In 2021, TikTok updated its privacy policy which allowed it to collect biometric data on its users, including faceprints and voiceprints. Rather than explicitly informing its users about this change, they only communicated that they were issuing a “privacy update” upon opening the app. Once people found out what the update entailed, they started growing concerned, and rightfully so. It’s a significant shift from companies collecting behavioral data on their consumers to something a little more invasive and without consent. Only 36% of Americans trust tech companies using facial recognition technology. In general, public trust in big tech has been steadily falling in the United States. Yet most of us still click “accept” to the Terms & Conditions on any website without actually knowing what we agree to. There’s been an apparent disconnect between what we expect from US businesses and what we blindly agree to.

What is Data Privacy

Everyone has data – name, age, gender, birthday, interests, browsing habits, etc. These aspects of a person’s identity fall under the Personal Data category. That data is valuable to big corporations, whether they sell the data to gain revenue for free services to their consumers or buy the data to advertise their products to potential consumers in a tactical, albeit intrusive, way. In the notorious  2018 Senate Hearing on Facebook, Mark Zuckerberg’s retort, when posed with the question of how Facebook remains profitable when its service is free, gave us a glimpse into an obvious yet disturbing truth behind the operations of a big tech company. “Senator, we run ads,” followed by a cheeky smirk. The purpose of data in the capitalist sphere we’ve grown all but too familiar with in the US has become predictive modeling of human behavior.

Data privacy can be defined as the careful handling of data throughout its lifecycle, from data creation to data deletion, based on its relative importance. It’s a field that has grown exponentially in the digital age, dealing with the management of data, governance, compliance, laws around it, consents, notices, and regulatory obligations. The Health Insurance Portability and Accountability Act, better known as HIPPA, is a policy in the healthcare sector that protects against institutions misusing patients’ medical and health data. It prevents healthcare organizations from giving out patient information on their physical and mental health and requires that healthcare and healthcare insurance industries protect this information from fraud or theft. This policy prevents insurance companies, pharmaceutical companies, and doctor’s offices from directly targeting people with personalized ads for products or services. HIPPA is the only sector-specific policy in the United States that protects people from having their personal information abused or exploited by large corporations. With only three states having adopted some form of data privacy law, it’s unclear how soon Congress will propose bi-partisan data privacy legislation. For the time being, it’s up to the individual states.

Legislation

It’s no surprise that the United States government is behind on data privacy regulation. As with many contemporary issues, it often takes a while for the government to create bi-partisan cooperation toward implementing change. Currently, the European Union is leading the data privacy venture with the General Data Protection Regulation (GDPR). Its creators intended for it to be the toughest privacy and security law in the world to date. Much like the right to the pursuit of liberty or free speech, the new EU regulation is stalwart in the idea that “the protection of natural persons concerning the processing of personal data is a fundamental right.” Under this regulation, EU citizens have the right to ask companies how their personal data is collected, stored, and used. They also have the right to request that their data be deleted from a company’s database (or CRM). Companies must get consent from a consumer before collecting and storing their data. With the exception of HIPPA, there is no centralized regulation that protects US citizens’ personal information from being abused by companies.

The closest piece of legislation we have exists only in California, whose government passed the California Consumer Privacy Act (CCPA) in 2018. Under CCPA, citizens have similar rights to those established in GDPR, except for a few differences. But it can be inferred by the name that CCPA only applies to California residents. Similar pieces of state legislation were passed in Virginia (the Consumer Data Protection Act) and Colorado (the Colorado Privacy Act), both in 2021. The biggest hurdle appears to be the extent to which Democrats and Republics want big companies to be penalized for mishandling personal consumer data. While Democrats want to enable consumers to hold businesses accountable for abusing their data, Republicans opt for more business-friendly legislation. Without centralized federal regulation, having varying data privacy laws by state makes the issue much more complicated. It leaves consumers unsure or unaware of their rights.

The Artist Experience

In 2016, Mozilla partnered with Tactical Tech to bring the Glass Room to London and New York City. This immersive exhibit, made to look like a tech store, was created to teach people about who is collecting their data online and why. The Glass Room attempts to demystify the world of data privacy in a vast digital world where one can lose themselves without knowing it. It does so by getting participants to think about how they interact with online platforms and helps visualize and contextualize otherwise abstract ideas.  

