‘Virtual You’ Lives a Life of its Own
Trent Smith
Associate Professor Trent Smith is lecturer in economics at the Otago Business School, University of Otago.
Matt Ditchburn
Matt Ditchburn is a graduate of Laws and Commerce and current postgraduate student in economics at the Otago Business School, University of Otago.
Ideasroom
There is a virtual copy of your life on the internet. Does New Zealand’s new privacy law do enough to protect it?
In today’s digital world, we are all being watched. Every time you pay for something electronically, scan a loyalty card, interact on social media, do an internet search, or even just carry a smart phone, the details of your actions are recorded and stored for commercial purposes. The phenomenon of commercial mass surveillance has grown rapidly in recent years, resulting in a secretive new industry. Dubbed surveillance capitalism by author Shoshana Zuboff, the stated purpose of all this collection – targeted advertising – sounds harmless enough. But there is good reason to be concerned about what is being done with the “virtual you” that lives a life of its own in the world of surveillance capitalism.
The world leaders in commercial mass surveillance are, without doubt, America’s “big tech” companies: Google, Amazon, Microsoft, and Facebook. For some 20 years now, Google has been targeting ads not to keywords in search queries but to particular individuals. The more Google knows about you, the better it can identify ads likely to attract your attention (and clicks) and thus the more it can charge in advertising fees. Much of Google’s business model appears aimed at collection of more and more personal data: Search, Gmail, Android phones, Maps, Street View, self-driving cars; a consumer who uses these tools makes it possible for Google (or anyone else who obtains such data) to make precise predictions about your future purchasing behaviour.
Should you be worried? There is no doubt that much good could come from a highly personalised marketplace. But even setting aside the danger that an Orwellian authoritarian might someday gain access to this data – putting us all in danger as citizens – consider the impact of surveillance on us all simply as consumers. The digital footprint you leave behind in the shadowy world of surveillance capitalism contains detailed information about your life, and, in particular, it allows an observer to draw inferences about what you know – and, critically, what you don’t know – about products you might consider purchasing in the near future. An advertiser who knows you are unaware of the low-priced competitor across town is unlikely to offer you a special discount. In practice, nobody needs to “know” anything, as the scale of data collection means that clever and devious marketing experts need play no role in this strategic game: artificial intelligence and machine learning will do the work of systematically picking your pocket.
The usual saviour of the consumer – competition! – seems unlikely to solve this problem. From what is known of current industry practice, the virtual copy of your life available for sale on the internet will be offered not to all comers at a competitive price, but to the highest bidder in a secretive auction. The auction winner will be the bidder who is able to extract the best price from you at the highest profit; no other seller will have easy access to your attention.
None of the practices we have described above are barred under New Zealand’s newly updated Privacy Act (2020). Indeed, we know of no jurisdiction anywhere that has adequately addressed the difficulties that arise from the commodification of our digital footprints. This doesn’t mean we shouldn’t be talking about what can be done.
The privacy policies of every major New Zealand retailer are easily available for you to read online. You won’t need to read too many to realise that many of our most trusted companies are aware of the value of consumer data, and are clearly giving themselves permission to engage in – and profit from – surveillance capitalism. This need not be the case.
It is true that the new Privacy Act provides greater protection and abilities for the Privacy Commissioner than the 1993 Act, but it still leaves plenty to be desired. The main changes include mandatory breach reporting, ensuring data heading overseas is subject to adequate privacy safeguards, and affirming the Act’s extraterritorial effect, demonstrating New Zealand’s legal jurisdiction over all internet activity involving New Zealand consumers. The new Act, however, does not prevent consumers’ information being used for targeted advertising, either individually or anonymously pooled based on consumer characteristics.
One step that should be taken immediately is the establishment of a Data Standards Authority (DSA) through the Privacy Act. This could be an independent Crown authority, similar to the Broadcasting Standards Authority, chaired by an individual outside Government. Roles could include annual reporting on privacy trends to improve New Zealanders’ trust in data protection, assuming the role of enforcing personal information access complaints, and providing an online privacy certification system for websites. The benefits of a DSA include an independent authority capable of auditing Government entities, the ability to tailor data protection requirements by industry, and ease of reporting for consumers.
Another thing that desperately needs implementation is a “right to be forgotten” in the Privacy Act. Websites or organisations holding your virtual copy (even if they were not the original collector) could be required to delete all personal information that they have collected at your request, or because you have registered your personal identifiers (name, mobile number, home address, e-mail, etc.) in a central repository.
It’s important that we act now to protect vulnerable consumers from the tyranny of surveillance capitalism. As the late internet activist Aaron Swartz once wrote, “Information is power. But like all power, there are those who want to keep it for themselves.”
