Press Release: DataEthics4Allᵀᴹ Launches AI DIETᵀᴹ Returnship Program for Women+ on International Women’s Day
Press Release: DataEthics4Allᵀᴹ Launches AI DIETᵀᴹ Returnship Program for Women+ on International Women's Day. An inclusive program to help Women+ in Tech with a Career Gap to Re-enter the Workforce.
Share:
Written by:
Tags:
On International Women’s Day, it gives us great pleasure to announce the launch of DataEthics4All’s AI DIET Returnship Program for Women+.
An inclusive program to help Women+ in Tech with a Career Gap to Re-enter the Workforce.
DataEthics4All Foundation is launching an AI DIETᵀᴹ Returnship Program exclusively for Women+ to help experienced workers in tech who took a break from the workforce for a few years to raise children, care for a sick parent, deal with an illness, or for military service and would like to re-enter the workforce.
DIETᵀᴹ stands for Data, Diversity, Inclusion, Impact, Ethics, Equity, Teams and Technology and we feel that this new definition of Diversity and Inclusion in Tech is necessary to Build A Better AI World Together!!
The AI DIET Returnship Program is for anyone who identifies themselves as a Woman, has worked in Tech, cares about the ethics of the entire end-to-end data science pipeline and all it’s use cases including Artificial Intelligence.
This 12 week Returnship will help those who already have several years of experience working in the tech world, and would like to rebuild their technical skills.
The Program will provide Mentoring support from our DataEthics4All Community of 1100+ Global leaders from 54 Countries at the intersection of Data, Technology, Policy, Ethics and Social Impact
and an opportunity to work on a real life project that can be showcased to a potential employer along with star recommendations from Mentors who’ve worked with you.
Happy International Women’s Day!!
Join us here on our Ethics 1st LinkedIn Live today at 3:00 pm to learn more about the program and get all your questions answered.
Contact [email protected] to learn more.
Share:
Written by:
Tags:
“It’s a well-known fact now that AI data sets are really rooted in bias.”
– Toju Duke
“If the systems are very inaccurate right now it’s probably best not to use them – we’re supposed to be saving lives, not allowing more people to die. The problem though is that we are dealing with huge numbers of people; humans alone cannot address those issues, so we do need some form of automation and AI system.”
– Toju Duke
I am text block. Click edit button to change this text. Lorem ipsum dolor sit amet, consectetur adipiscing elit. Ut elit tellus, luctus nec ullamcorper mattis, pulvinar dapibus leo.
Expand
About the Talk
With Coronavirus and the destructive path it’s forged across all countries, communities and economies, AI is being adopted by private and public entities globally to develop and deploy solutions to track and predict its spread amongst other solutions.
While AI could help reduce the overwhelming strain on health care systems, its algorithms are subject to biases that further deepens societal injustice and inequities across the world.
In this episode of the DataEthics4All Live Fireside Chat, Shilpi Agarwal, Founder of DataEthics4All and Toju Duke, Product Lead at Google discuss the current applications of AI systems on Covid-19 contact tracing, patient diagnosis and health progress across race and diverse groups and the effects these applications have on communities of color which have seen 2-4x more deaths from Covid-19 than what has been expected.
They also discuss how authorities and businesses should approach bias in the the datasets and algorithms AI systems are built on to reduce the systemic injustices being addressed today.
Transcript
0:05 Shilpi Agarwal:
Hello everyone and welcome to DataEthics4All Live, where we talk with data ethics trailblazers about the future of data and AI. I’m your host Shilpi Agarwal, and today’s topic is particularly relevant right now: we are going to talk about bias in AI and in Covid healthcare solutions. It gives me great pleasure to welcome my guest, who is a Google Product Lead for Europe, the Middle East and Africa; she is also the project manager for Women in AI Ireland and founder of VIBE. Please welcome Toju Duke! Welcome to the show!
0:51 Toju Duke:
Thank you Shilpi, and to everyone in the DataEthics4All group, happy to be here!
0:56 Shilpi:
We are so excited to have you! This is a conversation that’s at the top of our minds these days; coronavirus has forced its destructive path across countries, across communities and across economies. This pandemic has taken lives, it has damaged health and produced a historic economic decline. But it seems like Covid-19 has a disproportionate impact on communities of color. Can you elaborate on that a little bit?
1:52 Toju:
Yeah, happy to. I was just thinking about this talk and thinking about how on 31st December 2019 everyone was singing happy new year, there were lots of recounts of what happened in the past decade – the triumphs and the trials, people who have passed away, the companies that have made the highest turnovers and all of that. Everyone was excited to go into the new decade, and come 2020 now – we’re just in the second half of the year – I personally can’t wait for 2020 to be over! A lot of people echo the same sentiments – it’s just been very interesting; there’s been lots of things going on in 2020. And that goes back to the racial injustice and systemic injustice that we’ve seen; and now it’s resurfaced in 2020 with all the things that have happened with Covid-19. The recent Black Lives Matter protests due to killings of black people in the US; racism and systemic injustice have been brought up again, there have always been conversations around them, but I think now more people are beginning to understand what people of color have been talking about for a very long time now. Something struck a chord across everyone because we all watched the video of George Floyd. And I found it really interesting to see how Covid-19 is still a racial problem; it’s almost like people of color, minority groups, disadvantaged groups always get the brunt of anything bad that happens in society, including Covid-19. When you look at data right now
Toju: People of black descent or Latino descent in the US are three times more likely to get the virus, and they’re twice as likely to die.
4:23 Shilpi:
So is there a particular reason why it has impacted minority communities more; is it education, the way we live our lifestyle – what is affecting one versus the other more than usual?
4:41 Toju:
When you look at the data in terms of incomes; people from minority groups are earning half the national average income, and that means that they cannot really apply social distancing measures in their communities – all sharing apartments and sharing houses.
Toju: Then when it comes to their jobs, their jobs are mostly frontline jobs, so even if some of them are middle class doctors and nurses, they’re still jobs right there on the front line, and because they’re already in a disadvantaged community, they need to go to their jobs; most of their jobs they can’t do remotely. So we have jobs like doctors, nurses, bus drivers, shelf stackers, technicians, production line jobs, services jobs – in all these jobs people need to be out there on the front line on public transport, rubbing shoulders with everyone else and being exposed to the virus. I think along those lines as well, there’s been some form of unconscious bias in terms of the treatment that they receive, in terms of doctors showing some form of discrimination to people of color and even in terms of prioritizing who should be treated. I’ve heard stories of people of color being sent back home even when their coronavirus case was severe; those people were not treated, and they died. In a time of pressure, the things inside you come out the most, including all forms of biases and unconscious biases. Doctors are under so much pressure right now; they’re like our soldiers right there on the front lines, taking the bullets of this virus – in that situation it’s very hard for them to make calm, objective decisions when it comes to who they prioritize.
7:53 Shilpi:
So I’m really appalled to hear that about the doctors – they are making the best judgment as much as possible, but we have heard stories, not just sending people of color home, but we have seen that they also send other people home; they treat a younger person more than a senior citizen because they have to make a judgment. I don’t know how they are making this humanitarian judgment, playing God here – but it must be very difficult for them as well, I can imagine, playing God is not easy. Taking the decision of who gets to be treated versus who gets sent home and for how long and and all of that must be hard for them as well. But if they are consciously making any kind of biased decisions then of course that’s not good.
Shilpi: Let’s talk about the apps that are being developed – there are just so many! App-based contact tracing is appealing in part because the coronavirus spread is so stealthy; infected people transmit the virus for days before they develop symptoms, and it can take several more days for public health investigators to learn about the case and confirm it with the testing. These teams have precious little time for traditional contact tracing where they go and interview an infected person, track down everyone who has come in recent contact with them as much as they can recall – I mean it’s hard if somebody asked me what I did over the weekend, I sometimes forget, or even yesterday, right! We do so much, it’s hard sometimes to recall, and then getting those people to self-isolate before they pass on the virus is difficult. By the time you get the data, you have a couple of days to chase people down. So if smartphones could detect the two users who are close enough to share the virus with an app that could alert one person as soon as the other person gets sick, it looks like a promising solution. So how has AI been applied to Covid-19 contact tracing applications and healthcare in general?
10:22 Toju:
I think with contact tracing there’s still a bit of a controversy there, but I’ll just touch on it a little bit. It uses location tracking capabilities on people who have caught the virus, and it helps them determine where they have been and who they’ve been in contact with by looking at their location.
We have a few countries who have adopted it, like South Korea, Taiwan, and of course China integrated it into some of their main apps like their Alipay apps and their recharge apps which are major apps used by lots of people in China.
We have countries in Asia all using these contact tracing apps, we see Europe slowly adopting it as well – but the Norwegian government for instance have decided to drop it mainly due to privacy issues. It’s collecting people’s data, amassing it in a database and AI technologies are meant to be using that data to help provide solutions for Covid-19, but then there’s a big question around regulations of privacy and user data – if I had Covid-19, do I even know where my personal identifiable information is being sent to? I think it probably would be sent to the Irish government, but I have no idea if people in China already have this information because they could be selling it off to third-party apps as well. That’s the major controversy there – if we do not have any proper global regulation around privacy and people’s data, especially around Covid-19, how much do we allow all those countries and companies to use this data? Google and Apple decided to come together and develop some APIs and some technology and said they’re actually going to work together to help improve the contact tracing app to make sure they protect user information as much as possible. So the big tech companies are trying to provide some solutions to this problem, but it’s a major problem. In terms of healthcare overall, there are lots of things that AI is doing, like tracking surveillance around areas that have the most Covid-19 cases; we have chat bots that help answer questions around it; helping with drug development as well. There’s a lot of work around data mining as well, helping to build the data sets that we have and build predictive computer models; there’s lots of literature searches digging deep into all literature to see if any predictions can be made. So a lot has been going on with AI in the background, which is all great news.
14:14 Shilpi:
Today 50 countries including some of the countries that you mentioned – New Zealand, South Korea, Vietnam, some parts of Africa and Europe, Russia, China, India, Australia, some states in the US including North Dakota and Utah – have all implemented contact tracing to some degree. Some have made it mandatory; some have opened their APIs to satisfy the more privacy-conscious citizens, but at the same time you also mentioned how Google and Apple have come together and are trying to provide some guidelines around what the contact tracing app should or shouldn’t do; what data it should or shouldn’t collect. What is disturbing is that 50% of these apps don’t even have any sunset policies or even transparency around what data they are collecting, how long they will be collecting it, even when the pandemic is over. All those are really questions of concerns for privacy-conscious citizens and it has led to a very big debate. And then there are also questions regarding the effectiveness of the measures of contact tracing – do you think it is a viable solution to help with the Covid-19 crisis?
15:42 Toju:
I think it’s a solution that will help reduce the spread, ideally. I’ll give an example from here in Ireland – the numbers were contained a little bit and it got to the stage where we stopped recording any new cases, and the main reason for that is because there was a lot of contact tracing being done.
We didn’t have the app at that time but between the healthcare sector and the police force, they were scrambling around trying to find everyone who the patients had been in contact with to contain the virus.
So I do believe that contract tracing can help contain it to a certain extent, of course it’s not going to provide a solution or any drug development to cure the virus or produce any vaccines, but it should be able to help contain it to a certain extent. In terms of percentage, I can’t give any numbers right now because I haven’t really looked into that and I’m not even sure that data is available yet, but it’s definitely a step towards the right direction.
16:47 Shilpi:
True, true. According to Douglas Leith, computer scientist at Trinity College Dublin, and computer scientist Stephen Farrell there’s two technologies – GPS and bluetooth beacon. Of course we have identified that GPS is not as effective but even with using bluetooth beacon technology, the signal strength is much lower – there are some challenges. When two people are sitting in a restaurant across the table from each other; if they have their phones in their pockets versus if they have their phones on the table the signal that the bluetooth sends is different, and so identifying who came in contact with whom is a challenge. Some of the other challenges are like metal reflection that plays a part in the sending of the signals; the strength of the signals of the bluetooth beacon. So do you know of any other current challenges in AI that could affect the predictions and the results in patient diagnosis and treatment?
17:52 Toju:
What I’ll mention right now is just the prevalence issue that’s been raised recently around bias in AI, because it still goes back to effects and the predictions that any AI system spews out in every industry, including healthcare and Covid-19.
It’s a well-known fact now that AI data sets are really rooted in bias. We’ve had recent issues with the MIT Tiny Images dataset for instance that was pulled a couple of weeks ago mainly because of the issues it had with bias.
Just to give some more context for people who probably don’t know the story; MIT had a data set built in 2008 that was helping spew out high-res images, and it was working with another AI data set called ‘what net’. Now the problem with that is when it assigns a text to an image, it could be very wrong derogatory words – for example it will compile a black man’s picture with a monkey and use the n-word to identify it; or with a woman carrying a baby, it calls her a whore. Because there were a lot of things that were unearthed by research scientists, some of them in Dublin, who actually tested this model and saw that these are sort of outputs that this model brings out, it was announced in the press and MIT pulled it back.
Toju: The problem with that though is a lot of companies have gone ahead to apply this dataset in their AI systems as well – so how much pulling back can we do?
We have Amazon and IBM who have pulled back their facial recognition software because we found out that it has an issue where it doesn’t recognize black skin color; it recognizes more white skin color.
Toju: We have something else around Pulse, which is another data set that was built by university researchers, and it still couldn’t identify black skin – it’s meant to take a blurry pixelated image and identify the person; they inputted Obama’s face into it and Obama came out as a white man, or they put in Muhammad Ali and he came up with blonde hair. It’s not just around the data sets, it’s also around the historical and societal inferences.
So if we have people making these data sets and they’re not exposed to any form of diversity in their thinking, in their societal upbringing, in their interactions with society, then it’s very likely that the data sets will be biased
Toju: In the sense that it’s not going to represent a diverse and inclusive range of people and ethnicities and cultures and genders. The problem with that is if we have any AI systems that spew out predictive solutions for Covid-19, once again we already know what that means – the black communities are being suppressed and oppressed by this. I think that’s part of what’s happening because we do have AI systems that are predicting the severity of the illness; most AI systems that do this work with image and computer visioning or image computing; and if they are using that, these are already rooted in bias because most of them were trained on Imagenet, which is another data set and another model that is biased.
21:33 Shilpi:
Very true. I’m going to pause here and take some live audience questions.
21:41 Terrance Johnson:
If I’m understanding the conversation properly, I don’t see how emerging technology is going to change long-standing and pre-existing human racism and discrimination. It seems like it more so would be used as more of an oppressive tool and weapon, since it primarily appears to be coming from the same bad actors. I kind of spoke to this in your last meeting and it seems to me concerning the whole digital divide
Terrance: the conversation should be talking about how to get more oppressed and vulnerable populations into technology, so as to positively affect their own lives.
23:10 Toju:
I totally agree; whatever is coming down the line is not going to address these issues, we have to take a step back to address those issues. One of the things I’m going to work on in the next few months is examining data sets, coming up with best practices that we can apply in the industry, looking at the amount of bias that we have in the current data sets that people are using; that companies and governments are utilizing, and making sure that there’s some form of transparency and extendability in these AI systems. We have a few tools already out there across the tech industries; Google for instance have something called model cards where you can actually document the different models that you have for your AI systems, and if that’s documented then if someone has a question around the platform or the AI, hopefully those model cards should be able to give some more transparency into why that AI system arrived at the prediction that it made. We also have something called What-If tool, where if that’s implemented at the start of building that algorithm, ideally it should be more transparent and explainable.
I think that’s where ethical AI comes into play, making sure that whatever new AI systems are being spewed out they’re following some form of data ethics, and for the current AI systems, making sure that we do examine them and reveal any biases and any inaccuracies that they have.
Toju: That’s what’s happening today, and that’s why we have Amazon and IBM pulling their facial recognition software; we have MIT calling back widely used data sets, because of these inaccuracies; we have university researchers calling back Pulse as well. So we’ll keep on seeing more of this, but I think what’s important is for all of us to come together; when we identify these things, actually make some noise about it, raise it to the right people.
If more people come together to talk about it, hopefully globally we’ll have some form of regulations that are not too intrusive and not too dependent on the tech companies
Toju: but at the same time signifying there’s still some form of guidance and some form of law and regulations involved. With these third party AI companies, there’s one that is actually being sued by the government now because it used data in the wrong way – that will be avoided. On the flip side as well, like Terrance said:
We need more diverse people working in these industries, working in these teams as AI engineers, data scientists, because if they have more diverse people, the new data sets coming up should represent what they believe in and societal changes.
26:06 Shilpi:
We have just a few more minutes, would anyone else like to ask any more questions?
