Why so much demand for our personal data ?

The EU Gene­ral Data Pro­tec­tion Regu­la­tion (GDPR) tur­ned three on 25 May 2021. After twelve months of digi­tal tools being rol­led out on a mas­sive scale due to Covid-19, this anni­ver­sa­ry is shed­ding new light on the stakes connec­ted to pri­va­cy and Euro­pean digi­tal sove­rei­gn­ty. For France’s Natio­nal Com­mis­sion on Infor­ma­tics and Liber­ty (CNIL), it’s the per­fect occa­sion to go back over what consti­tutes this regu­la­to­ry fra­me­work, what it pro­tects and what pre­ci­se­ly is in so much demand.

The oil of the 21^st century

First of all, what is “per­so­nal data”? It’s not like other data – it contains infor­ma­tion that can iden­ti­fy a per­son, like their name, a num­ber connec­ted to them, or their digi­tal fin­ger­print. It’s often said that per­so­nal data is the oil of the 21^st cen­tu­ry but com­pa­ring it to “seeds” seems more apt, as this kind of infor­ma­tion is only made valuable when it’s used in cer­tain ways.

A clas­sic example is the foot­print left online by inter­net users, which is gathe­red through cookies when users navi­gate online, or from connec­ted objects. Having accu­rate know­ledge of nume­rous details (such as the age, loca­tion, taste, pur­cha­sing beha­viour, health condi­tion, or even ideo­lo­gi­cal beliefs) of poten­tial consu­mers is extre­me­ly valuable for com­pa­nies, as it allows them to seg­ment their mar­ket bet­ter. In just a few years, per­so­nal data has become a stra­te­gic finan­cial asset, one that’s par­ti­cu­lar­ly enti­cing for GAFAM, as shown by reve­nue from the first quar­ter of 2021 – $23.6bn net pro­fit for Apple vs $11.2bn in the same per­iod last year ; $17.93bn (vs $6.8bn) for Alpha­bet, Google’s parent com­pa­ny ; and $9.5bn (vs $4.9bn) for Facebook.

A tool to improve public poli­cy and cri­sis management

Howe­ver, far from only ser­ving com­mer­cial inter­ests, per­so­nal data has also pro­ven to be very use­ful for crea­ting effi­cient public poli­cy, espe­cial­ly during the pan­de­mic. For example, since the Covid-19 vac­ci­na­tion cam­pai­gn was laun­ched, regio­nal health agen­cies have had access to infor­ma­tion to track its pro­gress across France. Since Janua­ry, the “Vac­cin-Covid” infor­ma­tion sys­tem (deve­lo­ped by France’s public heal­th­care body, “Assu­rance Mala­die”) ensures that vac­cines and stages of vac­ci­na­tion are tra­ceable at a natio­nal level, from pre-vac­cine consul­ta­tion to injection.

Access to data is a real issue for the EU, which is aware of their depen­den­cy on forei­gn sys­tems. They have made control­ling this access a pillar of their digi­tal sove­rei­gn­ty stra­te­gy. Seve­ral major events in 2020 stand out in this area – the Schrems II judg­ment, han­ded down by the Court of Jus­tice of the Euro­pean Union last July, which inva­li­da­ted the Pri­va­cy Shield, under which data could be sent to the US ; the com­mit­ment to trans­fer the Health Data Hub to a host that would prevent that sen­si­tive data from poten­tial­ly being expo­sed to access requests that are ille­gal under GDPR ; and, final­ly, the Digi­tal Gover­nance Act, Digi­tal Ser­vices Act, Digi­tal Mar­kets Act and, in the near future, the Data Act (legis­la­tive pro­po­sals spea­rhea­ded by Thier­ry Bre­ton), which aim to update the legal foun­da­tion of the future Euro­pean data economy.

Pro­tec­ting data from cyber-crime

Unsur­pri­sin­gly, access to data is an enor­mous tar­get for cyber­cri­mi­nals. During the year of lock­down, the French Natio­nal Agen­cy for the Secu­ri­ty of Infor­ma­tion Sys­tems (ANSSI) saw a four-fold increase in the num­ber of attacks. While ban­king and health data are most typi­cal­ly tar­ge­ted, all data is now vul­ne­rable to attack, whe­ther to sim­ply cause trouble or as bla­ck­mail mate­rial. As for the CNIL, it recei­ved near­ly 3,000 noti­fi­ca­tions of data vio­la­tions from com­pa­nies in 2020 under the GDPR, com­pa­red to 2,300 in 2019.

