If there is one characteristic that distinguish human beings from other animals, it is the way in which it establish relationships with others from the same species. The complexity of human connections spread across its culture and social organization. It is as a group that exists and manifest itself throughout many natural environments, such as the sky, the bottom of the sea, the outer space and the virtual space.
To occupy such places, we use special equipment that adapt our bodies and allow us to fly, to dive and transport ourselves across the globe. Unlike flying and diving, the interface that allows us to navigate throughout the virtual space do not transport our physical bodies, but instead, a representation through cables and electromagnetic waves. This representation is a profile.
Virtual society
Profiles are what occupy the virtual space. From a browser session to a digital user record, profiles are the special clothing that allows us to manifest and express ourselves in a space shared with half of global population. Individuals, companies, governments and many other organizational groups establish relationships inside the virtual space and, together, compose a social organization that function over computers. If in past times the biggest human settlements from history were built around river margins, the biggest human settlements from the digital era are built over servers that share the same communication protocol.
Barriers have another meaning in the digital space. They do not divide borders, cultures or languages, and profiles freely travel around the world searching for connections. News, messages, phone calls, articles, games and many other forms of communication nurture connections between people from many places over the world, with speed and distance that have no precedent throughout history.
A lot of what we know about the past is revealed through objects, carcasses and nature observations that tell chapters of stories from their times. When establishing a connection, profiles leave footsteps that, like buried objects, are found by virtual archaeologists. Studying those footsteps from many profiles allow some to know human behaviors with precision. That knowledge, which is yield by a few, can grant powers that vary from anticipate personal preferences to shake democratic structures.
Picture of a shoulder bag created by North American natives from the end of XVIII century. This object reveal some of the culture and costumes from the people that lived in North America. Source: Metropolitan Art Museum of New York.
Diminishing virtual existence
In 2008, Barack Obama’s presidential campaign became a model after using data from many sources to get to know the electorate of each North American state. Data was used to classify voters by categories as affinity with democratic party ideals, consumer habits and sociodemographic information. All digital communication strategies and speeches from the former candidate were built based on that data. Barack Obama became the 44º elected president of the United States, and the digital specialists team that made that possible sold the technology that elected a president to governments and companies.
Eleven years later, political consultant company Cambridge Analytica filed a bankruptcy request, after accusations of using unauthorized profile data to influence voter behavior. The company had created an app inside Facebook to profile psychological traits based on a series of questions, answered by about 270.000 people. The respondents, as well as their connections on Facebook, had their data collected and organized in a database summing up 50 million profiles. After breaking Facebook’s terms of service, the app was banished. Facebook was fined 5 billion dollars and his founder and CEO, Mark Zuckerberg, called to testify before a North American court.
Outside the political spectrum, companies built business models around the collection and processing of profile data. Examples are Netflix and Spotify, with their technologies capable of predicting personal preferences. Other businesses are less known and, sometimes, use profile data without proper consent from their holders. Some of those practices won headlines from newspapers around the world. In 2012, North American retailer Target was accused of using their customer's data to predict which ones might be pregnant in order to personalize their marketing campaigns. The mere possibility of a company having that kind of information generated protests, and Target publicly defended itself from the accusations. In 2015, a data leak from extramarital social network Ashley Madison revealed not only the data of 39 million users, but bad data management practices from Ruby Corporation, the company behind the social network. Users were forced to pay in order to have their data removed from their databases, employees used fake accounts to interact with profiles and security flaws were found in the site’s source code. In 2017, the company paid 11.2 million dollars to close all legal disputes under its former name, Avid Media Group.
Picture of the previous Ashley Madison's home page. Source: Reuters.
Profiles went from tools to create connections to open diaries. The small online communities that shared the ideals of a free internet proposed by Tim Berners-Lee were replaced by big digital urban centers, with companies that violate the individuality in the digital space and transform it in business, without proper consent from people whose data are collected.
Political events have the ability to alter the course of technology development. Just like Barack Obama’s presidential campaign was a milestone to the use of predictive technologies, Cambridge Analytica scandal was the event that urged the development of many civil and political movements around the creation of data security policies in the digital space.
Data protection and digital rights
General Data Protection and Regulation, or GDPR, is the biggest initiative to protect profiles in the digital space, replacing a data protection law created in 1995 at European Union. The law, a response to Cambridge Analytica’s case, was sanctioned at European Union and applied in 2019. Around the world, many similar initiatives to protect data were created or are being studied. Data protection laws give decision power over any data that is collected and processed to their holders. This power is based on the principles of transparency, permission and data control. Citizens naturalized in countries that have data protection laws similar to GDPR can:
- know what a company does with their data;
- decide how a company can use their data;
- modify and revoke permissions that were previously consent in regard of their data.