27:30 Susanna Raj:
I have one question, Toju. Just this morning there was a news release about a data set; it was the largest ever, and they found the same disparity which we already know, but this was more documented. It seems like South Asians and African Americans are disproportionately affected in the health care system. So even though it’s all in the future and we are working on it, what do you think we should do now so that people get access to care in those communities?
28:13 Toju:
Well, if the systems are very inaccurate right now it’s probably best not to use them – we’re supposed to be saving lives, not allowing more people to die. The problem though is that we are dealing with huge numbers of people; humans alone cannot address those issues, so we do need some form of automation and AI system.
Toju: I think for a short-term solution, if we feel that the data sets that have currently been applied are not good enough and are really rooted in bias, it’s best to understand what proportion of these communities, the black and Asian communities, what proportion of them are really being affected – and if it’s a large volume, then we have to ditch the AI model in the short term until it’s fixed, because we can’t provide solutions by killing or oppressing people that have already been oppressed for centuries.
32:14 Shilpi:
In the end, this is an ongoing discussion, we don’t have a clear solution for this – but these are some of the questions we do need to raise, and we need to ask these questions so that we can come up with a better tomorrow. As Dr Maria van Kerkhove, technical leader at the WHO says: “asking the question ‘are we doing enough’, regularly and repeatedly is critical”. With that I want to thank Toju and everyone in the audience who joined us today and helped us with this important topic and interesting conversation. Thank you Toju!
33:06 Toju:
Thank you, it’s been great being here, thanks for having me!
Shilpi Agarwal – Founder & CEO, DataEthics4All
Toju Duke – Product Lead, Google
Press Release: DataEthics4All partners with Miami Dade College for the STEAM in AI Movement
Press Release: DataEthics4All partners with Miami Dade College for the STEAM in AI Movement. Miami Dade College is the most diverse institution in the nation. There are 167 nations and 63 languages represented in its student body. The college’s eight
Share:
Written by:
Tags:
We are proud to announce and welcome Miami Dade College as the newest DataEthics4All’s official STEAM in AI Partner!
“The collaboration with DataEthics4All will allow MDC students to become well-rounded professionals in AI. We are excited to bring these resources to our students through the coming AI Centers at MDC.” Antonio Delgado, Vice President of Innovation and Technology Partnerships.
Miami Dade College is the most diverse institution in the nation. There are 167 nations and 63 languages represented in its student body. The college’s eight campuses and outreach centers offer more than 300 distinct degree pathways including associate and baccalaureate degrees, career certificates and apprenticeships. Baccalaureate degree offerings include biological sciences, engineering, data analytics, information systems technology, education, public safety, supervision and management, nursing, physician assistant studies, film and others. MDC is the recipient of many top national awards including the Aspen Prize. As Democracy’s College, MDC changes lives through accessible, high quality-teaching and learning experiences. It is the home of the Miami Culinary Institute, the Miami Animation & Gaming International Complex, the Miami Fashion Institute, the Eig-Watson School of Aviation, The Idea Center, the Cybersecurity Center of the Americas, the Cloud Computing Center, the Center for Learning, Innovation and Simulation, the School for Advanced Studies, and the New World School of the Arts, to name a few of its most innovative programs.
MDC has been named among the nation’s “Great Colleges to Work For” since the program’s inception. The College embraces its responsibility to serve as an economic, cultural, and civic leader for the advancement of our diverse global community. Its alumni and employees contribute more than $3 billion annually to the local economy, and MDC graduates occupy top leadership positions in every major industry. MDC is renowned for its rich cultural programming. It is the home of the Miami Book Fair, Miami Film Festival, the National Historic Landmark Miami Freedom Tower, the Tower Theater, Dyer Building, Koubek Center Mansion and Gardens, MDC Live Arts, the Lynn and Louis Wolfson II Florida Moving Image Archives, the Museum of Art and Design, a sculpture park and a large campus art gallery and theater system. MDC has admitted more than 2,000,000 students and counting, since it opened its doors in 1960, and more than 100,000 students are currently enrolled.
“Our students will have access to a vibrant community; they will have the possibility to share with peers with similar interests and passions about AI. This partnership will strengthen MDC endeavors to create new opportunities for learning the skills of the future”, Anabel Mederos, Artificial Intelligence for All, Grant Project Manager at Miami Dade College.
The traditional definition of STEAM includes subjects like Science, Technology, Engineering, Arts and Mathematics. Great linear paths to careers in Artificial Intelligence. But today, there are also nonlinear STEAM Paths that can lead to careers in Artificial Intelligence, Machine Learning and Deep Learning.
Since DataEthics4All is on a Mission to break down barriers of entry to tech, build diversity, inclusion and equity in Tech through a grassroots approach, DataEthics4All’s STEAM in AIᵀᴹ also includes Sociology, Technical Education in AI, Ethics, Analytics and Mentoring.
DataEthics4All hopes that the unique 10 Pillars of this Program such as Free STEM Tutoring, Career Mentoring, Project based career mentoring, Career Counseling, Essay Reviews for College Applications, help with College Applications, Career Technical Education, Internships, access to a global Community of Tech and Social Impact Leaders, Networking Opportunities, Leadership Opportunities and an Opportunity to earn the Presidential Volunteer Service Award will bring the much needed STEAM in AI through this Movement!!
“I’m pleased to announce the latest partnership between DataEthics4Allᵀᴹ and Miami Dade College for our STEAM in AI Movement and be given an opportunity to help support 100,000 students of Miami Dade in Career Mentoring, finding new Tech Jobs, Internships, Leadership opportunities and in earning the Presidential Volunteer Service Award!!” Shilpi Agarwal, Founder and CEO, DataEthics4All Foundation.
Contact [email protected] to learn more.
Share:
Written by:
Tags:
“There is a problem with that – that the minimally viable product is pushed so fast in the pipeline, that companies don’t even take the time to make sure that it is also ethically viable.”
~ Susanna Raj
TEST
“You’re now thinking about having the right team in place, having an ethics first mindset across that team and within the individuals themselves, and also looking for someone who can lead that team in ethics.”
~ Sam Wigglesworth
Expand
Talk Summary
DataEthics4All brings this Series of Ethics 1stᵀᴹ Live Talks for Leaders with an Ethics 1stᵀᴹ Mindset, those who put People above Profits. Come, Join us for this lively and informative discussion and food for thought on how to create an Ethics 1stᵀᴹ World: People, Cultures, and Solutions.
This week, in the 10th Episode of the DataEthics4All Ethics 1st Live, we discussed: MVP vs EVP – What should Startups focus on?
1. Minimal Viable Product vs Ethically Viable Product. What should be the primary focus of an Agile Startup?
2. How to build a Product with Ethics by Design?
3. How to build a Startup Team with Ethics INSIDE? Champions who put Ethics above Profits?
Come, Join us and share your perspective and best practices. If you’d like to be invited as a Panelist, please write to us before the show.
Transcription
0:39 Susanna Raj: Hello everyone! We are back again for our weekly ethics first live talks. I’m here with Sam Wigglesworth, and Shilpi unfortunately could not join us today, but we are going to run the show, and Sam is going to introduce the topic. It’s a very, very relevant topic that is very close to my heart. So Sam, go ahead.
1:07 Samantha Wigglesworth: Brilliant! Good evening, and lovely to see you again, Susanna. This is session 10, it’s January the 27th, and what we wanted to focus on this evening is looking at minimum viable products versus what is called EVP, and EVP is referring to ethically viable products. So we’re just going to discuss that this evening and what the importance of them is for startups in particular, and where we should focus our time.
1:38 Susanna: What is an ethically viable product?
1:46 Sam: From my perspective, it’s moving away from the traditional MVP, where you want to get a team together as quickly as possible, produce an idea and pull an MVP together, a minimum product together, you’re now thinking about having the right team in place, having an ethics first mindset across that team and within the individuals themselves, and also looking for someone who can lead that team in ethics.
2:15 Sam: That’s what I would say. You want to focus on responsible AI as well, that’s the core focus when you’re building responsible applications. Yeah, making sure you consider everybody’s decisions as well, and everyone’s requirements, it’s really important for the user.
2:32 Susanna: Yeah, definitely, and, you know, the minimally viable product has now been sold to everyone, and it’s a very lean, agile, framework in which to develop a product as quickly as possible – a testable product that you can push out to the public, and then the public can actually work on it, give you feedback on the failures and the flaws in your design, and you can quickly iterate, fix it and move on.
3:01 Susanna: There is a problem with that – that the minimally viable product is pushed so fast in the pipeline, that companies don’t even take the time to make sure that it is also ethically viable.
3:19 Susanna: To me, an ethically viable product is more important than a minimally viable product because in the long term, once the pilot is done, once the testing is done, it’s not possible for you to go back in time and fix what was originally a critical ethical flaw in your design.
3:41 Susanna: So, do you have any questions for us that we can answer from the audience?
3:49 Sam: Let’s have a look. Let me just check if we have any questions.
3:57 Sam: Not at the moment, we don’t at the moment, but please go ahead and ask us.
4:02 Sam: Yeah, I think you’re right though, it’s a really good point that you were making that we do need to think about it from an ethical perspective and an EVP rather than a minimum viable product.
It’s becoming more common now to do that – to think about the company’s values, how the models that we’re training and building treat the end user and how we as a business are focusing on that as an element for development.
Susanna 4:37 think, the first call about it, I think that’s the question right, you know, yeah, really cool about it. [?]
4:46 Sam: Yeah, like you were saying you want to have an agile approach. It’s not that we’re dismissing that you should still go through the process of scoping your ideas, of strategizing, and planning and going through that development life cycle and testing, deploying, and then iterating and improving.
5:09 Sam: But fundamentally, from my perspective, and from what we’ve learned so far, it’s really about the data that you decide that you’re gonna train your algorithm, your machine learning model on, and understanding that and making sure that it aligns with your end user – that it avoids as much as possible those biases that we have talked about that creep into data and into training models.
5:40 Sam: That’s really important for me, and we can look at frameworks to help us with that, whether it’s our DataEthics4All pillars, or others that are more available internationally and in companies, but the fundamental thing for me is that we consider all users and all end users when it comes to the data itself and the model. Yeah, what about you? What do you think? What’s your view?
6:05 Susanna: My view is the same, that right now there is a question within the field of ethics, you know, not in the field of ethics within the AI industry, it’s ethically costly businesses, by design, you know, trying to build ethics into the product.
Susanna: Yeah, waiting for inclusiveness, making sure that you are hiring the right person, that right the people are in the room, and also, that you are able to do market research for the target audience, making sure they are also included in the process, all of this costs money. So what do you say to that?
6:48 Sam: Yeah, it’s absolutely true, I think you have to align your product, your EVP with a funding model, as well, that aligns with your values.
Sam: I think it’s looking for those individuals that are interested in helping invest and grow that, whether that’s within the company itself, or looking for funds. Yeah, so certainly doing your research in that area, whether it’s working in an application in ed-tech, or in an ethics framework, for example, you’ve got to look for those funding avenues, and they’ve got to align with your values in your mission.
7:32 Sam: I’ve seen before that, we’ve seen in the articles that we’ll be reading, particularly from the one from TechCrunch, that Shilpi shared earlier, that for several years, a company can be developing a product, and invest millions of dollars into it, into both the marketing, and promotion of it when it’s finished, and the development, and if you don’t get it right that first time, like you said, and you don’t build it into the design from the basis, then that’s it. It just takes one mistake, absolutely. We’ve seen it before, and we don’t want that.
8:06 Sam: So aligning the right funding avenues, and making sure that that is your priority, and that comes from the team, and comes from the design.
8:17 Sam: What do you think? What’s your view?
8:19 Susanna: I don’t believe in that argument when people say it’s so expensive to build ethics into the whole design of your product. No, it is probably the most priority expense for your company at that stage, you should spend as much money on that as possible.
8:38 Susanna: If it takes time, then you should take that time and build it ethically – hire the right person, wait for the right team to form and make sure that your team is inclusive, make sure for all the discussions you have about the people who for whom you are building the product, make sure those people are also in the room with you.
8:56 Susanna: So it is an expensive avenue, but I think that is the only way to avoid the pitfalls that we are seeing now. Also, going down the road after you make a mistake, and after you see that it is no longer ethical, and then people are shouting at you and suing you and all of that, that is it is a costly endeavor, right? You might as well put the money in before into the product itself. So that’s what I think.
9:35 Sam: Knowing when it’s ready and taking time is important, I agree. I think from the very, very beginning, if you have a team that understands data, that understands the importance of privacy, that understands how to protect security and users rights, and has that perspective.
Really importantly for me, and I’ve been looking at a couple of TED talks as well about this recently, and actually we’ve had a talk on this, and we did have a talk last year during our Summit – we mentioned the importance of inclusiveness and understanding language, but it’s also about understanding culture.
10:17 Sam: If an organization can do that, and can make it a global application, thinking about the global South – we’ve talked about the global south before quite a bit.
10:28 Sam: Sometimes we have a perspective and we need that to be global. We need to look at that from many different lenses, from a language perspective, and also from a cultural perspective.
10:40 Sam: That takes time, as well, and learning. Do we have any questions?
11:12 Susanna: Yeah, anything related to this topic of an ethically viable product, this building with ethics by design into the product life cycle. Do you have any questions for us? You know, ping us? Put it in chat, and we will answer it live for you here.
11:27 Sam: I have a question then, and I think one of the questions we wanted to ask was, how do you build a team with ethics inside? So what is your view? How would you build a team up with ethics inside?
11:29 Susanna: First of all, with ethics, you can say that ethics has many different frameworks out there, but the one that is most crucial to any product’s viability, is to have inclusiveness built into it.
12:04 Susanna: You cannot have inclusiveness built into it when you don’t have representation of everyone at the table, everyone at every stage of the process, everyone who’s going to be impacted, the people are going to use your product, as well as the people who are developing a product – both of them should be from that background from the same background, should have also differences in different disciplines should come together. We don’t have that anymore. Different races and ethnicities, and different people who speak different languages. Even languages have different meanings in the same word, as a different meaning or a different connotation in another language. So you don’t know all of that unless you build a team that is more inclusive.
12:52 Susanna: So to me inclusiveness is the first first pillar of you know, building an ethically viable product. And if you cannot build an inclusive team, as of now, wait, all silver workers.
Susanna: Wait, wait until the person is there and don’t Don’t rush into it. And that waiting is not considered viable in the industry. But to build an ethically viable product, you must wait. And that is what I think and it should have. I think the next step is it should have inclusive use cases that benefit anyone, everyone everywhere. It cannot be just your product. Let’s say you’re selling something like a device, you know that is going to benefit only a certain group of people,
Susanna: you need to think how that device will be used against another group of people. So it needs to be inclusive.
These use cases are another area that I think we should have in the design itself. Any other things that you think should be there at the design stage?
13:57 Sam: Yeah certainly, I think as developers, and designers, we need to come from a perspective of knowing that we need to be agile in the way we approach products and developments. But before we get to that stage, like you said, we have to take our time, we have to understand the importance of knowing and being transparent with the technology that we’re building, and understanding how the processes of the algorithm operate, and the data that’s been captured. I keep saying that, I think that’s really important – from my perspective, from my background and from the work I’ve been doing, I think that’s really key.
14:38 Sam: Understanding the phases of development, but getting those people involved from an early stage, like you said, aligning them with the values of the company, and treating people that are part of that journey with fairness and respect and rights to privacy as you go along.
14:58 Sam: I think also you’ve got to think about, like we said, safety and security, and that it operates efficiently for everybody, and that we’re accountable to any outcomes. Like you said, we often find that, in the past, we’ve gone ahead of ourselves and developed products that are for users and very functional and well designed, but we haven’t often thought of the consequences. So we need to think about that first, before building – just know the pitfalls first and learn from that.
15:29 Susanna: Yeah, you have to think about all the use cases. I know they say that we didn’t have the imagination to think that facial recognition would be used? No, not really, you had the imagination to build the facial recognition tech, but you can’t say you did not have the imagination to think of any evil use cases, so we must have the imagination to ‘think evil’ as well so that we can avoid being evil.
16:03 Susanna: You have to think, how will this be used against an individual? Or against another country? What about countries that don’t believe in democracy? How will they use it?
16:15 Susanna: We didn’t think of all of those things, we launched facial recognition technology out there, and it is now being used in countries that don’t believe in democracy against their own people. So those are the use cases that you have to think about and all of this thinking takes time, and that is what it means to build an ethically viable product rather than a minimally viable product. A minimally viable product is easy to build and very fast, but an ethically viable product takes a longer time.
