Clicking 'I accept' doesn't mean you surrender right to know how a company uses your data
You can ask and they're legally required to answer
Ron Deibert is director of the Citizen Lab at the University of Toronto's Munk School of Global Affairs and a member of the board of directors of Open Effect, a Canadian not-for-profit that conducts research and advocacy focused on ensuring people's personal data is treated securely.
Chances are you're reading this article with some kind of smart device. And if you're doing so in public, there's probably a bunch of people just like you nearby, staring into the glow of their tiny screens, swiping through profiles and tweets, tapping away at a game, or organizing a date.
And the chances are also pretty good that years ago, months ago, weeks ago or even today, most of them probably just clicked "I agree" rather than read the confusing fine print of the terms of service for those apps.
But have you ever thought about what companies do with that data once you share it with them? Do you ever wonder if they track your location, or your social networks or something else? Do they hand it over to other companies? To the government? If so, under what conditions?
If any of those thoughts have ever crossed your mind — and there are good reasons why they should — there's a new, easy-to-use tool to help you get some answers.
- What are your dating and fitness apps sharing about you?
- Some fitness trackers vulnerable to monitoring
- Spy agencies target cellphones, app stores to implant spyware
The Citizen Lab and Open Effect recently launched a revamped version of their online tool, Access My Info, which empowers Canadians to easily exercise their legal right to understand what data is out there about them, whether that information is shared and, if so, with whom.
All you have to do is visit the online portal, choose the service or organization you want information from, fill in your account details, and after only a few minutes, the Access My Info tool automatically generates a PDF with a detailed list of questions that can be sent to the service provider. Under Canadian privacy laws, the organizations you request this information from must comply or risk being fined.
In the course of their research, Access My Info creators Christopher Parsons and Andrew Hilts discovered that many Canadians entrust their information to third parties, but few exercise their legal right to find out what those third parties do with that information. It's not easy to know what specific questions to ask, and to whom to address them.
Endless flood of data
Research has shown most internet users are either ignorant of, or apathetic about the data they give away and what companies and governments do with it.
Meanwhile, a booming industry is thriving on the endless flood of data users transmit. Sexual preferences, eating and drinking habits, exercise routines, and a seemingly boundless number of other data points are now fed into a massive algorithm-driven business ecosystem that sorts and categorizes us.
- Listen to Part 2 of a special series on big data on CBC Radio 1 at 9 p.m. on June 30
- Listen to Big Data, Part 1
The problem, according to research, is that algorithms like these can perpetuate racism, sexism and other forms of discrimination. The data about you that's out there could have a tangible impact on your freedoms: your ability to get life insurance, a mortgage, a job, or even travel across borders.
The combination of users casually giving up personalized data with no real understanding of how it's being used and companies and governments accessing and analyzing it with no one holding them to account is a recipe for privacy loss and other abuses.
Parsons and Hilts' solution was to build a public portal to automate the generation of formal information requests. The idea is that by simplifying an otherwise complex legal process to reveal what data is collected and shared, Access My Info will motivate users to exercise more stewardship over their data.
Rather than blithely click "I accept," a more informed user base will understand better what their apps are tracking and giving away. Having a motivated user base make inquiries to companies will, in turn, help rein in the now free-wheeling industry of big data analytics by showing it consumers are paying attention.
The first version of Access My Info, released in 2014, was a huge success. Tens of thousands of Canadians requested information from telecommunication companies. The requests didn't go unnoticed. Companies were caught off guard by the flood and many subsequently released public transparency reports that disclosed information about how often they share user data with law enforcement and other government agencies.
Some of these companies are headquartered outside of Canada, so it will be interesting to see how they respond because under Canadian law, they must comply with such requests.
Users can also assist in our research by sharing with us the information they receive, so we can track industry trends and compare responses from companies in different sectors or countries.
In its first day of release, the revamped Access My Info generated more than 1,000 requests, most of them to Fitbit, followed by Apple and Rogers.
Having spoken to representatives from companies and governments that receive these requests, I know they find them to be a nuisance. It costs them money and time. But their irritation means Access My Info is doing its job, helping to motivate consumers to be more vigilant about what's being done with their information.
Should this success continue, consumers will be able to navigate the world of big data armed with a better awareness of the privacy and security trade-offs they're making as they swipe and click.