The director of the Microsoft Chair for privacy and Digital Transformation, Ricard Martínez, talks about the value and importance of Internet user data, in addition to other current issues such as the legal regulations for the Internet or COVID tracking applications.

Ricard Martínez has a PhD in Law and his study has focused on the fundamental right to data protection and questions about information technology. He has collaborated with a multitude of entities such as the Spanish Data Protection Agency or the Conference of Rectors of Spanish Universities (CRUE-TIC). Currently, in addition to CRUE-TIC, he also coordinates the Working Group on Digital Rights of Citizens of the Ministry of Energy, Tourism and Digital Agenda. He has also collaborated with different universities as a professor and as a Data Protection Officer at the University of Valencia. He currently works as a professor for this in the Department of Constitutional Law, Political Science and Administration, in addition to being the director of the Microsoft Privacy and Digital Transformation Chair. He has numerous publications, both books and articles, in which he delves further into these topics.

The first thing and to get into the matter, what is this concept of Big Data and why has it become so relevant in recent years?

 Data, like oil, has always been there. 3,000 years ago there were already oil deposits that people used to polish ships, now we use that same oil as fuel. The same has happened with data. The arrival and appearance of the Internet has meant a huge change in the computing capacity that we have. Now we are dealing with a much higher volume of data and a speed to interpret them, thanks to technologies such as Cloud Computing or Machine Learning. Machines and computer programs like these have allowed data to be processed beyond human capabilities. Data can be studied and compared without the need for complex tables or structures to understand the human mind.

This has allowed much more massive analyses to be carried out. Thanks to this new treatment, it is possible to observe the trends and conditions of a population, on health and social issues, etc., and carry out preventive measures.

"Machines and computer programs like these have allowed data to be processed beyond human capabilities"

I recently heard that the value of the data has exceeded the aforementioned oil, how can this be explained?

 The effectiveness of this advertising is much greater than the traditional one. Emotions play a vital role when it comes to positioning your ads. On the Internet you know what ad to put at any given time so that it has the maximum possible success. For example, advertising a restaurant through traditional media will never have the same effect as showing the restaurant’s advertisement to people who, thanks to its GPS location, know that they are close to the area of the restaurant. Also, if you know that these people are there passing through or traveling, you also know that they are more likely to visit the restaurant.

Has data always had this value or has it increased with the advent of the Internet?

This is what we talked about at the beginning, the data has always been there, what has changed has been the ability to process it. Your data alone is of little use, but if these techniques are applied to the analysis of large amounts of data, they become of very high value and interest. These analyses can be directed to different areas; scientific, health, advertising... A simple example to understand is that thanks to these analyses, companies know which user to “attack” to achieve greater dissemination. Observing the data, users are chosen that within the network (or the social network) have a greater reach and interaction potential for marketing or advertising campaigns.

So is the user really interested in sharing these data?

The answer would be it depends. In theory the answer would be yes, and in most cases it is. But the reality is that it depends on the guarantees we have when using the web / application. If we are willing to offer our data, we must have guarantees that it will be used correctly and for a lawful purpose. Each user chooses its environment, what web pages s/he visits, what searches s/he does, what comments s/he writes, etc., and, based on this, companies decide which advertising to show her/him. To this “personalised” advertising, we must also add another very important factor, the ratings of the users themselves. This interaction is valuable both for companies (to know which products they like the most) and for other users when choosing a product over others. In the end, as I said, it depends on the guarantees we have that this data is used correctly.

"If we are willing to offer our data, we must have guarantees that it will be used correctly and for a lawful purpose"

It is here, to ensure the proper use of data, where I understand that the figure of the DPO comes into play, who is s/he and what role does s/he play for companies?

The DPO or Data Protection Officer is the regulatory compliance officer within a company, institution, whatever. That is, s/he is the one who supervises the performance of the company with the data it processes. It is a job that to do it requires, in addition to knowing the norm, having the skills to apply it in each context. For companies and institutions, such as the UV, that work with a large amount of data, the advice of a DPO is essential.

If even with this figure, the company commits an irregularity, does the legal responsibility fall on the Delegate?

The DPO is an independent figure from the company, institution, etc. It is a “collaborator” who reviews their management of the data, and as such has no legal responsibility for misuse that the company may do. However, as a compliance officer, the DPO has an obligation to report any violation or anomaly that it detects. Once this notification is made, the responsibility remains in the hands of the company.

Cases such as Brexit or the election of Donald Trump have set the alarm bells regarding the power of Big Data. Do you really believe that data processing can have the power to change a country’s elections? And what measures have been taken so that events like this do not happen again?

Nobody does magic and, if you are going to vote white, from one day to the next, makes you change and vote black. The strategy was to emotionally involve the undecided and get them to choose one side or the other. This has been investigated and both the European Parliament and the US Parliament have made their inquiries with various conclusions. One of the responses has been to establish greater vigilance over these companies to control their activity. The Netherlands, for example, eliminated all kinds of democratic voting that took place online. Twitter no longer allows political or ideological advertising on its platform. Furthermore, any such infringement would currently be judged as illegal data processing. As it is ideological data, the infringement would be of a very serious nature, with penalties ranging between 20 million euros and 4% of its income. In Spain, the largest fine of this type that has ever been is 8 million.

If the company, despite operating at a global level, is not based in Europe, can the company be sanctioned according to the European norm or is the country of origin the one in charge of judging it?

European law provides for this and you have the right to judge the company regardless of which country it is in. Provided that the crime was committed to a citizen or on European territory. Companies are required to appoint or send a representative to act on their behalf. The designated headquarters, for example, for Facebook is in Ireland, so if this company commits a crime, it would be the justice of this country who would be in charge of judging the company, in the first place. You can file a complaint with the police yourself if you believe that your data has been misused and this complaint will end up reaching this company in Ireland or the company that you have reported.

There are applications, such as COVID tracking ones, that create certain insecurity for people, how do these types of apps guarantee the privacy of the data that we offer them?

This kind of applications have unfortunately not been very successful here in Spain or in Europe. The model used to guarantee user privacy consists of a decentralised model of government control, keeping user data anonymous and verifying positive through the health system. The data here is used to verify the profile, but remains anonymous when stored. Verification of the positive is carried out using data from the health system. If the application detects that your data is positive, notify this to the rest of the application users who have been in contact with you, but without revealing any information or data about you. Here in the Valencian Community, for example, the application we have used worked differently. If the user has symptoms, s/he indicates them in the application. The information reaches a doctor, who attends you over the phone, with your medical history in front of you, to confirm whether the symptoms may be a sign of COVID or not.

"There are people who distrust applications such as COVID tracking ones while they have countless applications installed on their device that offer little or no guarantee of the proper use of your data"

Do you think, then, that the population is aware of how their privacy works and the management of data that is carried out on the Internet? How necessary do you see the work of disseminating these scientific and technological advances?

Society clearly needs more information and more training on privacy. They need this knowledge to be able to trust and distrust. To find out which website or application is going to use your data correctly and which one is not. Most people do not have a good notion about their privacy and how it really works, so their opinion and actions are driven by external stimuli. The objective of data analysis and processing is to help and improve people’s lives, but there are people who distrust applications such as COVID tracking ones while they have countless applications installed on their device that offer little or no guarantee of the proper use of your data.