Media Release

 

FOR RELEASE: 29 May 2019

CPRC research finds Australian consumers in the dark when it comes to data free-for-all

New report highlights current business practices and necessary reforms to prepare Australia for the Fourth Industrial Revolution

Consumer Policy Research’s Centre (CPRC)’s latest report – A Day in the Life of Data – illustrates the bewildering volume and scope of data collected about consumers just as they go about their daily lives.

The Fourth Industrial Revolution is here, and personal information is increasingly being collected and commodified while legislation fails to keep up.

Led by CPRC Senior Research and Policy Officer, Brigid Richmond, the report presents the personal data extracted from consumers each day, often without their full knowledge, understanding, or consent.

“It’s time for Australia to join the action being taken globally by policymakers and regulators to foster ethical innovation and good data practices. There needs to be an active decision by government to protect the rights and welfare of consumers in the Fourth Industrial Revolution,” says Brigid.

“In this report, we took an average 24-hour period and analysed how data is collected, used, shared and stored across a range of common products and services. We also explored how this information is being conveyed consumers.”

A Day in the Life of Data highlights how technology enables online and offline tracking of consumers with greater precision, volume and velocity than ever before. From this data companies can infer everything from personality, health status, and political affiliations, through to even our mood.

Potential harms include manipulation, discrimination and exclusion, personal security risks, and consumer mistrust, along with unique risks for children who have now grown up in a connected world.

“We know that a lot of good can come from empowering consumers with more control over their data, but stronger laws are required to protect against exploitation and deliver greater transparency,” Brigid explains.

“Most importantly in this research, we engaged directly with consumers to gauge their level of awareness about data collection and use, experiences with online privacy policies, and concerns about the very real harms of poor data practices.”

“We found the often-misplaced trust that consumers have in companies quite striking. Many believed they had full control of their own data and were able to maintain a high level of privacy. Details of just how far their data travels, and the potential consequences, resulted in some very shaken responses.”

The report outlines several policy responses and business practices which CPRC CEO, Lauren Solomon says will be critical to ensuring that innovation and markets operate in line with community values and expectations.

“As a nation we risk losing the value presented by the data economy, which simply cannot operate without the trust of consumers and the broader community,” warns Lauren.

“To build and strengthen this trust, our research finds that both government and business must focus on transparency, protecting fundamental human rights, preventing exploitation and ensuring consumers gain a fair share of the value generated by new data-fuelled technologies.”

“Globally, consumer groups, policymakers and regulators are all taking steps to protect consumers in the Fourth Industrial Revolution, while ensuring innovation thrives and economies grow. We need decisive action to pull Australia out of the digital backwater and ensure we regain our reputation as tech innovators and early adopters. There is significant societal and economic risk in failing to act now.”

CPRC partnered with data trust, ethics and privacy firm, Greater Than X on the qualitative components of the research and the better business practices.

Greater Than X Co-founder and CEO, Nathan Kinch believes this kind of research is both timely and essential to get businesses to ask what data privacy means to them, why consumer trust is so low, and how they can regain it.

“There is a critical gap – the mechanisms through which companies convey legal agreements, such as privacy notices and terms and conditions, is broken. Individuals should be empowered with dynamic tools that enable them to learn and take informed action. This needs to be done in a way that simplifies, rather than complexifies, daily life,” says Nathan.

“In an experiment with everyday consumers, we documented their navigation of legal agreements when purchasing online, and their reactions when presented with the extent to which their data is collected and processed. The participants’ responses to the data collection and processing supported existing research globally. The majority of participants demonstrated physical discomfort. Many articulated their disbelief and fear of potential harms.”

“It is critical that government, industry and the community work together. A high trust digital economy benefits everyone, from citizens to businesses and government agencies. Trust is the key to sustainable growth. In this report we’ve outlined six core elements of ethical business design. These practices are essential to designing ethical, verifiably trustworthy digital services for all Australians.”

A Day in the Life of Data was launched today during CPRC’s first Consumer Policy Connect Series webinar for 2019, which featured Lauren Solomon and Brigid Richmond from CPRC, Nathan Kinch and Mat Mytka from Greater than X, and Dr Chris Culnane from the University of Melbourne’s Department of Computing and Information Systems.

An overview of the key research findings, policy responses and better business practices is provided on the following page, with the full report available here.  Lauren Solomon, Brigid Richmond and Nathan Kinch are available for interview on request.

About Consumer Policy Research Centre (CPRC)

CPRC is an independent, non-profit, consumer think-tank established with seed funding by the Victorian Government in 2016. CPRC undertakes consumer research independently and in partnership with others to inform evidence-based policy and business practice change. We work closely with policymakers, regulators, academia, industry and the community sector to develop, translate and promote evidence-based research to inform practice and policy change.

Fact Sheet

CPRC Research Report: A Day in the Life of Data

Key stats:

  • The average person would need to spend 76 days to read all the digital privacy policies they have agreed to in that year.1
  • Greater than X’s qualitative consumer experiment showed that the privacy policies and terms and conditions that would need to be read an accepted for a typical purchase of a Valentine’s Day present would take over three hours to read.
  • Data tracking is big business. Sales of location-based targeted advertising alone is estimated to reach around US$21 billion in 2019. 2
  • It is estimated that 91% of the top one million websites track their visitors.3 82% of web traffic has Google trackers, 28% has a hidden Facebook pixel.4
  • 39% of advertising and tracking services analysed were cross-tracking device services, able to identify the same users across multiple devices.5
  • 2018 research conducted on behalf of CPRC found that 71% of consumers did not want their location data shared with third parties.6
  • In 2018 majority of the 5,855 most popular children’s apps were not using – or incorrectly using - the settings to disable tracking of children.7
  • When location data is updated hourly, only four spatio-temporal data points are required to identify 95% of individuals.8

Main research findings:

  1. Data tracking is increasingly inescapable. Trackers are common offline and online. Even nonusers of major services such as Google and Facebook are being tracked by those companies.
  2. Data collection is largely opaque. Consumers don’t understand what they are handing over or the value of that data. Policymakers will find it difficult to design effective remedies unless the supply chain governing data collection, sharing and use is more transparent.
  3. Consumers feel overwhelmed by privacy policies with limited understanding of, or control, over their data.
  4. Targeted advertising is not the major harm. The more significant harms – and the harms that policymakers and regulators should be discussing – are the growing risk of consumer manipulation, discrimination and exclusion based on automated decision-making using online and offline profile data.
  5. Transparency and accountability are key. The key issues for policymakers are: requiring transparency, enabling consumer comprehension and control, implementing accountability measures (for data collection and for automated decision-making), and establishing minimum protection standards.

1 https://www.nytimes.com/2019/02/02/opinion/internet-facebook-google-consent.html

2 https://www.nytimes.com/interactive/2018/12/10/business/location-data-privacy-apps.html

3 https://www.vice.com/en_us/article/xwjden/targeted-advertising-is-ruining-the-internet-and-breaking-the-world

4 https://whotracks.me/

5 http://eprints.networks.imdea.org/1744/

6 https://cprc.org.au/2018/07/15/report-consumer-data-digital-economy/

7 https://blues.cs.berkeley.edu/blog/2018/04/25/wont-somebody-think-of-the-children-examining-coppa-compliance-at-scale/

8 https://arxiv.org/abs/1712.05627