Data Privacy and Consent | Fred Cate | TEDxIndianaUniversity

Summary

This thought-provoking talk critiques the reliance on consent in modern privacy laws and data protection. The speaker highlights how consent mechanisms often fail due to complexity, inaccessibility, and the illusory nature of consent in many digital environments. They argue for a shift towards data stewardship, where organizations bear responsibility for the privacy of personal data. By focusing on clearer, more effective practices and rethinking privacy laws, the speaker advocates for more meaningful privacy protections in an increasingly data-driven world.

Takeaways

• 😀 Data is rapidly becoming uncontrollable, with vast amounts being collected, inferred, and even created about individuals every day.
• 😀 Privacy laws across the world emphasize consent as a key component, but the speaker argues that consent is problematic and ineffective in protecting privacy.
• 😀 Consent is often impractical due to the complexity and length of privacy notices, leading many individuals to ignore them entirely.
• 😀 Modern consent is frequently illusory, as individuals often have no real choice, such as being forced to accept terms to update software or use devices.
• 😀 There is a growing burden on individuals to give consent in a meaningful way, which in reality shifts the responsibility onto them, rather than companies collecting the data.
• 😀 Consent notices are often inaccessible and difficult to comprehend, making it challenging for individuals to make informed decisions about their data.
• 😀 The collection of personal data frequently occurs in public or group settings where obtaining consent is either impractical or impossible.
• 😀 Many companies engage in trillions of data transactions yearly, with much of this data being used for purposes like marketing or assessing creditworthiness, often without individuals' explicit knowledge.
• 😀 Privacy policies are so long and complex that it would take an individual over 30 working days to read just the privacy policies of the 40 most popular websites.
• 😀 Instead of focusing on consent, the speaker advocates for data stewardship, where companies that collect and use personal data are held accountable for its protection.
• 😀 The speaker calls for a clearer framework for what can and can’t be done with data, such as defining acceptable use cases like fraud detection or research, to ensure privacy protection without overwhelming individuals with constant consent requests.

Q & A

What is the central theme discussed in the script?

The central theme of the script is the challenge of personal data, privacy, and the role that consent plays in modern data protection laws, particularly focusing on why consent as a mechanism for privacy protection is often impractical and ineffective.

How has data collection changed in recent years according to the speaker?

Data collection has become ubiquitous and is growing at an alarming rate, with individuals volunteering vast amounts of personal data through activities like social media posts, photos, texts, and more. This data is being collected and analyzed, often without individuals fully understanding the extent of it.

What does the speaker suggest is a significant issue with current privacy laws?

The speaker suggests that current privacy laws, particularly those based on consent, are ineffective because they place an unreasonable burden on individuals, who are often unaware or incapable of fully understanding the implications of their consent to complex privacy notices.

What is the historical basis for modern privacy laws?

Modern privacy laws are based on the work of Dr. Alan Weston, who in the 1960s defined privacy as the right of individuals to control when, how, and to what extent information about them is communicated to others. This definition laid the groundwork for privacy laws worldwide.

What statistic did the New York Times report about data transactions?

In 2017, the New York Times reported that a company no one typically associates with data collection, such as a non-famous entity, conducts 50 trillion personal data transactions every year, highlighting the sheer volume and complexity of data exchange.

Why does the speaker argue that consent is an impractical solution to privacy?

The speaker argues that consent is impractical because people often ignore or fail to fully understand the complex and long privacy notices they encounter. This makes consent a meaningless or illusory process that doesn't effectively protect individual privacy.

How does the speaker illustrate the problem of consent with an example?

The speaker uses the example of updating an iPhone, where users are presented with numerous screens of privacy policies that they are forced to accept in order to use the device. This demonstrates that consent is often coercive and not a genuine choice.

What role does the speaker believe businesses should play in data protection?

The speaker believes businesses should act as stewards of data. They should be held accountable for any harm caused by mishandling personal data, rather than shifting the responsibility to individuals through consent.

What alternatives to consent does the speaker propose for improving privacy protection?

The speaker proposes focusing more on data stewardship, establishing clear rules about what data can be used for, and emphasizing redress for when things go wrong. These alternatives aim to shift responsibility away from individuals and toward businesses or organizations handling the data.

What positive example of consent does the speaker mention?

The speaker mentions a feature in Apple devices that notifies users when an app is using their location data, giving them a chance to opt-out. This is seen as a meaningful, timely, and effective use of consent to protect privacy.