Why so much demand for our personal data?

The EU Gen­er­al Data Pro­tec­tion Reg­u­la­tion (GDPR) turned three on 25 May 2021. After twelve months of digit­al tools being rolled out on a massive scale due to Cov­id-19, this anniversary is shed­ding new light on the stakes con­nec­ted to pri­vacy and European digit­al sov­er­eignty. For France’s Nation­al Com­mis­sion on Inform­at­ics and Liberty (CNIL), it’s the per­fect occa­sion to go back over what con­sti­tutes this reg­u­lat­ory frame­work, what it pro­tects and what pre­cisely is in so much demand.

The oil of the 21^st century

First of all, what is “per­son­al data”? It’s not like oth­er data – it con­tains inform­a­tion that can identi­fy a per­son, like their name, a num­ber con­nec­ted to them, or their digit­al fin­ger­print. It’s often said that per­son­al data is the oil of the 21^st cen­tury but com­par­ing it to “seeds” seems more apt, as this kind of inform­a­tion is only made valu­able when it’s used in cer­tain ways.

A clas­sic example is the foot­print left online by inter­net users, which is gathered through cook­ies when users nav­ig­ate online, or from con­nec­ted objects. Hav­ing accur­ate know­ledge of numer­ous details (such as the age, loc­a­tion, taste, pur­chas­ing beha­viour, health con­di­tion, or even ideo­lo­gic­al beliefs) of poten­tial con­sumers is extremely valu­able for com­pan­ies, as it allows them to seg­ment their mar­ket bet­ter. In just a few years, per­son­al data has become a stra­tegic fin­an­cial asset, one that’s par­tic­u­larly enti­cing for GAFAM, as shown by rev­en­ue from the first quarter of 2021 – $23.6bn net profit for Apple vs $11.2bn in the same peri­od last year; $17.93bn (vs $6.8bn) for Alpha­bet, Google’s par­ent com­pany; and $9.5bn (vs $4.9bn) for Facebook.

A tool to improve pub­lic policy and crisis management

How­ever, far from only serving com­mer­cial interests, per­son­al data has also proven to be very use­ful for cre­at­ing effi­cient pub­lic policy, espe­cially dur­ing the pan­dem­ic. For example, since the Cov­id-19 vac­cin­a­tion cam­paign was launched, region­al health agen­cies have had access to inform­a­tion to track its pro­gress across France. Since Janu­ary, the “Vac­cin-Cov­id” inform­a­tion sys­tem (developed by France’s pub­lic health­care body, “Assur­ance Mal­ad­ie”) ensures that vac­cines and stages of vac­cin­a­tion are trace­able at a nation­al level, from pre-vac­cine con­sulta­tion to injection.

Access to data is a real issue for the EU, which is aware of their depend­ency on for­eign sys­tems. They have made con­trolling this access a pil­lar of their digit­al sov­er­eignty strategy. Sev­er­al major events in 2020 stand out in this area – the Schrems II judg­ment, handed down by the Court of Justice of the European Uni­on last July, which inval­id­ated the Pri­vacy Shield, under which data could be sent to the US; the com­mit­ment to trans­fer the Health Data Hub to a host that would pre­vent that sens­it­ive data from poten­tially being exposed to access requests that are illeg­al under GDPR; and, finally, the Digit­al Gov­ernance Act, Digit­al Ser­vices Act, Digit­al Mar­kets Act and, in the near future, the Data Act (legis­lat­ive pro­pos­als spear­headed by Thi­erry Bre­ton), which aim to update the leg­al found­a­tion of the future European data economy.

Pro­tect­ing data from cyber-crime

Unsur­pris­ingly, access to data is an enorm­ous tar­get for cyber­crim­in­als. Dur­ing the year of lock­down, the French Nation­al Agency for the Secur­ity of Inform­a­tion Sys­tems (ANSSI) saw a four-fold increase in the num­ber of attacks. While bank­ing and health data are most typ­ic­ally tar­geted, all data is now vul­ner­able to attack, wheth­er to simply cause trouble or as black­mail mater­i­al. As for the CNIL, it received nearly 3,000 noti­fic­a­tions of data viol­a­tions from com­pan­ies in 2020 under the GDPR, com­pared to 2,300 in 2019.

