Transparency in Data Mining: From Theory to Practice - Discrimination and Privacy in the Information Society - page 303

While the right to “notice” is limited to the data subject, a strong argument
could be made to expand this right to the entire public in the predictive modeling
context. As prediction methods require the analysis of personal information which
pertains to almost the entire population, disclosure according to this theory must
also be provided to all. Everyone is a “data subject” one way or the other. Thus,
everyone should be provided with information regarding the way personal
information is used in this process.
Transparency premised on this specific theory might only have a limited reach.
The “notice” requirement usually includes informing individuals as to the way
their information is aggregated (segment (a)). Yet can the “notice” principle,
which is derived from the notion of data subject autonomy, justify broadening
transparency into the latter stages of the prediction process? Under EU Law, the
data subject must receive information regarding future purposes of personal
information analysis (a right referred to as “purpose specification”). 20 These rights
might translate into providing some of the information addressed in segment (b)
above. Yet reaching farther into the analysis process is quite a theoretical stretch.
One can argue that the latter steps of the data flow (segments (c) and (d)) all result
from the initial secondary uses of personal information. Therefore, data subjects'
autonomy and liberty should be acknowledged by providing them with a full view
of subsequent information flow.
Such arguments for the broadening of the autonomy argument to the latter
segments of the data mining process will probably be rejected. In the information
age, it is difficult to argue for (and surely, enforce) such a broad definition of
autonomy and control over personal information. This assertion follows from
recognizing the ease with which individuals concede their personal data in
commercial settings. It is noted that individuals value their privacy and fear
personal data would be subsequently used in a variety of ways. Yet such concerns
cannot justify providing individuals with control over events such as those
discussed here (in the latter stages of the predictive process). The collection of
personal information and its initial analysis are quite removed from the subsequent
use. I acknowledge that this analytical position is somewhat different from the
existing legal and theoretical setting in EU Data Protection law and theory. I
believe it is aligned, however, with actual information flows and market trends.
These indicate, in most cases, a loss of interest and control in personal information
which travels beyond a specific threshold of proximity to the relevant individual.
Furthermore, this autonomy-based theory is not sufficiently robust to justify the
specific forms of transparency the latter stages of the process call for. Autonomy
and control might provide a right to understand future analysis of the personal
data. Yet the above analysis indicates the need for ancillary information rights as
well. For instance, transparency calls for mandating governmental studies of the
causation underlying its actions, and the success and failure rates of the project.
The connection between such information and the autonomy (in the context of
control) rights of data subjects is even beyond incidental.
20 This right is found in Articles 10 and 11 of the Data Protection Directive 95/46/EC.