Privacy in the developing world: a global research agenda
Privacy is internationally recognized as a fundamental right. Yet the confines of the right to privacy are subject to never-ending games of tug-of-war between individuals, governments and corporations. These games are rarely fair – individuals are often under-informed and lack the capacity to assert and protect their privacy, while those who seek to erode it are increasingly overbearing and secretive. This is particularly the case in developing countries, where the absence of adequate legal and institutional frameworks and safeguards facilitates unhindered corporate intrusion into privacy. Governments also collect and share excessive amounts of personal data in the name of development, security and the modernization of public administration. In many developing countries, though constitutional provisions may already exist, privacy is still being entrenched, and the capacity of human rights organizations to educate and advocate is still growing. But in the meantime, governments are spying on their citizens, corporations are buying and selling personal data, and individuals are consistently losing the tug-of-war.
In 2010, Privacy International commenced a two-year project aimed at conducting research, building capacity and engaging with policy-makers in countries across Asia. Funded by the IDRC, the PrivAsia project was intended as a first step towards addressing the awareness, information and regulation deficits in developing countries. PI collaborated with partners in Bangladesh, Hong Kong Special Administration Region of China, India, Indonesia, Malaysia, Nepal, Pakistan, the Philippines and Thailand to conduct a wide range of activities, including research and analysis, policy engagement and advocacy, training on privacy issues, and media engagement.
The project exceeded all of our expectations. Privacy has now penetrated the public discourse in countries and is swiftly rising up the policy agenda. As well as greatly improving public awareness and understanding of privacy issues, and enlivening governments as to the need for better legislation, regulation and safeguards, PI’s partners have been at the forefront of many of the most serious challenges to privacy in recent years, including the implementation of the Unique ID project in India and the Watan Card in Pakistan.
Process
As the conclusion of the project in July 2012 approached, we set out to bring our existing partners together with new actors from Latin America, the Middle East and North Africa, to tap into the needs, experiences and expertise of those working in privacy issues across the developing world, and begin planning our future work on privacy in developing countries. On 23rd and 24th June 2012, over 40 experts from academia, human rights, the legal profession, the technology industry and the media assembled in London to discuss the state of privacy, surveillance and human rights in developing countries.
In order to maximize creativity and initiative, the workshop was designed in the Open Space format, where participants are invited to formulate the agenda, form breakout groups and discuss the issues they feel are the most important and relevant. Open Space sessions were interspersed with short presentations from Privacy International’s partners about the nature of their work and their achievements over the past two years.
Participants divided the discussion into two themes: the “what” and the “how”. The first day of the workshop was dedicated to the “what” – uncovering the dynamics of the most pressing threats to the right to privacy in developing countries. Much of the discussion focused on the paucity of laws and regulations and the failure to enforce existing laws and regulations. Of particular concern was the field of data protection, which in many countries is seriously under-regulated or governed by fragmented and weak regulations. Topics like the power of corporate interests and the effects of privatization of public services resounded with many participants, who expressed concerns that policy-makers are too quick to yield to corporate influence.
The collection and storage of biometric information and the use of ID cards was also an issue of great concern to participants, who discussed the implications of collecting biometric information across areas as diverse as identity theft, social sorting, criminal investigations and genetic profiling. Issues of discrimination, as well as potential infringements of sexual and reproductive rights were also considered. Another focus of the workshop was the export of surveillance technologies from Western countries to undemocratic regimes across the developing world. Related discussions about communication surveillance and collection of communications data arose, which then naturally extended to discussions of political intelligence gathering and the lack of oversight mechanisms to ensure the protection of privacy rights.
On the second day of the workshop, participants tackled the “how” of privacy advocacy and policy engagement in developing countries. A variety of ideas, questions and challenges arose from discussions, relating to building constituencies and alliances, generating common language and glossaries, and creating compelling narratives. Many participants spoke of the need for more comparative research on legal frameworks, and discussion focused on the importance of best practice examples in supporting advocacy efforts.
Thanks to the diversity in experience and perspectives of the workshop participants, discussion was stimulating and challenging, pushing the boundaries of previous ideas about how privacy is mediated in developing countries. Important networks were made and bonds formed both across and within regional groupings, as participants shared experiences and discovered common challenges. The dialogue and debate served to inspire the Privacy International team, and laid the foundations of Privacy International’s global research agenda.
Looking forward: a global research agenda for Privacy International and our partners
In the aftermath of the workshop, the Privacy International team set about synthesizing the ideas, needs, challenges and inputs raised by the participants into a cohesive programme of action and research. As well as seeking to understand the regional and national differences in terms of advocacy and research, PI tried to extract the thematic priorities for partners and understand how various elements of privacy are linked to or reinforce one another.
As a result of the workshop, PI understood that the core of its developing world agenda going forward would have to be detailed and rigorous research into the laws, regulations, practices and safeguards relating to privacy, surveillance and human rights. Collating and analyzing this information at the national level would enable partner organisations to better engage in domestic advocacy efforts, provide a valuable resource for partners in other countries and regions to draw on when designing their own research and advocacy, and allow PI to better map the development of privacy protections across the globe. In response to the feedback and ideas offered at the workshop, PI also isolated seven thematic intersecting areas around which partners will conduct discrete research and policy engagement projects. These can be summarized as follows:
Data protection
In the majority of developed countries the use – and misuse – of personal data provided by individuals to private and public entities is governed by extensive data regulation regimes. This does not mean that data protection in the developed world is perfect, but the legislative frameworks provide a basis for action and a space for debate, whereas in many developing countries these frameworks are either at a nascent stage, are not implemented or enforced, or simply do not exist at all. Given the rapid changes in communications, technology and the exchange and use of data in emerging economies across the world, research is urgently needed on the state of data protection in partner countries, and on comparable regulatory standards and best practices. The findings will help to facilitate policy engagement efforts designed to encourage the adoption, strengthening and implementation of data protection frameworks.