To move through the Glass Room is to be reminded of the many ways we unwittingly submit ourselves and one another to unnecessary surveillance, with devastating consequences

The New York Times

As with any other complex social issue, artists have been quick to be the messengers of social and moral concern. The beauty of the arts is that they can convince people that they need to care about something. Humans are inherently visual creatures, but it sometimes takes more than just showing an audience why something is a problem. Some artists have gone so far as to make an audience live a problem, either in an immersive exhibition or through some “alternate universe Black Mirror” way. One such experience is German artist Tobias Leingruber’s Facebook ID card project. In 2012, Leingruber created Facebook ID cards for his guests at an art event. This concept was somewhat influenced by George Orwell’s 1984. Leingruber’s project lends commentary to how social media pervades our everyday lives. If we allow digital platforms to consume our identity little by little, where is the line drawn? And because we give such importance to having an online presence, is it really unimaginable that one day we base our value on the digital content we so meticulously curated to achieve some level of social status?

Netflix’s Black Mirror episode Nosedive also played with this idea in 2016, in which a woman’s life unravels over her slowly deteriorating “social media score” as she desperately tries to cling to the small amount of social standing she has. While these are two extreme examples (thankfully, in the ten years since, Leingruber’s fake project hasn’t become a reality), the main question coming to my mind is what happens to us when nothing is private anymore? In the United States, citizens are very well aware of their rights as established by the Constitution. Yet when a significant data breach at a big company occurs, collectively, we aren’t as outraged by it. This isn’t to say that civil and constitutional rights aren’t as necessary. But as the EU established in the GDPR, “the protection of natural persons in relation to the processing of personal data is a fundamental right.” As more of our personal lives become exposed and our habits become exploited by big business, how does the nonprofit sector factor into all this?

Arts Nonprofits’ Adaptability

In a society where technological trends feel almost ephemeral, it’s understandable why many nonprofit art organizations are slow to adopt the most up-to-date data collection, storage, and management technologies. Several factors come into play, like lack of funding, tech-hesitant Boards of Directors, and a general lack of awareness of systems that would make the work more efficient. Even many for-profit entities are behind the curve when it comes to having a data strategy. But as opposed to for-profit businesses, nonprofits could be using data from their communities to create more effective programming tailored to their target audience’s needs. These efforts are crucial to achieving its mission. One author noted that when organizations lack the data architecture to fully leverage the data available to them, the actual opportunity cost is innovation.

Knowing how to use the data is only part of the equation, though.

As if investing in data collection and management alone wasn’t a whole new world for nonprofits, we now add the complex issue of consumer privacy into the mix. The lack of US regulation around data privacy begs the question: what responsibility do the private and nonprofit sectors have in this realm? While there is little US legislation for the private sector, there is even less for the nonprofit sector, leaving organizations even more in the dark. Yet, data has become more crucial than ever in understanding their target demographic, creating appropriate programming, and effective marketing materials in nonprofits. However, the lack of data architecture and policies leaves nonprofit organizations vulnerable to data breaches equally, if not more. The New Jersey Shakespeare Theater experienced a ransomware attack in 2019. Hackers disabled the organization’s access to its ticketing system and patron database. Several other breaches have occurred in which hackers gained access to an organization’s funder information, costing them tens of thousands of dollars, practically forcing some to shut down.

Because nonprofits don’t operate as a traditional “business” and because those kinds of data breaches don’t typically make headlines, this may be seen as a trivial issue. But as entities that hold personal identifying information on patrons, donors, employees, and Board members, nonprofits have just as much an obligation to protect their data as do for-profit businesses. The following are starting points nonprofits should heavily consider in developing a long-term strategy for data storage and protection:

• Understand the legislation (discussed above) that exists to develop protection plans
• Form a data and cyber security governance committee
• Embrace cloud-based storage software
• Properly educate employees on data security

Conclusion

The arts can be used to inform the public about this issue and make it understandable through a more tangible medium. With the current lack of legislation in the United States, the arts can bring awareness to this issue and empower the public to push the federal government to implement change. All in all, nonprofit arts organizations have the same responsibility as for-profit and government entities to protect personal consumer data and use it ethically. The relationship between people, their data, and business is significantly unbalanced. But artists and arts organizations can help restore the balance by acting in the best interests of the public and using legislation such as the GDPR as a reference.

