IEEE Digital Privacy Podcast Series: Episode 2

 

A Conversation with Beth-Anne Schuelke-Leech
Associate Professor, Engineering Management Innovation and Entrepreneurship, University of Windsor
IEEE Society on Social Implications of Technology representative

Listen to Episode 2 (MP3, 22 MB)

 

Part of the IEEE Digital Privacy Podcast Series

 

Episode Transcript:

Brian Walker: Welcome to the IEEE Digital Privacy Podcast series, an IEEE Digital Studio Production. This podcast series features conversations with industry and academic leaders, as well as key stakeholders of digital privacy in order to help advance solutions that support the privacy needs of individuals. In this episode, Beth-Anne Schuelke-Leech Associate Professor, Engineering Management Innovation and Entrepreneurship at University of Windsor and a representative of IEEE Society on Social Implications of Technology provides an overview on digital privacy and discusses what's needed to advance the technology space. Beth-Anne, thank you for taking time to contribute to the IEEE Digital Privacy Podcast Series. To get started, can you share your thoughts on the importance of the IEEE Digital Privacy Initiative?

Beth-Anne Schuelke-Leech: So right now, people, we do not have the same protections of privacy online as we do in the physical world. So, a lot of people have vulnerabilities to losing control of their data and their digital lives, and they don't necessarily understand the implications of that or that they're even making a choice. Often they're not really making the choice about that. And so, we need to have a conversation about what is happening, what the consequences are, what kind of data is involved. And doing that through the IEEE Digital Privacy Initiative makes a lot of sense. It needs to have different stakeholders involved. So both the developers and legal experts and social scientists, policymakers and the IEEE has the credibility to bring those people together to have that conversation.

Brian Walker: You've described digital privacy as being a balancing act. Can you expand upon that?

Beth-Anne Schuelke-Leech: Privacy has a lot of different meanings. So, there's no consensus about what it means or why it is needed or how to achieve it. So, there have been a lot of explorations and kind of explanations of privacy for many, many years. There are discussions in the legal realm, psychology, and philosophy, and then there are just general public expectations. And there's a lot of cultural and societal differences about what privacy means and where it occurs and the kinds of protections that we have. So, the difficulty is that often it's left to companies to manage what digital privacy is going to be, and they have to balance the costs and benefits of gathering, using, analyzing, exploiting and protecting the data with the different legal requirements and public expectations. And really, in the cyber realm, these really aren't defined the way they are in the physical realm. So companies are really struggling to understand. So, it is a balancing for the companies and it is a balancing for public policymakers who want to encourage innovation and want to encourage the knowledge economy and want to encourage all of the benefits that come with that, but also need to figure out how to protect people and protect their rights and ensure that they are protected.

Brian Walker: So, given those perspectives, how can we practically manage privacy within a societal framework?

Beth-Anne Schuelke-Leech: So right now, people are essentially using services on online platforms that they don't necessarily really have a good idea of what kind of data is being gathered and how that data is being used. And the transparency behind that is, is really not there. And so, it's difficult for people to really have a choice that they're making. They're really not, they don't know how to protect themselves and they don't know what is kind of being done, what they should do. It kind of defaults to the person to figure out how to protect themselves. And what really needs to happen is a lot more transparency from companies and organizations as to what kind of data is being collected and allowing people to make choices, not just about whether they're going to use the service or not, but about what data is gathered, how long the data is collected, or how long it is kept. What are their rights to remove the data at some point if they think or correct the data, if it's not accurate. What is, how are they being influenced the data? And a lot of that is going to have to occur, within the requirements of being more transparent. So, for example, Europe has its General Data Protection Regulation, the GDPR, which requires companies to conform to certain expectations about privacy and what's being done with data and with transparency. California has established a privacy rights through its CCPA, but these are kind of really spread in terms of, for instance, with the California one, if you don't live in California, if you're not a resident of California, you can't take advantage of the protections that are afforded by that, even if the company that is taking the data and using it resides in California. So, this kind of hodgepodge mesh that we have really is not a framework. It's just kind of a hit and miss, so to speak, in terms of whether you have privacy and what that means. So, I really think we have to come up with some mechanism for ensuring larger transparency and allowing people to make choices, rather than simply being required to opt-in to their data being gathered and used and analyzed and then being influenced in ways that there may or may not appreciate if they understood both what was being done, but also the consequences of what was being done.

Brian Walker: So Beth-Anne, in looking at digital privacy from a global perspective, what are some of the similarities and or differences between countries and regions?

