Sandro Gaycken explains „Why Data Portection does not protect much anymore“. He wants to put a bit of criticism on data protection.
What should it protect primarily?
It might be some sort of german thing based on the Volkszählungsurteil. What was produced then by the … was the „Informational Self-Determination“.
You might adjust your behaviour wt people or institutions whom you could suspect to know something about you.
You might be careful when to tell what to whom, because you can’t know in advance who has access to it.
Information self-determination is fundamental for freedom:
- Free press
- Free Vote
- Free Opinion
- …
As soon as you are being watched you are behaving differently.
This is the basis of freedom. Do you feel free? In order to have that you need informational Self-Determination.
How is it enforced?
1. Avoidance of surveillance:
- Volkszählung: If we don’t store data you can be sure it’s not used against you.
- Traditional, but now: no more. With terrorism and other threats right now this is no more. More and more data is gathered everywhere. Method of crimefighting has been changed, there is not as much investigation going on anymore but it’s gearing more towards prevention. But this means more surveillance, profiling and so on.
- Srong rise of large-scale, highly efficient identification surveilance
- New paradigm of preemptive crimefighting
Because of these changes more work is done regaring data protection. We cannot avoid data collection anymore so
2. Regulation of surveillance:
Data Protection
Lawwise Regulation of the evaluation of that data
Sufficient Knowlede by Data Protection
Data Protection aims to provide the public with sufficient knowledge about which data are known where.
So once you know who knows what about you you can again do the right choice. You are informed.
But is it doing that right now? Sandro says „No“. You are not informed.
Questions
- What is „sufficient knowledge“ to decide freely and self-determined?
- What is decision-making psychologically?
- Does data protection provide sufficient knowledge?
Decision Theory
First some categorization…
There are two kinds of knowledge-based decisions:
The good kind: Deciding with certainty
- Everything is definite
- Everything is known
- Consequences can be entirely forseen
The bad kind: Deciding with uncertainty.
- not Everything is definite
- notEverything is known
- Consequences can not be entirely forseen
How to calculate your odds for uncertain decisions?
Back in the old days: Rational of course!
Rational choice theory, game theory, maximin-models, …
But: criticism started in the 50ies!
Actual humans in complex situations are neither willing nor able to calculate all the time.
They use shortcut-strategies
Heuristic Decisionmaking
„Reduced Rationality“
Tversky & Kahnemann 1974/2005:
You judge a situation coarsly by using your everyday knowledge
depth of your investigation depends on how relevant it is for you, but usually:
You don’t bother for the most complete and correct information possible
Mostly, you even can’t bother at all
Exception: Some hackers :-)
Even Worse
Uncertain decisions are not only based on a reduced number of hear-say facts, they are also psychologically biased!
Bias #1: You love your own values! So:
You tend to memorize things in support of your own values. So your hear-say knowledge is biased from the beginning.
What you choose as relevant facts depends a lot on what you want to be relevant facts.
„Public“ opinion of your own group is very influential: you don’t want to stand outside.
Bias #2: Further charateristic effects
Anchor-Effect: Very colorful or very recent facts are more present than others
Familiarity-Effect: Frequently heard facts appear to be more true and more frequent than others (e.g. all the terrorism news stories etc. By repeating it you get the impression that this is happening all the time.)
Representativeness-Effect: People are judged by the stereotype they are taken to represent. (e.g. people from a particular party or if they are lawyers. You already put a stereotype on them but don’t check their individual profiles)
Uncertain Decisionmaking
Not so very rational!
Based on a reduced number of facts, mostly from your own hear-say knowledge …
Now: Deciding And Surveillance
Back in the old days of avoidance: decision with certainty
But now: decisions with uncertainty
- Too many facts to consider
- Too many technological options
- Too man potential surveillers with too many interests
- Everything is too complex to understand in principlle (for most people)
and that means…
Public hear-say knowledge about surveillance will be very influential
That knowledge will largly consist of what has been prominently in the press on surveillance.
General public opinion about surveillance will bias that knowledge even further
And The Winner Is…
Some people will not be informationally self-determined decidingwt surveillance
People who:
Posseses a rather bad and sceptic hear-say knowledge about surviellance
Have a bad or sceiptic attitude towards it
Hear rather bad then good news about surveillance
Don’t like the involved stereotypes, like police etc.
The Big Question
Does data protection help these people regain certainty regarding their decisions?
Data Protection Doesn’t Protect Much
Data protection is a complicated and huge judicial apparatus itself, so it rather adds to complexity and uncertainty then reducing it.
Even the „public facts“ are useless, because they’re boring and still too much to read
It’s much less a matter of public opinion, it’s existence is not even widely known
Successful cases of protected data are not much in the news
The stereotypes usually involved in data protection are not exactly trustworthy either.
Mistakes Of The Data Protectors
Esoteric perception: if I can know this and be informationally self-determined, anyone can
Overestimation of rationality: decisionmaking must always be as rational and informed as I know it (from science and law)
Different perception of the involved stereotypes: state authorities and lawyers are my friends
Anything to Hide?
- Some cases can be seen already: those who have something to hide! (or they thing they have something to hide although they have not. They lost their self-determination already.
- Drug addicts, troubled families seek less help because they are uncertain about what happens to their data.
- Press informants fear that they cannot be guaranteed anonymity
- Even witnesses and accused fear that their lawyers could be wiretapped.
It also seems that companies can break data protection without any fines etc.
The True Basis of Decisionmaking
A faint idea of the mere technological possbilities is much more decisive than anything data protection has ever said or done.
Surveillance is:
- Omnipresence
- Unstoppable
- Networked
Public mind: „Everyone powerful can in principle a lot about me“.
Foreseeable Developments
Foreseeable new problems: networking of databases and „the eternal memory“ of databases and their public perception
Health databases; „Anyone might get infos on my illnesses in 20 years. Do I really want to see the doctor with this?“
School databases: „Crap. I screwed up today and it’s going to follow me for the rest of my life. Forget about a regular job. Give me those drugs.“
A way out?
If you want to protect real, irrational, busy, non-scientific people: Is there a way out?
There are a few options:
Dramatically increase penalties
Have free and independant data protectors (not politicians and lawyers)
Decomplexify & simplify surveillance (people could go and look what’s happening technologically)
Decomplexify & simplify data protection (bring out very clear cut stuff: Here is what data protection can do for you)
Not really
But: Let’s be honest: that’s not going to happen
And: sceptical people and people with something to hide will still never be informationally self-determined again in any surveillance-related situation.
Either we return to our previous policy of avoidance of surveillance or we publicly abandon that useless and vain illusion of informational self-determination.
Technorati Tags: 25c3, ccc, conference, bcc, privacy, dataprotection, surveillance