introduced by Jo Herlihy
This was the introduction for our discussion on the
20th January 2010
In the arena of public policy there are a number of areas where issues relating to data sharing and privacy are being debated and discussed. It would be very helpful to receive ideas on where people think the most effort should be spent.
What I’ll cover:
2. Data sharing and privacy - the larger picture
We can recognise 3 broad areas:
For example, services based around entitlement are linked to benefits such as Free school meals, travel, adult care and health
This also covers a host of complex issues around, for example, medical records – connecting for information related to health through to medical information for research – although most of what I cover isn’t related to this
e.g. child protection, ContactPoint, safeguarding
e.g. ID card, National Fraud Initiative, DNA database,
Each of the broad areas outlined above are derived from different aspects of public policy. On the service side for example, we see data sharing used in the following areas:
From these broad interests we find initiatives based around for example:
An ongoing and much debated topic has been the extent to which this focus easily dovetails with the other areas - public protection and law enforcement. The discussion focuses on either the need for strict partitions between the areas or the view that they should be permeable, crossing over to deliver against multiple agendas.
The over-arching view of the citizen within a service context shifts to that of the need to understand that person as someone potentially at risk, a possible predator and potential criminal. This shift can be seen in:
It has been difficult to ascertain with any real certainty the breadth of vision – which has, in turn, given rise to a host of associated discussions on both technical and data management aspects:
The debate and emphasis around data sharing has evolved over the 25 years. We should remind ourselves that the Data protection act was introduced, significantly/symbolically in 1984.
Initially the focus was specifically about protecting the individual from possible misuse of information stored on a computer. This was only extended to cover a wider range of formats later on.
In this original focus data protection appears initially as a set of checks and balances against the powers of the state and developed in response to the opportunities the capturing of digital data provides around the potential for the abuse and misuse of the information held. The Act was very specific. People need to know what the information is intended for and that it only used for this purpose.
The current focus on modernising government and the emphasis on data sharing gives quite a different emphasis. Today’s concern is not so much about the protection of that data but removing the barriers to it being shared to make the best use of technology in modernising business processes. The protections given to individuals are seen to act as a barrier to making service better:
Today the support FOR data sharing seems to come from both the public (different expectations of public service driven by banks, retail etc) and from government who feel great pressure to modernise business processes and reduce bureaucracy and deliver efficiencies.
A recent survey published by LGITU indicated overwhelming support by government officers (77%) for the need to share data for all manner of purposes – place shaping, service take up, customer insight, adding value and preventative services. When asked about the need to share sensitive citizen data to improve quality and efficiency of public service delivery one respondent answered:
“There is clearly a need as all cases of headline cases of child abuse could have been prevented if agencies communicated with each other.”
Interpretation of the Act is now constantly stretched as frustrations with the lack of flexibility mean that changes to processes can’t be made in the way staff would like.
Creative thinking has been stimulated by the ease of data capture and how it could be better used when brought together with other data sets in new ways. While such data sharing is very attractive it is also seen to be hindered by the same barriers.
So is it a surveillance or data base state – a 1984 scenario?
There are lots of instances and examples we might bring to mind that seem to confirm it is.
For example, there has been an underlying drive to connect up systems across all levels of government to provide the overarching view of the citizen – e.g. to link database to a core spine provided by the DWP, the Client Information System, the National ID register. Linking these to, for example, data on health records seems to underpin government initiatives. This is the core of concern around the database state.
However, the question of how firm a vision this really is, and what this means in practice has resulted in enormous confusion and problems around IT strategies.
Safeguarding and vulnerability – There is a continual expansion of a view of the public at risk of harm and in need of protection. Various tensions should be therefore brought to the surface and discussed and resolved. These are: the tension between government supporting independence yet the ongoing need by them to want to connect and engage with the public; the tension between minimal government versus the institutionalisation of idea of risky individuals; costly and over-complicated IT solutions that embed a culture of risk within systems yet often don’t address more specific local business problems; the tendency to offer IT solutions instead of social/professional practice ones.
New paternalism/Need & Nudge – This is a new form of state paternalism where the aim is to to proactively identify behaviours that could be detrimental to an individual. New policy initiatives now focus on prevention rather than “cure”. Since the Black report on the NHS from the early 1980s, there have been great attempts to better understand the health of the nation through improved data gathering – at a macro level to understand links between personal health and wider social factors. Today discussion is much more about focus on actual individuals and their personal behaviours resulting in trends towards micro management – of which personal data becomes increasingly important.
The perception that public servants have of themselves as acting as customer advocates shouldn’t be allowed to become a proxy for the real thing – strong individuals. The State has filled the vacuum vacated by self-determining political and social organisation.
Public protection/security – the discussion on security is quite distinct – although there are some important links to be mindful of. The major shift in views around protection and the growth of registers, flags in IT systems, and so on, means that it is not always possible for a member of the public to understand the way in which information given in one context could be information at the disposal of law enforcement in a different context.
Although the Government recognises this tension – it poses it as a technical matter, essentially as a question of balance. Through the security discussion, the state determines the parameters around which freedom is negotiated - and has a freer hand to do so in absence of any independent politics. The absence of this means that, for many, it has now become quite alluring to use the judiciary and European Court as a counter-point to potential state abuses. While checks and balances may be appropriate against arbitrary power, a reliance of the unelected judiciary also seems a fairly perilous road – as it marks a distinct shift away from the accountable legislature.