The role of the GDPR and CNIL in data protection

So, what role should the GDPR and CNIL play in this context ? GDPR can be seen as part of the EU’s huma­nist approach, pro­vi­ding a regu­la­to­ry fra­me­work for per­so­nal data on its ter­ri­to­ry with citi­zen rights at its heart. It also stan­dar­dises the obli­ga­tions impo­sed on pro­fes­sio­nals and allows them to deve­lop their digi­tal acti­vi­ty, which is based on the trust of their users. In this way, it is also a cyber­se­cu­ri­ty tool, inex­tri­ca­bly lin­ked to data protection.

As a regu­la­tor, the CNIL has four mis­sions : infor­ming people of their rights and sup­por­ting orga­nisms in upgra­ding their com­pliance, and, on the flip­side, auditing/sanctioning them, and moni­to­ring the sec­tor, which allows it to have dis­cus­sions with all parts of the digi­tal inno­va­tion eco­sys­tem, from resear­chers to start-ups.

One case stu­dy that demons­trates this role is that of online adver­ti­sing. Since 2018, this has been a major sec­tor for com­pliance upgrade, with more than 20% of year­ly com­plaints connec­ted to mar­ke­ting. Without wai­ting for the adop­tion of ePri­va­cy regu­la­tion [which pro­tects Euro­pean citi­zens’ pri­vate com­mu­ni­ca­tions from any inter­fe­rence], the CNIL adop­ted a prag­ma­tic, mul­ti-stage regu­la­to­ry pro­cess, in consul­ta­tion with the par­ties concer­ned. This resul­ted in two fun­da­men­tal regu­la­tions regar­ding the use of cookies : cla­ri­ty of infor­ma­tion and equal ease of accep­ting or refusing.

Ano­ther afo­re­men­tio­ned prio­ri­ty area is cyber­se­cu­ri­ty. Along­side the ini­tia­tives of other players such as ANSSI, the CNIL pro­vides dai­ly sup­port to com­pa­nies for best IT secu­ri­ty prac­tices, which – beyond being man­da­to­ry – have become a consi­de­rable stra­te­gic asset. On its web­site, many peda­go­gi­cal resources are avai­lable, such as good remote wor­king habits for indi­vi­duals and pro­fes­sio­nals, in the aim of set­ting up a digi­tal culture that’s com­mon to all.

The last example is that of arti­fi­cial intel­li­gence (AI). The CNIL is very active in this area, on both the legal, IT side of things and the ethi­cal, for­ward-plan­ning side of things. Eve­ry year, it holds the “Ave­nirs, Inno­va­tions, Revo­lu­tions” (Futures, Inno­va­tions, Revo­lu­tions) event to dis­cuss socie­tal ques­tions rai­sed by new tech­no­lo­gies. This, in turn, gave rise to the report “AI and algo­rithms : allo­wing humans to main­tain control”. It demons­tra­ted the wide range of ques­tions evo­ked by AI and put for­ward a num­ber of recom­men­da­tions, inclu­ding the prin­ciples of loyal­ty and vigi­lance, which are part of a new gene­ra­tion of gua­ran­tees and fun­da­men­tal rights in the digi­tal age. The CNIL also publi­shed a metho­do­lo­gi­cal contri­bu­tion to the com­plex debate around facial recog­ni­tion, as well as its regu­lar “Inno­va­tion & Pros­pec­tive” book­lets, and its new col­lec­tion of offi­cial reports, with the first focu­sing on voice com­mand devices.

In any case, digi­tal advances have not only pro­found­ly chan­ged our eco­no­my, but also the orga­ni­sa­tion of our socie­ties and poli­ti­cal ins­ti­tu­tions. The inter­net is not a place but rather a connec­tion, through which data is pro­ces­sed and trans­fer­red inter­na­tio­nal­ly on a pre­vious­ly uni­ma­gi­nable scale. In the end, what’s at stake is the abi­li­ty of coun­tries to enforce com­pliance with their laws and rights. In the face of this chal­lenge, the CNIL needs to contri­bute to a com­pre­hen­sive stra­te­gy that affirms digi­tal sove­rei­gn­ty, both at a natio­nal and a Euro­pean level.