Communications surveillance
Access to and use of communications data is an issue of particular concern in developing countries, which tend to lack the necessary institutional frameworks, transparency norms and oversight mechanisms to ensure that the right to privacy is respected. Further research will be conducted to analyse the design and operation of different communications regimes, uncover surveillance practices, socialize norms of privacy in communications and advocate for legislative and regulatory protections in communications systems.
Export of surveillance technologies
Privacy International has been at the forefront of uncovering illicit and unethical export practices, which facilitate the transfer of advanced surveillance technologies from the West to undemocratic regimes in developing countries. These technologies are also being exported to developing countries that often lack the appropriate legal frameworks to implement surveillance techniques within the confines of the rule of law. We will continue to pursue such research with its partners in developing countries across the globe.
Political intelligence oversight
The high levels of autonomy and secrecy in the operation of national intelligence services is disturbing even in countries with advanced constitutional and human rights protections. In developing countries, the use of the intelligence services to monitor human rights defenders, political opponents and other groups of interest to the state can be truly frightening, particularly in the absence of judicial or legislative oversight mechanisms. Investigative work in developing countries will be pursued by our staff and partners, with the objective of uncovering the nature and operation of local intelligence services, and advocating for the strengthening of oversight mechanisms.
Politics, identity, sexual and reproductive rights, and social sorting
Under the dubious banners of public security, health, morals and order, governments are increasingly using personal data and surveillance to categorize and control citizens and organizations on the basis of the political affiliation, identity or minority status. This often amounts to a form of social sorting, whereby governments use controls to create and reinforce social differences and other forms of discrimination, or undermine the enjoyment of other human rights; for example, personal information derived from the health system may be illegitimately used to monitor pregnancies and abortions, or surveil people living with HIV/AIDs. Our research will aim to reveal that measures taken in the name of development and security may lead to the quashing of dissent, the violation of sexual and reproductive rights, and the entrenchment of social divides.
Delivery of public services
As governments adopt new technologies to meet the challenge of delivering public services to rapidly growing populations, the right to privacy is increasingly qualified by considerations of utility and efficiency. Many developing countries are establishing ehealth systems, gathering and digitizing vast amounts of personal, sensitive data about every individual who accesses the system, in the absence of sufficient privacy and confidentiality procedures. Social protection and cash transfer programmes, increasingly popular development tools, are also designed to collect and share excessive amounts of information with the aid of biometric technologies. So-called "smart technologies" are being adopted as a solution to the challenges of growth, urbanisation and climate change, without taking into account the implications for the privacy of citizens. Together with our partners we will research, investigate and critically analyse the state of privacy protections in public administration and public service delivery, with a particular focus on e-health systems and social protection programmes.
ID, DNA and biometrics
Closely related to the delivery of public services, including health services, is the introduction in most developing countries of identification systems, including ID cards and centralized, digitized DNA and biometric databases. The privacy risks associated with ID and biometric systems are numerous, ranging from identity theft and fraud to social sorting and persecution. PI and our partners have long been at the forefront of debates around identity systems in both the developing and developed world, and going forward will extend their research and advocacy efforts to new countries and regions where ID and biometrics is emerging as a key topic of public discourse.
The future of the right to privacy
Privacy International is excited to move ahead with its global research agenda, and looks forward to creating new partnerships and reinforcing existing collaborations in developing countries across the globe. However, it recognizes that just as the confines of the right to privacy are constantly changing, so too are the challenges to privacy. Acknowledging that the privacy and surveillance landscape will continue to change in the light of technological advancements and local, regional and global developments, Privacy International intends to continue to increase its global research and advocacy capacity in order to respond to such changes. By maintaining an international network of advisors and researchers, creating information sharing platforms, and facilitating regional and international communications between our partners, Privacy International will ensure it can engage with privacy threats and violations wherever and whenever they arise.
Over the next few years, we urgently need to:
- Identify the state of privacy protections in partner countries, and comparable standards and best practices, to facilitate policy engagement efforts designed to encourage the adoption, strengthening and implementation of data protection frameworks.
- Understand the design and operation of different communications regimes, and to uncover surveillance practices, to socialize norms of privacy in communications and advocate for legislative and regulatory protections in communications systems.
- Establish the appropriate legal frameworks to implement advanced surveillance techniques within the confines of the rule of law.
- Uncover the nature and operation of local intelligence services, and advocate for the strengthening of oversight mechanisms.
- Reveal that measures taken in the name of development and security may lead to the quashing of dissent, the violation of sexual and reproductive rights, and the entrenchment of social divides.
- Critically analyse the state of privacy protections in public service delivery, with a particular focus on e-health systems and social protection programmes.
- Extend existing research and advocacy efforts to new countries and regions where ID and biometrics is emerging as a key topic of public discourse.
The privacy and surveillance landscape shifts constantly in the wake of technological advancements and socio-political developments - our global research and advocacy will allow us to stay ahead of the curve.