16:45 Sam: It is an investment, yeah I agree. I think what you mentioned earlier about having use cases for individuals or even countries that look at risks, and how it might be used against that particular group or individual is really important. Especially when it comes to the newer, more advanced technologies that we’ve seen in voice and facial recognition, I think both of those areas, those avenues are worth exploring.
Sam: I also found, from the research, that we often build products that are not accessible, so we need to think about accessibility.
We’ve talked about that a little bit before, but I think that’s really important for those that have multiple special educational needs, for example, that maybe need not only to read but also to have good audio, and good visuals of websites or applications.
17:51 Sam: I think we’ve got some questions coming up, let’s go into the feed. Okay, it’s not that busy on the comments feed, but I think we’ve covered most bases this evening. I know we had a couple of key questions about what we should be focusing on, what’s most important, and how do you build it? I know that in the articles that we’ve been looking at together as a team.
Sam: there’s an important requirement for an ethics first leader to lead that team, and I think sometimes you need both that and the right group, as well.
18:45 Susanna: I know that article mentioned that, you know, you should have an ethics chief officer, but I tend to disagree with that – it’s not just one person who’s being the ethical lead in the team, it doesn’t work like that.
19:03 Susanna: It has to be everybody, if we are going to build something which is ethical by design, everybody in the room has to be a voice for ethics and has to be the person to advocate for ethics from that room, it cannot be a single person – that is a model that has already failed.
19:23 Susanna: We saw with Google and all of them, you know, it’s not like you have a chief AI Ethics Officer and Chief AI ethics is such that no is doesn’t have the, you know, the ability to this another community wise, everybody in the company at every stage and every process should be talking about ethics.
19:43 Susanna: You know, in DataEthics4All, for example, all of us are advocates for ethics, so it’s not possible for the organization to do anything unethically because everyone in the room will speak up for it.
19:58 Susanna: Speak up politics, that is how I know ethics by design should be bad. What do you think?
20:06 Sam: Yeah, I think it’s it’s key, and we should be thinking about it from within as well and understanding that it’s actually part of your fabric as an organization, and it’s interwoven into design, it’s not separate. You shouldn’t just have that one individual, or that one small group, you need it to be across different teams or multiple teams, it’s part of a culture.
20:34 Sam: We’ve got our main objectives as an organization, and one of our missions is that we build it into the fabric of who we are, as an organization, I think that’s really important.
We learn and we improve, but we do want to start from that base, from the bottom up in that respect. I think we’ve covered all questions for this evening, and I’ve really enjoyed the discussion.
21:19 Susanna: Definitely, Samantha is also a founder of an organization – she is also a founder of a startup, so she knows what it means to build ethics by design into the product, into her programs, and into her organization. I am also a founder, so this is not something we just talk about, this is something we are trying to implement in our own products and in our own companies. So it’s a long journey, it’s an expensive journey, it takes time to do this the right way, and we have to break this mold of ‘minimally viable product‘, but just focus on the the agile framework that is included in that philosophy, but take it and use it for an ethically viable product, an ethically viable lifecycle of a product.
22:14 Susanna: You have to really dive deep into that, build explainability into it, build inclusiveness into it, make sure everybody is included, and every use case is also included.
Susanna: So, those are all the things that we are all trying to practice, and you can contact any of us for any more information on how to implement this in your companies. Sam is an expert in NLP so she would be able to help with how to build an ethically viable product as an NLP expert.
22:50 Susanna: So, DataEthics4All is an organization that is founded by Shilpi Agarwal, who believes in the Ethics First mindset, and everybody here is an ethics first mindset leader. So we are all here to support you in your journey to build ethically viable products. So come and ask us any questions, come and join our community.
23:30 Sam: Thank you, Susanna, who’s our chief ethics first officer, she’s our ethicist, absolutely. So thank you.
23:29 Susanna: Thank you, everyone, for joining us. It was a pleasure talking to all of you this evening. And we hope to come to you again next week for another lively ethics first discussion. Thank you.
/
Join Us in this weekly discussion of Ethics 1stᵀᴹ Live and let’s build a better AI World Together! If you’d like to be a Guest on the Show, Sponsor the Show or for Media Inquires, please email us at [email protected]
Come, Let’s Build a Better AI World Together!
Share:
Written by:
Tags:
“Whatever data you’re collecting from a user, you have to exactly notify the user what data you’re going to collect, what you’re going to use the data for, and the user should have the right to say no.”
– Shilpi Agarwal
“We need to be a bit more data-literate, know where our data is, request data if we want it, and be a bit more willing to understand some of the issues.”
– Sam Wigglesworth
Talk Summary
In this Ethics 1st Live Discussion, members of the DataEthics4All leadership team discuss the misuse of data – what it is, some examples and how you can defend yourself against it.
Transcript
0:08 Shilpi Agarwal:
Welcome to another Ethics 1st Live talk. I’m your host Shilpi Agarwal, founder of DataEthics4All, and I’m joined by my colleagues from the leadership team, Susanna Raj and Samantha Wigglesworth. Sam is joining us from the UK, and Susanna is joining us from California, sunny California! If you’ve joined us for the past five live talks or you’ve managed to see a recap of some of those, our intention with bringing these Ethics 1st Live talks to you is to bring food for thought for leaders with an ethics first mindset – those who put people above profits and have ethics in their DNA; who value ethics above all; it is not an afterthought, it is by design and it is at the forefront of everything they do. To encourage more such leaders and to bring more food for thought, this is our weekly talk series. Today’s topic is misuse of personal or private information; a really exciting topic because it is at the top of everyone’s mind. Private information and the misuse of it is very common these days and sometimes it’s a gray area and we don’t even know that we have misused it. Today’s talk will shed some light on what exactly is private or personal information, what is personal data, who has the right to use it, who has the ownership of that information and when is it okay to share or sell that information or use it publicly. I hope that our discussion today will spur up some conversation and food for thought. Let’s start with a basic question: what is personal information; what is private information?
3:27 Susanna Raj:
I believe private information is defined in very broad terms; legally even your name is considered private information. Your name – even your first name – your contact information, your home address, your IP address, and any information that can be linked to you to identify you as an individual is considered private information.
3:57 Shilpi:
Yeah, it’s called PII – Personal Identifiable Information. Any information that can identify you as a person, as opposed to being anonymous; as opposed to a female living in California aged between this and this – that is all still demographic information, there can be hundreds, thousands, millions of people with those same exact demographics. But when you put a few things together then it’s easy to identify a unique person, so this PII is a unique identifier; anything that uniquely identifies you. Sam, do you want to add anything to that?
4:45 Sam Wigglesworth:
You’re absolutely right, according to legislation personal data includes name, surname, location – anything that’s personally identifiable to you. It’s not just demographic data, it might be just a reference to health data as well, it does span quite a lot, there’s a lot to cover.
5:37 Shilpi Agarwal:
It’s also sometimes a combination of these identifiers. For example, even the first name is considered PII, but there could still be many people with the same name, like there could be many Shilpis in the world, but when you combine that with more information like my health care data or non uniquely identifiable information like my zip code, it narrows it down and then it is more easy to uniquely identify that person. That’s when that information truly becomes personal or private information. For example with healthcare data, it could be of lots of different people, but when you combine it with name and demographic and location, when in an office there’s only one person with that name, then those are the kind of things where we need to be careful of how we reveal that information. Okay, so what is considered data misuse?
7:12 Sam Wigglesworth:
I was looking at this earlier and I thought for me it’s having someone’s individual information and using it not for the intended purpose. That’s my definition. It doesn’t mean that it’s necessarily illegal, but it’s not used for the intended purpose.
7:50 Susanna Raj:
I would add to that that it’s not only for the unintended purpose, but also that any data you collect without permission, without consent or you collect it for one use case and use it for another use case, or you expand the use case without going back to the user and informing them again – all of those are considered misuses. In the realm of social media releasing someone’s private information because they have a contrarian viewpoint or a political viewpoint, and then you want to reveal their personal information – all of those are data misuses.
8:32 Shilpi Agarwal:
Yeah absolutely. I gave a talk at the DATAcated show about the ethical considerations of data collection. Consent was a major topic then – first of all you have to take explicit consent for whatever data you’re collecting from a user, and it has to have three key ingredients. It has to exactly notify the user what data you’re going to collect, what you’re going to use the data for, and the user should have the right to say no. When you’re asking for consent there should be a clear way for them to say no. If you go further, there should also be a way for them to revoke that permission so it’s not that they’ve given you the permission once and you just have it forever. You should also have a clear sunset policy, meaning you know when that data will expire, so you don’t collect somebody’s data with their permission but hold it forever and then use it for other purposes or selling it. Overall, data misuse is data being used for a purpose other than that for which it was collected without the consent of the user. Whenever as a business we want to use the data we have collected for something else, we must go and inform the users. That’s not just ethical, nowadays there are new laws that will ask you to do exactly that. So, what are some examples of data misuse that we have seen in recent times?
10:46 Susanna Raj:
There’s been a lot since 2016, there has been so many misuses of data! Cambridge Analytica is one that comes to mind; another is the time when an undercover FBI agent’s address and her name was identified. Even though she was publicly identified as a person, the fact that she had another job that was undercover was linked; both of them linked together. Sam could be a teacher in the United Kingdom, but she could also be an undercover agent – if I link that information and leak it, that puts her life in danger. That is called doxxing – if I have a disagreement with her and I know this information about her and I put it on social media. That was one of the major misuses that happened during the past administration in the United States and then it was back and forth; the far right and the far left doxxing each other and releasing private information, putting people’s lives in danger just because they are disagreed with the political viewpoint of the other person. So those are the kind of misuses that have been happening, especially on Twitter and Facebook.
12:36 Shilpi Agarwal:
And also Google and Amazon – basically all of these companies that have marketplaces. Facebook’s Cambridge Analytica started with the marketplace; there were apps collecting data from users, but those users explicitly gave information to Facebook, and then these other apps through the marketplace went and collected that data from the friends of the friends who actually owned the app. I might give permission to a mobile game app to collect my data because I want to play that game, but that doesn’t mean I’m also giving you permission to access the data of my friends! These marketplaces are a big loophole, Google got into a lot of firewalls to collect location data without explicit content from the users. Amazon’s marketplace also was doing that, although it’s still under investigation and the charges have not been formally brought, but there is an in-depth investigation going on by the EU’s antitrust authority to see if sensitive information from Amazon’s marketplace has been used by the sellers to their advantage. Sam, do you want to add something to this?
14:20 Sam Wigglesworth:
Yeah, I was going to say that Twitter is starting to review its privacy policies based on previous issues with uploading of videos and images which are then being used against individuals, so they’ve reviewed their policies based on that quite recently. In the news in the UK we know that data is being and has been in the past misused by organizations for individuals that are quite prominent, quite famous – that’s been in the news recently as well, where data’s been obtained without permission. That’s something that we’ve seen quite a lot of here. You’ve mentioned Google and the collection of data from ads, what I’m seeing is more companies now looking at solutions to make their data protection policies more stringent and strong. We talked about it last week in the previous Ethics 1st Live talk about bounties being awarded to developers who can find loopholes and gaps, whether in software or web applications; people are now actively looking to do that and they’re hiring people to do that, so that’s really positive.
16:31 Susanna Raj:
There’s been a lot going on in terms of controlling this misuse of information that each company is trying to bring up. The one that Sam mentioned was that Twitter came up with a privacy policy that said you cannot post private images and photographs without consent, but that policy was so poorly written it was used against activists trying to bring people who were causing violence and riots to justice. They posted their images and Twitter took them down thinking that it was private information posted without permission – how would they give permission to post those images? But those images were already public in another domain, so the policies are great if they are written in a proper way and take into account all the variables. It goes back to my research industry terminology – all your variables have to be defined, all your legal terms have to be well defined, so you have to define what is private and what is not private quite thoroughly.
17:47 Shilpi Agarwal:
It was a well-intentioned effort, they wanted to protect people. Social media nowadays is full of things like when you go to a party and people take pictures with you in the background and then they post it on social media – and there is no consent. What if I don’t want wherever I am publicly on social media? But it’s difficult to take consent from everyone, especially in a crowd, so what do you do? How do you put something in place where you can report to Twitter and ask them to take it down, and they will review it? It was a well-intentioned effort and something that definitely needs to be done because on social media platforms kids do it, we all do it, we want to brag about ourselves, but we forget that in the process we may be hurting someone else’s privacy or their private information. Like Susanna said, the far-right activists felt very happy that this policy is going to actually protect them because now nobody will know the face of people who are actually deliberately causing intentional harm to society. Obviously we don’t want that, but to be fair the policy said that you have to appeal to take something down, not that you can do it on your own, and Twitter will make an informed decision whether it needs to be taken down, so in this case if they see that it is an actual far-right activist group that is causing harm to society, then Twitter can decide not to take it down and let it be common knowledge that these are the kind of groups or people that are causing harm to society, and so stay away from those kind of things or protests. You gotta start somewhere, because this has become a giant beast; social media today has become a giant beast. It’s very hard no matter how well intentioned the laws you put in place are, there’s always good and bad to it. So, what is the difference between data misuse versus data theft?
20:31 Sam Wigglesworth:
They’re slightly different. Misuse as we’ve said is where data isn’t being used for its intended purpose as Susanna said, without consent. Theft is when there’s been a data breach or a cyber attack on a company or an individual’s data and it’s taken without consent. You’re not aware of it at all.
21:35 Shilpi Agarwal:
True, there’s no consent of any kind – with misuse there might be for one particular purpose, with theft there is no consent, period. Consent is not given by the user for any purpose to a particular person or company or vendor or user or app for that purpose; they decide to just steal that data and use it; that’s literally what it means, it’s basically theft. In some ways what happened with Cambridge Analytica also can be considered theft because the users only gave information consent for their own information, but that app stole data from all of their friends, so it would be considered theft. Susanna do you have anything to add to that?
22:40 Susanna Raj:
No, theft is just taking something without permission – that’s the basic definition of theft; that definition applies to data.
23:01 Shilpi Agarwal:
With misuse also, it is still our data so in both cases we are the owners of the data, but in the first case we are willingly sharing it with someone. So are there any laws today to protect us, the users, from companies misusing our personal information or stealing our data?
23:46 Sam Wigglesworth:
We do have in the UK and in Europe policies around data protections; we have the Data Protection Act in the UK which has actually been reviewed recently in 2018. That governs the use of personal data, how it’s collected and what we should be using it for. Then you’ve got the Computer Misuse Act as well which covers what we were just talking about, the risks that data in an organization could be collected illegally.
24:28 Shilpi Agarwal:
We also have GDPR and the CCPA, which is for California, but it should be everywhere; it should be applied nationwide. CCPA stands for California Consumer Privacy Act, it gives users protection for their data, so whenever you visit a website even if cookies are there, you can say ‘do not sell my information’. You can explicitly ask for a company to share whatever information they have on you; they have to actually show it to you, and if you say that you do not want that information stored, they have to abide by that and delete all the information they have collected on you. You can also fill out a form saying ‘do not sell my personal information’ and in that case they will not be allowed to make money out of your personal data. Those are some things that the California Consumer Privacy Act protects. I will let Susanna talk more about GDPR if she wants to add anything.
25:46 Susanna Raj:
Yeah, GDPR is much broader than the CCPA in that it goes further, not only with deletion of data – the right to forget your data – but also the definition in Article 48 of GDPR and also the European laws are very strict in how they define a person and personally identifiable information. A ‘living person’ versus a ‘natural person’ versus a ‘legal person’ – they have different definitions, and they also define in a granular way the difference between corporate rights and individual rights. All of those are much better in GDPR than the CCPA – which is a good start for California, as far as the whole of the United States we don’t have anything like that, so California is leading the way in that. It still falls very much behind the GDPR though in terms of defining what is a person; what the legal identity of a person is versus a company, that has been done very well by the GDPR.
27:06 Sam Wigglesworth:
What you mentioned earlier about sunset policies comes up in this particular legislation as well – if you’re going to be utilizing data it’s got to be done lawfully; it has to be time limited and limited to what it’s necessary to be used for, and accurate. You have the right to request what information is being held on you. It covers a broad range of parts of the legislation which are protected, and the UK is modeled on that – both the UK legislation and GDPR operate together.
