Thread by @simdebro

Dear fellow data subjects, here's a thread about a paper I just published - about how you often knowingly (or not) share your peers' data along your own, and how service providers - but you too! - benefit from this and perpetuate this unfair phenomenon (1/13)

People’s decisions to use certain services may allow the data controller to know more about them, but also about others - think of a genetics firm discovering that you carry hereditary diseases, and applying this knowledge to your unaware/unconsenting family members (2/13)

To the (limited) extent that people can be said to ‘pay’ for a service with their data, part of the price is actually also other people’s data, the potential impact this has on them, and increased risks to their rights. I refer to this phenomenon as #PrivacyExternalities (3/13)

Externalities are costs/benefits imposed on 3rd parties who didn't choose to incur them, and are the by-product of an activity.
There are financial incentives and exploitative dynamics behind these disclosures of your peers' data, which perpetuate such phenomena: (4/13)

(1) Data controllers and users benefit from not having to invest time/resources into products and services that adequately take into consideration the user's peers (safeguards in product design; mechanisms of access to personal data; duty of notification).
The total cost (which..

...includes the cost for 3rd parties) is therefore greater than the cost advertised (which concerns the cost for the user only).
Providers can cut costs, and users can get cheaper products - but an invisible price paid by others, just like for pollution externalities (6/13)

(2) In the context of surveillance capitalism (or merely a business model relying on the accumulation&monetisation of as much data as possible), #PrivacyExternalities also make way for a profit-driven controller to (illegally) exploit these peers' data for its own benefits (7/13)

A good example: #privacybydesign in messaging services
When requesting access to your phone's contact list, @signalapp uses an elaborated mechanism that preserves your contacts' privacy, whereas FB Messenger asks the user to continuously upload her contacts' info to Facebook’s...

..servers, and to give consent for the data to be further processed (notably for ad purposes). Achieving privacy is resource-intensive, hence FB obviously saves resources on not developing the mechanisms that would prevent the externality of contacts' data sharing. However, ...

...FB also *actively* exploits the externality to generate profits: remember #ShadowProfile? FB processes your contacts' data (even non-FB users) to infer data about them and serve them targeted ads online.
The users themselves are not responsible for the abuse,... (10/13)

...yet they are the ones 'electing' one service-provider among many others, and exposing their peers to its intrusion and potential harm of *rogue* controllers.
There is a collective and interdependent aspect to privacy & data protection. (11/13)

Your DP-choices affect others' Data Protection. Be responsible, e.g. #useSignal
This *could* be a trifle issue if it were not systemic and taken advantage of by a business model that thrives on abuse. #SurveillanceCapitalism
It's also mainly an issue of enforcement (12/13)

I suggest two solutions for addressing this issue, but I *really* need your thoughts about the best way forward, esp. as the issue is often invisible for those affected.

The paper is open-access, have a read!
policyreview.info/articles/analy… (13/13)

Thanks to all the inspiring authors on whose work I built! Especially papers by (lead author)
@ReneLPMahieu @jorisvanhoboken @nhelberger @lilianedwards @mikarv @Symeonidis_I @airi_ @zephoria @alicetiara @Mark_MacCarthy @DennisDHirsch @omribenshahar Gergely Biczók ...

... @darahallinan @RobKitchin @MathiasOZ @SilviaPetulante @mantelero @HNissenbaum @Floridi