Do people really make decisions about their personal data? And what happens to them in the digital space? GIDE’s Paul Twomey on collection mania and a new approach that would help.
In recent years, in addition to the increasing collection of data by everyday apps and artefacts, we have seen how vast amounts of information are resold in secondary markets. That market is expected to generate $681.39 billion in revenue in 2023. What is the problem GIDE has identified and how are these best tackled?
Paul Twomey: I don’t think anybody from the CEOs of the major platforms down to you me and my mother has any comprehension of the amount of companies collecting data on individuals nor how much data is collected.
Most people who go online know that some data about them is collected by companies, but they do not know who is actually collecting data, how, and to whom they are selling that data. The reality is: It is thousands of companies that constantly collect vast amounts of information from our online activity, largely without awareness from users.
We are also unaware of the amount of information that is usually collected from us. There’s a group out at the Brown Institute at Columbia University who have done a review focused on the biggest US-based companies terms and conditions: They can collect over 450 pieces of data every time you turn on your phone, by collecting non-personal and personal data stored on the device, data about your behaviour on the device, information about the device itself and its signals and location as well as your use of their product.
It is important to grasp how entrenched the ecosystem is. For example, the reason someone gets a particular ad is not necessarily because what they did online, but because the people they spoke to the day before made some comment on a website or on social media that then got picked up and transferred, sold, repositioned and used to show a targeted ad the next day.
People don’t know who’s collecting the data. We don’t know who it’s being sold to. We don’t know the quality, the quantity of it. We don’t know what it’s getting used for. But we do know that the whole ecosystem is all around advertising and manipulation. Advertising is about trying to convince you to do something.
You could counter: It is only an ad.
It is true, it may be just an ad, but it also might be someone trying to manipulate our political statements. Someone might be trying to manipulate what we’re trying to do socially; or to manipulate what we’re doing online or offline. Dennis Snower, who is my co-chair in the Global Initiative Digital Empowerment, and I found ourselves one night talking at a G20 meeting in Riyadh, criticising these and other features of surveillance capitalism. We decided we should do more than critique it, we should try to fix it – which was an arrogant thing to conclude. But nevertheless, we started GIDE.
Can you outline the dimensions of the problem you identified for me?
In simple economics: I’m a consumer. I give you money, you give me a product or service. If I do that to a platform operator or to an Internet service, they will provide me with goods or services, usually provided from a third party, often a manufacturer or another service provider. You have a three-part process, that’s e-commerce online. It works as a normal market, worth about $4.8 trillion. It’s about the size of the German economy every year, and it’s growing quickly. And at the heart of that, the consumer is still king. Because the consumers have experience from the offline world to know whether they’re getting good deals or not. They know they can say, “No, I don’t want the product or the service”. They can send it back or cancel it. However, below that market there is this subterranean transaction that’s going on. The provider says: in return for allowing you to participate in the digital economy I’m going to collect vast amounts of information about you – way beyond your comprehension.
If the market is so big, isn’t it too late already? How can you intervene?
We’re simply saying: Online and data markets need to have the same degree of transparency as offline markets; and people need to know who’s collecting data about them and have the right to negotiate how such data is going to be used, shared or processed and under what terms. You can apply that simple test in national and regional jurisdictions and solve many of the malfunctions of the data economy. We have focused much of our attention on the European Union and we’ve got a discussion going amongst its organs. But our framework can work more broadly. I take your point that it’s very big and I take the point that it’s a single internet, but in a topological network that knows no geographic boundaries digital sovereignty is best achieved by giving citizens meaningful control over data about them. When your citizens have data sovereignty, then your country and your society begin to have some element of sovereignty in the online environment.
Hence, is it up to governments? Do you work with governments?