28:00 Shilpi Agarwal:
You brought up the sunset policies; so data collection at the moment, especially with contact tracing and everything that’s happening with Covid, we have all these contact tracing apps and even the government, even schools are collecting your data. What schools are doing, for example in my kids’ schools, is they have a seating chart and they want kids to sit every day in the same exact place so that if somebody tests positive then they can inform everybody who came in contact with the kid. Again, it is well-intentioned and it is good for the purpose that it’s serving right now, but hopefully Covid is behind us and whatever data and information we have collected through contact tracing we need to let it go, we need to have a sunset policy. Basically they have minute-by-minute information on where you’re going, which stores you’re visiting; they have so much information on that person, so it could be misused in a big way. And also, while I was talking about this talk that I gave for DATAcated, there was also this use case where H&M was collecting information on their employees. Every time an employee went on a holiday or took a vacation or took personal leave, they were forced to have an interview with senior leaders, and they were asked to share more information than they needed to, and then this information was used for understanding their religious preferences among other things, also putting them on this corporate promotional ladder or whatever you want to call it. For all of these practices they were fined 41 million dollars. Maybe it was well-intentioned; maybe they only wanted to know how to better understand their employees to be able to give them better perks and create more things that will engage their employees; so maybe it was well intentioned. But the execution of that and the data that was collected was more than was needed. So coming back to data collection, everything starts with data collection, so we have to be very conscious and ethically minded when it comes to every stage of the data.
30:58 Susanna Raj:
Especially with IoT [Internet of Things] devices now, that is another whole big area of security issues. Here in California PG&E has smart meters which collect all the data about when you do your laundry, how long you do your laundry for, when your lights are on, when they’re off – it collects all kinds of information. We went through a breach in India and lost a lot of that information to thieves. Why are companies collecting this information when the purpose is to know how much energy you are using – you don’t need the granular details of each home and each individual’s user preferences. We have to be aware of what is being collected on us; I believe as individual users it’s on us.
31:57 Shilpi Agarwal:
But you know what PG&E is doing, right? They are not only seeing what time you are doing your laundry, but they actually have come up with different pricing points. Again, where they are coming from with this information is that they want to spread out the stress on the grid, because everybody comes back from work and maybe does laundry between 4-7pm, or between the morning times when there’s not that many people working and people are from working from home. So to reduce that they have different pricing strategies for people who are doing laundry from 4-7pm or on the weekends versus people who are doing it on other times of the day. So to your point, yes they are collecting that information; because they have the smart meter they can do that, and they are actually incentivizing people to do their laundry or use less electricity on the times when the grid is already overloaded. Yes it is well-intentioned, but with data comes responsibility, and with more data comes more responsibility. If we want to use the data we collect from our users, we have to secure it properly so it is not susceptible to breaches. That is an ongoing task of the security officer, it’s a nightmare these days! We talked about ethical hacking and the bounty and all of that – imagine the jobs of the privacy and the security officers, it must be hard because you never know who is going to come after your data.
Alright, last question: what can we do to better protect our data? Is there anything we can do as consumers to protect our data?
34:23 Sam Wigglesworth:
We’ve just got to realize, and I think we’re more aware of it now since the pandemic started and we started working from home using IoT devices a lot more than we used to and being on our computers at home, that actually our work and private lives have blended a little bit and we just have to be a little bit more vigilant of what we’re doing online, what we’re sharing and how we’re sharing our information. Just generally we need to be a bit more data literate; that’s what we try to do, we want to focus on that and develop those skills. Knowing where our data is and requesting data if we want it, being a bit more willing to understand the pitfalls and maybe some of the issues and if we want to know more we can find out more and build our knowledge. That all helps, definitely. Being ready, reading around the topic, visiting our community as well and learning about what we’re discussing in our community online and in these talks. That will make us more resilient, I think we’ve got to think about that going forward.
35:49 Shilpi Agarwal:
It starts with information: we have to know our rights, we have to know where we are sharing our data, what others are doing with our data; if we are signing our consent on a 45-page document, it’s our job to read it and understand it, and make sure what it is going to be used for.
36:13 Susanna Raj:
It’s also your job to demand that the 45 page be a four page document, it’s within your right to demand those things and it is also within your right to ask whether you really need a coffee maker with IoT in it? Can’t you just walk and go and put the damn switch on instead of asking Alexa to turn it on for you? All of those things – what is the convenience and what is the freedom you are paying for it? And also, incentivizing behavior is another thing that corporations are doing with our IoT information, and yes it may be to help the power grid, but also if they are changing the behavior of each individual household, and especially households that may have a disabled community member living in them, they may be using more power at different times of the day and they may not be able to transition to that incentivized behavior that PG&E wants us to have. Also thinking about other communities who may not be able to accommodate your behavior modeling practices. Including all of those things; I don’t think the burden should be only on us – it’s like it should be on you to read every 45 page document? No, no, I don’t want to read a 45 page document, I want you to give me a two page document, it’s also my right to demand those things and to make the laws work for us.
37:58 Shilpi Agarwal:
I think with that we will end this on a good note; know your rights and demand your rights, do not think that if it’s out there then it’s out of your hands, you still have control, the data belongs to you and you have ownership of that information – you alone have ownership of that information and you can now ask for the right to be forgotten, that data to be deleted and that data not be sold to anyone else. You yourself are the only person who should be able to make money out of your own data, no one else. So with that note, hope you got some good food for thought and we’ll see you next time. Thank you Susanna and Sam! For everyone who is going to watch this on demand please feel free to post your comments, we are always listening and we’d love to hear from you.
Join Us in this weekly discussion of Ethics 1stᵀᴹ Live and let’s build a better AI World Together! If you’d like to be a Guest on the Show, Sponsor the Show or for Media Inquires, please email us at [email protected]
Come, Let’s Build a Better AI World Together!
Share:
Written by:
Tags:
``Do we understand what responsible AI is?``
``Are we informing and educating all the people that might have an impact in the decision making process.`` - Diya Wynn
“I think it’s so important the work that data ethics for all is doing, and exposing young people to stem and technology and opportunities and artificial intelligence”
– Diya Wynn
I am text block. Click edit button to change this text. Lorem ipsum dolor sit amet, consectetur adipiscing elit. Ut elit tellus, luctus nec ullamcorper mattis, pulvinar dapibus leo.
“Deloitte… said that while organizations understand that there’s a risk, or understand that there may be a potential for bias and a lack of transparency, they really don’t have the skills in order to be able to address those issues.”
– Diya Wynn
Expand
We are seeing AI/ML in almost every industry and every facet of our lives. The convergence of the cloud and AI is fueling this transformation and enabling widespread innovation. And AI is expected to continue to fundamentally change industries and how we engage in the world. While the benefits of AI are being widely recognized, there are obstacles and concerns surmounting. In order to sustain the ongoing adoption and realize the full benefits of AI, we need responsible development, deployment and use to ensure risk and unintended impact are minimized. “Responsible” isn’t just defining a set of principles, but it is putting those principles into practice driving when and how AI is leveraged and experienced.
Diya Wynn has worked in technology for 25 years building, delivering, and leading in early and growth-stage companies. She has a passion for developing current and emerging leaders; promoting STEM to the underrepresented; and driving diversity, equity, and inclusion (DEI). After spending years in technology-focused roles and separately pursuing passion projects in DEI, she now has a role marrying the best of both worlds. She leads a team focused on engaging with customers to go from principles to practice – operationalizing standards for responsible use of Artificial Intelligence/Machine Learning and data.
Expand
0:00 Shilpi Agarwal:
Next up, we have Diya Wynn, Senior Practice Manager of AWS. Diya has worked in technology for 25 years, building, delivering and leading in early and growth-stage companies. She has a passion for developing current and emerging leaders, promoting STEM to the underrepresented and driving diversity, equity and inclusion. After spending years in technology-focused roles, and separately pursuing passion projects in DEI, she now has a role marrying the best of both worlds. She leads a team focused on engaging with customers to go from principles to practice, operationalizing standards for responsible use of artificial intelligence, machine learning, and data. Please welcome Diya Wynn! Hi, Diya, how are you?
1:17 Diya Wynn:
I am doing great. I’m excited to be here.
1:20 Shilpi Agarwal:
I’m excited about your talk on ‘How to accelerate AI adoption’. I’m going to give you the space.
5:00 Diya Wynn:
Greetings to everyone. As was introduced, I’m Diya Wynn, and I’m excited about having the opportunity to share a little bit today. Now, I would say I have a distinct pleasure in being on the stage with so many other amazing folks that have been talking with you over the last three days. But I also have a bit of a challenge, because we’ve had some amazing individuals come and I think I’m at the end of the day!
I just want to take a moment to share a little something with you that will hopefully give a bit of context for how I got here, and why this particular area is important. So, I have two boys and I grew up in a family of girls in the south Bronx, between Harlem and New York City. Earlier in my years, I had not been exposed to technology; I had not had the privilege to see other people who were in technology in my family. What was traditional at the time was to see women who were teachers, maybe nurses. I got a computer early in the third grade, and that actually was the catalyst for me that made me want to go into technology. It was that exposure; and I bring that up because I think the work that DataEthics4All is doing is so important, in exposing young people to STEM and technology and opportunities in artificial intelligence, and even exposing and elevating the awareness of folks that may not be as aware of some of the challenges and the things that we should be mindful of, or avenues for us to consider as we look to advanced technology. I just wanted to bring that up because for me, when I started to think about my earlier experiences, I was looking at: ‘well, what do I do with my sons? How do I prepare them for what’s going to come in the future?’ And that’s really led me to where I am today. My background is in technology, I studied computer science. I was that third grader who kept my mind focused on technology even from the start, but I wanted to make sure my sons too are able to navigate this world, because we know that there are changes on the way that we will have to live with and adjust for, when we think about technology, artificial intelligence and robots being at the forefront of how we engage and shaping how we interact with the world. This is as much an inclusion, diversity, and equity problem as it is a technology problem. So, that’s just a little bit of my introduction and why this is so important that we bring awareness and education and opportunity exposing individuals to more of what the world will look like and the opportunities we have in it.
9:14 Diya Wynn:
Now, since I’m here on the last day of this AI DIET world, I wanted to just give you a brief overview of some of the solutions that my team and I have created to help our customers at AWS in this journey to responsible AI.
Most of you are already aware of how much machine-learning and artificial intelligence has been incorporated into everything that we do. Most of our industries are exploring and using artificial intelligence in some ways. Just recently I bought some new appliances in my home, and now my Samsung refrigerator and TV and microwave all have ways of talking to each other and giving me alerts in different places. Those are some simple examples, but then we also know that organizations are starting to use it in ways that aren’t just research and development or proof-of-concept projects anymore; they’re really leveraging artificial intelligence in major ways to advance products to see greater efficiency in operations. And we know that they’re handling real-world tasks, maybe not as simplistic as my Samsung kitchen appliances, but more complex problems that we thought perhaps unachievable or unattainable in the past. And this whole idea of this increased use of machine learning and artificial intelligence technologies means that there’s an increased need for us to not only be aware of benefits and potential risks, but also be doing something about them.
12:00 Diya Wynn:
Companies and CEOs recognize that there is a potential for bias and lack of transparency, and we’re seeing this in other organizations, big and small. At the same time, there is a concern – and this came through in a Gartner study – that 85% of the projects were expected to deliver erroneous outcomes due to bias in data algorithms and the teams that produce them. So what do we do then, if we recognize that more companies are going to begin to use artificial intelligence and more applications are going to have AI and ML infused into them, and we’re going to be interacting with it more, and that there are these potential risks? There’s another study as well (from Deloitte), that said that while organizations understand that there’s a risk or a potential for bias and a lack of transparency, they don’t have the skills to be able to address those issues. So, there is some level of awareness and some people will question whether everyone is fully aware of where there may be an impact – but then, what do we do? Not everyone is sitting in circles like what we just saw over the last three days, where they’re talking about potential opportunities, and the ways in which we might look at navigating bias, or how we understand our data and look at more complete and robust options with our data. Not everyone is sitting in those environments, so what do you do when there is such great promise and opportunity when we think about the ways in which AI has been used today?
14:03 Diya Wynn:
We heard some examples – when Vivian was talking about being able to give those who were autistic the ability to be able to recognize expressions that they wouldn’t normally be able to do, amazing use case, right? Or in the case of Thorn, which is helping children that may have been pulled into child sex trafficking; helping them to be reunited with their parents. These are use cases that matter, and we want to be able to have the technology at hand for us – so then what do we do?
I think when we think about enterprises and us wanting to be able to leverage the great benefits from the technology, we also need to make sure we’re not infringing on civil liberties, and that there is inclusive technology or models that are being in used in ways that respect our rights, are fair and inclusive. In the work that I get to do, and my team as well, we understand that this is not a simple problem. Some of the things we can do to address it may in fact be simple, but this really is a multi-disciplinary problem; not just looking at the skills or the expertise from certain industries, but also bringing to bear philosophy, law and these other social sciences to begin to address some of the issues and challenges, and create opportunity. I heard someone say that the other day: consider every problem as an opportunity.
16:12 Diya Wynn:
So, what my team and I got to do is create this framework to begin to address the gaps in skills in the enterprises and organizations we’re talking about, so that they’re not just aware and wondering what to do, but they actually have the skill and capability to address problems, and begin to tap into how we operationalize responsible AI. What things do we put in place to ensure that we’re looking around corners and seeing where we didn’t notice that certain individuals may not have been at the table, and that applications aren’t necessarily meeting the needs of some of our consumers?
AWS Ratio is our responsible AI framework that helps us establish principles so we can take an intentional and strategic approach, so that we can deliver good outcomes and minimize unintended impact and risk. This is our answer for assisting organizations with building on their AI investments in ways that allow us to experience the great benefits that we get; tackling these challenges but also addressing opportunities or areas where they may be risk. Each stage in Ratio helps us highlight questions; primary considerations; areas that we need to pay attention to in order to identify where there are gaps or potential risks, and begin to address those with some best practices and actually doing the work to put them into place in the organization.
18:28 Diya Wynn:
So we help our customers look at artificial intelligence and machine learning and the way in which they’re going to employ that in a responsible way. This for us is identifying a new operating model, right? Looking at people, process and technology, so that we can really drive better outcomes and reduce risk. Defining and executing that operating model goes across every stage of what we would say is the machine learning lifecycle, but this is really a part of a holistic AI journey. Do we understand what responsible AI is? Are we informing and educating all the people that might have an impact in the decision making process, in annotating data, as well as our data scientists that are training models, who all are educated in and love their area, in ways that they actually can be accountable and responsible, and take a part in ensuring that we’re delivering, building, deploying and operating responsibly?
19:40 Diya Wynn:
We’ve defined seven pillars as a guide to help us navigate through the areas to put in place the right things in order to design, develop, deploy, and operate responsibly. This will hopefully address ethical concerns when we assess this more broadly, and help us define players that have a responsibility, so they have clarity about where they fit in and when, and then give us a relative mechanism for being able to monitor and iterate that over time. And continuing to improve the process, because the ultimate goal is that we minimize the risk, reduce unintended impact and build in an inclusive way.
20:37 Diya Wynn:
Now, I talked about this, and we started off with this first piece or definition that said: ‘Accelerating business outcomes with AI matters. Raising the bar on responsibility matters even more. And Trust is at the centre’. The reason why I say that is because this conversation ends up being one about trust, and we’ve heard a little bit about that over the course of the last couple of days, as well. As human beings, we don’t trust things that we don’t understand. Companies need to be seen as trustworthy and as building trustworthy products, and the absence of that is going to have an impact on the company, people’s perception of their products and the technology itself, which ultimately has an impact on the industry and will inhibit our ability to leverage it to get life-changing solutions or solve problems. We want organizations to be building and operating responsibly so we can continue to solve real-world problems.
A great example of that would be that of the NFL and the way in which they’re using AI to find new ways to address player safety. I told you the example of Thorn with child sex trafficking or even someone that’s using AI to start to predict how they might help heart-related issues so that they can provide more preventative care. These are the ways in which we want to be able to leverage it, so we’ve got to build a foundation of trust. That notion has to start not just with the data sciences, or those of us that are aware, but really giving opportunity and responsibility to everyone in the lifecycle. That starts in a large part with our companies and our organizations that are building and deploying the technology in this way.
22:55 Diya Wynn:
So with that, I will say thank you, because I only had a little bit of time. Our solutions really go from discovery into production, and these are ways in which our team (which is a global team) can begin to partner with our customers and take them along this journey, going through the seven pillars and highlighting areas of opportunity for us to address to really build more inclusively, and ultimately have the foundation of trust that allows us to solve more, and to address more and more.
23:39 Shilpi Agarwal:
Completely agree with you Diya, what a fantastic talk, completely agree that we have to move forward with social good as our core in order to leverage data, technology and artificial intelligence to make the world a better place. Thank you so much!
