November 9, 2017

Do you have control over your health data?

Simon Kavanagh

Lifecare Chief Designer, Tieto

Do you remember that Café in Barcelona which served you a delicious cortado while you surfed their free WIFI? Do you remember the personal information you gave them when you signed up? Surely you read their terms and conditions? More importantly, do you know who has your information now and what they are doing with it?

If you are not working in the area of online privacy and security and are not a member of a group such as Necessary and Proportionate or routinely paint your face to confound facial recognition algorithms, then chances are you didn't know you were giving personal information away and you certainly don't know where it is now. It's also likely that you don’t really care. The majority of people who regularly use online services don’t know or care about the leakage of their personal information. The old adage states that if a service is free then you are the product (think GAFA) but it's also true that the most common response is: meh.

How will this effect your life?

What exactly is the problem with a café holding onto your email address, IP address, date of birth and name? What impact does this have on my life? Well, if I’m lucky then none at all. But luck is hardly a long-term strategy for online security. As more and more of my personal data is being vacuumed up, stored in dubious locations and used without my informed consent, then I will soon run out of luck.

Identity theft is one of the most obvious risks. A friend of mine recently told me of his experiences of being attacked in this manner. The most horrifying thing was the ease with which it happened.

  • Someone had collected basic information about him (name, address, phone number, social security number, etc.) and sold it to an attacker. Yes, there is a market for this; yes, it’s mostly on the “dark web”.
  • Armed with this basic information the attacker first phoned the victim's mobile phone operator, claiming to be the victim. He went on to explain he was travelling with his family and had forgotten his phone. He asked the mobile operator to forward all text messages to his wife's phone for 24 hours (which of course was the attacker's own).
  • Once this was in place the attacker went to the victim's online bank and logged in with 2-factor authentication. You thought 2-factor authentication was the zenith of online security? Consider: the two factors the attacker used was the mobile number and social security number combined with a onetime code sent as an SMS.
  • The victim, of course ignored this SMS and thought it was a mistake. The attacker got a copy of the SMS and used the code to log on and empty the victim's account.

Voila. From start to finish the attack took under 10 minutes. The seed was personal information stored in unsecure locations. It is a frightening story, but it's becoming more and more common. A recent study by a research group showed that in the US alone identity theft hit a record 15.4 million people in 2016, a rise of 16% on the previous year. And if you think it’s only your public Facebook profile which is leaking sensitive data, then take a deep breath and have a look at this map showing known medical data breaches in the US from 2009-2016.

You should care about your personal data

But maybe you don't believe identity theft is something which should concern you. Fair enough. Maybe you also don't believe your personal information can be used for phishing attacks (if not, see this nice guideline from the Finnish consumer authority). Fair enough. But there is another reason why you should care about your personal data, where it’s stored and what it’s used for. Namely, that it can have a very positive use for someone else - and even save their life – but not without your help.

To explore this, let's leave generic personal information such as address and phone number and move to medical information. If you were born in a western society in the last 50 years, then chances are that you've had a neonatal heel prick. You wouldn't remember it since you were probably less than a month old at the time. This is a routine blood test done to detect a range of congenital diseases. Some of these diseases, if treated early, will never develop to impact you. So, it’s all good medical practice. The blood sample which was taken at the time from your tiny heel is sometimes destroyed. Sometimes not. In 2012 it was discovered that over a million heel prick samples from Irish babies were being stored without consent. Despite the tremendous research potential this data source had, the samples were systematically destroyed. Storing them was judged, correctly, to contravene the nascent EU Data Protection Directive (a precursor of the GDPR). If consent could have been smoothly obtained then this sample data set (some going back decades) would have been very attractive in the area of genomics and preventative treatment. How many of these babies had genetic precursors for conditions which they did or didn't develop in later life? And what were the differences in their lives which could have contributed to their different outcomes? It's a common misconception that our genome is like a blueprint or a script. If you have a certain genetic precursor then it is set in stone that you will develop a certain way. The truth is more complicated and an area of intense research. Why does one identical twin develop a hereditary disease when their sibling does not, though they grew up together, shared the same experiences and have identical DNA? Unravelling these puzzles involves combining Genotype data with Phenotype data (how a person develops, what are their traits, what are the symptoms they present with). For that to happen, more quality data are needed from disparate sources and it needs to be combined with research focused on uncovering the links between the two. And here’s the tricky thing which Ireland was not able to get right in 2012: this data needs to move as per the owner's informed consent. In the Irish case it was decided that consent could not be easily (that is, affordably and securely) obtained. So, the only option was to destroy everything. If a consent network had been operational then the story might have been very different.

Tieto are aiming to lower the threshold

There are many challenges in building a consent network, but one of the biggest is getting ordinary people to care enough about their data and the uses it can be put to. This is the design challenge that Tieto (together with California start-up Gem) has undertaken. We see a future where anyone can see where their most valuable information is, what it is being used for and by whom. From there they should be able to take control and make informed decisions as to its use. We don't see technology as the major stumbling block here (although recent innovations in Distributed Ledger technology have meant that the consent solution itself doesn't end up as another weakly guarded honey pot of personal data). Raising awareness and combating apathy is much more challenging. Most people simply don't care. To succeed Tieto are aiming to lower the threshold to care about your own data. For this we are leaning heavily on user centred design. Together with a tight group of partners including biobanks, patient groups, hospitals, research institutions and independent data ethics auditors, we are putting down the rails for a truly transformative consent network which empowers people to take control of their personal data and use it to the benefit of society.

Although identity theft and other forms of data based attack will unfortunately become more and more common Tieto are committed to balancing those against a range of positive secondary uses of your personal data. And we want you to be in control.

Stay up-to-date

Get all the latest blogs sent you now!