Best Practice Forum on data and new technologies in an internet context

Event report

The conditions of collection, storage, and processing of data is at the centre of public and private debates. This session paved a way to a better dialogue around these conditions and the best practices related to data to ensure it is used to benefit and not harm individuals.

Mr Wim Degezelle (Consultant, IGF Secretariat) mentioned that since the end of February, meetings have taken place to discuss the issues and topics that need address in the Forum. The specific topic of best practices and data came from the Multistakeholder Advisory Group (MAG) and concerns definitions and concepts. The idea is to reach agreement on the meaning of words around data and to ensure that technologists, journalists, activists, private businesses, and policy makers use words related to data with the same meaning. One of the outputs of the early discussions this year is the creation of the Best Practices Forum (BPF) Data and New Technologies Issues Cards, a short document of two pages that maps different thoughts around data and new technologies. The Issues Card fosters dialogue and awareness around the meaning of data terms and problems related to them. In practical terms, the Issues Card could be used by anyone, including policy makers, when they discuss data. The card is available at the IGF website. Ms Concettina Cassa (ICT Senior Specialist, Agenzia per l’Italia Digitale) explained that the BPF is a specific platform to exchange experiences and good Internet practices.

Ms Verónica Arroyo (Policy Associate, Latin America, AccessNow) briefly presented the ‘do’s and don’ts’ guide for law makers or states regarding COVID-19 contact tracing apps and tools. The recommendations in the guide are broad because they address different and plural realities across the world. The eight ‘do’s’ and seven ‘don’ts’ recommendations are based on data protection principles. The document is available online. Arroyo also mentioned that the government of Peru, after exchanging ideas with groups from civil society, decided not to utilise a contact tracing app. The main concern of AccessNow is the usage governments in general will make in the future of all the sensitive data presently collected. Ms Emanuela Girardi (Founder, Pop AI) highlighted that currently in Europe several tracking apps are in use and different organisations are taking into consideration privacy issues related to it.

Mr Ricardo Chavarriaga (Senior Scientist, Zurich University of Applied Sciences (ZHAW) and Coordinator of CLAIRE AI & COVID-19 Task Force) pointed out that CLAIRE is a network of European researchers in artificial intelligence (AI) that includes some 400 research groups in academia and industry. Since the beginning of the pandemic, the group has initiated voluntary efforts to address effects of the COVID-19 pandemic. They have enrolled 150 volunteers from different areas of AI and from different countries to think about how technology could properly help. The first issue the group noticed was that that much information was available, but not properly structured. The group sought to collect information in a structured way, then to help individuals to find the right information about COVID-19. The main challenge was to collect reliable and labelled data. This difficulty was related to the heterogeneity in privacy regulations and a lack of integrated and common pipelines for data collection and storage across health institutions. Also a lack of available infrastructure for cloud storage and interoperable use of sensitive data hindered effective collection and use of data. Chavarriaga considered that it is crucial to take a proactive stance to build a more resilient infrastructure, meaning flexible and agile response mechanisms that allow experts from different domains to have access to meaningful resources.

Mr Cathal McDermott (Senior Legal Counsel, Microsoft) addressed the seven privacy principles implemented by Microsoft in technologies created by the company to tackle the COVID-19 pandemic. The first principle reinforces the importance of meaningful consent and transparency concerning how long sensitive data related to COVID-19 will be used. The second principle regards the purpose of data collection. Microsoft wants to ensure that sensitive data is only collected in public health services. The third principle limits the amount of data collected to the minimum required. The fourth principle regards transparency of where data is stored, either on the cloud or on individual devices. The fifth principle provides appropriate safeguards to the data collected. The sixth and seventh principles reinforce that data will not be shared without consent and will be deleted as soon as its purpose is achieved.  

Mr Michael R. Nelson (Senior Fellow and Director, Technology and International Affairs, Carnegie Endowment for International Peace) believes one of his roles in the forum is to provide some diversity, given his conviction that public regulation should be the last resource to address in several data issues. Nelson also stressed that many buzzwords related to technologies create confusion and sometimes fears. He suggested that new ways of naming technologies should be discussed. In this sense, data governance, one of the buzzwords of the moment, means very different things to different social actors. For a CEO of a company, it means how to manage corporate data, while for governments the term relates to public data policies and mechanisms of control to flows of data. Another unclear term is ethical AI, considering that ethics is a variable open concept. Nelson suggests replacing it by digital human rights, because human rights are defined in several international legal documents. The terms digital sovereignty, data sovereignty and cyberspace also raise concerns because they relate somehow to territoriality, when, in reality, the Internet is not spatial or static. It is more useful, instead of talking about territoriality, to talk about where individual data is stored or whether it is encrypted. There is a need to be more specific about what several technologies really are. If their real meaning is translated into their names, the public debate around them will be easier and more transparent.