DataEthics4All hosted AI DIET World, a Premiere B2B Event to Celebrate Ethics 1st minded People, Companies and Products on October 20-22, 2021 where DIET stands for Data and Diversity, Inclusion and Impact, Ethics and Equity, Teams and Technology.
AI DIET World was a 3 Day Celebration: Champions Day, Career Fair and Solutions Hack.
AI DIET World 2021 also featured Senior Leaders from Salesforce, Google, CannonDesign and Data Science Central among others.
For Media Inquires, Please email us [email protected]
Come, Let’s Build a Better AI World Together!
Share:
Written by:
Tags:
“I don’t believe we should be paid for our data. I don’t think I’m ready to say yes to that question – to sell my privacy to people.”
– Susanna Raj
“I do not want my browsing history to be tracked, but if you are going to track, show me what you tracked, and let me be the decision maker of whether I wanted it to be stored, deleted, or paid for.”
– Shilpi Agarwal
Expand
Talk Summary
DataEthics4Allᵀᴹ brings this Series of Weekly Ethics 1stᵀᴹ Live Talks for Leaders with an Ethics 1stᵀᴹ Mindset. Food for thought for Leaders who put People above Profits!! Come, join us for this lively and informative weekly discussion on how to create an Ethics 1stᵀᴹ World with Ethics 1stᵀᴹ minded: People, Cultures, and Solutions. In this Live Talk, we discussed the topic of Get Paid for your Data.
Transcript
00:25 Shilpi Agarwal:
Hey everyone, welcome to Ethics 1st Live! I’m your host, Shilpi Agarwal, founder and CEO of DataEthics4All, and I’ll be joined by my panelists today, from the DataEthics4All Leadership Team, Susanna Raj and Samantha Wigglesworth, good evening. Today we are going to talk about whether we should we be paid for our data? It’s a very interesting question that we all have on our mind. Last week on Ethics 1st Live we talked about how our personal and private information is being misused or sold without our permission, so this is a kind of part two of that: whether we should be paid for our own data or not. As you know, Andrew Yang, who was a former presidential candidate, started the Data Dividend project because he believed that social media companies should pay a dividend to the consumers whose data they are holding and making money off. That was also a theme for California’s governor, Gavin Newsom, who also created a digital dividend project and wanted Californians to be paid something for their own data. So let’s start with what our panelists think – first of all, do you guys think that consumers should be paid for their data? We’ll start with Susanna.
3:05 Susanna Raj:
I don’t believe we should be paid for our data. I don’t think I’m ready to say yes to that question – to sell my privacy to people. I know it is already being taken over by companies; but I would like to have my ownership back, I don’t want to sell it.
3:36 Shilpi:
You don’t want to sell it, you just want the ownership back. But what would you like to do with the things that you have shared freely, on Facebook or on any other social media platform?
3:50 Susanna:
I have not yet shared anything freely, but whatever was taken without my permission I would like it back. If not, I would like to take everything back and also be informed what is being taken away from me – that is what I would like to have.
Susanna: I don’t think privacy should become a commodity; I don’t think it should become something you sell.
Susanna: I don’t believe you want to go down that path – I know what California has done is in a way empowering people, they think that is one way of being bringing data ownership back to the people by saying there is a price for the data; so that means that you become the seller and then you have ownership back. But why do I have to sell anything to have ownership back? I can keep that to myself and still have my ownership – why do I have to sell it?
5:02 Sam Wigglesworth:
Susanna has raised a really good point. For me we’ve got to a point where quite a lot of our data is already with social media companies and tech companies, and has been for quite a while, so the horse has already bolted in some respects. Initially I was thinking that yes we could certainly benefit as citizens from having some sort of reward for the utilization of our data if it’s appropriately used. But first I think let’s look at the data that is currently in the data lake, if you like; and that’s being utilized by private companies, and let’s focus on protection under legislation similar to what we were discussing last week and what you’ve just raised about the California legislation.
I think it’s important that we focus on that and that organizations have their own very robust disclaimers as well that state what data they have about you and what it’s going to be used for. Legal policy would give us that power back, which is what Susanna was saying.
Sam: There are some incentives out there in the marketplace for us to benefit financially from data, but again I don’t think it’s a great deal, that’s my view.
6:43 Shilpi:
I hear both of you, here’s where I’m coming from: the California Consumer Privacy Act is the baseline protection for consumers, right – there is some level of protection that has now been turned into the law. Unfortunately California is the only state in the United States that has adopted that as the bare minimum for privacy protection. Of course we would like all states to implement something, hopefully something standardized, not that every state comes up with their own version, because then it is a mess to do business across states and for consumers to understand. Today we have to understand GDPR as a consumer and as a business owner, and GDPR and CCPA are very different in their own ways.
Multiply this by 50, or if every country came up with their own, and there are some countries who have their own versions of it, so it would become a real nightmare to keep track of everything for consumers as well as for businesses. I agree with both of your points – at some point I was also of the opinion that it’s our data and so consumers should benefit from it. To your point Susanna, one set of data is the information that we have shared freely when we are creating an account, posting pictures, sharing posts, saying things, tagging our friends, posting group pictures, posting videos – there are things that we have freely given. Yes, these platforms are portrayed as a way to connect to people and so we thought that we are really just sharing this with our friends, our family, so we are share how we feel; our thoughts, our desires, our hopes, our ambitions.
It is different if I’m asking my friend about a car and that information is sold to a car company to say that I’m in the market to buy a car. There are some things that I shared, but then there are some tangential advantages that were taken out of that data, not only that information but also collecting third-party information like where we go to fill our car or service our car, or buy groceries or clothes, or apps that we use.
Shilpi: There are other things that we have not given explicit permission on to take that information, but now they are creating this 360 degree profile validating and accumulating information from multiple sources and then selling it to companies to target us in many different ways.
Coming back to the question on hand of whether we should be paid for it; it is a very messy situation and the more I read about it the more I feel that yes, we should have ownership of it; there should be transparency on what is out there on us, but at the same time if we also start trading our information, we could start going down a very bad path.
Shilpi: Let me ask you another question, how much would these companies pay for our data, if we went down that route?
11:25 Sam:
Very little, very little, I think.
11:28 Susanna:
Yeah, even if they paid $100,000/year that’s like a penny for them, compared to the billions that they make out of each person’s data. The amount that they are now giving, that they said that they will be giving, is not even at that level – it is around 5, 10, 20 or 30 dollars. It’s nothing compared to what they are going to make out of it.
12:00 Sam:
You’re right. There’s a couple of quotes I’ve read that the digital dividend could be something like $20-$50 per data set. There is value there but is it significant enough to warrant it being put in place? And yes, a thousand pounds is quite helpful I guess but is it sufficient to share data to that extent?
12:33 Shilpi:
One of the key factors to consider is that data is the new oil and it is an inexhaustible resource, so it’s unlike any other resource that is exhaustible; this is an inexhaustible resource. $100,000 is a very far-fetched number
13:03 Susanna:
I’m just putting it out there – challenging companies to pay $100,000 per person, haha!
13:14 Shilpi:
Yeah… I read somewhere that the statistics show that they make seven dollars profit out of every person after deducting all their own expenses and costs that come with it – so no, one thousand dollars, one thousand pounds is a very far-fetched number!
Shilpi: Even if that were true, we are giving them an inexhaustible resource to own it, and saying that we give them permission. There need to be really good laws in place to say that you have to pay every time, not just once. I just saw a lot of questions from Michael Novak – he seems to have some interesting points.
16:18 Susanna:
He mentioned ‘exchange for services’ – that’s what the medical industry uses now; you could be part of a clinical trial and for the time you spend there you are compensated for it, but you’re not exactly compensated for your data.
16:38 Shilpi:
I was reading that in these clinical research trials they pay different to different participants based on whether it’s a rare disease – one person’s disease may be different than the other – whether it’s a new area that they need more data on, based on age demographics whatever – so it’s very common.
In the same way one person’s data might be more valuable than another person’s data – it may be based on age, it may be based on ethnicity. So even if we come up with a number, it will be very difficult to make sure everybody can be paid a fair amount – and will that amount be a standard amount, will it be a one-time payment, or will it be an annual year after year payment? Will the data appreciate over time and will I be paid more or less based on now what my data is worth year after year? All those are very interesting points to consider.
18:00 Susanna:
Right now credit is given in the medical industry for using your cell line – there was a famous movie about it even recently.
18:10 Sam:
I think they do don’t they, I know that in health research because clinical studies traditionally attract payment, when you’re collating data in that area, that’s one of the things to consider – utilizing that resource. Obviously because of restrictions on patient data, it’s going to be harder for us to obtain that as researchers. I think that is a good thing; that should be in place. But there are models in place already to to get funding when you participate in a trial.
Michael mentioned that it might not necessarily attract a payment but there might be other things you could exchange, rather than it being funded through the dollar or pound, it would be a token for example. I know that that’s something that’s been discussed and thought about as well. It’s something along the lines of a token; I heard of tokenization and tokens and how they might then be exchanged for other services; so that’s some something that I’ve looked at recently, and I think companies have started to think about that as an alternative.
Sam: Like you said it’s really difficult to locate data when you’ve shared it – and I did think about this before; we’re looking at things retrospectively, so how do we follow the data itself, and what value do we give to it?
20:13 Susanna:
One of the interesting questions now is how do we retrieve back all the data that we have given – if I deactivate my Facebook account, Instagram, Whatsapp and just disappear off the grid, is my data also taken out? No, it’s not.
20:38 Shilpi:
Like they say, once on the internet, forever on the internet.
Hi Michael! I know you had so much to say, did you have trouble getting on?
21:00 Michael Novak:
… yes. But nonetheless! Thank you for having me on today, I was looking forward to it this week, I’ll put it that way. I’ve been working on several projects related to privacy, security and ethics for several groups, and it’s exciting because now is the time for us as a society to begin addressing this, so that’s why I was adding all those comments as you were talking earlier, because it’s very important.
21:40 Shilpi:
Absolutely. So what is a burning comment that you want to add for the discussion that we have had so far?
21:52 Micahel:
Yeah, if you don’t mind I’ll go back to a couple that I made previously. Regarding compensation – this is my experience, I don’t claim to know everything all the time, but it’s been raised by several groups that rather than pay money, what if companies gave you compensation? Meaning that, for example – you like to go to a certain well-known coffee store, here’s some vouchers.
Michael: Or in the medical field if I’m suffering from a condition, maybe I want to participate, but I want to control my data, so using a distributed digital identity system it is technically possible and it’s politically feasible to allow me to say: ‘okay Sam, I’m gonna give you six months of access to these physical attributes of me – my height, my weight, my mental condition, whatever it might be – and once I agree to that, it’s done. When the timer goes, I get to decide if I want to stay or go; I’m in control.
23:30 Shilpi:
I think what Michael is saying is what we touched upon last week – one, the user should have full control over their data, and two they should have the control of not just consenting to say yes, but also to say no, and there should be a clear sunset policy so if you give them permission to sell your data, they don’t get to keep it forever and sell it on again.
24:07 Michael:
Compensation could be something as simple as a gift certificate to the local bookstore – it’s what’s valuable to you, and what do I as the vendor have access to; maybe it’s a frequent flier mileage – it doesn’t have to be money for money.
24:33 Susanna:
Is this similar to the bartering system – are we going back to the bartering system, exchanging one good for another?
24:42 Michael:
Philosophically, yes, but it could include currency – I may say: ‘here’s this money, here’s 10 or 100 pounds’, it could be money. But the idea is – and you spoke about this earlier – how much does it cost for the vendors or the merchants or the entity to collect all that data, and how much is it worth to them – so again the answer is it depends on what they’re willing to barter it for, whether it’s a dollar, a mark, or a voucher.
The other part that I wrote in my comments is that I would let the market decide – for example, during the holiday season I imagine retailers would pay more to have access to what you’re looking for, what do you need this year, what do you need right now compared to March or April? So again, it’s not just a standard ‘okay this is the only rule, and that’s it’. The other part that I’ll bring up before I be quiet for a minute is… are you familiar with the privacy paradox? It’s the idea that when you sign up currently for a credit card or something, the companies will provide you with the terms and conditions: if we allow you to use the card, here are all the details. Most people, most of the time, myself included, look at and go ‘yeah, I’m not reading five pages of terms and conditions’ – I put it in a drawer, and then if something goes wrong I come back and say: ‘hey, why didn’t you tell me?’ They can respond with ‘well, you consented to this.’
So the idea of the privacy paradox is that even if companies with the best intents provide users with all the terms of the privacy – how I’m going to use your data, what I may or may not use it for, it’s such a large volume that it’s there but consumers won’t use it. So the paradox is: you’ve got the data, but you’ve made the decision: I’m not going to read that information even though you provided it to me. So when I’m talking about the ethical part of that, it’s still a dilemma because how do we provide you the user with enough information to encourage you to read it so that you know what your privacy rights are – how long will you have my data for, what do I get in return, etc – without giving you all the terms and conditions about the 2500 conditions that our lawyers put together.
27:30 Shilpi:
So, there are a couple of thoughts here – there are a few companies now that have started independently doing this sort of thing. Instead of letting the tech giants who own our data in some way or another put a number on how much our data is worth, there are independent third-party companies that have started platforms where as a consumer I can go and register there, and every so often they will say ‘oh you’ve accumulated 250 kilobytes of data this week, that is worth five dollars’. Do you think that is the right way to move in this direction?
29:38 Shilpi:
I mean like a user creates an account on their portal and then they will track how much information – just like these third-party cookies are tracking us, and the third-party cookies are browser-based; they will collect all the information and then they will say that this information you have allowed to be tracked, they can put a number on it and tell you how much your data is worth. So my question was: is that the right way to move forward?
30:36 Susanna:
That’s again somebody else deciding for me how much my data is worth. I can go on Facebook or Gmail and there are extensions and toolkits where I can download my own data and see how much is collected – now, there is an agency called Data C or something, and they are now going to track all of this information for me and then tell me whether I want to sell it or not sell it, and then they are going to get a rate for it. On what basis?
31:17 Shilpi:
What they are saying is that they are more transparent – that’s where they’re coming from, they’re showing you what information they collected, they’re giving you a choice of whether you want to sell this data or not, and they are giving you a price. You can’t say that you want more for it, they have decided a number saying the data that we’ve collected on you would probably sell in the marketplace for five dollars. Whether they make a hundred dollars out of it or not, we are willing to pay you five dollars for this data and then you are in control – do you want to sell it or not. That’s what Data C, and there’s another one called Reclaim – they both are doing that and I’m sure there are plenty more.
32:00 Michael:
Yeah, so I was going to say again – I’d let the market decide. It’s a valuable service, because as a user I don’t keep track of every single thing that happens to my information electronically by all the companies, whether it’s the utility, the apartment etc – so I have a choice as an individual, but the key is I have the option, compared to five years ago where you don’t even have the option. It’s a service if i want to use it; if I don’t I take responsibility; that does come with consequences both good and bad. If I use it maybe they do find me a better priced credit card for my use cases; maybe they find me better health insurance based on my needs etc. But if I don’t, that is a individual decision which I think is a good thing.
33:03 Shilpi:
I think I’m not hearing what I want to hear from each of you! We started this discussion with saying that I am the owner of my data and I should be paid something for it; then we came to the thought process that if I as an owner of this data sell it once, then I am commercially commoditizing my data ownership, and once it is sold, it will then be used, misused, sold, resold to other companies. And now privacy has been made into a commodity, and we will put a price tag on it, and whether that is the right thing to do or not.
Now the other end of that spectrum is if the tech giants aren’t making this decision of how much your data is worth, but a third-party company deciding – again, we are not going to ever be the decision makers, because then everybody will say: ‘I want ten dollars’ and somebody else will say twenty dollars or one thousand pounds, right? So I don’t think we are ever going to come to a point where the user is going to decide what that number will be – the best we can get is a choice whether we want to do it or not, and these third-party providers like Reclaim and Data C are moving in that direction, where they are telling us that we have collected this data with your permission – do you want to sell it or not? And if you decide to sell it, we can give you five dollars for it. My question was – and I did not hear an answer from any of the panelists! – is whether that is the right way to move forward, or we should just say that ‘it’s my data and I don’t want to sell it’ – each company should tell me what they have on me, and then don’t do anything about it.
35:13 Sam:
For me, if we have organizations like Data C and the others that you mentioned and you’re browsing online at a retail store and the cookies are tracking what you’re looking at and what your preferences are, I think there’s an assumption that from the user’s perspective that there will be some data collected, and I think it’s at that point that the individual has to decide that that’s okay, and there should be a facility there either through a disclaimer or through policy that covers that and reminds the individual that they are being tracked and that data is potentially going to be used for marketing purposes. Adding a potential additional bonus on top; if there’s a financial gain then that might be an incentive actually for a lot of people; it gives them a little bit more power back. It’s not the whole solution, but I think it’s an option definitely.