The role of the GDPR and CNIL in data protection

So, what role should the GDPR and CNIL play in this con­text? GDPR can be seen as part of the EU’s human­ist approach, provid­ing a reg­u­lat­ory frame­work for per­son­al data on its ter­rit­ory with cit­izen rights at its heart. It also stand­ard­ises the oblig­a­tions imposed on pro­fes­sion­als and allows them to devel­op their digit­al activ­ity, which is based on the trust of their users. In this way, it is also a cyber­se­cur­ity tool, inex­tric­ably linked to data protection.

As a reg­u­lat­or, the CNIL has four mis­sions: inform­ing people of their rights and sup­port­ing organ­isms in upgrad­ing their com­pli­ance, and, on the flip­side, auditing/sanctioning them, and mon­it­or­ing the sec­tor, which allows it to have dis­cus­sions with all parts of the digit­al innov­a­tion eco­sys­tem, from research­ers to start-ups.

One case study that demon­strates this role is that of online advert­ising. Since 2018, this has been a major sec­tor for com­pli­ance upgrade, with more than 20% of yearly com­plaints con­nec­ted to mar­ket­ing. Without wait­ing for the adop­tion of ePri­vacy reg­u­la­tion [which pro­tects European cit­izens’ private com­mu­nic­a­tions from any inter­fer­ence], the CNIL adop­ted a prag­mat­ic, multi-stage reg­u­lat­ory pro­cess, in con­sulta­tion with the parties con­cerned. This res­ul­ted in two fun­da­ment­al reg­u­la­tions regard­ing the use of cook­ies: clar­ity of inform­a­tion and equal ease of accept­ing or refusing.

Anoth­er afore­men­tioned pri­or­ity area is cyber­se­cur­ity. Along­side the ini­ti­at­ives of oth­er play­ers such as ANSSI, the CNIL provides daily sup­port to com­pan­ies for best IT secur­ity prac­tices, which – bey­ond being man­dat­ory – have become a con­sid­er­able stra­tegic asset. On its web­site, many ped­ago­gic­al resources are avail­able, such as good remote work­ing habits for indi­vidu­als and pro­fes­sion­als, in the aim of set­ting up a digit­al cul­ture that’s com­mon to all.

The last example is that of arti­fi­cial intel­li­gence (AI). The CNIL is very act­ive in this area, on both the leg­al, IT side of things and the eth­ic­al, for­ward-plan­ning side of things. Every year, it holds the “Avenirs, Innov­a­tions, Revolu­tions” (Futures, Innov­a­tions, Revolu­tions) event to dis­cuss soci­et­al ques­tions raised by new tech­no­lo­gies. This, in turn, gave rise to the report “AI and algorithms: allow­ing humans to main­tain con­trol”. It demon­strated the wide range of ques­tions evoked by AI and put for­ward a num­ber of recom­mend­a­tions, includ­ing the prin­ciples of loy­alty and vigil­ance, which are part of a new gen­er­a­tion of guar­an­tees and fun­da­ment­al rights in the digit­al age. The CNIL also pub­lished a meth­od­o­lo­gic­al con­tri­bu­tion to the com­plex debate around facial recog­ni­tion, as well as its reg­u­lar “Innov­a­tion & Pro­spect­ive” book­lets, and its new col­lec­tion of offi­cial reports, with the first focus­ing on voice com­mand devices.

In any case, digit­al advances have not only pro­foundly changed our eco­nomy, but also the organ­isa­tion of our soci­et­ies and polit­ic­al insti­tu­tions. The inter­net is not a place but rather a con­nec­tion, through which data is pro­cessed and trans­ferred inter­na­tion­ally on a pre­vi­ously unima­gin­able scale. In the end, what’s at stake is the abil­ity of coun­tries to enforce com­pli­ance with their laws and rights. In the face of this chal­lenge, the CNIL needs to con­trib­ute to a com­pre­hens­ive strategy that affirms digit­al sov­er­eignty, both at a nation­al and a European level.