range of smart devices in our homes are voice-activated,
and they're capable of listening in on our daily activities.
Some people argue that the government are collecting valuable information
for counterterrorism operations using this technology.
So should smart devices be allowed to continually record and listen?
There are several issues associated with the collection and use of personal data,
which you are expected to know about for the exam.
We're going to run through them now.
The first is privacy.
So consider who has access to your data and how is this access controlled?
Is the data private?
The second is the issue of ownership.
You may have supplied a lot of your personal data to a company or an online platform,
but who actually owns the data held about you?
Well under current data protection legislation in the UK,
you own the vast majority of your own personal data,
regardless of who may currently hold it.
This is the concept in law of the owner of a data, which is you,
versus the stewards or the protectors of the data,
which will be the people who hold it.
We also have a right to erasure,
your legal right to have your personal data removed from any system you've supplied it to.
The third issue is that of consent.
How can data be collected on you?
Reinforced data protection laws in this country, with the recent implementation of GDPR,
require organisations to ask for positive consent or opt-in.
It is no longer legally sufficient for them to collect data on you automatically
or for them to get you to simply tick a box that says I don't want my data used.
You now have to positively consent or opt in.
And this opt-in message must be in plain, simple English and must be obvious to the user.
The next issue to be aware of is that of misuse.
With vast amounts of your personal data now supplied to businesses and online platforms,
we have to think about how this could potentially be misused.
Could these websites be hacked?
What measures do they have in place?
What preventative systems do they have to protect you?
Could you be subject to phishing scams if your information is hacked?
And finally, and also spanning across all of these issues,
is the underlying concept of data protection.
How is your actual data protected?
What are your legal rights?
And this all leads to what is known as data protection law or legislation.
Over the last few years, data protection legislation has become incredibly robust
in both the UK and throughout mainland Europe
with the implementation of the General Data Protection Regulation.
And this is something we're going to take a look at
in a little more detail in the next section of this video.
The Data Protection Act 2018 is an updated piece of UK legislation
which is designed to protect an individual's personal data.
Prior to 2018, it already provided a great deal of protection to UK citizens,
but it has since been updated and made even more robust
by fully implementing all of the General Data Protection Regulations
set down by the European Union.
It provides various rights and guarantees under law,
and these are known as its basic principles.
The first is fair, lawful and transparent processing.
Personal data must be processed lawfully, fairly and in a transparent manner
in relation to the data subject.
This means that all data controllers must only process data for the purpose they acquired it
and with consideration of the data subject's rights.
The next principle is purpose limitation.
Data must only be collected for specified, explicit and legitimate purposes
and not further processed in a manner that is incompatible with those purposes.
The only exception to this purpose is relating to public interest
and scientific or historical research.
The next process is data minimisation.
This means only holding as much data about a person as is necessary.
Data must be adequate, relevant and limited to what is necessary
in relation to the purposes for which they're being processed.
For example, if you are collecting data to post a catalogue,
you only need the person's name and address.
You do not need their date of birth or gender.
It's not relevant.
The next principle is accuracy.
The data you collect must be accurate
and where necessary, kept up to date.
Every reasonable step must be taken to ensure that personal data that isn't accurate is corrected.
To fulfil this principle, you must update data if a customer notifies you of a change.
You must also erase the data if it's no longer necessary.
And under the regulation,
data subjects have the right to rectification, and this must be fulfilled within a month.
The next principle is data retention periods.
Data you hold must be kept in a form which permits identification of data subjects
for no longer than is necessary for the purposes for which the personal data is processed.
You may store it for longer for archiving purposes in the public interest,
scientific or historical research purposes.
The next principle is that of data security.
The data you hold must be processed in a manner
that ensures appropriate security of the personal data,
including protection against unauthorised or unlawful processing
and against accidental loss,
destruction or damage
using appropriate technical or organisational measures.
The last principle is accountability.
Now, accountability is a new principle in the Data Protection Act so it can comply with GDPR.
In order to do this,
data controllers must be able to prove that their data protection measures are sufficient.
They must have appropriate technical and organisational procedures,
which include suitable privacy policies and keeping sufficient records of their processing activities.
Another piece of legislation you have to be aware of is the Computer Misuse Act of 1990.
And this is an example of a piece of legislation
which had to be created in order to keep up with technology.
This act makes it illegal to make any unauthorised access to data
with the intent to commit further offences or with the intent to modify data; e.g., via viruses.
By bringing in this act, there's a whole series of online activities which are now illegal.
Some examples are on the screen like the planting of viruses, hacking, data theft and fraud.
Now you also need to know about the Privacy and Electronic Communications Regulations,
especially in regards to internet cookies.
So typically, a cookie is a small text file with ID tags that is stored in your computer,
and cookies can be created when you use your browser to visit a website.
They're typically used to keep track of your movements within the website
and can help by resuming where you left off when you revisit the site,
remembering your registered login,
remembering theme selections, remembering preferences,
and customising your experience in various other ways.
By law, any website operator using cookies must tell the user cookies are there,
explain what the cookies are doing,
and obtain the user's consent to store cookies on their device.
So in summary, we've provided some information which was gone through in this video.
Pause it now and take some notes.
An additional summary here of the Data Protection Act,
the Computer Misuse Act
and the Privacy and Electronics Regulations are provided.
Pause the video and take some more notes.
(uplifting piano jingle)