36:45 Shilpi:
I think we are still beating around the bush here – let’s go with a yes or a no!
36:47 Sam:
Yes, I think it’s a good idea.
36:50 Susanna:
No. Whether it’s a third party, the retailer themselves or whatever it is, why not go with a model where I pay for their services? If, say Facebook goes into that model where they let me take a monthly subscription of $5 or $10, I’m okay with that.
37:13 Shilpi:
That’s where the research comes in – if that happens, they will make a fraction, a very small fraction of what they’re making today; they will first of all lose a lot of their users, and they are making billions out of the information from targeting ads to us – that they cannot do.
37:47 Susanna:
This also comes down to the poverty line, and that people in different countries don’t have the same economic opportunities, so they cannot afford five dollars a month to go on Facebook – they have other priorities for that money. Maybe it’s better for all of us to move in that direction.
38:20 Shilpi:
There is a lot of value in these services – I’m half way across the world from where I’m from, I’ve left that world for almost half my life, but I’ve been able to connect with my friends there. When I go back to my native land and I get together with them, that’s a wonderful feeling, to be able to reconnect with your loved ones, your friends and family all across the globe. With subscription… who knows?
39:00 Michael:
I agree with both of you because… assume for the moment that third party, whomever it is, says they’re going to manage it; you all now have to pay five dollars or whatever the amount is – but I would push them and say that’s nice but why don’t you pay me? Every time I use your service I’m giving you a piece of my location; my time – how much time was he on, how many times did he speak to his friend in India? They’re getting data from me, so rather than me have to pay a subscription I would have them pay me, because they need me more than I can do without them. We have something here called a telephone, you may not have heard of it, but I can talk to anyone and I pay a telephone bill for that. So while we become accustomed to Zoom, I really believe it needs to be that the individual has the choice and that they could be compensated by vendors and third parties for that opportunity to use their services, because then they do collect data on us anyway.
40:28 Shilpi:
The third party is saying that it’s not a one-time thing – so every week they will pay you based on how much information they have collected – that is my understanding of what I read without signing up on their platform as a user. So it’s something similar to what you’re saying. I think this is a very fascinating discussion, and we could keep discussing this on and on and there wouldn’t be any conclusion to it! I think for me, I feel like even the third parties are not reliable in some ways – what we should have is the model that they have chosen, but I think the middle path – the Buddha’s path! – would be that Facebook decides to pay us, but keeping everything that these third parties are doing, it tells us transparency wise: this is the information I collected on you this week; that is worth five dollars to me; do you want me to sell this information or not – if you want you can delete any information on yourself at any point in time, and I’m okay with doing that.
Not just because once you’ve submitted something or shared something I will hold it forever and use it as I will; I think the middle path would be instead of us paying for subscription to Facebook and lose the connectivity of so many people, Facebook and Google and all the data lakes should be the ones to adopt the model of the third party platforms. I think that is the best way to move forward with this. Instead of us coming up with the platform; instead of the consumers coming up with the number; instead of the third party coming up with the number. And it should always be incremental and the amount should be subjective every year or every month based on what activity you did; how much data was collected; what it’s worth. The transparency and the trust will only be there when we move forward in this direction. What do you think?
43:02 Sam:
That’s a good point. Incrementally you review the data that’s stored, you agree to that and if there’s an option for you to then benefit from that as a consumer then that would be a move forward towards trust and transparency, I think. Consent is obviously the key thing too.
43:32 Shilpi:
And then ‘do not sell’ is an option – do not sell, delete my information; all of those, we should have the choice. So I think this is a middle path of all of us – Susanna said it’s my data, tell me what you have, give me the right to delete it; Sam wanted a third party – so I think with all of our views, I feel like this would be a really good way. At least with Google and Facebook. Sam you mentioned that if you are browsing, then they are going to collect some data on us – that is what is bothering me;
Shilpi: We have come to the point in society where we feel like this is the norm, this is how it’s going to happen – if you’re going to browse on the internet, information is going to be collected on you, and that is okay, that is normal.
I think that is what we have to now change; we have to say that no, that is not normal – I do not want my browsing history to be tracked with a cookie, or if you are going to track, show me what you tracked, and let me be the decision maker of whether I wanted it to be stored, deleted, or paid for. With that, I’m going to wrap up today’s discussion, I think we really hit some good points, food for thought really for ethics-first-minded leaders; leaders who have ethics in their DNA and who are always trying to make the world a better place. We are going to take a two week break for the holidays, so thank you for tuning in and happy holidays from the DataEthics4All entire team. Thank you Michael for joining us today, thank you Sam and Susanna, not just for today but your support for throughout the year, and Michael you too, you are an active community member and you’ve made DataEthics4All what it is today, thank you everyone. Happy holidays!
Join Us in this weekly discussion of Ethics 1stᵀᴹ Live and let’s build a better AI World Together! If you’d like to be a Guest on the Show, Sponsor the Show or for Media Inquires, please email us at [email protected]
Come, Let’s Build a Better AI World Together!
Share:
Written by:
Tags:
``The merit of this is that we can get to these violations or ethical problems sooner`` ~ Shilpi Agarwal.
“I think the bounty system is less damaging and it’s more beneficial. It’s one of the most practical approaches”
~ Shilpi Agarwal
TEST
“Everyone can find a vulnerability that is against their own community, and bring that to the tech companies attention”
~ Susanna Raj
Section
Talk Summary
DataEthics4Allᵀᴹ brings this Series of Weekly Ethics 1stᵀᴹ Live Talks for Leaders with an Ethics 1stᵀᴹ Mindset. Food for thought for Leaders who put People above Profits!! Come, join us for this lively and informative weekly discussion on how to create an Ethics 1stᵀᴹ World with Ethics 1stᵀᴹ minded: People, Cultures, and Solutions. In this Live Talk, we discussed Ethics Bounty Systems.
1:12 Shilpi: Thank you for joining us for this episode of the Ethics 1st live, where we bring food for thought for ethics first leaders, or leaders who put people above profits.
1:24 Shilpi: So today’s topic is a very interesting topic, it’s about the ethics bounty system, so let’s start with what an ethics bounty system is.
2:42 Susanna: Basically, the way I understood it is it’s just basically hunting for bugs, bugs in the code or bugs in a program, or a public website or in an AI model. I mean, it started with websites in the past, and now we’ve seen the AI models too, so you find a bug, or you find a vulnerability in that, and they give you a reward for it.
3:05 Shilpi: Yes, and my understanding is that too. So this ‘bugs for code’, to find bugs in the code, has been there for some time, but now they’re bringing it into the AI systems.
3:21 Shilpi: With AI systems, until you deploy them, you don’t know, not really what bugs its has, but the way it is affecting the audience or the people that it was intended for, and it can cause a lot of harm, as we both know, to the projected audience.
3:42 Shilpi: You cannot know that until you have different perspectives from different people, and so that’s why there is something called the ethics bounty system, where tech companies are coming up with ways to encourage people from different socio-economic backgrounds, gender, races, and just everyone that the software, or the app, or the platform, or the toolkit is intended for, to test it out and report bugs.
4:18 Shilpi: Bugs in terms of, you know, it’s not, ‘the algorithm is not right, the data is incorrect’, it doesn’t necessarily mean the code in this case, it’s about the AI system, right? So why do you think it’s important to have such a system in today’s AI world?
4:37 Susanna: I mean, there are lots of reasons given for that. When you try to find a bug or you try to find an ethics violation from within the team, you have a certain bias.
4:48 Susanna: Just in the same way we are not able to catch our own typos, we cannot catch our own mistakes because we are so embedded in the process itself that we can’t even see what our vulnerability is, and who the other group is that we are discriminating against.
5:07 Susanna: So, giving this to an outside group, or a group of individuals who don’t have that same loyalty to the group means that they’ll be able to actually find it quite easily. They can also be very open and transparent in how they attempt to bring this to our attention. Another great impact that I see is that because you are opening this up to a wider diversity of people, it’s not just, ‘I’m just opening this ethics bounty to only the USA’, it’s all over the world. So, everyone can find a vulnerability that is against their own community, and bring that to the tech companies attention. So I think this is a great idea.
5:47 Shilpi: Yeah, I completely agree with you, and just like you said, when this is being developed, and these AI systems are being developed, nobody develops them with a bad intention, right? It’s sometimes not even possible to think of all the scenarios in which it could create harm.
5:49 Shilpi: So having these different voices, and backgrounds, and diverse voices to be able to contribute to the project that will end with a bounty, it encourages people to spend time on it and find ethical violations.
6:20 Shilpi: So, the merit of this is that we can get to these violations or ethical problems sooner. And then instead of going through the approach of announcing it on social media, or taking the legal route, people can actually reach out to the tech companies themselves and report them, and then the tech companies can take action.
6:45 Shilpi: So it’s a win win, right? Instead of having a PR nightmare, people are helping them to find the bugs, helping them to solve these problems, and reporting it from the diverse backgrounds that they come from. So yeah, I think it’s a great idea and more of it should be implemented. What are some of the great tech companies or examples that you have seen in terms of adopting these ethics bounty systems?
7:22 Susanna: I think pretty much all the big companies now have a programme like this, including Facebook, Apple, Microsoft, Google. I mean, they all have an ethics bounty system, and Twitter is one of the major ones recently, but I think they all have this program in place.
7:40 Shilpi: Yeah. And so Twitter, their meta team, which is their machine learning, ethics, transparency and accountability team, created this recent AI algorithm bounty, and I was reading through this report about one of their algorithms that was initially for the cropping scenario of how image cropping is done, and somebody brought it to their attention that it was favoring the white faces more than the darker ones.
8:08 Shilpi: So even with Barack Obama’s photo, they proved that he was being left out of this frame. But as they created this bounty, and I read through this research, where the prizes were given, and there were so many other issues that came up, and they were awarded for those that were not even intended to surface, nor would they have surfaced unless this bounty system was created.
8:36 Shilpi: So I think it’s a wonderful idea, and now Google has also started implementing it for the Google Play Store, right? So it’s not only the code that they are implementing, they are also providing a bounty for anybody who is able to find a bug in any of their Google Play Store apps, which is the next step.
9:06 Shilpi: Apple has been doing it too – they have these rules for their normal code, which is that you must be the first to report it, and you must clearly explain and show evidence for it, and you can’t disclose it publicly unless Apple gets a chance to fix it, and you can get a bonus if the company reintroduces a known problem and a new patch.
9:30 Shilpi: All of these things are already there. They can easily take this and implement it for an ethics bounty programme for their AI systems, which makes sense. You can’t publicly slash them on social media, tarnish their reputation and get the bounty, right, you can’t have everything – your cake and eat it too. So you first have to report it to them and give them a chance to fix it. Do you want to add anything to this?
10:01 Susanna: So yeah, definitely there is one aspect of that. I mean, they get to see the vulnerability or the bias in the system, and they get to fix it.
10:12 Susanna: But I’m also wondering was there a major ethical violation because of this vulnerability? And did they quickly fix it or patch it up? If that’s the case, does the public get to know the impact of it from when it was already launched? Do they get to know the impact of it? Is there transparency around it?
10:33 Shilpi: That is a good point. So what you’re trying to say is that if somebody finds a vulnerability, and they report it directly to the tech company, and that tech company fixes it, will there be a public report after that? Or will it be just a hush-up and it will be swept under the rug?
10:48 Susanna: Yes, because it could have already impacted some communities – it could be that my data was breached, and it was sold to somebody, but they fixed the vulnerability so I didn’t know about it. So, where is the transparency there? And does the bounty system cover that? Is the system covered?
11:09 Shilpi: That’s a good question. And I think this could be a great question for our audience, as well as some of the tech companies who are coming up with such bounty systems. I guess what we are trying to say is, yes, this system works – It’s great that you are asking for our community help by crowdsourcing to find the problem, right?
11:33 Shilpi: So that is great first step, but then let’s go one step further, let’s not just sweep it under the rug, and because you say, ‘Oh, we’ll give you the bounty and you can’t say anything about it until we get this fixed’, how will this person who has raised this flag know, first of all, that you have fixed it?
11:52 Shilpi: Will you make a public statement about it? Will you let that person know privately that you’ve fixed this and that this is what you have done? And then will you release a public statement announcing to the world that this was a vulnerability that one of the people or some people found and these are the steps we have taken for it? And these are the communities affected and going forward, this will not be done?
11:53 Shilpi: So there needs to be a clear, closed-loop process for this to be a foolproof method.
12:22 Susanna: Yes, I do agree with that. I think that is the next step. I mean, this is a step in the right direction, but we need to move a little bit more further to help bring transparency to any process. Mistakes can happen, I don’t believe that we can be a society without mistakes, in building anything. We build bridges and even they have faults and they crumble and fall down, mistakes happen anywhere.
12:49 Susanna: The process and the transparency around it is what an ethical community, like our community, would demand.
12:58 Shilpi: Yes, and speaking of which, what if we started a database and asked people to report any of these ethical bounty system’s, especially for AI, that they find and also any vulnerabilities that they find?
13:18 Shilpi: I know there are some who do this already, but what if we could do something where people feel comfortable to report this, and then, we are able to work with the tech companies to figure out a way to make sure that this has been resolved.
13:33 Shilpi: So, an independent body that is saying exactly what you touched upon – it cannot just be reported to them and be done with, in that case we don’t know if any steps were taken after that.
13:46 Shilpi: So an independent body like DataEthics4All, per se, or any other independent body, would be the mediator to understand, you know, what were the steps that were taken and were they enough, and act as kind of a regulatory body to understand if it was done exactly the way it was supposed to be.
14:10 Susanna: I think that would be really great to have, because right now we have AI incident reporters and databases that track vulnerabilities and incidents or adverse impacts of AI. There are systems that track that, but there are no systems like this.
14:26 Susanna: There is a bounty hunter, and they find a vulnerability, but then what happens to the impact prior to somebody finding this vulnerability and what happens after that?
14:43 Susanna: If an independent organization can go and build the database or bring some transparency around it, that would be a great service to the public.
14:52 Shilpi: Alright, so you second that we should move in that direction. The last question for today – so you know how in software code, and I know I’m a software engineer and married to another one, there’s always these bugs that are under critical issues that you find in software development. You put them under critical issues, and there are different priority levels, red and orange zones and all of that, right, it’s all color coded, and it’s all different priority levels, and it’s supposed to be critical.If there is a bug in the code, it’s critical.
15:33 Shilpi: So, do you think it should be grouped as a critical issue if there is an ethical violation in an AI system?
15:58 Susanna: Yes, I think it should be. I think we should have a classification, like that, that tells us what are the most adverse impact ones, what are the most critical, and go down the list to the least impactful. Yes, that would be a great idea.
16:14 Shilpi: Yes, I think so too, because we may think that this code is not creating harm, but the bias in AI can cause harm to so many different protected and marginalized communities and people, so we need to make sure that this doesn’t happen. We are all looking for tech regulation, but that’s going to take time. As you know, it’s not a foolproof method to catch everything.
16:42 Shilpi: So, the ethics bounty system does not rely on either bashing the companies on social media or filing for a legal battle, or waiting for a new regulation to take place.
16:58 Shilpi: I think the bounty system is less damaging and it’s more beneficial. It’s one of the most practical approaches to regulating this than we have ever seen and used.
17:11 Shilpi: Like you touched upon, it’s a global system that can be used in non-native English speaking countries where there are things that happen that are swept under the rug, or because it’s not predominantly affecting the United States, not much action is being taken against it. So if we have an ethics bounty system, and if we are able to classify them as critical issues, things that people have crowdsourced as a community, across the globe, I think that is a great step towards moving forward in building the next generation of AI systems that are ethical and transparent, and making sure that the tech companies are accountable. Is there anything you would like to add, Susanna, before we wrap?
18:03 Susanna: Nothing, I mean, I think this is also a call for action – so anyone in the audience who wants to join us in helping build this thing, you’re welcome to come and talk to us.
18:14 Shilpi: Yes, absolutely, and a great call to action, Susanna, thank you for adding that we are always looking for very dedicated and passionate volunteers who are passionate about this mission, who are passionate about the problem and who want to bring a solution. We are not the type who will just talk about the problem, we are solution focused.
So we just touched upon one of the solutions that we would like to implement, and we would love all of your help in coming together as a community in taking this first step. So we invite you to join us, and join us in creating a better ethics first world. Thank you, everyone.
