Data Access in the Australian Communications Sector
Today we are releasing outputs from a study of data access in the Australian communications sector. I worked on this project alongside Punit Jagasia and James Arvanitakis and it was funded by the Australian Communications Consumer Action Network.
It started with a very basic question: Companies are collecting lots of data about us. Could we get access to it?
We spent a year studying privacy and data policies, asking for our data (or in some cases, the data of research participants), talking (and arguing!) about what should be considered best practice in the space and analysing the broader policy environment.
From all that, we produced consumer tip sheets on data privacy and access, a tool that visualises your Facebook data ) and a report. We also published a scholarly article on Internet Policy Review a few weeks ago that examined Australia’s broader data policy framework .
We did not have the capacity to run a large scale study of data access (like Jef Ausloos), so the finding are only exploratory or indicative. There is also no one major finding. For example, we did not find issues around compliance. In our view, all companies were broadly compliant with the relatively low bar set by the Privacy Act, which requires companies to give customers their personal information upon request.
However, under Australian law, personal information is only ‘information or an opinion about an identified individual, or an individual who is reasonably identifiable’ (see Section 6 of the Act). So companies only had to provide data that is expressly about an individual, like ‘a person’s name, address, contact details, signature, place of employment, work role’ (see page 56 of the Productivity Commission’s final report on Data Availability and Use).
This was relatively easy to achieve. What was more interesting was what happened beyond the provision of personal information. We found that:
There is no standard amount of data provided: Some companies only provided personal information and others gave us much more.
Most companies are not giving consumers all the data they collect: Companies like Facebook, Google and Twitter provide consumers with a lot of information but they are also holding on to a lot more they don’t provide. There are (some) good reasons for doing so but it challenges the claim that data access alone redresses the balance between companies and consumers.
The provision of more data is not necessarily a good thing: There is no point giving consumers lots of data if they can’t understand it. Lots of companies overwhelmed us with data. It wasn’t clear what we as consumers were supposed to get out of it.
There is little to no investment in data literacy: Companies often just handed over the data and rarely tried to make large amounts of data meaningful for consumers (like through our visualisation tool for example).
Data portability is available and not accessible, or not available at all: Some companies provided data in portable formats (like JSON) but there was no guidance on how to achieve portability. There are good business reasons why you might not want to tell a consumer how to move to a competitor but the result of this is that portability is restricted to consumers with strong digital literacy.
In light of these results, we welcome the introduction of the proposed Consumer Data Right. It will standardise a relatively messy space and could provide positive outcomes for Australian consumers. However, we have our own concerns with the Bill as it currently stands and discuss this later on in the report.
To sum up, what this study does is raise questions around the role and function of data access. In an analog environment, it made some sense to give consumers a right to access their personal information and it was a relatively easy request to fulfill.
We believe that the principle of the right should survive into a digital environment. However, much more thought needs to be given around the role and scope of such a right and how it can operate effectively in the context of widespread data collection and analysis. The Consumer Data Right is a great attempt as solving this problem, but it is also only one step towards rebalancing the overall information asymmetry between companies and consumers.
