Customers prevented from accessing their own data
An international study that examines the obstacles facing citizens in accessing their personal data finds serial malpractice and obfuscation on the part of public and private sector organisations when citizens seek clarification of what these organisations know about them. The study forms part of the IRISS (Increasing Resilience in Surveillance Societies) project, funded by the European Union. It documents the actual experience citizens have when trying to use the law to access their data.
European and national laws give citizens the right to know how their personal data is used, shared and processed by private and public sector organisations. The study, encompassing citizen interactions with 327 sites, found that what should have been a straightforward process was complex, confusing, frustrating and, in the end, largely unsuccessful. The research sites were chosen based on a consideration of the socio-economic domains in which citizens encounter surveillance on a systematic basis. These domains were health, transport, employment, education, finance, leisure, communication, consumerism, civic engagement, and security and criminal justice.
Professor Clive Norris, a specialist in the sociology of surveillance and social control from the University of Sheffield, led the study in partnership with his colleague Dr Xavier L’Hoiry. He said: “We part with our personal data on a daily basis, creating vast and invisible reservoirs of actionable personal information. We do this actively and passively, and our experience of the world is reshaped in ways that we don’t appreciate. We are selectively marketed to, our locations are tracked by CCTV and automated licence plate recognition systems and our online behaviour is monitored, analysed, stored and used. The challenge for all of us is that our information is often kept from us, despite the law and despite our best efforts to access it.”
The research found that the spirit of the European Data Protection Directive has frequently been undermined as it has been transposed into national legal frameworks, and then further undermined by evolving national case law. Citizens, in their role of data subjects, encounter a wide range of legitimate but not always convincing and straightforward restrictions in their attempts to exercise their rights. These legal restrictions are further undermined by serial obfuscation on the part of data controllers or their representatives.