Privacy

Introduction

Open data programs enable the release of government data in reusable formats under open licenses. They also seek to make data findable and interoperable so as to maximize their reuse both alone and in combination with other data. However, tensions arise when datasets include private or sensitive data. 

The first State of Open Data chapter on Privacy released in 2019 discussed how open data programs tend to exclude personal data from being released as open data. It also noted the risk individuals run of being re-identified from their data, even when it has been anonymized. The deliberate release of personal information in certain types of records, such as from government registries and court decisions, was a privacy concern raised in the chapter, as was how digitization shifts and amplifies privacy risks. 

Four years on, these issues still remain current. To take the analysis a step further, this update to the State of Open Data report considers them in the context of the growing demand for access to a broad range of government data. With a burgeoning digital and data economy, there is growing pressure on governments to provide access to public sector data to stimulate innovation.¹ This ever-increasing demand for access to public sector data generates at least four clear privacy challenges, each of which is discussed in depth below.

Re-identification Risk 

Widespread practices of combining data from multiple sources increase the risk of re-identification of individuals who have been de-identified in particular datasets.² Even if open data is not related to specific individuals, it can still be used in combination with other data, whether open or privately held, either to re-identify individuals in de-identified datasets or to profile individuals. This enhanced risk of re-identification from combining data from multiple sources is sometimes referred to as the ‘mosaic effect’.³

For example, open aggregate geo-demographic data can be used to draw inferences about individuals who are matched to specific geographic areas through data from other sources containing names and addresses.⁴ Such practices are common, for example, for direct or targeted marketing. 

Profiling of individuals has received heightened attention since the Cambridge Analytica scandal heightened public awareness.⁵ Profiling can have diverse impacts, depending on who is doing the profiling and for what purpose, and can adversely impact both privacy and human rights.⁶ But it can be problematic to use such concerns as an argument to restrict access to open data that can have a wide range of beneficial uses - open data and privacy are not necessarily opposing concepts.⁷ Instead, these issues highlight the need for robust data protection laws,⁸ for data governance frameworks,⁹ and for ethical approaches to AI and analytics.¹⁰ They may also require a greater role for the use of privacy-protective technologies.¹¹  All of these issue areas have seen a rapid growth in interest and activity, because ensuring that data governance frameworks are in place is a task directly adjacent to open data.¹² 

Increased Demand for Public Sector Administrative Data Access

There is growing pressure on governments to provide de-identified human-derived data as open data.¹³ Governments collect a large volume of administrative data¹⁴, often containing personal data. This data has significant value – for transparency as well as for innovation purposes, including the development and training of AI systems for use in government and in health care.¹⁵ 

As noted in the previous section, while such data could be made available as open data if anonymized, there are concerns about the risk of re-identification. Such concerns have created pressure for governments to look beyond open data portals to other models of data governance for sharing public sector data.¹⁶ These can include ‘data trusts’,¹⁷ which are legal structures that provide independent stewardship of data or so-called safe-sharing spaces.¹⁸ 

There are, however,  drawbacks to these non-traditional data governance arrangements. For example, they tend to be more complex and more resource-intensive than regular data portals. Access to data via alternative governance mechanisms may also be limited to certain actors and may be referred to as ‘semi-open data’.¹⁹ In addition, providing public sector data through such data governance infrastructures raises important issues about public engagement, ethics, and the communal benefits from data sharing and use.²⁰ 

Another thing to consider is that building and maintaining such infrastructures is likely to be resource-intensive, raising the question of whether they might draw attention and resources away from conventional open data portals. This means that robust de-identification and/or anonymization techniques will be required, and ethical data use frameworks, oversight, and enforcement will be important considerations.²¹ 

Open Government Information and Enhanced Privacy Risks

Data mining and data extraction processes, along with new uses of data, exacerbate privacy challenges in the case of open government information that contains personal information (such as court decisions and registry information). Although this is not open data under the conventional definitions, contemporary technology easily allows personal data to be harvested from these documents or registries. In this sense, they become open sources of government data, and this can raise significant privacy concerns. 

