Public policy is an instrument that is used by nation-states to achieve their aspirations. The moral codes held and shared together by society compel its policymakers to draft policies, laws, and regulations that represent the ethos and aspirations of society.
Humans have historically relied on information and data to innovate and create value within society. The banking and financial sector, medical facility providers, and government entities have always relied on information and data to deliver services, create products and contribute towards the overall socio-economic growth of society. However, the size, structure, and usability of the data have varied throughout human history.
In today’s world, improved computational capabilities have enabled businesses and public and private organizations to better structure their data in the form of huge databases and leverage analytics to generate business intelligence and contribute value creation.
With these computational and analytical capabilities, there are increasing avenues to develop profiles of humans’ behavior around their purchasing, spending, and consumption habits, their genetic profiling, their travel history, medical history, etc. While these capabilities add value to human society, they also come with risks of intruding into individuals’ privacy.
Unfortunately, the discourse around personal data is only centered around its protection from leakage or prevention from the breach. However, the primary objective to safeguard personal data is to ensure that such data are not processed to create a more inequitable society and bring about unfair outcomes.
The amount of discrete data available today allows us to bring more nuance and innovations into public policy, therefore aiding in ironing out any imbalances within society.
Public policy experts wish to avail themselves of discrete personal data accumulated by public and private organizations to effectively address issues associated with healthcare, financial sustainability, and overall security concerns.
To put forward any policy recommendations, there is a need to identify broad patterns of human behavior and propose a solution that may further require some algorithmic decision-making. This identification of human behavior or preferences and then associating it with respect to ethnicities, race or religion can cause the wedges within a society to deepen even further.
Therefore, the protection of personal data has not just associated with its secure storage in safe or information systems but rather it’s fair processing that helps to eliminate or minimize the asymmetry within the social classes of the society. But when such personal data used to carve out policies that might be extractive in nature or to target a particular section of a society, then there is a strong likelihood that it would end up legalizing prejudice and systemic racism.
There is strong contention among privacy advocates that the use of such discrete personal data can strengthen the elite capture and cultivate extractive public policies where minorities of the society can be a further target for extraction.
Consider the scenario in which increasing medical treatment costs need to address within a society, and as the public policymakers begin to crunch through the data, they figure out that a substantial chunk of medical costs has associated with the treatment of a specific disease. That might be more prevalent within individuals and families of a specific racial or ethnic background.
If public policymakers or regulatory authorities use similar information to allow medical insurance companies to increase the insurance premium for individuals belonging to that racial or ethnic community. Then it may put the community at a disadvantageous position or may deprive some of the similar communities to afford medical insurance at all.
There can be various similar scenarios where minority sections of the society could subjected to policy decisions that will inflict damage to the society’s fabric. And therefore, such data processing might serve as a tool to perpetuate the problem rather than the solution.
Data privacy, therefore, needs to see as a public policy challenge and not just as an information security issue. The objective of protecting personal data has linked to the creation of a fair, harmonious, and just society.
Editor’s note: Visit ISACA’s privacy page for additional information about privacy, including frameworks and guides, certification and training, and other featured resources.
About the author: Muneeb is an Information Security & Privacy Consultant with a forte in strategy, program development, governance, and compliance. Based in the Middle East region, he has worked with clients from the financial, governmental, and telecommunication sectors to help them in developing and implement cybersecurity and privacy programs in accordance with their regulatory, legal, and compliance requirements. He has contributed with his knowledge and expertise through various writings, podcasts, policy reviews, and conference appearances.
For more details, visit https://www.linkedin.com/in/muneebimranshaikh/.
Author:
Muneeb Imran Shaikh, CISSP, CRISC, CCSP, PMI-ACP, ISO 27001, ISO 27701 LI, COBIT 2019, CDPSE, Competitive Strategy & Innovation – London School of Economics
Date Published: 7 March 2023
Visit CxO Global FORUM or CxO News Live for all the latest updates.