Resources

Alexander, Alistair. “The Glass Room: Big data, privacy and interactive art.” Mob Lab. April 28, 2018. https://mobilisationlab.org/stories/big-data-privacy-interactive-art/.

Crittenden, Elizabeth. “Let’s Talk: TikTok’s Privacy Update And Incubator For Black Creatives, Spotify’s Speech Recognition Technology, And More.” Arts Management & Technology Laboratory. June 22, 2021. https://amt-lab.org/podcasts-interviews/2021/6/lets-talk-tiktok-privacy-update-and-incubator-for-black-creatives-spotify-speech-recognition-technology.

DalleMule, Leandro and Thomas H. Davenport. “What’s Your Data Strategy?” Harvard Business Review. May-June 2017. https://hbr.org/2017/05/whats-your-data-strategy.

“Data Privacy – Definitions, Importance, Legislations / Privacy laws.” Data Privacy Acts. May 12, 2020. https://dataprivacyacts.com/data-privacy-everything-you-need-to-know/.

Fang, Jiashun. “What Makes Facial Recognition Controversial?” Arts Management & Technology Laboratory. February 13, 2020. https://amt-lab.org/blog/2020/2/what-makes-facial-recognition-controversial.

Frankfurt, Tal. “How To Avoid Security Breaches In The Nonprofit Sector.” Forbes. March 31, 2021. https://www.forbes.com/sites/forbestechcouncil/2021/03/31/how-to-avoid-security-breaches-in-the-nonprofit-sector/?sh=1be2a0095ce0.

Fried, Ina and Mike Allen. “Exclusive: Trust in tech craters.” Axios. March 31, 2021. https://www.axios.com/edelman-trust-barometer-tech-5787acea-8ef5-4d0b 96946e4f8eb006c4.html.

GDPR.eu. “General Data Protection Regulation (GDPR).” Accessed April 6, 2022.  https://gdpr.eu/tag/gdpr/.

Jehl, Laura and Alan Friel. “CCPA and GDPR Comparison Chart.” Baker Hostetler LLP.  Accessed April 30, 2022.     https://www.bakerlaw.com/webfiles/Privacy/2018/Articles/CCPA-GDPR-Chart.pdf.

“Legislative Preview: Data privacy”. Congressional Quarterly Magazine. February 14, 2022. https://advance-lexis-com.cmu.idm.oclc.org/api/permalink/73df9d80-2c49-4f29  a233-3ca744502911/?context=1516831.

Leingruber, Tobias. “FB Bureau Berlin: Get Your Fb Identity Card!!” Free Art and Technology Lab. February 24, 2012. http://fffff.at/fb-bureau-berlin-get-your-fb-identity-card/.

NBC News. “Senator Asks How Facebook Remains Free, Mark Zuckerberg Smirks: ‘We Run Ads’ | NBC News.” April 10, 2018, 1:00. YouTube video. https://www.youtube.com/watch?v=n2H8wx1aBiQ.

“Nosedive.” IMDb. Accessed April 30, 2022. https://www.imdb.com/title/tt5497778/.

Pardes, Arielle. “What Is GDPR and Why Should You Care?” Wired. May 24, 2018. https://www.wired.com/story/how-gdpr-affects-you/.

Pyne, Lydia. “A Data Artist’s Guide to Putting People (and Privacy) First.” Hyperallergic. May 6, 2021. https://hyperallergic.com/641187/living-in-data-jer-thorp/.

Rippy, Sarah. “Colorado Privacy Act becomes law.” IAPP. July 8, 2021. https://iapp.org/news/a/colorado-privacy-act-becomes-law/#:~:text=Sarah%20Rippy%20IAPP%20Member%20Contributor%20On%20July%208%2C,earlier%20this%20year%2C%20to%20enact%20comprehensive%20privacy%20legislation.

