Robin Wilton's esoterica

Under the possible heading of "YAROPI" (Yet Another Report On Personal Information), the Ministry of Justice report on Data Sharing was published today. However, it certainly should not be written off just because so many other PII-related reports and reviews have come out recently. (In fact, the alternative "Moore's Law" might lead us to pay particular attention to it on that basis alone).

The report itself is only part of the output you can get to via the MiniJust link; you will also find copies of all the submissions sent in to the review team (by organisations and individual citizens), and summaries of the consultative workshops they conducted to get input in person. There is a mass of data there, and the review's independent authors (Information Commissioner Richard Thomas and Dr Mark Walport - Director of the Wellcome Trust) have done an amazing job of digesting it, setting out their findings and making 19 recommendations.

A black mark, by the way, to whichever sub-editor at the BBC allowed this slug to be left in the lettuce:

"The review, headed up by Information Commissioner Richard Thomas and Wellcome Trust director Dr Mark Walport, was commissioned a week before HM Revenue and Customs lost two discs containing personal details of 25 million people."

Presumably the journalist who wrote that piece works "out of" the BBC (rather than working in or for it), gives an implausible "110%", and does so "at the end of the day" (rather than during or throughout it). He or she also doubtless expects to be paid a salary rather than working "for free". C- , See Me. 

But enough of that... back to the Data Sharing review.

Here's the summary of the "Technology" subsection:

"In summary, it is clear that computerised technology for the processing of personal data brings with it opportunities and risks, and a whole set of new challenges. In our view, however, one principle stands out most clearly: information sharing should be facilitated by technology, not driven by it. The tail should not be allowed to wag the dog. The fact that technology allows more information to be collected about more people does not mean that more information should be collected. Just because something is possible does not mean that we should rush to do it. Benefits can be pursued from collecting personal information and using it appropriately, but there must be an equal focus on safeguards."

I lead by quoting that in full, because it neatly encapsulates the report's view of the role of technology relative to the other mitigators of risk relating to data sharing. The Executive Summary is crystal clear: the principal issues concerning data sharing are ones of culture, legal framework and regulation, with further specific reference to the treatment of statistical and research data, and publicly-accessible personal information.

Technology does not appear in any of the 19 recommendations.

Thankfully, I think this mirrors Sun's view of the role of technologists and technology in questions such as these. It's not our role to tell legislators how or when to legislate. There's a valid role for technologists in advising on best practice, but that is something which needs to flow from policy statements such as this report, rather than from vendor companies promising that more technology is the answer.

The 'technology' summary paragraph also neatly reflects a message which my colleague Fulup ar Foll uses to great effect: "nowadays, the treatment of personal data is no longer a question of what is possible, but one of what is acceptable".

There are a number of ways in which that acceptability can be assessed, and enhanced or degraded. The technology summary mentions the balance between what is possible and the appropriate safeguards. At least equal attention needs to be devoted to the balance between what is beneficial and what is risky; what is cheap or expedient and what is respectful of the citizen's informational self-determination.

Let's hope the Walport/Thomas review comes to be seen as a major step towards putting those principles into practice.