The Social, Cultural, Epistemological and Technical Basis of the Concept of "Private Data"

Funders: ESRC and the (CASE) Studentship partner is the Office of the Information Commissioner, UK.
Name: Karen McCullagh
Supervisors: Dr Mark Elliot, Dr Kingsley Purdam and Mr David Smith (Deputy Commissioner, ICO, UK) with external advice from (Francis Aldhouse OECD) and Prof Joseph Jaconelli (Law School, University of Manchester)

Research Aim

This research aims to investigate the concept of private data, and seeks to make a contribution to the fields of privacy and data protection.

Background:

It is becoming increasingly easy to collect data, not simply because information technological developments provide such capabilities (Rosen, 2000, 25), but rather because government and commercial organisations want to track what people are doing and when (Eztioni, 1999, 9). However, what constitutes private data is a key element in many contemporary conflicts over information for instance, whether it is appropriate to ask a question on income in the 2011 Census.

Arguably the meaning of privacy in peoples lives is changing due to advances in technology. For instance, weblogs raise a number of privacy issues. They are easy to produce and disseminate, resulting in large amounts of sometimes personal information being broadcast across the Internet. Also, they are persistent and cumulative. This merits an examination of whether privacy has become a devolved issue determined by the ability and interest of an individual in maintaining certain data as private? If different levels of privacy already exist across different types of people in society, how are these different levels of privacy and therefore risks of disclosure developing?

Existing legislative measures will be examined to determine if an adequate definition of private data exists. If deficiencies are revealed then an interdisciplinary approach will be utilised to explore if useful definitions of 'private' exist beyond the legal sphere. If useful definitions are not available then the research will attempt to develop an understanding of the concept private data and to inform the constructive debate necessary for the development of a practical, workable definition for legal and policy decisions.

Approach:

1. Semi-structured interviews will be conducted with privacy and data protection experts from around the world. These interviews will examine understanding and satisfaction with current concepts such as personal and sensitive data protection. This phase of research will also seek to test a proposed definition of private data.

Proposed definition:

Data privacy concerns the legal regulation of the boundary between personal and private data. Private data is regarded as a subset of personal data the disclosure of which could cause unreasonable harm to an individual.

It is the legal right of an individual to withhold consent to the collection, processing, communication or usage of personal data, the disclosure of which could cause unreasonable harm to an individual. Disclosure of private data should not be compulsory except where it is in the public interest, for instance if disclosure is in the interests of national security, public safety, the economic well being of the country, for the prevention of disorder or crime, for the protection of health, or for the protection of the rights and freedoms of others or society as a whole.

2. A question will be inserted into the Information Commissioners Annual Track (Individual) Survey in 2006. The question is designed to examine public attitudes towards sensitive data. It will test both satisfaction with the current categories of sensitive data and also attitudes towards new categories of sensitive data raised in recent studies.

It is important to ascertain if the legal definitions accord with the views of the public, who often play the role of data subject, as government legislative initiatives are intended to give effect to the legal requirements of a society, and will only be successful if they have the support of the public.

Proposed Question: Some types of personal information are considered 'sensitive' and given extra protection in law.

I am going to read out a list and I would like you to tell me, on a scale of 1 to 10, how sensitive you consider each one to be. 1 means not at all sensitive and 10 is extremely sensitive.

• Personal contact details (e.g. home address, phone number)
• Financial data (e.g. income and savings)
• Data concerning race or ethnic origin
• Criminal record
• Biometric information (e.g. iris scans, facial scans and finger prints)
• Political opinions
• Membership of political party/organisation
• Clickstream data (e.g. record of web pages visited)
• Religious or philosophical beliefs
• Genetic information
• Health information
• Sexual life information
• Education qualifications
• Employment history
• Trade-union membership

3. An online survey will be used to explore privacy attitudes of bloggers from around the world. Bloggers will asked to answer questions anonymously about their blogging practices (i.e. what kind of information they write about on their Bebo, Myspace, Xanga, LiveJournal, Friendster, Facebook etc.) and their expectations of privacy when publishing online.

All answers will be stored and analysed on a confidential basis.

The responses will be used to inform academic discussion of blogging practices and attitudes towards privacy.

How you can participate in the survey? To complete the survey, follow this link: Blogger's Privacy Expectations and Attitudes Survey