Rippy, Sarah. “Virginia passes the Consumer Data Protection Act.” IAPP. March 31, 2021. https://iapp.org/news/a/virginia-passes-the-consumer-data-protection-act/.

Schenker, Dylan. “Artist Explores Online Identity and Privacy With Facebook ID Cards.” VICE. March 5, 2012. https://www.vice.com/en/article/z4y5z8/artist-explores-online-identity-and-privacy-with-facebook-id-cards.

State Of California Department of Justice Office of the Attorney General. “California Consumer Privacy Act (CCPA).” Accessed April 22, 2022. https://www.oag.ca.gov/privacy/ccpa?msclkid=7dc2492cbd9411ec867bf5984af6282d.

“The Week in Breach: 12/04/19 – 12/10/19.” DeckerWright Corporation Blog. December 11, 2019. https://www.deckerwright.com/blog/the-week-in-breach-1-5.

“What is CRM?” Keap. Accessed May 2, 2022. https://keap.com/product/what-is-crm.

Younanzadeh, Emanuel. “Why Your Company’s Data Architecture Is More Important Than the Data Itself.” Forbes. April 13, 2022. https://www.forbes.com/sites/forbescommunicationscouncil/2022/04/13/why-your-companys-data-architecture-is-more-important-than-the-data-itself/?sh=609e81e85311.

The State of Digital Privacy

Due to the structure of the digital economy, numerous stakeholders over the past two decades have advocated for better regulation. In response, the European Union enacted a new privacy regulation called the General Data Protection Regulation (GDPR) in 2018. The regulation included stipulations on how data should be stored, how consent can be obtained from consumers, and how organizations must comply with consumer requests to delete their data.

While GDPR and other privacy regulations like the California Consumer Privacy Act attempt to improve the privacy landscape, emerging technologies have shifted it yet again. The Internet of Things (IoT) – devices of all sorts that are connected to the internet – has expanded exponentially, increasing the data that is collected without much oversight. An example of this is a smart home thermostat that is ostensibly collecting and sending data to the company about heat consumption, but is in reality also tracking other things like electricity usage or times when you are not home.

It isn’t just the Internet of Things; the use of artificial intelligence-enabled services has also increased. AI-enabled social media platforms like TikTok, Instagram, Facebook, and Twitter all require users to agree to their terms and conditions, many of which have onerous data collection and usage stipulations. Many Internet users express a desire for privacy while still using services and devices that have opaque privacy and data collection policies, thereby acting inconsistently with their stated privacy preferences.

All of this is important for arts organizations, especially as it becomes harder to reach audiences through non-digital means. Two studies conducted by Lutie Rodriguez of the Arts Management & Technology Lab underline the challenges that arts organizations face in the privacy space. She reports that while 90% of nonprofits are collecting data, 49% of surveyed nonprofit professionals were unable to articulate how it was collected. Additionally, she found that in a subset of 100 arts organizations, 55 had no privacy policy on their website. These data points indicate that merely raising the level of awareness at arts and nonprofit organizations would be an improvement in the way they implemented privacy tools and techniques.

Tools and Techniques for Digital Privacy

While there are challenges to implementing privacy in today’s digital infrastructure, there are numerous existing tools and techniques that arts organizations can leverage. Some require resources, but many merely require an understanding of privacy techniques and some forward thinking. In this next section, we dig into several areas through which arts enterprises can implement digital privacy: organizationally, through art and artists, and by knowing what techniques to avoid.

Organizational Tools and Techniques

Some arts organizations are already trying to offer their customers more privacy-conscious tools, such as the Lebanon Public Library System which has started to offer a Virtual Private Network (VPN) service in order to allow their users to shield their web usage. This is a technique requiring resources but means that library patrons can browse the internet and conduct important personal business such as logging into a bank account without worry of data compromise.

Another example of privacy-conscious practices in the arts is a privacy-preserving machine learning framework for video analysis called ARTYCUL. This framework allows museums to use their CCTV cameras to inform them about the preferences of their visitors based on foot traffic. The most important aspect of this framework is that it does not collect information on visitor identity in any way, unlike many other products in the security market that use facial recognition. 