I’ll go back a step. One of our colleagues does a lot of research in terms of people’s attitudes around e-commerce. And one of the things he’s learned about feedback from consumers about the Internet is pretty simple: People’s trust in the Internet continues to fall away. People’s use of it continues to go up because it’s essential now in modern life. The consequence of these opposing forces is that people are calling for more governments to intervene, to try to fix the problems of trust on the Internet. But governments are very complicated and too slow to solve these problems. We are suggesting a market-based system.
We should find a way whereby the consumer is empowered to actually negotiate those terms of use directly – not individually because that is ineffective, but following the examples in financial services and other parts of the economy: citizens should have rights of association and they should have the rights to be represented by skilled professionals that negotiate on their behalf.
People’s trust in the Internet continues to fall away. People’s use of it continues to go up because it’s essential now in modern life. The consequence of these opposing forces is that people are calling for more governments to intervene, to try to fix the problems of trust on the Internet. But governments are very complicated and too slow to solve these problems. We are suggesting a market-based system.
Paul Twomey, Co-Chair of GIDE (Global Initiative for Digital Empowerment)
And how?
If we can move the skills from the part of the economy and put some of those skills with the consumers, then they’ve got the skills to negotiate not just financial things but also participation in public good data analysis. There are many other benefits individuals can negotiate when interacting online. We think if you could properly empower the consumers in the data economy, then you’ve actually got a market-based mechanism.
And that means that you’re trying to shift the power structure, right?
Yes. One offline analogy thing that struck me was travelling in Europe. If I check into a hotel in Europe no matter how much data they have on me, the law of the land requires that for key parts of information about me the only source that matters is my passport. And I thought: If we do this offline, why don’t we do this online? Why don’t we say that if you want to access that personal information, then just like my hotel example, you’ve got to get it from a source controlled by the consumer and they’ve got to agree to it. And it doesn’t matter how many avatars of Paul Twomey a company may have, they should still have to get my personal data, say as defined in the GDPR, from a source I control.
If we apply this rule to online interactions, then individuals have a point of leverage. Then add to that the rights of association and representation. Because not everybody understands the complexities of the data markets, we need skilled agents and advisors who act in our best interest to advise and represent us.
And in this example, the hotel would not make less money.
Quite the contrary. Currently, we are actually failing to create wealth, and we are stalling innovation, because we’ve allowed this collection of data not to operate properly as a market. All we’ve done is solve for only one potential source of wealth creation, which is advertising. Let’s look at the offline world, and see what’s worked offline. Let’s try to bring it to the online problem.
And what are the social benefits of your proposed ecosystem?
One example. Online gambling has become a big issue that people worry about. With our model, each consumer will be able to control who gets data about them, preventing, for example, that online casinos use this data to exploit their gambling vulnerabilities.
More importantly, if you’re a child, your parents have a role in saying yes or no. So, parents can decide whether and how data about their children is shared? We’re not trying to be the nanny, we’re actually trying to be the opposite of a nanny. We’re not trying to say “No, you can’t do online gambling.” What we are saying is you or your parents get to control where your data goes and you get to say yes or no, which has some impact on the degree to which you then get targeted. What we are saying is particularly important when we talk about children or other vulnerable groups.
How?
To use an example: One of the platforms has a marketing segmentation that collects data from teenage girls who are going through difficult puberty and have recently sold it to advertisers. Another example we’ve seen in Australia is people who are looking online for alcohol rehabilitation centres, and the data being sold to alcohol companies.
Who is selling the data – the search engines?
This is a tricky question. Although there is not a global and comprehensive registry of the companies that sell data, there are thousands of companies that self-identify as data brokers. However, this list does not include many companies that sell data as part of wider operations, and do not consider themselves data brokers. Moreover, big tech companies usually reject being called data brokers mostly because they claim to operate through consent.
However, an equally important question is: who buys data? From traditional buyers such as advertisers, bankers, employers, insurers and governments you need to add every company that has an interest in obtaining insight of their customers or potential customers. This is nearly everyone.
Perhaps the correct question is: who isn’t buying, selling or sharing data?
