Government, business and our personal lives are increasingly driven by our personal data. Credit card transactions, location data, and health records have the potential to improve products, provide insight for policymaking, and detect security threats. But they also challenge our notions of privacy, intimacy and autonomy. How can results from privacy research be translated into policy?

The session was chaired by Richard Gomer, a researcher in Meaningful Consent. The panellists brought expertise from the areas of publishing, computer science, artificial intelligent and security

• Yves-Alexandre de Montjoye (Data Scientist and privacy researcher at Imperial College London)
• Luc Moreau (Professor of Computer Science at King’s College London)
• Yogesh Patel (Chief Scientist at Callsign)
• Leonie Mueck (Division Editor at PLOS ONE.)

Questions to the panel

1. What could mathematics offer to address the issues? The question was taken by Yves who said that in the context of Big Data statistical and analytical techniques are important to model behaviour and understand how sensitive information can be inferred from apparently innocuous data. Luc pointed to algorithmic accountability as a major challenge for data provenance modelling.
2. How is anonymization done and how could it be undone? Leonie addressed the context of repositories of data under pinning research. Concern is considerable in the health domain but it is also an area where regulation is quite mature. De-identification itself is an obsolete technique and not a useful basis for any privacy policy. The publishing business would welcome formulation of and clarification on the rules and regulations. Yogesh emphasised the maturity of cryptography but recognised its limitations.
3. What is the role of data governance and its complementarity with techniques such as differential privacy? It can be hard for organisations to know what their own policies should be, though. Techniques for de-anonymisation are still being developed, so a technique applied to data today could be insufficient in the future.
4. What is the role of accountability and techniques such as Data Provenance tracking in providing greater accountability? The panel considered the role of trust, and the necessity of building services and technology that are trustworthy. Regulation has a role here and understanding exactly what would make an organisation trustworthy could do with some exploration.
5. What are the challenges in privacy self-management? Regulatory regimes place much of the onus on the individual. The complexity and scale of digital services makes this challenging. There are alternative to explore here are AI decision support and regulatory approaches that recognise collective bargaining from data subjects.

Discussion and recommendations