In the same vein as ARTYCUL, there are a number of other ways that arts organizations can modify existing practices to be more privacy-conscious. For instance, many nonprofit organizations use data mining to assist in marketing or funding. Instead of following industry practices of collecting all existing data, organizations could instead use privacy-preserving machine learning techniques that protect the identities of users while still offering important insights.

Privacy-preserving techniques also exist for location-based data, which many museums use to assist with digital enhancements to physical exhibits. Without adding extra infrastructure or requirements, museums can use altered machine learning techniques that anonymize and aggregate location data to protect user privacy. 

A great example of this technique is a mobile application that was developed to track the spread of COVID-19. Health professionals and developers came up with an application that was compliant for handling sensitive health data and used location-based data for epidemiological purposes without compromising user privacy. This application is a clear illustration of the power of privacy-preserving techniques that arts organizations could implement as a part of their digital infrastructure.

A final technique for arts organizations to ensure user privacy is to add or validate usable opt-out features for their website or online presence. Historically, many websites have made it opaque and challenging, if not impossible, for users to understand what data was being collected and to opt-out if desired. Arts organizations can easily add this infrastructure without much overhead. Other research suggests that notifications for interactive exhibits at museums can feel invasive if timed poorly, meaning that arts organizations should consider the effect they want to have on their websites and mobile applications from a privacy perspective before implementing them.

Engagement with Digital Privacy through Art

While it is important to address privacy at an organizational level, arts enterprises also have a unique ability to educate and inspire their audiences. Many artists are rising to that challenge in the digital privacy space by engaging with the topic in their art. Examples of this include engagement with facial recognition and some of its nefarious uses, especially for populations that are already marginalized.

Another example is an art exhibit entitled Think Privacy,” in which the artist directly confronts the ways that social media extracts user data. It features brightly colored posters with provocative quotes that warn audiences to think and work on improving their privacy, such as “Meta Data Kills” and “Users Make, Brands Take”. A final example of artists engaging directly with digital privacy is at the Museum of Contemporary Photography, where an exhibit called “In Real Life” examined “the most polarized forms of imagery” today: surveillance cameras and facial recognition.

Techniques and Patterns to Avoid

Finally, another way arts organizations can leverage existing techniques and tools is by learning from the past mistakes of other industries and organizations. This means avoiding harmful digital patterns and privacy pitfalls, such as the dark patterns in applications like Tinder or programs like Adobe Acrobat. It also means ensuring compliance with data regulations and with common sense privacy practices, thereby avoiding situations such as Google’s Arts and Culture application being banned for the way it used data. 

Conclusion

While digital privacy at a large scale seems daunting, there are numerous ways that arts organizations can elevate their privacy profile without significant overhead or infrastructural change. This article has offered a broad look at some of the existing techniques and tools that arts organizations could leverage, and underlines the importance of raising privacy awareness.

References

Abbas, Roba, Katina Michael, and M. G. Michael. 2015. “Location-Based Privacy, Protection, Safety, and Security.” In Privacy in a Digital, Networked World: Technologies, Implications and Solutions, edited by Sherali Zeadally and Mohamad Badra, 391–414. Cham: Springer International Publishing. https://doi.org/10.1007/978-3-319-08470-1_16.

Ardagna, Claudio A., Marco Cremonini, Ernesto Damiani, Sabrina De Capitani di Vimercati, and Pierangela Samarati. 2007. “Privacy-Enhanced Location Services Information.” In Digital Privacy. Auerbach Publications.

Beja, Ido, Joel Lanir, and Tsvi Kuflik. 2015. “Examining Factors Influencing the Disruptiveness of Notifications in a Mobile Museum Context.” Human–Computer Interaction 30 (5): 433–72. https://doi.org/10.1080/07370024.2015.1005093.

Dimick, Mikayla. 2020. “The Environment Surrounding Facial Recognition: Do the Benefits Outweigh Security Risks?” AMT Lab @ CMU. August 17, 2020. https://amt-lab.org/blog/2020/8/the-environment-surrounding-facial-recognition-do-the-benefits-outweigh-security-risks.

Harvey, Adam. n.d. “Think Privacy.” 21st Century Digital Art. Accessed April 4, 2022. http://www.digiart21.org/art/think-privacy.

