Data trusts: more data than trust? The perspective of the data subject in the face of a growing problem

ABSTRACT

The recent report, Growing the Artificial Intelligence Industry in the UK (Hall, Wendy, and Jerome Pesenti. 2017, https://www.gov.uk/government/publications/growing-the-artificial-intelligence-industry-in-the-uk) suggests the use of a 'data trust' to facilitate data sharing. Whilst government and corporations are focusing on their need to facilitate data sharing, the perspective of many individuals is that too much data is being shared. The issue is not only about data, but about power. The individual does not often have a voice when issues relating to data sharing are tackled. Regulators can cite the ‘public interest’ when data governance is discussed, but the individual’s interests may diverge from that of the public. This paper considers the data subject's position with respect to data collection leading to considerations about surveillance and datafication. Proposals for data trusts will be considered applying principles of English trust law to possibly mitigate the imbalance of power between large data users and individual data subjects. Finally, the possibility of a workable remedy in the form of a class action lawsuit which could give the data subjects some collective power in the event of a data breach will be explored. Despite regulatory efforts to protect personal data, there is a lack of public trust in the current data sharing system.

KEYWORDS:

• Data trusts
• data protection
• privacy
• fiduciary
• smart cities
• data sharing
• personal data

Disclosure statement

No potential conflict of interest was reported by the author.

Notes

1 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation).

2 Article 4(1) and Recital 26 Regulation 2016/679.

3 As further explained (The Law Commission 2014 paragraph 1.110):

 … technological advances have made it increasingly difficult to protect the subjects of anonymised data from being re-identified whilst at the same time supplying sufficient information to make a dataset useful. For example, a set of data on the outcomes of treatment for heart disease treated at a particular hospital is likely to be much more useful if the data include matters such as age, body weight, socio-economic data, ethnic background, other diseases or relevant medical interventions.

4 Such as the number of individuals in the receiving zone of a cellular tower.

5 Vidal-Hall and others v Google Inc [2015] EWCA Civ 311, [2016] QB 1003 is an exception along with Wm Morrison Supermarkets Plc v Various Claimants [2018] EWCA Civ 2339, [2019] 2 WLR 99.

6 See for example, The IEEE Global Initiative on Ethics of Autonomous and Intelligent Systems https://standards.ieee.org/industry-connections/ec/autonomous-systems.html accessed 6 February 2019, and The Partnership on AI (including corporations such as Microsoft, IBM, Apple and Facebook), https://www.partnershiponai.org/ accessed 18 January 2019.

7 A group promoting self-regulation of on-line advertising.

8 More recently, Delacroix and Lawrence have made similar suggestions (2018).

9 Knight v Knight 49 ER 58, (1840) 3 Beav 148.

10 Knight v Knight 49 ER 58, (1840) 3 Beav 148.

11 Knight v Knight 49 ER 58, (1840) 3 Beav 148.

12 Data Protection Act 2018 Section 2(1) which requires the consent of the data subject or another specified basis for such processing, for example, the legitimate interest of the data controller.

13 George Bray v John Rawlinson Ford [1896] AC 44, 51.

14 Unless of course in situations, such as identity theft, where significant financial losses could be experienced by any one or several individuals.

15 Vidal-Hall and others v Google Inc [2015] EWCA Civ 311, [2016] QB 1003.

16 Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data. OJL 281, 23.11.1995, p 31-50. Note that this Directive is no longer in force.

17 Vidal-Hall and others v Google Inc [2015] EWCA Civ 311, [2016] QB 1003 para 77.

18 Vidal-Hall and others v Google Inc [2015] EWCA Civ 311, [2016] QB 1003 para 100.

19 Vidal-Hall and others v Google Inc [2015] EWCA Civ 311, [2016] QB 1003 para 139.

20 Wm Morrison Supermarkets Plc v Various Claimants [2018] EWCA Civ 2339, [2019] 2 WLR 99.