Page 19 - FIGI - Big data, machine learning, consumer protection and privacy

of arbitration proceedings to resolve complaints and issues. There is extensive data that does not relate to
to bargain away their rights to be heard in court. an identifiable person that can be used for commer-
Instead, such laws insist on procedures ensuring that cial and social benefits. However, where personal
consumers have a fair and transparent process to data is used, it may give rise to concerns about the
hold providers accountable. privacy of the individuals concerned.
Thus, many countries’ laws protect consumers Privacy encompasses a broad range of notions.
against misleading product descriptions, unfair con- Whether viewed as a value or in terms of rights or
tract terms (e.g., exclusion of liability), faulty prod- protections, it has been boiled down by some schol-
ucts and lack of redress mechanisms. Such laws ars to concerns about “individuality, autonomy,
prohibit manufacturers and retailers from negotiat- integrity and dignity,” part of a broader range of
52
ing such terms with consumers, so that they can- ideas concerning freedom in personal and family life.
not argue that consumers consented to them when While privacy may refer to the individual’s free-
they bought the product or service. The consumer dom from others interfering with personal choices,
protection approach introduces minimum common particularly relating to their body, a large part of pri-
standards and procedures to provide a base level of vacy concerns what is known by whom about the
protection rather than leaving everything to consum- individual, and thus treatment of personal data. Data
er autonomy and responsibility. privacy is not the same as data security. Secure man-
Consumer protection laws have an important, agement of data is necessary to protect privacy, but
even symbiotic, relationship with competition law privacy concerns specific values relating to individu-
and policy. The asymmetry of bargaining power that al persons that need to be taken into account when
justifies consumer protection may be exacerbated ensuring data is secured.
where a market is concentrated and consumers lack Thus in the digital context, privacy involves con-
alternatives for a given service. There are currently trols on the collection, use and sharing of person-
increasingly calls to address high levels of market al data. “Personal data” is a term with a potentially
concentration in data markets from a competition vast meaning, extending to any information relating
policy perspective. The European Commission and to an identifiable individual. Most data protection
53
several Member States have been developing the- regimes recognise that some personal data is more
ories of harm around large tech firms that gather sensitive or easily susceptible to abuse than others
consumer data through business models that use and apply tightened controls accordingly.
such data to generate advertising revenue. Some Data about a person may be:
authorities such as Germany’s competition authori-
ty, the Bundeskartellamt, have raised the possibility • provided by the person (e.g., a user name, or a
that failure to respect consumer privacy rights can postcode);
in some circumstances amount to abuse of dom- • observed about the person (e.g., location data); or
inant market position under competition law. The • derived from provided or observed data (e.g.,
focus of this paper, however, is not on competition country of residence derived from the postcode);
law aspects of big data and machine learning, but on or
consumer protection and privacy issues. • inferred from the foregoing (e.g., a credit score)
A number of consumer protection measures dis- through deduction or reasoning from such data. 54
cussed in this paper are just as pertinent to sole
proprietor businesses and micro-, small- and medi- Consumers face privacy risks where their personal
um-sized enterprises (MSMEs). Where countries’ data may be accessed by unauthorised users, may
laws do not treat these as data subjects or con- be abused, or may be used for profiling that leads to
sumers, they may not benefit from the protections subjective inferences about the consumer that may
afforded under data protection and privacy laws. be difficult to verify, and may result in automated
There are strong arguments in favour of extending decisions that affect the individual’s life.
such protections to such businesses. A key privacy risk relates to the aggregation of
personal data. In the case of big data, this risk is
2�5 What is data privacy? aggravated where personal data is not anonymised,
or where pseudonymization or anonymization has
Privacy risks been attempted but the re-identification of the per-
Not all big data and machine learning techniques rely son remains possible (see section 6.3). Increasing-
on personal data or give rise to consumer protection ly, countries are legislating to protect the personal

Big data, machine learning, consumer protection and privacy 17