Fifteen Eighty Four

Part 1 outlines the rapid worldwide use of mobile phone location data for contact tracing purposes. Part 2 concludes by examining how information privacy law protections apply now and how they should apply in the future, especially in relation to new forms of modulated power.

What about the application of current information privacy law protections?
Part 1’s brief coverage of contact tracing developments clearly highlights significant challenges for information privacy law. Information privacy law provides a range of life-cycle protections that begin at the point of data collection and end with destruction or de-identification of no-longer-required data. In the interim, data collection organisations have a range of obligations to fulfil: the individual should be notified about the purposes of collection so that they can meaningfully consent to subsequent uses. Personal information can generally only be collected and used for defined and legitimate purposes about which the individual is adequately informed. Individuals have a range of interaction mechanisms that seek to ensure the maintenance of control by giving them the ability to affirm the accuracy and currency of collected personal information. Personal information, once collected and stored, must be kept secure.

At the heart of these protections, is the notion that an individual data provider should retain some degree of control over how their information is handled, thus preserving their autonomy and their ability to consent to fully informed decisions about information exchange. However, information privacy law protections, and privacy rights in general, are not absolute. The information exchange process, at the heart of information privacy law, requires a balancing of individual interests with other organisational and societal requirements.

The safety and security interests that emerge in a pandemic will outweigh individually focused information privacy protections. Control based initiatives therefore focus on legal and technical solutions to limit the collection and use of mobile phone location data. Legal solutions concentrate on the lawfulness, necessity and proportionality of collections to ensure that collected data is used only for pandemic purposes, those purposes are transparent and time-limited to the duration of the pandemic. As highlighted in Part 1, technical solutions focus on a range of privacy preserving measures such as decentralised data collection and analysis that minimises the data collection requirement and preserves anonymity by mitigating re-identification possibilities.

These legal and technical solutions provide important information privacy protections that seek to ameliorate the binary outcomes generated from zero-sum questions, such as that posed in Part 1. However, while the solutions provide practical responses to immediate issues, it is important to realise that other fundamental information privacy law issues arise. These issues involve questions about new forms of power in networked societies, termed by Julie Cohen, as modulation.

How is a modulated perspective of information privacy law different?
A modulated perspective specifically addresses the power consequences that flow from the use of everyday technologies, like, the mobile phone and the vast amounts of sensorised data they generate. These technologies, and their data, have a modulating effect, because they increasingly mediate and shape our experiences with the world. In other words, we understand the world and our place in it from our devices. This power of mediation means that the practice of citizenship can be configured in subtle ways by device design and data analysis.

Configurations can manifest in forms of ‘power over’, where we do something at the behest of a data collecting institution rather than ourselves. The pervasive tracking of self-quarantined individuals by app, detailed in Part 1, is a case in point. More insidiously, they can manifest through how we perceive the world around us. This latter point is particularly important in the context of the COVID-19 pandemic because we are quickly being segmented into different categories of citizen – tested or not tested; positive or negative; quarantined or self-isolated; vulnerable or healthy. As Part 1 details, this segmentation process is increasingly divined and directed via the mandatory or voluntary use of mobile phones and the location data they by-productively produce.

These direct and subtle forms of power have important implications for information privacy law regimes that can either legitimate or reject collections and uses of personal information. The very process of legitimation or rejection shapes our understanding about the role of information privacy law and the level of protections we can expect as citizens in our societies. Hence, our most intimate device, the mobile phone, is being used to shape and segment our notion of citizenry and, in turn, it is also being used to shape our understanding of the information privacy protections we should expect.

In this context, information privacy law has a vital role to play regarding social shaping that current forms of information privacy law struggle with due to the binary cognition of individual protections versus collective needs. In the vastly complex networked societies we now live in, whether we have control over our information is no longer the defining conceptual question to ask. Instead, as Sean McDonald helpfully identifies, the real question is whether our data is being used to control us? If that is indeed the right question, then profound attention needs to be given to the legitimation process of law and its effect on governance practices that go beyond the COVID-19 pandemic.

These processes of legitimation and governance practice do not begin and end in parliaments and other democratic fora. Instead, they continuously flow to and from centres of infrastructural power, such as the labyrinth of telecommunications pathways, down to the sensors of our individual devices and back again. Modulated power continues to flow and shape our understandings regardless of the abnormality of the COVID-19 pandemic. This is an important point. It harks to the fact that the devices and the private sector infrastructure used for mobile phone contact tracing are part of an existing and continuous surveillant structure of informational capitalism. How governments utilise that structure, and are themselves enfolded into that structure, are vital issues to address when thinking about the long-term consequences of modulated power that are intrinsic to the operation of effective information privacy law in complex, networked societies.

Mobile phone contact tracing is potentially an important tool to mitigate the wide-scale transmission of COVID-19. However, it is only one tool in a multi-focused toolbox involving the scale of testing regimes, public health infrastructure and political priorities. The legal and technical solutions recently proposed are important practical responses to the complex information privacy issues that arise from the governmental use of mobile phone location data. It’s necessary to focus on the immediate but it’s also crucial to consider the ongoing issues of modulated power. The pandemic will end at some point in the future, but the surveillance structures of informational capitalism will continue to pervade.