Way back in January 2020, the U.K. only had a handful of confirmed cases of COVID-19. Little did U.K. Information Commissioner Elizabeth Denham know that in a few months she would be opining on contact-tracing applications that would soon be downloaded by millions of citizens in an effort to combat an escalating pandemic.
It has been more than a year since the pandemic disrupted activity on a global scale, and while some small signs of hope from the worldwide emergency are starting to appear, there have been plenty of lessons for privacy professionals and regulators to glean from the age of COVID-19, especially given the rapid growth of the digital space.
"I think the genie was completely out of the bottle in 2020 when it came to the huge acceleration of digital and the huge acceleration of the use of data," Denham said during an IAPP Global Privacy Summit Online 2021 discussion. "I think we saw five years’ worth of acceleration in one year, and data protection has been a part of that."
Denham said she found the "old principles of data protection," such as fairness, due diligence and accountability, proved to be as useful as they had ever been as governments and private sector organizations wrestled with contact tracing and employee privacy. The initiatives may have been different, but the questions ultimately remained the same.
Those initiatives are likely not going anywhere in the near future, and Denham believes businesses and governments may advocate keeping a level of surveillance intact to use data for public interest purposes, a move that may not sit well with a public that wishes to see a return to a pre-pandemic status quo.
"I think there will be a tension between people and citizens thinking we should go back to the way things used to be with the boundaries and the barriers, and I think there will be a tension with that desire and government and businesses wanting to continue to innovate and go digital," Denham said.
The information commissioner does not see the biggest point of contention between these two sides to be the use of data for diagnostic and clinical trials but rather whether health location data will be decommissioned after the pandemic. Denham said the public does not expect to have this information used to follow them, particularly when there are still concerns around contact tracing and vaccine passports.
The COVID-19 pandemic changed many of the conversations around the use of data this past year. It also changed the agenda of the U.K. Information Commissioner's Office.
Denham said the ICO shifted 50 or 60 staff members into advisory roles. During one month in the pandemic, Denham estimated the ICO dolled out nearly 600 pieces of advice to organizations.
When looking back at how the ICO approached its role during the pandemic, Denham maintained the right call was made, even if it opened the ICO and herself to criticism.
"We really had to get a grip on helping organizations make the right decision, and we took some flack for this. We backed off on some of our investigations, which was our advertising technology investigation, because we thought that what the public really needed is for us to be on that advisory side," Denham said. "I’ve been criticized by civil society and others for taking a soft approach to (COVID-19), but I think it’s the best decision that we could make at a time with new business processes, new innovations and new data sharing between government departments and breaking down of traditional siloes. They needed us there."
The road to recovery from the COVID-19 pandemic will be a long one, but as Denham noted, there have been some signs of breakthroughs that allowed for the agency to revisit other items. The ICO has been able to return to its adtech investigation after putting it on pause last year.
The shift to a post-pandemic world will not happen overnight, and thus, the conversations around data protection and privacy that have been brought forth by the pandemic are not going to end any time soon. Data concerns will remain, and privacy professionals have their work cut out for them. Rather than focus on the burdens, Denham sees this as a compelling time to work in privacy.
"I guess what I would say to practitioners, chief privacy officers, data protection officers and other specialists, you are in the center of so many discussions," Denham said. "It’s never been a more fascinating time to be a data protection or privacy specialist than right now. There are real issues at the intersection of law, technology and society."
Photo by Waldemar Brandt on Unsplash
