GEOG3025 Confidentiality and social implications

GEOG3025 Confidentiality and social implications Lecture overview: Objectives of lecture Introductory questions Confidentiality principles in census and administrative data Social implications of personal and geographical data Lecture summary

GEOG3025 Objectives To understand legislative framework for gathering official statistics To understand basic data protection legislation and principles To consider the social implications of statistical population data collection

GEOG3025 Introductory questions… Who will have access to the data I provide? Doesn’t the government know all about me already?

GEOG3025 Legislation Compulsory registration of births and deaths under Population (statistics) Act 1938 and 1960 allows some statistical data collection Census conducted under Census Act (1920) Compare Netherlands (e.g.) Official Statistics Act (1996) right to use personal data from government institutions for statistical purposes

GEOG3025 Census Act 1920 Does not require a census to be taken, but provides the legal framework Relates to arrangements involving enumeration and forms – not to administrative population registers “…from time to time to collect and publish any available statistical information…”

GEOG3025 Census confidentiality act

GEOG3025 Disclosure protection measures Small cell adjustment (rounding to 3s) Record swapping Thresholds (40/100 in CAS and 400/1000 in STs) Design of tables – design for average cell count greater than one Conditions of use/end user licensing ? Photo: Dave Martin

GEOG3025 Income question in 2001 “Despite strong support… we have concluded that the inclusion of an income question would mean that the risk to the overall response to the Census was unacceptably high …Recognising the strength of support for this topic we intend to pursue further the availability of DSS benefit data for small areas and other ways of producing estimates of income by area”. Scottish Deputy First Minister Jim Wallace

GEOG3025 Citizen information project Consideration of a high quality single population register Benefits to citizen (convenience, accuracy of information Synergy with identity cards but separate (register streamlines creation) New legislation required

GEOG3025 Data Protection Act

GEOG3025 Data protection principles (1) 1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless- [specific conditions met, inc. consent] 2. Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes. 3. Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed. 4. Personal data shall be accurate and, where necessary, kept up to date.

GEOG3025 Data protection principles (2) 5. Personal data processed for any purpose or purposes shall not be kept for longer than is necessary … 6. Personal data shall be processed in accordance with the rights of data subjects under this Act. 7. Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data. 8. Personal data shall not be transferred to a country or territory outside the European Economic Area unless [it provides equivalent protection]

GEOG3025 Caldicott Report (1997) Information explosion creating new risks Tension between confidentiality and service provision/research Difficulty of obtaining patient consent Patient-identifiable information only to be transferred for justified purposes

GEOG3025 Confidentiality rules covering Named data or data items which could, either alone or in combination, potentially identify patients (eg. postcode and date of birth) Some statistics on small populations (eg. by age-group at electoral ward level where the population at risk is lower than 1,000)

GEOG3025 Caldicott principles Justify the purpose Don’t use patient-identifiable information unless absolutely necessary Use the minimum necessary patient- identifiable information Access on a strict need-to-know basis Everyone aware of their responsibilities Understand and comply with the law

GEOG3025 In practice Consent not required where information has been effectively anonymised “The tension between individual rights and public good in this area is complex” Need for matching and linking, if not identification – new NHS number Need to work out limits of implied consent

GEOG3025 Social implications…

GEOG3025 GIS, spatial data and ethics? Simple models of ethics fail us in the face of technological and data complexity “One solution is for those who create and use the systems to attend more carefully to the other communities to which they belong” (Curry, 1998)

GEOG3025 Moving beyond “PalaeoGIS” (Curry) More complete representation (the homeless, narrative time, etc.) More accurate representation Accessibility (by more groups) Power (regained independence) Privacy (diminish proiliferation of digital individuals) Creation of community

GEOG3025 Neighbourhood Statistics Attempt to deliver small area social data to all –But NB practical accessibility Potential for empowerment Requires social action by informed users Creation of community??

GEOG3025 Lecture summary Current legislative environment Limitation to censuses Complexities of data protection Pragmatic and ethical issues A call for the creation of community?