Personal data hung in museum
THE exhibition was called Secret and opened in the Wuhan Art Museum in April. And what was in the show? The personal information of the 346 000 citizens of the central Chinese city of Wuhan that the artist Deng Yufeng had bought on the black market.
Treated with a special chemical, parts of the printed information are blotted out. Invisible under a fluorescent lamp, the data appears under ultraviolet light. Detailed in nature, the information displayed is chilling.
“Tan*, female, 28 years old, phone number:*; home address: Wuchang, Heping Avenue, Rongqiao Mansion*, drives a red BMW, licence plate number*, engine number* …
01/03/2018, 11:06 AM, bought 3 sets of baby commodities, 1 box of diapers and 3 boxes of milk powder on Taobao;
02/03/2018, 13:23 PM, bought 1 blouse and a pair of high-heel shoes on Taobao;
04/03/2018, 20:00 PM, bought the books – Infants Education and Parent-children Relations on Taobao.”
“Where is the ethical boundary between the data and each citizen?” asked Deng at the news conference before the exhibit’s opening.
A week later, the US Congress questioned Facebook chief executive Mark Zuckerberg about the social network’s infamous data leaks.
China has become a major player in data-based global enterprises. Some believe companies are emerging rapidly in this digital economy war because of lax privacy protections in China.
“This is sickening,” said someone contacted by event volunteers to see the show as their personal information was partly disclosed.
User data, as we have learned recently, plays a critical role in how many internet companies operate. They freely collect information whenever clients use their web applications and are asked to fill in data.
“Users have been largely unaware of this process. Yet their data was becoming the web companies’ most important assets,” said Nadia, director of the Nandou Personal Data Protection Research Centre (NPDPR).
Not only can this data be shared, sold and transferred; it can also be leaked in the process.
Since the first half of last year, the data of 1.9billion people has been leaked or stolen.
The security threat comes not only from sellers, but also from data collecting platforms.
“Nobody wants to become transparent on the web,” said an exhibition volunteer. “All one’s needs, as well as defects, are exposed by these apps. It’s horrendous. But users are forced to hand over their information when they register.”
Though China has an internet security law specifying users own the rights of access, choice, removal and correction of their personal data, few companies abide by the law.
“We may share your personal information and other data with a third party from time to time.”
“We may sell or rent out your information to others… ”
“Whatever happens, we are not to be held accountable.”
These are the common words used in the privacy protection terms of the 1550 web apps that Jiang Lin and her colleagues at NPDPR have found by evaluating them since last year.
Among the terms and conditions, typed in light grey at the bottom of the user agreement for a consumer guide app called “Fruit Library”, are the rights to pass on users’ contact information and the recorded content of their calls.
“According to our survey, few firms conform with the internet security law. Less than 10% of those surveyed reached the required level of transparency, while more than 80% failed our evaluation,” said Jiang Lin.
China’s online video hosting and streaming platforms, for example, require users to obtain a verification code when they register and their phone numbers are also obtained.
Upon first logging in to the mobile app of Youku, one of the country’s major online video services, it says: “We are permitted to read your phone number and telephone content to enforce account information security and recommend content better suited to you.”
After registering, access to the user agreement and privacy policy is nowhere to be found.
Again, “If you don’t agree with our privacy policy, this software and service won’t operate normally… When you use our software and related services this means you have fully understood the whole content of our privacy policy,” reads the privacy terms of Toutiao, one of China’s biggest news and information platforms, which uses data mining and machine learning technology to recommend personalised content for individual users.
Though functions such as “reading of contact data”, “direct calls” and “recording” appeared on the Android phone of Huawei, the multinational telecoms equipment company, its user agreement does not inform users explicitly what it would be permitted to read, nor for what use.
Whether it’s Alipay, the third-party online and mobile payment platform, Didi, the ridesharing behemoth that acquired Uber China in 2016, Taobao, the e-commerce website, or amap. com, a mapping application, they all mention in their privacy terms that they may share users’ information under certain circumstances without their consent. This includes academic research for the purpose of service quality or for authorised third party partners.
“Collection of personal data and processing should be subject to consent. So far, no law stipulates that personal information can be disclosed just because it has to do with academic research, legitimate news reports or credit evaluations without the users’ consent,” said Deng Xueping, an attorney for the Capital Equity Legal Group’s Shanghai office, and a former senior prosecutor.
As Jack Ma, founder and chief executive of the Alibaba Group, said recently: “The coming 30 years is where the enormous opportunities lie. Data will be the core resource.”
Zhou Kunxuan, chief executive of 23 Mofang, an online gene-testing company, said at a recent product launch: “Our users soared from 30000 to 160 000 within a year. We have the largest consumer-level genetic detection database in China.” All this relies on using people’s data.
While the boundary of data and its commercial uses expand, so do ethical issues. If biological characteristics of a person make up an important part of personal data, will an insurance company still cover you if it can predict you will soon be subject to a serious illness?
Li Kaifu, a Taiwaneseamerican venture capitalist who launched Google China in Beijing, once said: “Generally speaking, in China, scientific development takes precedence over vague moral concerns.”
Jiang Lin said almost none of the sampled companies comply with the “minimum necessity” principle to access clients’ sensitive personal data.
“A lot of enterprises collect as much data as possible because they believe that even if it may not be useful now, it could be one day.” – www.worldcrunch.com