Landau, Susan. 2021. “Digital Exposure Tools: Design for Privacy, Efficacy, and Equity.” Science (American Association for the Advancement of Science) 373 (6560): 1202–4. https://doi.org/10.1126/science.abi9852.

Leon, Pedro, Blase Ur, Richard Shay, Yang Wang, Rebecca Balebako, and Lorrie Cranor. 2012. “Why Johnny Can’t Opt out: A Usability Evaluation of Tools to Limit Online Behavioral Advertising.” In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems, 589–98. Austin Texas USA: ACM. https://doi.org/10.1145/2207676.2207759.

Leverett, Eireann. 2018. “The Internet of Things: The Risks and Impacts of Ubiquitous Computing.” In Partners for Preservation, 81–100. https://doi.org/10.29085/9781783303496.009.

Mahmoodi, Čurdová, J., Henking, C., Kunz, M., Matić, K., Mohr, P., & Vovko, M. 2018. “Internet Users’ Valuation of Enhanced Data Protection on Social Media: Which Aspects of Privacy Are Worth the Most?” Frontiers in Psychology (9): 1516–1516. https://doi.org/10.3389/fpsyg.2018.01516.

McAndrew, Chuck. 2020. “LibraryVPN:” Information Technology and Libraries 39 (2). https://doi.org/10.6017/ital.v39i2.12391.

Nguyen, Stephanie, and Jasmine McNealy. n.d. “I, Obscura — Illuminating Deceptive Design Patterns in the Wild.” Stanford’s Digital Civil Society Lab & UCLA’s Center for Critical Internet Inquiry. https://pacscenter.stanford.edu/wp-content/uploads/2021/07/I-Obscura-Zine.pdf.

Nicas, Jack. 2018. “Why Google Won’t Search for Art Look-Alikes in Some States; Popular Selfie Tool in Art & Culture App Is Blocked in Illinois and Texas Because of Privacy Laws.” WSJ Pro. Cyber Security, January, n/a.

Nkonde, Mutale. 2019. “Automated Anti-Blackness: Facial Recognition in Brooklyn, New York.” Harvard Kennedy School Journal of African American Policy, 7.

Pester, Nick, and Nick Orringe. 2018. “Right to Privacy.” Property Journal, June, 52–53.

Preibusch, Sören. 2015. “How to Explore Consumers’ Privacy Choices with Behavioral Economics.” In Privacy in a Digital, Networked World: Technologies, Implications and Solutions, edited by Sherali Zeadally and Mohamad Badra, 313–41. Cham: Springer International Publishing. https://doi.org/10.1007/978-3-319-08470-1_14.

Rodriguez, Lutie. 2020a. “What Arts Nonprofits Should Know About Data Privacy and Security.” AMT Lab @ CMU. April 14, 2020. https://amt-lab.org/blog/2020/4/what-arts-nonprofits-should-know-about-data-privacy-and-security.

Rodriguez, Lutie. 2020b. “Why More Arts Organizations Need Privacy Policies.” AMT Lab @ CMU. May 28, 2020. https://amt-lab.org/blog/2020/5/why-more-arts-organizations-need-privacy-policies.

Sinha, Smita. 2018. “How Google’s Arts & Culture App Uses AI, Facial Recognition to Find Your Museum Doppelgänger.” Analytics India Magazine. February 19, 2018. https://analyticsindiamag.com/googles-arts-culture-app-uses-ai-facial-recognition-find-museum-doppelganger/.

Su, Chunhua, Jianying Zhou, Feng Bao, Guilin Wang, and Kouichi Sakurai. 2007. “Privacy-Preservation Techniques in Data Mining.” In Digital Privacy. Auerbach Publications.

Tanwar, Gatha, Ritu Chauhan, and Eiad Yafi. 2021. “ARTYCUL: A Privacy-Preserving ML-Driven Framework to Determine the Popularity of a Cultural Exhibit on Display.” Sensors 21 (4): 1527. https://doi.org/10.3390/s21041527.

Zarley, B. David. n.d. “High-Tech Art Exhibit Looks at Life through the Eyes of AI.” Freethink (blog). Accessed April 4, 2022. https://www.freethink.com/technology/facial-recognition-exhibition.