Data protection laws are an important step in order to guarantee travel safety in the digital space. They hold on two premises:
- people know how the business models of companies that they interact with work;
- any individual is capable to uphold their right to be holder of any created data.
Half of the world population do not have access to the internet. In Brazil, 28% of the population do not access the internet. Before Covid-19 pandemic, almost 25% of the population had no bank account, number that dropped to 5% after federal government paid a financial aid. The lower rates of people without bank accounts in Brazil and Latin America is praised by financial companies, that have access to a new customer segment to sell their services. It is possible that many of those accounts in Brazil become inactive once the financial aid ends, but data from those customers will stay with banking institutions. These people will not read terms of service and understand the details on how their data will be used when they need the aid to survive.
People waiting in front of an office of federal banking Caixa Econômica Federal. Source: O Globo.
Even who uphold their right to be holder of its data cannot guarantee that such rights will be respected. If you appear in a photo with other people, taken by a photographic camera that do not belong to you, your image will be stored in a place which you do not have control. With pictures, smartphone cameras save metadata with information that describe the image, like date and time that the picture was taken and where it was taken, using the phone’s GPS system. If the holder of the picture decides to upload it in a social network or an app that apply face filters, you can’t avoid having data that represent you traveling to those places.
In 2014, Google lost a legal dispute against Spanish social justice and work minister Mario Costeja González, who asked the company to remove from its search results any matches that could bring the minister’s name. After the case was close, Google created a channel to receive requests from European citizens who want to be remove from search results in what was called “the right to be forgotten”.
Not all people will read and understand every clause from every service term that they use, which would take days, even less will get involved in legal disputes over something that don’t seen to cause much harm. In order to guarantee a safe existence in the digital space, we need more than laws that recognize the ownership of digital data. Profiles are required in order to travel across the virtual space, which have more and more importance in order to be part of a society. It is to guarantee a virtual existence that is safe and free to participate that profiles must become digital citizens, with rights and obligations before the virtual society.
Digital citizenship
Brazilian work laws, abbreviated as CLT, represent a milestone in the relationship between wage workers and employers. This law prohibit abusive work practices such as excessive working hours and working conditions similar to slavery, and create a standard negotiation to exchange workforce for compensation. Some sections of the law define maximum working hours and minimum resting time between work days, minimum wage and compensated vacations. Companies comply with the law registering the job relationship in the employee’s work card, at the company’s employee register book, in a contract signed by both the employee and the company, and registering the employee at the state bank Caixa Econômica Federal. This process is supervised by the government’s Minister of Work. If one of the sides break the agreement, the other can seek the work justice to solve the dispute.
Four work cards open. Source: City of Curitiba's Government
Similar mechanisms were adopted to create Brazilian data protection laws sanctioned in 2020 under the abbreviation LGPD. This law states that citizens are the holders of their data. As a holder, it has the right to know how companies use its data, request copies and deletions of any information that any company have on the holder. The law appoints the ANPD, Brazilian National Authority of Data Protection, institution that will uphold the law and apply fines to companies that aren’t complying with LGPD.
Agreements between employees and employers are traceable by inpection agencies, unlike companies that hold profile data on databases under their control. In January 2021, a database with information from 220 million Brazilians was being sold on the internet. The people that claimed responsibility for its release told that the database was stole from Serasa Experian, a Brazilian company specialized in data intelligence for consumer credit services. Serasa Experian was notified by Brazilian consumer protection agency Procon, but up to this day the company denies that the data was stolen from its database. No one was accounted for the theft. Since it is being developed and can only apply fines after August 2021, ANPD was not capable of acting on the leak.
Some professional categories in Brazil require certifications that prove aptitude to work, like doctors, lawyers and engineers. Those certifications are issued by institutions related to federal and state governments, that are also responsible to guarantee that the workers will apply their knowledge on behalf of the interests of the people. Professionals that work with data management do not have similar certifications, and the decisions that they make with the data that is collected are carried only based on the interests of the companies that they work for.
Data protection laws are the first step to give voice to the people in the digital space, but they are not enough to guarantee that technology developments do not diminish or extinguish the presence of vulnerable groups online. Only when profiles are recognized as digital citizens, companies are monitored by independent entities and data professionals prove that they will uplold the interests of citizens when working with their data, digital space will be safe for people to freely manifest, express and connect themselves with the world.