There are several examples of such data-harvesting practices. Some involve the scraping of court decisions from court websites, as well as from websites that provide more global access to court and administrative tribunal decisions, which are usually de-indexed to prevent them from being searchable by name.²² The following example from Canada illustrates the vulnerability of personal information published online by government entities or by courts. It also highlights the global nature of these forms of data extraction with the resulting challenges for legal recourse. In 2017, Canada’s Federal Privacy Commissioner obtained a court order against a company based in Romania that scraped Canadian court websites in order to create a fully web-searchable database of court decisions.²³ The company’s activity led to multiple complaints from individuals who found that their names, alongside often detailed personal information, had become easily searchable online. The website operator also charged significant fees to individuals who sought to have their personal data removed.²⁴ The Canadian court ordered the website to remove the decisions, although the enforceability of the judgment depended on the cooperation of Romanian authorities. 

Data scraping thus creates important privacy risks, which, in turn, may create a tension with the desire to maintain transparency with respect to courts and legal proceedings. Similar issues can arise with other forms of open government information online, including registries. For example, the global corporate transparency organization, Opencorporates²⁵, creates and maintains an international database of corporate ownership to facilitate transparency at a global level. Where data is not readily available as open data, the organization scrapes it from online public registries, including one in Quebec. When the Quebec registry changed its terms of use in 2016 to prohibit data scraping, OpenCorporates stopped scraping to update its data. However, it went to court to resist demands by the Quebec corporate registry that it delete previously scraped data.²⁶ A Quebec court declared that OpenCorporates could not be compelled to delete this data as there had been no earlier prohibition on their acquisition through scraping.²⁷ Nevertheless, the underlying assumption in the case seemed to be that if a website’s terms of service prohibit scraping, data cannot legally be scraped.²⁸ 

It is worth noting that in the OpenCorporates case, the database contained the names of individuals linked to corporations, which was arguably not personal information as much as it was information about those corporations. This shows how restricting data scraping of public registries or documents can limit transparency and other important goals of open data. Yet, because there are also serious risks to privacy from the scraping of some government information, the solution may lie in appropriate governance of open government information. This may mean favouring transparency over privacy in some contexts, and taking steps to protect privacy, perhaps through a combination of terms of service, redactions and other privacy-protective technologies, in other contexts.

Collective Privacy

Ordinary notions of privacy focus on the rights of the individual and the impact on individuals of intrusions upon their privacy – or in the case of data protection, on the collection or use of personal data without the data subject’s consent and/or in manners that may be harmful to them. Collective privacy is concerned with the collective harms that may be experienced by groups or communities when human-derived data – even if anonymized – is used (or misused). Large datasets are increasingly used to power AI and analytics. Where these datasets contain human-derived data, their uses may have a number of different impacts. Human-derived data may be used to profile groups or communities, resulting in adverse impacts both for those groups and for individuals within them.²⁹ Possible harms include biased results, privacy invasion, surveillance, and a lack of algorithmic transparency.³⁰ For example, human-derived data might be used by city planners to determine which neighbourhoods should receive more (or fewer) resources. They might be used in decisions about the deployment of police, to profile individuals with certain communities as not being credit-worthy, or for price-discrimination practices. Collective and individual harms that flow from these uses of human-derived data are also linked to concerns about algorithmic bias as it is often large datasets that are used to train algorithms.³¹ 

Where governments provide large, de-identified datasets as open data, they may create the potential for group or collective privacy harms. Addressing these harms may not mean limiting access to open data. Instead, there may need to be governance, oversight, and recourse mechanisms in place to ensure that individuals and communities are protected from collective harms.³² Attention to collective privacy concerns are expanding with the rise of AI.³³

Conclusion

Over the past four years, the challenges for open data related to privacy have become more complex as greater volumes of public sector data are sought for use in AI and analytics. Not only can open data be used in combination with other available data to re-identify individuals, it can also be used in profiling activities that have the potential to adversely impact both privacy and human rights. The growing demand for data for research and innovation purposes is also putting pressure on governments to make administrative data and other human-derived data available as open data. This suggests a need for new governance frameworks that can address both re-identification risks and the ethical reuse of human-derived data through licensing and other governance arrangements. This may shift the focus of open data somewhat, and attention should be paid to who is entitled (or sufficiently resourced) to access and use these forms of data. The emerging concept of group or collective privacy is also important in understanding how analytics and profiling may produce both privacy and human rights harms even from anonymized data. This expanded understanding of privacy impacts from the use of data is important and should be taken into account in all open data contexts.