When you’re not the nanny, who are you then? The partner? The uncle? The good guy from the neighbourhood?
I suppose we’re the sort of people who believe in humane markets. We are pushing a certain vision and model. We’re pretty experienced in understanding how these markets work. And we’re pushing a humane model for a new type of social democracy if you like. And who do we see as being key to this being implemented? One is empowered citizens. But the second part, which we think is the key, is going to be the advisory people, the skilled people who actually are your agents.
Why are business people working with you at GIDE? Couldn’t they just think: These people want us to make less money?
One of our members used to run the data analysis program for one of the largest European retailers.
When she listened to our proposals she said: This is great because it will create a pricing mechanism for data. Now my bosses do not have any way of differentiating what information is valuable and what’s not. They think all information is valuable because we haven’t got a price on it and therefore we are drowning in data. We are collecting so much data. It is stupid because I don’t need 80% of the data that’s being thrown at me. I just need the stuff that’s useful. But we’ve got no pricing mechanism to send any signal about what data is valuable and what’s not in their context.
You used to be in the Internet business. What changed or what made you personally change professions?
For 12 years of my life, I helped to run ICANN, the multistakeholder organisation that ensures that the Internet works globally.
Our job was and still is to make sure that the technical coordination of the Internet works efficiently and securely. Now the whole global economy works on it. Because the Internet doesn’t have geographic boundaries, this has created huge large-scale oligopolistic models,
So why would I now be calling for a new regime for data management? Firstly, because a globally interoperable Internet does not require a surveillance capitalism. But further, I’m also a citizen of the world, particularly a citizen of the liberal democracies. We haven’t spent 400 or 500 years of our blood, toil, treasure and thought to build up citizen empowering political principles just to have a bunch of capitalists just think “Let me keep billions of people as data serfs so that we can harvest huge amounts of detailed data to manipulate these people directly, or indirectly through ads, without their understanding or control the use of their data.” That just undermines many of our liberal democratic principles.
A friend of mine, a professor at the Harvard Business School, asked me “Well, what do I tell my students who all think they’re going into this business model of collecting data and selling it?” My response: “Just tell them that they are confronting accelerating sovereign risk. Do you think that governments are going to let fundamental rights to be continually eroded?”
Let’s shift to the future. Fast forward ten years. What does the ideal world of data economies and governance measurements look like?
I expect for the average citizen, it’s going to be a fairly simple process. They will have an advisor who is sufficiently expert to ask the 20 or 30 questions that really matter. That advisor will translate the responses into a set of recommendations which are then reflected in code. And the permissions and terms of the individual will be machine readable and instantaneously supplied to businesses which make the request to deal with the individual. And for people who are presently making a lot of money just reselling and collecting personal data to sell, I think that gets more difficult because people want more control. Further, I think the new model will enable innovative ideas and growth to come forward. I think the model also will result in some limitations on the way the algorithms presently keep trying to produce conflict to drive user engagement.
Dr Paul Twomey is the Co-Chair of the Global Initiative for Digital Empowerment (GIDE) as well as Fellow and Initiative Director for Digital Governance at THE NEW INSTITUTE in Hamburg. Paul is a founding figure and former CEO of ICANN, the global coordination body of the Internet, a role in which he was described by the New York Times as “the Chief Operating Officer of the Internet”. Paul was CEO of the Australian Government’s National Office for the Information Economy and Deputy at the Australian Trade Commission. Paul is a Commissioner on both the Global Commission for Internet Governance and the Global Information Infrastructure Commission.
Formerly with McKinsey& Company, he was a special advisor to several Australian Ministers in the Keating and Howard Governments. He is a member of the SAP Artificial Intelligence Ethics Advisory Panel. Paul is a Fellow at the Global Solutions Institute in Berlin and a Distinguished Fellow, at the Canadian Center for International Governance Innovation. He received his PhD from Cambridge University.