19:05 Shilpi: To join our community, its DataEthics4All.org. Please join our community, and join us for these weekly live talks when we bring food for thought for ethics first leaders every week, Thursdays at 3pm Pacific.
Join Us in this weekly discussion of Ethics 1stᵀᴹ Live and let’s build a better AI World Together! If you’d like to be a Guest on the Show, Sponsor the Show or for Media Inquires, please email us at [email protected]
Come, Let’s Build a Better AI World Together!
Share:
Written by:
Tags:
“There are people in our community who do not understand how the technology works, but trust the technology so much – and I think that is the biggest vulnerability.”
– Susanna Raj
“If we are to rely on tele-health apps, it might be that we’re not only using it for diagnosis but we’re actually using it for informing the dosage as well, and that could could put us at risk.”
– Sam Wigglesworth
Talk Summary
DataEthics4All brings this Series of Ethics 1stᵀᴹ Live Talks for Leaders with an Ethics 1stᵀᴹ Mindset, those who put People above Profits.
In this week’s discussion, we explore ‘The Ethics of Healthcare Apps. What are some Regulations when it comes to for-profit healthcare apps? Vulnerability, Trust, and Manipulation: Key Concepts for the Ethical Evaluation of For-Profit Health Apps, the important distinction between Supportive and Manipulative Digital Health Environments, as well as Health Apps and Unfair Commercial Practices.
We started out by discussing some of the key regulations are when it comes to for-profit healthcare apps.
Transcript
00:32 Susanna Raj:
Hello everyone, welcome to our Ethics 1st Live talk, where we come every week and discuss lively topics surrounding the topic of ethics and how Ethics 1st organizations, applications, companies, people and products can work together to create an environment where ethics is at the forefront of everything we do and think about. Today I am going to be the one hosting – usually Shilpi does this, she had to leave for another event today. Here with me is Sam, and you all know Sam, she is a member of our leadership team and a teacher of languages – welcome, Sam.
1:22 Sam Wigglesworth:
Hi, good evening. It’s great to be here for another Ethics 1st Live event, and the topic’s going to be really fun to discuss.
Sam: We’re focusing on the ethics of applications in healthcare, and we’re going to be looking at regulation, what applications are out there, the vulnerabilities around them and how they could be used in a supportive way – or not, as the case may be!
2:01 Susanna:
That is the topic; we all use healthcare apps on our phone, and even on our watches now – some of you may own a wearable watch like an Apple watch or a Fitbit or any of those. Healthcare tracking apps are on our wearable devices, as well as on our phones, and on our laptops – there are so many things that can track your steps, your activity level, your heart rate. My mom uses a blood pressure machine; that brand has its own app, and it seems after we upgraded to the new IOS, data was being pulled from the tab into the healthcare app and it was automatically gathering all the data from there. It was a little creepy! Then you had to go back to that app and take out that information because it was tracking her blood pressure levels. They have given you all those options where you can and cannot give access to other apps; the other medical apps – but to me this is an area of concern, because now my parents’ medical institution also uses an app to schedule all their appointments, which have been video appointments the last two years. So that app is also there; and Apple is giving me a list of all those apps in the Apple healthcare record and asking, do you want to connect all the data from all of this? I’m just wondering what are the regulations around healthcare apps – Sam, what do you think?
3:52 Sam:
It’s a really good point about monitoring patient data. From my research, I’ve not found that much around specific regulations that govern the data that’s captured on applications, particularly monitoring health data and patient data.
We know that there’s a significant amount of legislation in place in the UK and Europe when it comes to data protection – the Data Protection Act in the UK and GDPR in the EU – but I feel from what I’ve seen that there isn’t significant rigorous legislation that covers this, and it’s a grey area.
Sam: While we focus on security and data security, we’ve actually focused very little on bioethics and data. There’s a gap there, I think.
4:56 Susanna:
That is what I also found out; there’s the GDPR as you said, and all of those regulations cover personal data and privacy, but in terms of healthcare, these healthcare apps aggregate the information they have on you to create a health profile of you.
They are accumulating and aggregating information from different sources to say if you haven’t walked this many steps; if you haven’t slept this many hours; if you haven’t drank water, if your blood pressure is low – whatever it is. It’s giving you information and trying to tell you whether you are a healthy person or an unhealthy person or on the borderline, so it’s actually giving you medical information; medical feedback.
Susanna: That is such a very concerning thing to me, because if I am getting this feedback, I may decide to give it the same validity as a doctor or a health institution – many people do that, and that to me is very manipulative in a way; it is not actually very supportive of me.
I think we have a few comments here – there’s a LinkedIn user saying there are examples of sensors in your shoes also sending data – oh my goodness, shoes! I haven’t seen that, but yeah, that could track how much pressure you are putting on the ground and whether you are using your heel or the front of your foot – I could see use cases for that. People who walk putting more pressure on their heels may not be walking at the right posture, and all of those things are there – but what I am concerned about is how much this feedback influences us as individuals where we are internalizing all of this information and thinking that this is validated information coming from a knowledgeable entity like a physician or a medical institution. That to me is the point that requires more regulation.
We have another couple of questions that Shilpi usually has written out for us – what are the key concepts of the ethical evaluation of for-profit health apps? So, in terms of for-profit health apps; all of them I think are for-profit, I don’t want to name all names, but all of those health tracking apps and devices that are being introduced into the market are all very for-profit; our medical institution is also for-profit – that is my opinion, it’s not a non-profit thing! But we have so many stringent regulations on how medical services should be distributed, but that kind of regulation is not there for the for-profit health apps. What do you think, what are the vulnerabilities?
8:54 Sam:
I completely chime with what you’re saying. I think from a medical perspective if you’re working in the public sector, data is very much secured internally if it’s patient sensitive, but when it comes to commercial apps the vulnerabilities exist for users across different age groups.
Sam: I think one of the key vulnerabilities is that actually as users we all have apps on our phones, on Internet of Things devices, that we use on a daily basis that are stored on cloud servers through our mobile devices, and they’re at risk – that’s the vulnerability.
They could be exposed (we’ve talked about this before in previous discussions) to malware, or somebody may be having access to that data if they wish to. We do often find that we lose this information. IoT devices can cause risks and harms, and we’ve got to be aware of that and also the fact that data could be then utilized by third parties without permission. They’re the main vulnerabilities. Particularly when you talk about your parents as well, I know that there’s tracking of data of vulnerable people and patients, and I think we just need to be very careful that we are aware of just how much is being utilized and stored.
10:38 Susanna:
One critical area for vulnerability is that of data being leaked out and being violated, but then the other vulnerability that I see as a user who lives with elderly parents is that they trust the information so much.
They trust it so much more than I do! When your Apple watch tells you that your heart rate is going up or is going down, they trust that more than what they are actually feeling. They also feel like ‘oh, something is now wrong with me’ – so it’s like bio-feedback to them, without knowing that it could be a glitch; it could be that these devices are not so accurate in how they track movement; when you move your arms up it can show a spike in your heart rate. There are people in our community who do not understand how the technology works, but trust the technology so much – and I think that is the biggest vulnerability. We have another LinkedIn user here who is saying that ‘the consent comes at device setup, but it seems genuine consent is unrealistic – what are you going to do, say no and be unable to use the device?’ Yeah, of course, that’s the thing: it asks you to opt in or opt out, and when you opt out you are essentially locked out of the device, you are not allowed to use it.
12:37 Sam:
It’s a very good point that you made. I read a really interesting paper earlier from NIH (National Institutes of Health), and they were discussing the fact that in the past what we often did was search online about our health issues, but now we have an application that replaces that. But obviously with that comes the capture of data, and we have a significant number of data points now, because there are many apps. There’s a market, as you said earlier; there’s a commercialized arm to it, and I think we have to be very aware of that.
Sam: We want to diagnose things, we want to know a little bit more about our health, and I think applications and searches online sometimes become almost like advice. The real danger is if we take that as a diagnosis and it’s not accurate. We have highly trained qualified professionals, and that’s not something we can replace.
14:09 Susanna:
One of our commenters is saying that ‘the terms and conditions generally say ‘we are not medical providers and this should not be treated as medical information’, but the thing is when you see this information then you go and bother your medical professionals, and you go with a false positive and you overwhelm the system’. Then there is a cascading effect that comes from not having that trust – my device says this but you say it’s okay to ignore that – what is happening to me? All that stuff now happens a lot. Also, there is manipulation that goes back and forth, because this is a predictive analytic which is telling you that based on this data, we are predicting that this is going to happen; or if you don’t accumulate this many hours of sleep, this is going to you know affect your mental health or your physical health – that is another level of manipulation, I think. This is part of surveillance capitalism – that is a term that is being used now to say that there are all these healthcare for-profit apps that are out there with capitalism in mind. That is the manipulation to me; I am being manipulated by all of these data points; instead of me using the technology, the technology is telling me how I should shape my day – and that is that is a manipulation, right? And that is psychologically changing the whole community, I think. What do you think? Do you feel you are being manipulated by all the healthcare apps – is it just me?
16:01 Sam:
No, I think you make a really good point. You mentioned surveillance capitalism, and we all know well Zuboff’s publication on that, and I think it’s important to understand that as with social media, our data is a commoditized good; I do often feel that when I use a wellness app or other applications they can be sometimes a little intrusive, and I think you have to almost start managing it. It can become a little bit addictive where you start to track your activities more based on feedback, and I think it can affect your behavior. It’s a really good point that we shouldn’t be using that as a diagnosis tool – we know that sleep is good for us, we know that eating well and drinking lots of water is good; we need to be aware of our own health, but using these apps is not a replacement for that. But yeah, you do find that it will sometimes change the way that you think about your own health, and that’s not a positive thing.
17:39 Susanna:
There is a LinkedIn user asking a question – will the apps sell your data to insurance?
17:46 Sam:
For all third parties, if your data is available to be sold, then there might be a market there, What do you think Susanna, is it something that you feel is a risk?
18:13 Susanna:
That is potentially a risk, and there are no laws in place.
Susanna: The HIPAA (Health Insurance Portability and Accountability Act) protection laws say that you cannot share this information to your insurers – but what about apps that are being developed and put on the app platform by insurance companies?
Susanna: I don’t know whether that is another area that we need to look at, because I do know that in America here we have Kaiser, we have Stanford, and all of them have developed apps, and they are putting them on android, apple, IOS platforms. But will personal data be actually connected to your medical record? I think the answer is no – I think that at least is still good, but it’s a marquee area that you could change. There is another comment that I think was related to HIPAA – ‘HIPAA requires some notice, but there is not a lot of genuine thought around whether the info in the notice is actually helpful or represents a choice – have you ever been to a dentist and said “no thanks, I don’t want to sign to say I saw the policy that I didn’t really see”‘.
Susanna: Yeah, with all those consent forms, I really doubt that people are actually paying any attention. What I am worried about is the behavioural impact of all of these healthcare apps.
20:18 Sam:
I would add to that: I do think often when it comes to consent – and we talked about this before – whether it’s surfing online on a website or downloading an application, I do think a move forward would be to be quite explicit about what data would be shared with that particular third party. I think having a disclaimer available that’s really clear will give us that transparency which is what we want. You’re right, terms and conditions are not clear and we do often tick without reading.
21:05 Susanna:
And we don’t even check it when we’re at the doctor’s office – if you are in a doctor’s office you are already under stress, I don’t think you are bothering to read that document very well! A LinkedIn user is saying: ‘do the kind of people who use such apps have a higher likelihood of being active/otherwise; therefore not representing the general population and setting incorrect metrics for future use?’ Yes, that is convenience sampling; a self-selected population.
Susanna: Let’s say I am going to install a healthcare app that tracks my steps that’s available to everyone, but I’m somebody who’s more worried about my health – I am self selecting myself for the study. I might be actually giving you the wrong metrics, because not everyone who is leading a sedentary lifestyle installs that step checker.
Also, the app itself manipulates you to become more active. Here’s my personal story: my step tracker tells me that in 2020 I didn’t move at all! That was when the pandemic hit. I’m wondering whether that is reflective of the general population, I don’t have that aggregate data. When this tells me I didn’t move at all, I tend to feel like: ‘Jeez, I didn’t move the whole year, what was I doing, sitting all the time?’ But I don’t know if that was that same for the entire world; probably everyone was more sedentary. So it is actually making me feel a little guilty but if I had that aggregate information maybe I would not feel so guilty.
23:40 Sam:
I do think though that with particular applications, whether it’s your Fitbit or your Apple watch or whatever, you do find that the data is presented to you in a way that is often going to try encourage you to be more active. I do often feel that you do get put under pressure a little bit, and you don’t need that when you just want to just go out for a walk and enjoy being outdoors.
24:26 Susanna:
Yeah, if your goal is 2000 steps and you see you’ve only done 1500, you just run around for another minute just to get it to that arbitrary number, without actually making sure you enjoyed the walk – that’s enough, why am I trying to set to an arbitrary number now? Another LinkedIn user is noting here that a friend identified a trend where his blood pressure rose every day around the time he checked his blood pressure!
25:17 Sam:
Yeah, that makes sense. You do find that during holidays when you might be more sedentary and not as active that you’re not checking as much, you don’t see yourself looking at the latest feed – so it’s good to sometimes switch off from that and take a take a break from it.
25:47 Susanna:
There’s actually a well-established finding that in doctor’s offices your blood pressure is high – they actually test you twice or three times if it’s too high; for my mom it’s very high. That ‘white coat syndrome’ – even after coming to the doctor’s office and relaxing there, she would get that high blood pressure show up.
Susanna: That is a common trend for most of us, so I think now during Covid we all have not only a blood pressure machine machine, an oxymeter – it looks like a doctor’s office now, and we get into this craziness thinking ‘oh, I can find out what my oxygen saturation is!’ but in reality it’s better to see if you are a healthier person, and if you are able to breathe and do all of that then you don’t need to check your oxygen.
26:50 Sam:
Yeah; I think having something that can give you a little bit of information on the number of steps you’ve taken is okay, as long as you have that information about general health. You can go out outdoors for example and have a break without having to use an application to do it.
27:45 Susanna:
So what do you think is an unfair commercial practice when it comes to healthcare apps?
27:54 Sam:
I think an unfair commercial practice might be your data being sold to a third party because there’s a market value and that being then used to diagnose things. Certainly unethical in my eyes – our health data should be primarily protected. We talked about bio-feedback earlier, but the data that’s tracking us could be utilized to other things, not just for marketing purposes, but also to change the way that we behave.
28:54 Susanna:
I think one area where I hope it’s not coming into practice is the area of the pharmaceutical industry being tied to the healthcare app industry.
Susanna: Right now we have that on the televisions – there’s a lot of ads here, I don’t know how it is in the UK – but here all the new medications will be first shown on the TV. If there’s a new medicine for diabetes; if there’s a new beta blocker, there will be a very expensive ad campaign for it showing how it is going to help you improve your life. It has a story-like presentation and appeal; it almost looks like a PSA and then at the very end in a very fast, 2x speed paragraph they will talk about all the side effects of the new drug and also the unproven data points of that drug – but that comes at the very end, and it’s very fast so you can’t even really grasp it. The whole ad is so melodramatic and you feel like you will have this glorious life if you take this new drug, and you will be relieved of your symptoms. That is there in the television industry now, but what I’m wondering is: what if all these healthcare apps have a tie-in with the pharmaceutical industry? They could market it directly to the people without the middle man of the physicians. I don’t know if it is there already – I haven’t seen any example of that in the healthcare industry, but it could be an unfair healthcare practice, in my opinion.
30:50 Sam:
I recognize that, definitely. Dosage is one thing that was picked up earlier by one of the papers I was reading – if we are to rely on tele-health apps, it might be that we’re not only using it for diagnosis but we’re actually using it for informing the dosage as well, and that could could put us at risk.
31:22 Susanna:
Mahesh R. raises an important point here, they say: ‘I think they might do’ – in response to our prior discussion about apps selling information to the insurers – Mahesh thinks they might do that: ‘taking away the private information and sell just the metadata’. What do you think about selling just the metadata – is that okay? If it’s not individually connected to you, would it be okay to have this information sold to an insurer, and the insurance company is making an aggregate decision based on that? For example, your geographic area – would that be okay? I don’t think so.
32:23 Sam:
This is a really interesting discussion; first of all: metadata, we have to define that as opposed to PII (Personally Identifiable Information), which is absolutely out of bounds. What is metadata? We’ve discussed before – it could be not just names and ages, but also other demographic information, and that could then lead to targeted advertising; products being targeted to you that you maybe don’t need or want. It’s an additional stress, particularly on vulnerable people, and if you haven’t got the right information to make the decision it’s a lot of pressure. We’d have to define what metadata is, but certainly we have to be very careful.
