Sitra’s recent survey probes the secret life of data collected about us
With the aid of six test subjects, Sitra’s Digitrail survey monitored the flow of individual data when using digital services and studied how well users are able to understand the data economy’s operating environment.
The first results from the survey showed that, despite exercising their rights under the General Data Protection Regulation (GDPR), users of digital services do not always understand how their data is used and have limited opportunities to influence how it is collected and used.
“I thought that my data was only disclosed to the service provider when using an online newspaper, for example. I found out that data about me is disclosed to various other organisations around the world and there is absolutely no control over the network that uses the data,” one of the test subjects revealed.
What happens to our data in digital services?
The data generated by the activities of individuals using digital services is a valuable asset and commodity. Its management is mainly in the hands of global technology and data companies. User profiles created based on individual data are used to target advertising, for example.
A big question mark over the GDPR’s effectiveness
The survey showed that the GDPR offers only a limited view of the flow of data in digital services. The operating environment is multi-layered and elusive. Using their right to access their data – a subject access request – as provided for by the GDPR, is the consumer’s only way to find out what data has been accumulated about them. However, an individual cannot possibly know all the third parties with whom their individual data is being shared.
“Our survey shows that is it very difficult for an individual to obtain an overall picture of the generation, consolidation and use of their personal data. Alternative data economy business models are needed to ensure a fairer future,” says Riitta Vänskä, Specialist at Sitra.
Who is responsible for children’s rights?
The data accumulated through digital service use enables very detailed user profiling. UNICEF has contributed to studying the online behaviour of children and their rights as data subjects, and is participating in the Where’s my data? – Citizen’s digital trail event organised by Sitra on the international Data Protection Day.
“Children must be recognised as a special user group, and services must be offered to them as well,” says Jussi Kivipuro, Development Director at UNICEF Finland. “A child has the right of access to their personal data. A business must ask permission to access a child’s data in a way that he or she understands. This means that the child must also be able to understand the consequences of giving such permission.”
Read more about the Digitrail survey and Sitra’s IHAN project
Sitra’s Digitrail survey was launched in November 2019. The analysis of the results will continue in January and February 2020. The first results were published at the end of January 2020 in connection with Sitra’s Where’s my data? – Citizen’s digital trail event. Six test subjects were used at the initial stage of the survey to study the ways of accumulating data and the amounts of data accumulated when using digital services, how the data is used, and how effective the GDPR is in giving an individual the opportunity to access information on the collection and use of data about them.
The test subjects were a 16-year-old schoolboy, a young university student (female), a middle-aged journalist (female), a middle-aged politician (female), a middle-aged executive manager (male) and a pensioner (female).
The survey was implemented as part of Sitra’s IHAN project. The Fair data economy project is building the foundations for a fair data economy, which is aimed at restoring confidence in digital services. Further information on the results can be found in Sitra’s article. More survey results will be available later this spring.
Sitra’s Digiprofile test
Take the Digiprofile test and get tips about responsible online behaviour.