Data Privacy

Conversation around Data Privacy

The National Academies Roundtable on Data Science Postsecondary Education focused on aspects of ethics and privacy during its December 2017 (see this site for the detailed notes from the meeting.)

The meeting featured presentations and discussions by a number of notable individuals:

• “Teaching algorithmic accountability in data science education” Cathy O’Neil (http://mathbabe.org)
• “Uncovering the substance of a data science ethics education” Solon Barocas (https://infosci.cornell.edu/content/barocas)
• “Recognizing and analyzing false claims from big data” Jevin West (https://jevinwest.org)
• “Mathematical approaches to privacy and fairness” Aaron Roth (https://www.cis.upenn.edu/~aaroth)
• “Navigating history, privilege, and power in information and data science” Anna Lauren Hoffmann (https://www.annaeveryday.com)

What are some highlights of this discussion that can be woven into our courses? Roundtable co-chair Eric Kolacyk noted that that “there are inherent ethical and privacy implications in the choices data scientists make while framing, obtaining, cleaning, manipulating, and interpreting data”. O’Neil stated that privacy and accountability may not be at the forefront of those using the data that are now available. Roundtable member Patrick Perry remarked that “privacy, fairness, and accuracy are all trade-offs that are at odds with one another”.

Regulatory Bodies

Unsurprisingly, different structures (e.g., countries, industries) have different regulatory needs. As personal data becomes a part of all industries, the need to regulate and provide consumer rights grows.

• The European Union’s General Data Protection Regulation (GDPR) has among the most restrictive data privacy policies. They require that companies empower “users to make their own decisions about who can process their data and for what purpose.”
• HIPAA guides the privacy of medical information in the US.
• The Gramm-Leach-Bliley Act put into place a requirement that individuals be informed of the personal financial information being collected about them.
• The California Consumer Privacy Act provides privacy rights for consumers in California, “including the right to know, the right to delete, and the right to opt-out of the sale of personal information that businesses collect, as well as additional protections for minors.”

Data Privacy in the Classroom

There are myriad approaches and topics to discuss with respect to data privacy. We start with a definition of data privacy as “focused on the use and governance of personal data” (IAPP definition). Data privacy is important precisely because information can be misused without the knowledge or consent of the data provider.

One of the biggest data privacy issues is the practice of organizations collecting data without explicit plans for how to use it (yet). Or, sometimes new (potentially problematic) uses for “old” existing data are found, and it is not possible to obtain retroactive consent. Using examples and case studies allow students to grapple with the trade-offs inherent to data privacy issues.

Recently, smart thermometers have been used to model the spread of COVID-19. An interesting class discussion could focus on who should have access to medical records collected by Kinsa Health (the maker of the thermometer).

https://www.nytimes.com/2020/03/18/health/coronavirus-fever-thermometers.html

In our classes, we’ve engaged with data privacy through these additional examples:

• The downloadable ethics chapter from “Modern Data Science with R” describes how multiple sources of information can be used to probabilistically identify individuals from datasets that were designed to prevent such disclosure.
• We’ve explored the differences in laws and regulations across regulations in the EU and United States. The policies relate directly to data privacy and the implications for organizations that interact with users in different countries.
• We’ve had students read and reflect on ethical frameworks from the Association of Computing Machinery (ACM) and the American Statistical Association (ASA).

Are there ideas that you’ve successfully used to teach about data privacy in the classroom? Are there instructional practices that you’ve found helpful? Valuable articles or resources to share? We would welcome suggestions.