33:14 Susanna:
And it could be from a very low sample size, and you could be making this generalized predictions that may not generalize to the entire population, so those kind of things are there in the use of metadata, but unless your metadata has a very large sample size, on a national or a global level, I don’t think so. I don’t know if they do that – that is something we’ll have to look into.
Susanna: But I think as of now from what I read in preparation for this talk, GDPR and the regulations that are here in America do not allow healthcare apps to sell these data to insurance providers – that’s the conclusion I came to, but I could be wrong.
Susanna: If somebody has more information on any of these topics, please feel free to come and let us know! You can reach us at https://dataethics4all.org, and you can even reach us at all of these channels – LinkedIn, Twitter and Youtube, come join our community and let us know how we can use your knowledge to make sure that everyone is well informed on all of these topics. Thank you for joining us, and thank you for a very engaged audience here!
35:20 Sam:
Thank you all for joining us for this particular talk, it’s been a really fruitful and really interesting discussion. We’ve got lots more to talk about, so please join us come to our community, join us as a member and go to dataethics4all.org if you want to find out a little bit more about what we’re doing. Thank you everyone!
Join Us in this weekly discussion of Ethics 1stᵀᴹ Live and let’s build a better AI World Together! If you’d like to be a Guest on the Show, Sponsor the Show or for Media Inquires, please email us at [email protected]
Come, Let’s Build a Better AI World Together!
Share:
Written by:
Tags:
How Can Tech Giants Using Biometric Data Be GDPR & CCPA Compliant?
RESEARCHER
Humairaa Patel
PRINCIPAL INVESTIGATORS
Shilpi Agarwal, Susanna Raj
DESIGNER
Ayomikun Bolaji
The guide provides advice for tech companies on how to become GDPR and CCPA compliant as well as recommendations on how to further enhance the ethical use of data in line with the 12-pillar framework outlined by DataEthics4All.
The focus is on the use of biometric data by the five largest technology firms: Facebook, Amazon, Apple, Netflix, and Google. The guide aims to inform tech firms of the steps they should take to be legally compliant with regulations (GDPR) and state law (CCPA) as well as raise awareness for customers about the rights they are entitled to exercise as data subjects. DataEthics4All recommends tighter rules, particularly in the event of a breach where existing GDPR regulations allow firms 72 hours to inform subjects of the breach without any rules on subsequent action.
DataEthics4All believes it is important that GDPR rules require firms to issue clear action and notices on what they will do to resolve the breach and/or compensate affected consumers, particularly in the case of biometric data.
Contents.
Executive Summary.
GDPR vs CCPA.
GDPR is a transnational measure.
GDPR has a Global effect.
Both GDPR and CCPA aim to empower consumers over their own data.
Data encryption is not mandatory for both GDPR and CCPA.
GDPR covers data privacy at the consumer level including 3rd party data providers who sell data for marketing such as marketing research, mailing lists, etc.
Data breaches and GDPR violations may result in financial penalties equivalent to four percent of the company’s annual revenue or approximately $20 million.
In Europe, they can begin with the determination of companies engaging in risky practices.
CCPA is a state law.
CCPA applies to firms operating in California or use the data of Californian residents providing they meet the three requirements.
Both GDPR and CCPA aim to empower consumers over their own data.
In CCPA violations, companies can expect a maximum of $7,500 per incident, but there is no limit on the number of violations that can be assessed.
CCPA focuses more on the first party owned data and not necessarily 3rd party data providers.
Data encryption is not mandatory for both GDPR and CCPA.
In California, incidents are considered to start at the time data is breached.
Readers of this guide will be able to see how the GDPR and CCPA work within the DataEthics4All framework.
Readers will be able to see GDPR and CCPA rules for biometric firms.
The guide includes DataEthics4All’s recommendations on where the law needs to extend further.
Issues with the GDPR and CCPA rules, where it doesn’t go far enough.
Recent trends in Big Tech firm fines.
Guide Outcomes.
Data Privacy/Security.
How can companies preserve Data Privacy?
The GDPR article 25 places responsibility of Data Privacy with the data controller. When processing data the GDPR requires implementation of appropriate technical and organisational measures such as pseudonymisation and to implement data-protection principles, such as data minimisation, as well as integrating the necessary safeguards into data processing.
METHODS TO DO THIS ARE:
THE GDPR OUTLINES MEASURES TO ENSURE SECURITY:
1.
2.
3.
4.
Security of processing data must be ensured, particularly in biometric data. This is because once leaked, the associated risk of data misuse is extensive as hackers can gain valuable data unique to individuals. Unlike passwords, biometric data cannot be changed and therefore leads to the possibility of people’s personal identity being in constant jeopardy.
CCPA Protection
Under the CCPA consumers have the right to sue over a loss of privacy resulting from a data breach.
Notification of a Personal Data Breach To The Supervisory Authority.
The GDPR allows firms 72 hours after having become aware of a breach to notify the supervisory authority.
In the event of a breach the controller/processor must:
1
Describe the nature of the personal data breach including where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned.
2
Communicate the name and contact details of the data protection officer or other contact point where more information can be obtained.
3
Describe the likely consequences of the personal data breach.
4
Describe the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.
Communication Of a Personal Data Breach to The Data Subject.
If the breach results in a high risk to the rights and freedoms of natural persons, the controller must communicate the personal data breach to the data subject without undue delay. The company must describe in clear and plain language the nature of the personal data breach.
THE CONTROLLER DOES NOT HAVE TO COMMUNICATE THE DATA SUBJECT IF:
DataEthics4All believe this is an inadequate rule which places a significantly low obligation on firms when data breaches occur. The consequences of data breaches can impact consumer of tech for long periods and therefore there ought to be stricter rulings beyond mere notification.
First, the 72-hour notice period is unnecessarily lengthy. Technology has rapidly developed and hence firms would be easily able to provide notifications within a shorter time frame.
DataEthics4All recommends a maximum 24-hour notice period. The legal obligation on tech firms using biometric data should extend to informing specific customers how they were directly impacted by the breach, with details of what data was affected and how. As well as that, the company should also outline what action they are taking to rectify or address the issue in line with compensation.
Transfers of personal data to third countries or international organisations have some regulatory restrictions.
A transfer of personal data to a third country/international organisation may take place if the Commission has decided that the third party (third country, a territory or one or more specified sectors within that third country, or the international organisation) in question ensures an adequate level of protection, then such a transfer shall not require any specific authorisation.
DataEthics4All thinks that this transfer should require authorisation by a supervisory body. This prevents the ease of spreading data to third parties.
Data controllers/processors can still transfer the data to a 3rd country without a Data Protection Implementing Act (DPIA) from the Commission if they have provided appropriate safeguards and on condition that enforceable data subject rights and effective legal remedies for data subjects are available.
Data Processing.
How Can Companies Ensure Fair Data Processing?
GDPR Article 5 and 6 outlines principles firms must adhere to when processing the personal data of customers.
Personal data must be processed:
DataEthics4All recommends that this is taken to the next level, the protection needs to come with compensational measures for customers in the event of any unlawful processing or loss of data.
Be collected for a:
a) specified
b) explicit and
c) legitimate purpose not in a way that’s incompatible with those purposes
However, the GDPR introduced a limitation on the tech industry. Biometric data under the GDPR comes under a special category of data and is defined as “personal data resulting from specific technical processing relating to the physical, physiological, or behavioural characteristics of a natural person”. Processing of such data is strictly prohibited.
DataEthics4All defines Biometric data as the unique, permanent, and collectable measurements of the physical or behavioural characteristics of an individual.
Although there are few limited and restrictive exceptions to this rule.
BIOMETRIC DATA CAN BE USED ONLY:
DataEthics4All recommends that the least intrusive type of data should be used and then consideration ought to be given to the securitisation of that data. Firms should choose the least intrusive and most secure.
Before implementing a system that processes biometric data, organizations should assess whether they can rely on an exemption to the GDPR’s prohibition to process biometric data. Big tech firms fall under the exception of being able to use the data as it is within the data subjects’ interest to protect their personal devices such as mobile phones.
ART. 13 OF THE GDPR REQUIRES THE FOLLOWING INFORMATION TO BE PROVIDED WHEN PERSONAL DATA IS COLLECTED FROM THE DATA SUBJECT:
Purposes of the processing for which the personal data are intended as well as the legal basis for the processing.
Identity and the contact details of the controller.
Contact details of the data protection office.
Legitimate interests pursued by the controller or by a third party.
Recipients of the personal data.
The fact that the controller intends to transfer personal data to a third country.
Once the data has been collected, data controllers need to ensure fair and transparent processing and provide the data subject with details on how long the data will be stored for. The regulation empowers customers with the right to request access from the controller for rectification or erasure of their data or restriction of processing concerning the data subject or to object to processing.
An area which requires greater scrutiny is a change in purpose for data processing.
DataEthics4All recommends that a fixed period of at least 1 month is given to consumers to consider any new changes to data.
CCPA and Data Privacy.
Overview of Required Notices:
Notice At Collection of Personal Information:
Firms must provide customers with a timely notice either before or at the point of data collection. The notice should be plain, straightforward avoiding legal jargon in a format that makes the notice readable and accessible for those with disabilities.
In the event a firm is collecting personal information from consumers mobile devices for a purpose not reasonably expected, the firm must provide a just in time notice.
DataEthics4All recommends the legislation should require firms to provide advance notice so consumers have time to think about whether they wish to provide consent.
Businesses must provide notices of all data and categories they will collect. They must not collect data for any purpose without issuing a notice.
DataEthics4All – The CCPA appears to be very notice heavy but has little on Data Minimisation, it appears to allow firms to collect any data if they issue a notice to the consumer.
When issuing a notice, firms must provide a link to their privacy policy.
Data Ownership.
How can companies demonstrate clear Data Ownership?
CCPA.
The privacy policy must be posted online through a conspicuous link using the word “privacy” on the business’s website homepage or on the download or landing page of a mobile application.
THIS SHOULD INCLUDE:
Customers hold the right to request deletion of personal information, the right to opt-out of the sale of personal information and the right to not be discriminated against.
Businesses must respond to your request within 45 calendar days. They can extend that deadline by another 45 days (90 days total) if they notify you.
45
calendar days
Netflix has been considering an enhanced use of customer data from its streaming services. It is suspected that this will involve analysis of users’ emotional behavior to understand their response to films. For instance, if any scenes from films were replayed or skipped and how frequently. Owning such data would reveal substantially unique information about specific individuals which raises concerns about how such vast volumes of data would be secured by the streaming platform.
Data Consent.
How can companies ensure they have explicit Data Consent?
As per Article 7 of the GDPR the data controller should be able to demonstrate that the data subject consented to the processing of their data. Consent is a highly contended area as often consent is obtained easily by tech giants within extensive and lengthy Terms and Conditions forms.
The GDPR aims to address this issue. It requires that in the event the data subject’s consent is given in the context of a written declaration concerning other matters, the request for consent shall be presented in a manner which is:
While the above appears to be a reasonable requirement, if a notice breaches such terms, the only consequence for firms is that the declaration is not binding. However, DataEthics4All suggests that this ought to be taken further. Many consumers of tech are unaware if a declaration is binding or not. Instead, if a firm uses a declaration in breach of the regulation the consequences should be more severe, the data subject should be made aware of the breach and consent ought to be re-obtained within a certain timeframe with firms highlighting the change explicitly. This will enhance accountability of firms as well as ensuring data subjects are fully aware of how their data is being used.
Data subjects also have the right to withdraw consent at any time and firms are required to make this easy for data subjects.
A more thorough assessment needs to be made when considering if a data subject freely consented to use of their biometric data. This is imperative as biometric data, unlike other data types, is completely unique to the individual and unchangeable, therefore, a breach could result in disastrous consequences for customers. Hence, stricter guidelines are needed when analysing if large tech firms have simple procedures in place for customers to opt out, with fines in place if they fail to do so.
CCPA and Data Consent.
The CCPA issues specific guidance on how firms must clearly inform consumers how to opt out of data collection initiatives. This includes clear links labelled as ‘Do not sell my personal information’ and instructions on how to submit preferences. The notice must also include a description of the customers right to opt out of the sale of their information.
DataEthics4All believes customers should have the option to opt out of other data collection methods other than selling info to third parties. This is because consumer consent is central to any data usage by large tech firms. Biometric data may only be used in limited circumstances under the GDPR, and users are entitled to have full autonomy on how their data is used.
Data Control.
How can companies be prevented from taking excessive control of Data?
The GDPR’s guidance on data minimisation and storage is one of the ways firms can prevent excessive use and control of biometric data.
THE DATA MUST BE:
CCPA Rights of the Subjects.
The business purposes for collection
Whether that information is sold, and for what business purpose
The third-party recipients of the data
To access their personal information
To equal service and price, even if they exercise their privacy rights
To know what information has been collected and the sources from which that data was collected
To know what information is being collected about them
To know if their personal information is sold or disclosed, and to whom
To say ‘no’ to the sale of personal information
Amazon’s introduction of the new biometric palm print scanners, Amazon One allows customers to pay for goods in stores by waving their palm prints over a scanner. The scanner can capture intricate details of the palm from lines and ridges and vein patterns. The indefinite storing of a palm signature as such provides Amazon with great control over the data. The data is only deleted if the feature is not used for two years.
DataEthics4All believe this time frame gives Amazon control over data for a longer period than necessary and instead should be reduced to a maximum of 1 year.
Transparency.
How can companies remain transparent and maintain the trust of data subjects?
Article 12 of the GDPR outlines the requirements surrounding transparent information and communication.
THE DATA CONTROLLERS NEED TO:
Further ways firms can maintain the trust of data subjects is through article 15 of the GDPR.
COMPANIES SHOULD INFORM CONSUMERS OF:
Financial Incentive Notices.
A BUSINESS NEEDS TO INCLUDE THE FOLLOWINGIN ITS NOTCIE OF FINANCIAL INCENTIVES:
1
A succinct summary of the financial incentive or price or service difference offered
2
A statement of the consumer’s right to withdraw from the financial incentive at any time and how the consumer may exercise that right
3
A good-faith estimate of the value of the consumer’s data that forms the basis for offering the financial incentive
4
Document a reasonable and good faith method for calculating the value of the consumer’s data
Transparency in the biometric sphere is imperative. Data breaches by large tech firms, for instance by Facebook in 2010, inspired mistrust within its community of users. The social media giant began automatically tagging people in photos using a tag suggestion tool, by scanning a person’s face via facial recognition and offering suggestions as to who that person is. The breach went even further as ghost profiles were created for individuals who did not have Facebook accounts. While the option to turn off the setting was available, users had not consented to activating the feature.
The controversy forced Facebook to introduce the following changes to increase user autonomy.
A FEW THINGS TO HELP GIVE YOU CONTROL:
Conclusion.
Issues with the GDPR and CCPA.
The GDPR and CCPA rules do not include substantial reference to pillar 3,8,9,10,11 and 12 of the DataEthics4All framework.
Recent Fines incurred by FAANG.
Facebook was fined $5bn by the Federal Trade Commission (FTC) for giving app developers Cambridge Analytica access to 87 million users data without clear consent. The Information Commissioner’s Office (ICO) considered this to be unfair processing of data as those who had not downloaded the app, but had friends that did, also had their data shared. The tech giant failed to secure customers personal data as it did not carry out suitable checks on third parties who were using its platform.
The Irish Data Protection Commission has launched an investigation into a data leak in which data of 533 million people from 106 countries was published online on a hacking forum earlier in April 2021. The DPC indicated that the evidence suggests more than one of the GDPR regulations have been infringed.
Amazon has been fined $886.6 million for breaking GDPR rules. At present it is unknown what breach has occurred, but a spokesperson from Amazon claims no breach has occurred and that customer data has not been leaked to third parties.
Google was fined £44 million by the regulator for ‘lack of transparency, inadequate information and lack of valid consent’ for advert personalisation. It was held that people were insufficiently informed about how Google collected data to personalise advertising. The Group argued that the firm had no valid legal basis to process user data for advert personalisation.
The fines incurred by the major tech firms appear to have an underlying theme of processing data for a purpose customers have not consented to or failing to secure the data adequately which results in a data breach and unlawful third party access to data where it is then misused.
KEY BREACHES:
CONSENT
UNFAIR DATA PROCESSING
DATA SECURITY
TRANSFERS TO THIRD PARTIES
PRIVACY
DataEthics4All
JOIN US.
Keep in touch with the latest in Data Ethics, Privacy, Compliance, Governance and Social Corporate Responsibility.
Join Us