The responsibility for data protection lies too much with the individual
According to Sitra’s survey, people do not understand the terms and conditions of digital services. The terms and conditions are too long and use difficult language. Less than half of the respondents in the four countries understand the terms and conditions of different applications or services well. The lowest reported rate of understanding is in Finland. A total of 57 per cent of the respondents feel that data protection rests too much on the individual’s shoulders. There were no major differences between the countries in this regard.
Young adults differ from other age groups
According to the survey, 18 to 24-year-olds have the most positive attitude to profiling carried out by service providers. This is also the age group that is the most willing to disclose their data to service providers and also for purposes that are in the public interest (such as environmental protection or healthcare) and for scientific research. Altogether, 37 per cent of young adults feel that online privacy has already gone, while the average of all respondent groups was 31 per cent.
The results of the respondents to Sitra’s Digiprofiletest support this finding. According to the raw data from the test, those under 19, who are major consumers of digital services, are surprisingly rather ignorant of data collection, use and sales carried out by service providers. When compared to all age groups, young people trust service providers most and protect their data least. When it comes to trust, data economy awareness and personal data protection, these young people most resemble their grandparents’ age group, respondents over 65 years of age.
Individuals’ concerns and expectations about the data economy
When asked about concerns over human rights online, clearly the most important theme is the potential of personal data falling into the wrong hands (60 per cent), but the safety of children online is also a cause of concern for many (37 per cent). Concern about personal data is higher in Finland than elsewhere. On the other hand, among all survey nationalities, Germans are the most worried about who has their data in their possession.
More than 70 per cent of respondents believe that it would be important to have a “fair data label” for digital services, to help recognise fair services. The interest in this was clearly highest in Germany (75 per cent).
When European companies were asked if they would find a fair data consumer label useful for their operations, only 29 per cent of firms answered the question in the affirmative. So, there is a clear conflict between consumers’ needs and companies’ interests. Finnish companies were the least interested in a consumer label, with a clear marginal to other countries.
People do not want artificial intelligence to help with data and privacy management
Respondents were also asked for their opinions on how the authorisation to use and manage the data collected about service users should be arranged. On average, the most popular of the options (30 per cent) was to have an authority regulate the use of data more strictly. However, there were significant differences between the countries.
The preference for authorities’ help was strongest in Finland (37 per cent) and weakest in Germany (23 per cent). In Germany, the preferred option (32 per cent) was for people to manage their data more actively and consciously themselves but only 19 per cent in Finland and 21 per cent in the Netherlands shared this opinion. In all countries, the least desirable option was the use of artificial intelligence in privacy management (2 per cent).
The rights of the General Data Protection Regulation are not exercised actively yet
Although more than half of the respondents thought they have a fairly good understanding of the content of the European Union’s General Data Protection Regulation, exercising the rights afforded by it is still rare. Less than half of the respondents had exercised their rights; this percentage has not grown significantly since 2018. The lowest percentage was reported in Finland and the highest in the Netherlands.
The most commonly exercised right is to forbid the service provider from processing data automatically: this percentage increased from 9 to 14 per cent between 2018 and 2021. The second-most frequently exercised rights are to request the service provider to grant access to the data that has been accumulated on the person and to inquire as how the accumulated data is used (both 11 per cent). However, there was only a 2 to 3 per cent increase in the exercising of these rights over the three-year period.
Almost half of the respondents said that the General Data Protection Regulation has not affected their online behaviour in any way.