1. The document discusses privacy challenges in the era of big data. It defines big data as extremely large data sets that are difficult to store, manage, and process using traditional methods due to the volume of data and processing speed/costs. 2. While big data provides benefits from insights discovered through analysis, it also challenges core privacy principles. Data collected and analyzed at large scale may not be truly anonymous, and re-identification is possible using additional data sources. Existing privacy laws may not cover analysis of non-personal data. 3. To address privacy risks, the document recommends expanding definitions of personal data and consent under privacy laws. Organizations collecting and processing big data should also implement privacy impact assessments, be

1. Privacy in the age of
’BIG DATA’
56th UIA Dresde Congress - November 1st, 2012
‘Rights of the Digital Person’
Marc Gallardo
email:
marc.gallardo@alliantabogados.com

2. # Summary
1.- What is ‘Big Data’
2.- Big Benefits
3.- Big Privacy Challenges
4.- Final Remarks

3. # 1 Definition
‘Big data usually refers to data sets
whose size is beyond the ability of
commonly-used technology tools to
capture, store, manage, and process
the data within a tolerable elapsed
time and cost’
 Not a new concept: « data mining »

4. # Defining Features

6. 5 exabytes of information created between the
dawn of civilization through 2003
Now 3 exabytes are created every day
1 terabyte (TB) = 1000 gigabytes (GB)
1 petabyte (PB) = 1.000.000 gigabytes (GB)
1 exabyte (EB) = 1.000.000.000 gigabytes (GB)
1 zettabyte (ZB) = 1.000.000.000.000 gigabytes (GB)
90 % of the data that now exists has been
created in the last 2 years
… and the pace is growing

8. # Other data sources

9. Tech
data Innovation
Software
Collection (Hadoop, NoSQL)
Vast amount of Hardware
Storage
data Processing (faster processors,
cheaper, bigger storage)
Sense-making
BIG DATA

10. # 2 Benefits

12. # 3 Privacy Risks
Big Data challenges
some of the core
privacy principles

15. Is the information amassed for such
analysis TRULY ANONYMOUS?
We can not be sure !!!
It can be relatively easy to take some
types of de-identified data and
reassociate it with specific individuals

17. Re-identification of data subjects
using Non Personal Data (NPD)
Whether or not NPD that forms
the basis for data extractions of
new knowledge is covered by our
data protection laws

19. Personal data is any
information about
identified or identifiable
person

21. # De Lege Ferenda
 Definition of PD and data subject
might be expanded to cover
technologies (i.e. data mining) that
make reverse engineering of forms of
« anonymisation » more feasible.
> crux point for the Regulation not to
become quickly obsolete.

22. Consent of Data Subject:
Freely given, specific, informed & explicit:
statement or affirmative action.
The problem under BD scenario is the DC
don’t know in advance what he may discover
after mining data so the data subject cannot
knowingly consent to the use of his data.

23. Automated individual decisions (AID) art. 15 DPD
Grants the right not to be subject to a decision
that produces legal effects which is based solely on
automated processing of data intented to evaluate
certain personal aspects.
Art. 12(a) grants the right to discover « the
knowledge of the logic ».
Limited scope: human intervention / knowledge
and remedy.

24. Automated individual decisions (AID) art. 20 DPR
Grants same right to oppose more broadly: not
only « evaluate » but analyse or predict the
person’s perfomance at work, economic situation,
location, health, personal preferences, reliability or
behaviour.
Right to « know the logic » is eliminated.
Right to know the existence and envisaged effect
of profiling.

25. To BD collectors & processors:
I. Engage PIA to identify and address risks relating
to BD analysis
2.- Be clear about what you collect and process
3.- Use de-identification techniques
4.- Secure the data to avoid data breaches

26. Good trend and the real challenge
for regulators
Preserve BD rewards
whilst seeking to
minimize privacy risks

27. # End
THANK YOU