Kevin Else, CSP Director shares his thoughts on data privacy and data handling in our latest article.
I am 63. Whether you are thinking it concisely or not, that one fact will have made you make some assumptions about me. Ok, you’re reading this either via our website, newsletter or Linkedin, so there are other elements immediately available to help you form that assumption. But what if that was the only fact you new about me? Could you make a decision based on just that information?
The thing is some services base decision on little snippets of information just like that as part of their decision-making process.
Let me give you an example…
I have had some work done on my garden, quite a lot really, which cost a few thousand pounds. Online banking would not let me pay, flagging the payment as possible fraud. Ok, understand why, so I rang the number provided. After entering more details, I finally got through to a human.
“Well sir, we have to be careful with these unusual payments from people who are not familiar with these sorts of scams.”
I could have mentioned that I have worked in Cyber security for over 25 years.
“Has the work actually been started, as often they never turn up to carry out the work?”
I could have opened the window so he could hear the noise of the digger and did actually point out the work was being carried out by a family friend.
“Some family friends don’t stay friends” I was told.
Anyway, I sorted it out in the end, after providing additional identification information, but the thing I am pointing out is that some decisions made by software can be based on very little information.
Data privacy
Data privacy regulation have made companies examine the information that they hold regarding their clients, and where possible reduce what they hold. But decision-making software requires as much information as possible, to make an appropriate decision.
There are elements of the GDPR (UK) act which cover information being used to make automated decisions. Article 22 of the UK GDPR, has additional rules to protect individuals if you are carrying out solely automated decision-making that has legal or similarly significant effects on them.
However…
There is no guidance on to what those “similarly significant effects” are.
When developing automated decision-making software, you need to ensure that the decision is: necessary for the entry into or performance of a contract, or authorised by domestic law applicable to the controller, or based on the individual’s explicit consent.
You must identify whether any of your processing falls under Article 22 and, if so, make sure that you give individuals information about the processing, introduce simple ways for them to request human intervention or challenge a decision and carry out regular checks. This is to ensure that your systems are working as intended.
So, there is a balancing act between the information that you hold and how it is used in automated decision making, which you need to plan and carefully document. This is so that you can demonstrate the correct controls when challenged by either the client or the ICO.