{"id":1315,"date":"2022-05-04T12:21:15","date_gmt":"2022-05-04T16:21:15","guid":{"rendered":"https:\/\/courses.ideate.cmu.edu\/62-830\/s2022\/?p=1315"},"modified":"2022-05-04T12:21:55","modified_gmt":"2022-05-04T16:21:55","slug":"an-introduction-to-data-privacy-in-the-arts","status":"publish","type":"post","link":"https:\/\/courses.ideate.cmu.edu\/62-830\/s2022\/?p=1315","title":{"rendered":"An Introduction to Data Privacy in the Arts"},"content":{"rendered":"\n

Intro<\/strong><\/p>\n\n\n\n

In 2021, TikTok updated its privacy policy which allowed it to collect biometric data on its users<\/a>, including faceprints and voiceprints. Rather than explicitly informing its users about this change, they only communicated that they were issuing a \u201cprivacy update\u201d upon opening the app. Once people found out what the update entailed, they started growing concerned, and rightfully so. It\u2019s a significant shift from companies collecting behavioral data on their consumers to something a little more invasive and without consent. Only 36% of Americans<\/a> trust tech companies using facial recognition technology. In general, public trust in big tech has been steadily falling<\/a> in the United States. Yet most of us still click \u201caccept\u201d to the Terms & Conditions on any website without actually knowing what we agree to. There\u2019s been an apparent disconnect between what we expect from US businesses and what we blindly agree to.<\/p>\n\n\n\n

<\/p>\n\n\n\n

What is Data Privacy<\/strong><\/p>\n\n\n\n

Everyone has data \u2013 name, age, gender, birthday, interests, browsing habits, etc. These aspects of a person\u2019s identity fall under the Personal Data category. That data is valuable to big corporations, whether they sell the data to gain revenue for free services to their consumers or buy the data to advertise their products to potential consumers in a tactical, albeit intrusive, way. In the notorious  2018 Senate Hearing on Facebook<\/a>, Mark Zuckerberg\u2019s retort, when posed with the question of how Facebook remains profitable when its service is free, gave us a glimpse into an obvious yet disturbing truth behind the operations of a big tech company. \u201cSenator, we run ads,\u201d followed by a cheeky smirk. The purpose of data in the capitalist sphere we\u2019ve grown all but too familiar with in the US has become predictive modeling of human behavior<\/a>.<\/p>\n\n\n\n

Data privacy can be defined as the careful handling of data throughout its lifecycle, from data creation to data deletion, based on its relative importance<\/a>. It\u2019s a field that has grown exponentially in the digital age, dealing with the management of data, governance, compliance, laws around it, consents, notices, and regulatory obligations<\/a>. The Health Insurance Portability and Accountability Act, better known as HIPPA, is a policy in the healthcare sector that protects against institutions misusing patients\u2019 medical and health data. It prevents healthcare organizations from giving out patient information on their physical and mental health and requires that healthcare and healthcare insurance industries protect this information from fraud or theft<\/a>. This policy prevents insurance companies, pharmaceutical companies, and doctor\u2019s offices from directly targeting people with personalized ads for products or services. HIPPA is the only sector-specific policy in the United States that protects people from having their personal information abused or exploited by large corporations. With only three states having adopted some form of data privacy law<\/a>, it\u2019s unclear how soon Congress will propose bi-partisan data privacy legislation. For the time being, it\u2019s up to the individual states.<\/p>\n\n\n\n

<\/p>\n\n\n\n

Legislation<\/strong><\/p>\n\n\n\n

It\u2019s no surprise that the United States government is behind on data privacy regulation. As with many contemporary issues, it often takes a while for the government to create bi-partisan cooperation toward implementing change. Currently, the European Union is leading the data privacy venture with the General Data Protection Regulation (GDPR). Its creators intended for it to be the toughest privacy and security law in the world<\/a> to date. Much like the right to the pursuit of liberty or free speech, the new EU regulation is stalwart in the idea that \u201cthe protection of natural persons concerning the processing of personal data is a fundamental right.\u201d Under this regulation, EU citizens have the right to ask companies how their personal data is collected, stored, and used.<\/a> They also have the right to request that their data be deleted from a company\u2019s database (or CRM<\/a>). Companies must get consent from a consumer before collecting and storing their data. With the exception of HIPPA, there is no centralized regulation that protects US citizens\u2019 personal information from being abused by companies.<\/p>\n\n\n\n

The closest piece of legislation we have exists only in California, whose government passed the California Consumer Privacy Act (CCPA)<\/a> in 2018. Under CCPA, citizens have similar rights to those established in GDPR, except for a few differences<\/a>. But it can be inferred by the name that CCPA only applies to California residents. Similar pieces of state legislation were passed in Virginia (the Consumer Data Protection Act)<\/a> and Colorado (the Colorado Privacy Act)<\/a>, both in 2021. The biggest hurdle appears to be the extent to which Democrats and Republics want big companies to be penalized<\/a> for mishandling personal consumer data. While Democrats want to enable consumers to hold businesses accountable for abusing their data, Republicans opt for more business-friendly legislation. Without centralized federal regulation, having varying data privacy laws by state makes the issue much more complicated. It leaves consumers unsure or unaware of their rights.<\/p>\n\n\n\n