Beth-Anne Schuelke-Leech: So, the expectations of privacy are very different and what privacy means versus the public good. So, for instance, in the United States, there are very strong privacy laws in terms of health care and physical privacy that those are kind of enshrined in the law and we have an understanding of what those mean. And we also understand that in many ways, digital privacy, it's very loose. They actually have very lax laws about digital privacy. On the other hand, in places like Europe, there's much more of regulations around trying to protect people proactively and an understanding that this is being done. In places like China however, the idea of privacy and the rights to privacy are culturally very different. There's just a different expectation of public and private spaces and around what rights they have to their own kind of what we call internal law in the United States, in North America. North America has a much stronger sense of individual privacy and protections than necessarily exist in other cultures. That doesn't make it right or wrong. It's just a different expectation.

Brian Walker: What regulatory actions are feasible to address near-term challenges to digital privacy, and how do we anticipate what may be needed for the future?

Beth-Anne Schuelke-Leech: So the difficulty is if you're talking about regulatory action in the United States versus regulatory action in Europe or in other jurisdictions. So, I'll start with the United States. One of the difficulties is there really is no consensus about what is needed and there is no consensus about what kind of actions could be taken. So, for instance, a few years ago, when Facebook had a breach of its use of data as opposed to a data breach, the Cambridge Analytica scandal which occurred, there was a short-term consequence to the company. But in the long term, people essentially went back to using the service, and it really didn't hurt them, not the company. Meta wasn't hurt financially. It wasn't hurt with users. So that sent the signal that privacy and privacy protection and data protection were not really that important to individuals. There also was a lot of lobbying that goes on to keep that those protections as loose as possible, simply because there's a lot of money being made on the use and exploitation of data. The difficulty is, is that with the political environment, it's really hard to imagine a very stringent federal policy coming down. So, what's more likely to happen is that you're going to get policies modeled after California's Consumer Privacy Act. In which case the companies are going to have to deal with a lot of different jurisdictions. And that is one of the reasons that companies often will support initiatives like the IEEE Digital Privacy Initiative, where the goal is to come up with standards and guidelines and kind of practices that companies can put into place that will allow them to protect people's privacy, but still allow them to innovate and still allow them to use the data and still allow them to move forward with being profitable, so to speak. So, what I see in the near term is that we're more likely to get greater diversity of regulations if we don't come to some consensus about standards for industry and guidelines that everyone will agree to. And I think those guidelines are going to have to include some of the protections that exist, like the GDPR, so more protections around transparency, more opportunity and choices for consumers and for citizens and for people to be able to decide what's being taken and why it is being taken and to make choices as opposed to simply requirements.

Brian Walker: What are your thoughts on how the IEEE Digital Privacy Initiative can help advance the digital privacy space?

Beth-Anne Schuelke-Leech: Yeah. To me, one of the most important things, because there is very little consensus here and you've got a lot of different stakeholders making a lot of different assertions and claims and trying to push the conversation in different directions. There really needs to be a space in which the conversation can occur. So there needs to be an exchange of ideas and an exchange of information and a real forum where you're dealing both with people who maybe have philosophical ideas of what should be happening, but also the practitioners and the developers, who can say what's realistic and what's not, and industry representatives that can outline what are the costs and benefits of doing these things. So the IEEE standards are voluntary industry standards as many associations make standards as opposed to legislation or regulations which are formulated by governments. And the advantages is that industry will often sit down and say, this is what will work with us or for us, and this is what's realistic. At the same time, learning that there's other interests and other jurisdictions. So, it's a consensus-based way of coming up with standards and guidelines. And that to me is really the value of the IEEE Digital Privacy Initiative is it really helps the conversation to occur. And because of the way that standards are done within the IEEE, which is consensus based and allowing people, you know, whoever wants to be involved can be involved and allowing for reviews and allowing for reflection. And then also, just with what's starting first with the digital privacy initiative of bringing different stakeholders together in different areas such as a framework area, and then looking at particular applications such as autonomous vehicles. That allows different experts to get together with different stakeholders and really talk about what is needed and what is going on. And it's that conversation that is absolutely critical.

Brian Walker: Beth-Anne, thank you again for sharing your insights with us today. In closing, do you have any final thoughts?

Beth-Anne Schuelke-Leech: I think it's really important that people who are interested in this engage with these issues. I really hope that people who haven't necessarily been involved in IEEE initiatives in the past will be engaged with and will make efforts to engage with that because it's absolutely critical that this be done with a wide range of stakeholders. It can't simply be the developers. It can't simply be legal experts or social scientists or other, you know, or privacy advocates. It has to be the whole group of stakeholders coming together. And so I really hope that people will engage in a way that that brings that legitimacy and credibility and allows really good things to come from this.

Brian Walker: Thank you for listening to our interview with the Beth-Anne Schuelke-Leech. To learn more about the IEEE Digital Privacy Initiative, please visit our web portal at digitalprivacy.ieee.org.