On the more positive side:
Innovation – The availability of data can stimulate new innovations in service delivery – the flip side of the concerns surrounding the sharing of data. Through the bringing together of information and data, including personal data, there are potentially many new possibilities for the design and delivery of public service.
Reducing bureaucracy – The opportunity to reduce unnecessary and time consuming contact with government could be dramatically improved through the massive overhauling of approaches and processes. Ironically, within each discussion of reducing bureaucracy is also a discussion about how ongoing relationships can be developed with the public (see later on engagement).
II) Political context – terms of debate as currently framed
There are other wider issues that also impact on the importance given to data and why it should be shared.
National government – there are a range of consequences arising from the current Governments world view and general political landscape:
Politics has been transplanted by a form of micro management where government is more akin to social policy and MPs operate more like service directors rather than politicians and leadership with sense of resolving wider social problems. Where there is activity there is a tendency for this now to be more by stealth and pragmatism. This was manifested in the arguments used around the ID card i.e. the arguments used were the ones they thought were most popular with the population which is then how the card was marketed. The case wasn’t put first – the ID card was going to be implemented, the public justification came later and was based on pragmatism.
Cynicism will dominate in absence of purpose – In the light of the above, it is likely that real and significant innovation around government service will be hampered without clarity of purpose.
Question of the ‘subject’ – one that needs to be managed or a strong self-regarding independent individual – We need to interrogate the concept of supporting independence when people seem dependent – e.g. Putting People First. Government feels they are not the cause but the solution to too much dependence on the state.
III) Data sharing in an uncertain political context
The consequence of lack of leadership - Confusion and lack of leadership in politics results in a reactive public policy and lack of rigour in design and implementation.
Arbitrary powers?
The current period of transition around the drive towards greater data sharing can mean that the scope for local interpretation and personal viewpoint at the level of project and operational managers is quite broad – meaning the discussion can seem quite arbitrary.
However, such arbitrariness on shaping direction of policy seems to spring from lack of certainty rather than arising from an over bearing surveillance state.
While this is not however a reason to be unconcerned, this also means that initiatives and activity can be dropped relatively easily when they come under any level of sustained questioning – modifications to DNA database retention time period; ID card roll-out; contact point scope.
A further thought is that policy is very much open to question and assumptions can be questioned so despite the overwhelming support for data sharing, I’m working on the assumption that it is possible to positively influence the current state of affairs – even if it’s just to keep the more arbitrary tendencies in check.
IV) A principled approach to data sharing
Citizen centric /Informed consent in a democratic society – We must clarify what this means and how this is distinct from customer focus. Our assumption must be that people are able to understand the purpose behind initiatives – as long as they are informed. The assumption must then be made that people freely consent (For the origin see Nuremberg – but need new contemporary examples around why informed consent important today – Nuremberg consent issue was around medical research).
The context of personal data
When dealing with service delivery, the public are not simply dealing with a collection of well meaning individuals (which staff often are). The inherent imbalance of power must not be forgotten by well-meaning professionals. We must recognise the authority of Authority – and see that the changing context for which personal data could be used is potentially problematic for the individual concerned.
Originally consent may have been obtained but not for the purpose it is now being considered. Many see that data protection therefore acts as a barrier to improvement – rather than a necessary defence against the arbitrary use/abuse of power.
For example: Connexions, (opt out); Equalities terrorism and profiling. (threat and criminalisation)
The context of the consent discussion is that with the absence of agency, a discussion about not having to defer to authority is abstract replaced instead by civil liberties discussions around the heavy handed state.
Or let’s compare the stringent standards developed to connect local to central government data sharing – military level security to protect its own assets – compared to the promiscuous use and handling of an individual’s personal details. For example, a patient record summary sent to insurance companies – The doctor can just sends in the existing format of the patient record, not stripped of DNA information and other sensitive data.
From the many points above, we can see that data sharing and data protection is probably more important today as a concept. It may be true that the origin of some of the concerns about the misuse of data arose as a reaction to the digitisation of data, it is not ICT that is the cause of the wider trends to share data. Whilst technology may make such things technically possible, other factors determine the direction of how the technology develops.
Although technology makes the sharing of data easier and enables new ways to deliver services. It underpins concerns around apparent drive to link up information systems with more sinister but undefined coercive purposes, for example, around ID management (forms of surveillance) or patient records (insurance companies).
Information held on both (passport and ID register) is similar, but that in addition to NI numbers and shared secrets, the register holds fingerprint biometrics, which will be required for passport issue in future, and a unique national identity registration number.
The population generally buys in to the appeal to protect the vulnerable around which much of the new data sharing systems have been developed.
The public’s lack of engagement means that it tends to consider personal identity important but in a narrow way – meaning that when it comes to privacy more generally, there is less concern about disclosure of personal information.
None of the above is an argument NOT to share data. It is however an argument for government, at all tiers, to be clear about the purpose and reason for various initiatives and that these are debated fully with the longer term implications and connections across government to be considered in the round.
People always say about such things that IT is never the problem, IT will always find a solution. However, without clarity of purpose, it is not possible to design at the outset systems that have sufficient flexibility to allow consent and later withdrawal is possible unless longer term thinking is undertaken.
For this, longer term thinking is required – along with the accompanying public debate. The evolution of this discussion indicates that the interpretation of data protection is set and framed by wider politics and it is, despite appearances, not a simply a discussion resolved by interpretation of legislation.
Click here to return to Social Policy Forum