<\/p>\n\n\n\n

The Artist Experience<\/strong><\/p>\n\n\n\n

In 2016, Mozilla partnered with Tactical Tech to bring the Glass Room<\/a> to London and New York City. This immersive exhibit, made to look like a tech store, was created to teach people about who is collecting their data online and why. The Glass Room attempts to demystify the world of data privacy in a vast digital world where one can lose themselves without knowing it. It does so by getting participants to think about how they interact with online platforms and helps visualize and contextualize otherwise abstract ideas.  <\/p>\n\n\n\n

To move through the Glass Room is to be reminded of the many ways we unwittingly submit ourselves and one another to unnecessary surveillance, with devastating consequences<\/em><\/p>The New York Times<\/cite><\/blockquote>\n\n\n\n

As with any other complex social issue, artists have been quick to be the messengers of social and moral concern. The beauty of the arts is that they can convince people that they need to care about something. Humans are inherently visual creatures, but it sometimes takes more than just showing<\/em> an audience why something is a problem. Some artists have gone so far as to make an audience live<\/em> a problem, either in an immersive exhibition or through some \u201calternate universe Black Mirror\u201d way. One such experience is German artist Tobias Leingruber\u2019s Facebook ID card project<\/a>. In 2012, Leingruber created Facebook ID cards for his guests at an art event. This concept was somewhat influenced by George Orwell\u2019s 1984<\/em>. Leingruber\u2019s project lends commentary to how social media pervades our everyday lives. If we allow digital platforms to consume our identity little by little, where is the line drawn? And because we give such importance to having an online presence, is it really unimaginable that one day we base our value on the digital content we so meticulously curated to achieve some level of social status?<\/p>\n\n\n\n

\"\"
Tobias Leingruber’s Facebook ID Card<\/figcaption><\/figure>\n\n\n\n

Netflix\u2019s Black Mirror episode Nosedive<\/em><\/a> also played with this idea in 2016, in which a woman\u2019s life unravels over her slowly deteriorating \u201csocial media score\u201d as she desperately tries to cling to the small amount of social standing she has. While these are two extreme examples (thankfully, in the ten years since, Leingruber\u2019s fake project hasn\u2019t become a reality), the main question coming to my mind is what happens to us when nothing is private anymore? In the United States, citizens are very well aware of their rights as established by the Constitution. Yet when a significant data breach at a big company occurs, collectively, we aren\u2019t as outraged by it. This isn\u2019t to say that civil and constitutional rights aren\u2019t as necessary. But as the EU established in the GDPR, \u201cthe protection of natural persons in relation to the processing of personal data is a fundamental right.\u201d As more of our personal lives become exposed and our habits become exploited by big business, how does the nonprofit sector factor into all this?<\/p>\n\n\n\n

<\/p>\n\n\n\n

Arts Nonprofits\u2019 Adaptability<\/strong><\/p>\n\n\n\n

In a society where technological trends feel almost ephemeral, it\u2019s understandable why many nonprofit art organizations are slow to adopt the most up-to-date data collection, storage, and management technologies. Several factors come into play, like lack of funding, tech-hesitant Boards of Directors, and a general lack of awareness of systems that would make the work more efficient. Even many for-profit entities are behind the curve when it comes to having a data strategy<\/a>. But as opposed to for-profit businesses, nonprofits could be using data from their communities to create more effective programming tailored to their target audience\u2019s needs. These efforts are crucial to achieving its mission. One author noted that when organizations lack the data architecture to fully leverage the data available to them, the actual opportunity cost is innovation<\/a>.<\/p>\n\n\n\n

Knowing how to use the data is only part of the equation, though.<\/p>\n\n\n\n

As if investing in data collection and management alone wasn\u2019t a whole new world for nonprofits, we now add the complex issue of consumer privacy into the mix. The lack of US regulation around data privacy begs the question: what responsibility do the private and nonprofit sectors have in this realm? While there is little US legislation for the private sector, there is even less for the nonprofit sector, leaving organizations even more in the dark. Yet, data has become more crucial than ever in understanding their target demographic, creating appropriate programming, and effective marketing materials in nonprofits. However, the lack of data architecture and policies leaves nonprofit organizations vulnerable to data breaches equally, if not more. The New Jersey Shakespeare Theater experienced a ransomware attack in 2019. Hackers disabled the organization\u2019s access to its ticketing system and patron database<\/a>. Several other breaches have occurred in which hackers gained access to an organization\u2019s funder information, costing them tens of thousands of dollars, practically forcing some to shut down.<\/p>\n\n\n\n

Because nonprofits don\u2019t operate as a traditional \u201cbusiness\u201d and because those kinds of data breaches don\u2019t typically make headlines, this may be seen as a trivial issue. But as entities that hold personal identifying information on patrons, donors, employees, and Board members, nonprofits have just as much an obligation to protect their data as do for-profit businesses. The following are starting points nonprofits should heavily consider in developing a long-term strategy for data storage and protection<\/a>:<\/p>\n\n\n\n