Ushahidi’s Zack Halloran has written a blog calling all ‘Privacy Wonks, Process Experts, Computational Linguists, Data Detectives, M&E Pros, Veteran Activists and Hackers of all stripes’ to work together to protect data owners’ privacy rights and safety.
It’s intended as the start of a larger conversation and we, the Responsible Data Forum, are very happy to host that conversation here. Read on, and see you in the comments:
Keep it secret. Keep it safe.
It’s hard to keep a secret.
It’s even harder when you don’t what the secret is, or whose secret you’re supposed to keep.
A lack of training and tools for the safe use of data is a real issue facing advocacy and human rights activists working with individuals at risk. Those individuals at risk are the data owners, and should have as much control as possible over how their personal data is used. So, how do you balance the needs of impact work with the privacy rights and safety of the data owners? For example, can an advocacy organization share the experience of a survivor of sexual assault without exposing that person, their friends, family and community to additional risk? The simple answer is, they can’t. But there are things we, collectively, can do to limit that risk.
Galia est omnis divisa in partes tres
There are three areas of focus here: developing data literacy resources, producing standard policies and frameworks for protecting and engaging data owners, and building tools that support the first two. More on each below.
Data Literacy Resources
The first step in making the collection and use of PII (Personally Identifying Information) safer is improving the average data literacy of those doing the collecting. The best way I can think of doing this is to create educational resources that explain, in a straightforward way, the risks of both structured and unstructured data and how to identify the PII that exists within each. In addition to basic literacy, things like explaining how bits and pieces of information from different sources can be used to identify individuals are important. This is how we learn what the secrets are.
Experts Needed: Privacy Wonks, Data Detectives, Veteran Activists and Graphic Designers. Explain the risks inherent in PII and how to identify it, collect anecdotes of PII gone wrong, and design educational resources that can be shared with organizations & individuals.
Standard Policies & Frameworks
Once we know what secrets we have, we need strong, clear, easy to adopt policies & frameworks that help us protect those secrets. Much of this comes from recognizing the rights of data owners and making sure they’re involved in the process. First, we need a Data Owner Bill of Rights; a foundational document that defines the universal rights of data owners and underpins all decisions related to collection and use. Second, we need a standard process for evaluating the potential risk to data owners. Third, we need a standard framework for informed consent to make sure data owners are as aware as possible of the risks and benefits when they share their data. All are needed, and proper use of each relies on some level of data literacy, especially the last one. The simpler we can make these, the better.
Experts Needed: Privacy Wonks, Process Experts, Veteran Activists & M&E Pros are key to this effort. Strong communication skills, a thorough understanding of the circumstances of data owners, a deep appreciation for the importance of privacy, and a keen eye for workflows and process design are required.
Tools
Building tools is really important to this effort. This is where we bundle up expertise to make it easier to use and share. Want to improve data literacy? Let’s put together online lessons that train people to identify PII in a report, and then let’s build software that identifies and masks PII for you. Having a hard time evaluating the risk to data owners in a campaign? Let’s design a workflow that walks you through the steps of the evaluation framework and produces a report. Having trouble adding informed consent into your data collection process? Let’s build templates for informed consent and plugins that work with your forms.
Experts Needed: Hackers, Computational Linguists, Data Detectives, Graphic Designers, and Process Experts. Build tools that codify the knowledge collected in the first two areas of focus. Make those tools easy to use and understand. Apply sophisticated approaches to solve difficult problems in a repeatable way.
This is a call to action; a cry for help; a request for comment. The hardest part, the biggest challenge, is making these really complicated concepts and processes simple and easy to use. That’s what will drive adoption. Let’s face that challenge together. Let’s leverage the diverse talents and disciplines of this community to make advocacy and human rights work a little safer for everybody.
