Governing Digitalization

Governing Digitalization Presented by: Professor Anne Flanagan Date: 17 March 2022 Data We are immersed in 'data' that will continue to grow - World annual data estimated to amount to 175 zettabytes by 2025  - would need 12½ billion of largest hard drives to store More data will be created in next 3 years than in last 30 combined  Personal data will be about half of this IDC Global Data Sphere Forecast (2020) Value of/Dependence on: Data 1. Needed for analytics to transform: Industry processes. Personalize: a. Services b. Products c. Medical treatments/etc. 2. Also likely to transform social and governmental domains Digitalization And Beyond - Continuing digitalization → "digital transformation" - Continuing interconnectivity  Connected processes  Connected devices: 1. IOT  8.7 billion- 11.7 (2020) 25. 4 billion (2030)  60% attributable to consumer devices 2. Non-IOT  10 billion (2020) Statista 2021; IOT Analytics 2020 Implications - More Valuable And 'Personal' Data Drives Greater Need For Governance, Controls, Security 1. Relevance of data protection frameworks and information security will only continue to grow 2. Whether premised on a human rights foundation or to ensure continued data flows - Some Sectors Are More Advanced In Their Digitalization Maturity Than Others 1. But effective use and control of digital assets will mean that their importance to direct future development will also only continue to grow 2. Nations will need to strive to ensure that their economies enable and benefit from digitalization and digital transformation 3. Including in public sector Enabling Digital Transformation - Inclusive (social and economic) - Focus on, e.g., human capital, connectivity, digital take up: 1. Education 2. Social protections 3. Digital access 4. Digital skills 5. Trust in digital: a. Privacy, b. Security, c. Transparency, d. Capacity 6. Other Digital Trust 1. "If the lifeblood of the digital economy is data, its heart is digital trust." PWC, Digital Trust Insights 2. "Digital trust is a domain of organizational resilience which empowers organizations to safeguard their information, people, systems, and technology, to ensure safety, security, compliance, privacy, ethical requirements, and brand reputation to enable business effectiveness and efficiencies." British Standards Institute 3. "Without trust, customers will not share the data required to drive a personalized experience. If they trust your company, many people will not mind sharing their data." UTU, Why Digital Trust is Essential EU Digital Trust: Data Protection - Omnibus framework - private and public sector  - Except Law Enforcement Directive Harmonized level of protection for EU residents; no transfers were not adequate protection - Principles that underlie rights and obligations - Premised on: -  Human rights foundation: ECHR, Art 8 and Convention 108  Single market powers to ensure continued data flows High level of enforcement  - At least one 'independent' regulator; dissuasive penalties The UK follows this model: UK GDPR US: Information Privacy - Despite having one of the earliest data protection laws (US Privacy Act 1974), there is not a comprehensive information privacy law - Sectoral model - specific information or individuals needing protection: 1. E.g., Gramm Leach Bliley - customer financial data; 2. HIPAA- electronic private health information; 3. Video Privacy Protection Act - video rentals/streaming services; 4. Family Educational Rights and Privacy Act - student records 5. E.g., Child Online Privacy Protection Act (COPPA) - children under 13; 6. Federal Trade Commission Act, s. 5- consumers from misleading/deceptive trade practices about information privacy and information security - No one single underpinning 1. GLB was a response to EU Directive's ban on transfers 2. HIPAA was intended to generate trust in digital health records 3. Video Privacy Protection Act a response to attempt to obtain Supreme Court nominee's video rental records and maybe First Amendment - But growing state legislation 1. State constitutional privacy rights: California (California Privacy Rights Act) 2. Virginia, Colorado - others pending 3. Continued, lawful access to data - efforts seem to be driven by tech companies - Continued data flows seem to be the drivers for the digital trade agreements by the US Jurisprudential Foundation Irrelevant? If core fair information processing principles are in place with individual rights and enforcement, it may not matter what the legal underpinnings are: - E.g., OECD Principles vs. COE Convention 108 and 108+ - Both seem sound bases for a framework But, implementation, consumer- business education and awareness as well as enforcement will depend on political will Even Where 'Privacy' Not A Cultural Value, Data Protection Should Be - Privacy has many aspects - e.g., personal intimacy, decisional privacy, religious privacy - While it can overlap with data protection (e.g. private information that you don't want disclosed) - it is not the same - Data protection has elements of equity/fairness/relevancy/accuracy - So, even in small towns or societies with communal living where privacy of our daily lives might not always be expected or the norm, personal data should not be secretly collected and commodified - It is a distinction with a difference