3 ms·

What's disappointing about issues like this is I worked on a specific transfer of health information from a govenrment health system to a university, and the at

What's disappointing about issues like this is I worked on a specific transfer of health information from a govenrment health system to a university, and the attitude of the school researchers to privacy was practically obnoxious. They absolutely exploited the pandemic to squeeze the toothpaste out of the tube and get their hands on data sets that we actually have privacy protecting technologies to facilitate access to, but they were using the emergency powers to do a wholesale seizure of the data sets themselves. Among the risks I specifically identified were that access to the patient data was the decision of a research ethics board whose decisions were not covered under privacy and access to information laws, and that the research organizations outright refused to allow their researchers to be identified individually - as per privacy laws that require all access to PHI to be by named individuals. The greater concern was once the data was in the hands of the university, they had no way of formally separating clinical research and broader access by social scientists, or worse, administrators with similar agendas, and questioning the integrity of some of the truly demented individuals who inhabit those institutions is apparently just not done. Govenrment health information systems have rigorous privacy logs that admins check on a weekly and monthly basis to see if their staff are trolling through records for people they know, but the universities have no such controls, and their IT organizations are not enterprise quality. Modern tools like differential privacy, tokenization, data synthesis, and other techniques are absolutely sufficient to test hypothesis before working on production data, but their skillsets appeared more in navigating bureaucracy and political leverage, so they used the tools they had. I say obnoxious because there is a certain archetype of person who spits and sneers when they hear words like "privacy," and their skillset often reduces to creating crisis' that always seem to have themselves in the middle, and it was well represented in the groups I dealt with. The NHS should take heed, as they are clearly being hustled.

Silhouette 4y ago
Did you blow the whistle on this abuse? If this was also in the UK then it looks like exactly the sort of serious breach of protocol that the ICO should investigate. If it involved sensitive personal data about lots of people then it might realistically have enough weight for that to actually happen too.
- motohagiography 4y ago
  If you are really serious about privacy, become a CIPP and do contracting work in the field. Be the change, etc. (https://iapp.org/train/ https://iapp.org/train/) There isn't a whistle to blow because when you look at the issue closely, it is really about exploitation of the circumstances within the law and processes, and not illegal activity. The methods of bureaucracy are to diffuse accountability so that no individual can be held responsible for a failure or misrepresentation, and that's really just the art of bureaucracy. Just because people are ideological or untrustworthy doesn't mean they are doing something illegal. Instead, I can participate in public discourse about privacy with other technologists and share insights and tools here, while affecting constructive change where I can. The misrepresentations that occurred in the process were structured to be deniable and transfer the risk to people who could not reason about them, or deny understanding it. This is just how bureaucracy works, and when you look at what people actually blow whistles on, it is much more black/white cut/dried than an abuse of process you need some depth on to understand. Sucesss for me was getting an executive board to sign a risk statement accepting the risks that our security project identified so that there was a paper trail of this huge decision available via access to information laws. Further, technocratic people tend to hate privacy because it is a limit on their power, and so the channels for someone "blowing a whistle" are really limited to Snowden level events, and even then stories that tarnish institutions themselves tend to get spiked by editors. It's rarely valuable, when instead you can articulate the dynamics that cause this stuff and make criticism of shitty practices part of the discourse. The whistleblower use case on this issue would be in the hypotheticals that result from the incentives downstream, where researchers start using the data sets to look up colleagues, health data ends up in a hacked data dump by some APT group, queries like when did a married colleague or politically exposed person get their last STD test, was an applicant for a role vaccine hesitant based on dates, was someone exposed during a public health incident, data attributes being re-used to support a national biometric internal passport system, an insurer or 'alternative data provider' acquires family based cancer predictors, passing community health information to NGO's and activist groups as leverage for their policy agendas, activists produce an online map of unvaccinated and hesitant peoples houses they way they have for gun owners and political donors, normalizing the use of personal health information for policy and governance beyond public health services, billing data for mental health services ends up in a policing intelligence database or shared with border guards, etc. None of these are known to have happened (yet) but they would be the trigger for scrutiny. In tech, we get issues pushed "down" to us to resolve in ways that may be unethical or illegal, but "good" developers don't ask questions. Compared to what's done at the platform and ad-tech companies, this issue is small potatoes.

Silhouette 4y ago

Did you blow the whistle on this abuse? If this was also in the UK then it looks like exactly the sort of serious breach of protocol that the ICO should investigate. If it involved sensitive personal data about lots of people then it might realistically have enough weight for that to actually happen too.

motohagiography 4y ago
If you are really serious about privacy, become a CIPP and do contracting work in the field. Be the change, etc. (https://iapp.org/train/ https://iapp.org/train/) There isn't a whistle to blow because when you look at the issue closely, it is really about exploitation of the circumstances within the law and processes, and not illegal activity. The methods of bureaucracy are to diffuse accountability so that no individual can be held responsible for a failure or misrepresentation, and that's really just the art of bureaucracy. Just because people are ideological or untrustworthy doesn't mean they are doing something illegal. Instead, I can participate in public discourse about privacy with other technologists and share insights and tools here, while affecting constructive change where I can. The misrepresentations that occurred in the process were structured to be deniable and transfer the risk to people who could not reason about them, or deny understanding it. This is just how bureaucracy works, and when you look at what people actually blow whistles on, it is much more black/white cut/dried than an abuse of process you need some depth on to understand. Sucesss for me was getting an executive board to sign a risk statement accepting the risks that our security project identified so that there was a paper trail of this huge decision available via access to information laws. Further, technocratic people tend to hate privacy because it is a limit on their power, and so the channels for someone "blowing a whistle" are really limited to Snowden level events, and even then stories that tarnish institutions themselves tend to get spiked by editors. It's rarely valuable, when instead you can articulate the dynamics that cause this stuff and make criticism of shitty practices part of the discourse. The whistleblower use case on this issue would be in the hypotheticals that result from the incentives downstream, where researchers start using the data sets to look up colleagues, health data ends up in a hacked data dump by some APT group, queries like when did a married colleague or politically exposed person get their last STD test, was an applicant for a role vaccine hesitant based on dates, was someone exposed during a public health incident, data attributes being re-used to support a national biometric internal passport system, an insurer or 'alternative data provider' acquires family based cancer predictors, passing community health information to NGO's and activist groups as leverage for their policy agendas, activists produce an online map of unvaccinated and hesitant peoples houses they way they have for gun owners and political donors, normalizing the use of personal health information for policy and governance beyond public health services, billing data for mental health services ends up in a policing intelligence database or shared with border guards, etc. None of these are known to have happened (yet) but they would be the trigger for scrutiny. In tech, we get issues pushed "down" to us to resolve in ways that may be unethical or illegal, but "good" developers don't ask questions. Compared to what's done at the platform and ad-tech companies, this issue is small potatoes.