[First published on LinkedIn June 30, 2023]<\/p>\n
This blog is the second part of the iLearn trilogy, written in reflection of my Secondment courtesy of the OpenInnoTrain<\/a> project, funded by the European Commission, and hosted by Anne-Laure Mention<\/a>. This part is heavily inspired by my conversations with Dan Harris and David Rousell from the Creative Agency<\/a> (RMIT University<\/a>). The discussions focused on my team\u2019s Academy of Finland funded project, BUGGED<\/a> (The Emotional Experience of Privacy, Cyber Security and Ethics in Everyday Pervasive Computing), and the work that David, Dan and colleagues have been doing over the years.<\/p>\n For a while now, my team (Hanna-Kaisa Alanen<\/a>, Ville Vakkuri<\/a> and Satu Rantakokko<\/a>) and I have been negotiating the significance of the General Data Protection Regulation (GDPR). From a research perspective, there are several interesting and somewhat unnerving dimensions to the regulation. From the outset, there seems to be pro-citizen intentions behind GDPR. The thought of being able to control one\u2019s data through understanding of its collection and processing, and the ability to \u2018opt-in\u2019 or \u2018opt-out\u2019 seems like one step forward. Yet, as many of you would have already noticed, there are a few pitfalls already to this first step. Hands up those of you who actually read every cookie sign you encounter? <\/em>And, do you accept the cookie statement and data collection before or after reading?<\/p>\n How do these statements make you feel? Do you feel in control of where your data is going? Do they really increase your awareness? Or, do they leave you with some doubts and hesitations, even though you did accept, because you want access to that content at the other side of the statement?<\/p>\n So, there\u2019s a shadow of doubt, a taste of darkness and possible receipt when entering into a website of your favorite artist, entertainment website, supermarket, or even public service. The statement was placed there in your best interest, but you haven\u2019t spent the time in familiarizing yourself adequately, and now you are the lazy, negligent user.<\/p>\n Then, what about the spaces in which you don\u2019t \u2018opt in\u2019 or \u2018opt out\u2019? Unless, of course, you do your homework well and choose routes known not to have Closed Circuit Television (CCTV) for instance (see the fascinating work of CCTV detection<\/a> by Andrei Costin\u2019s team), you will not doubt be leaking data every step you take.<\/p>\n While planning this current visit, I deliberated data collection in relation to which part of the BUGGED project I would focus on (Sensations of Privacy <\/em>(degree of spookiness), Ethics & Behaviour <\/em>(boundaries), Threads of Experience <\/em>(stories), and Design4Comfort <\/em>(principles). In\u00a0the first draft of my research plan I mentioned \u2018data collection\u2019. The plan boomeranged by administration highlighting the complexity of importing data into Europe thanks to GDPR. Naturally, this fact is complex and baffling in itself, assuming that cloud storage would be used, which renders even the European data international.<\/p>\n Yet, I began considering a few aspects of this matter. Firstly, contemporary challenges to research. Already research ethics, ethical clearances, and the knowledge of ethical clearance application processes, committee meetings, and amendments, have meant that in time-challenging situations, researchers are discouraged from engaging in topics and target groups requiring clearance. But now, in relation to GDPR, it feels that this ethical clearance process is multiplied in a chain of events that does not merely stop with the publication of anonymized results, yet, which a line of responsibility and accountability that sees the guardianship of data, where it\u2019s stored, how it\u2019s accessed lasting years after the research is published. Moreover, not only are the researchers responsible for this data, but so too are many individuals and teams across institutions.<\/p>\n Thus, another aspect about GDPR that I began to consider was whether or not, indeed, GDPR is intended to protect people so much as frighten them. A whole new economy driven by data has emerged. That\u2019s true. Has GDPR stopped data trade? You can answer that yourselves. Certainly, internet scamming, fraud and identity theft are rampant.<\/p>\n Definitely. But, what about the rest of it?<\/p>\n Talking about this with David Rousell and Dan Harris was empowering. I had begun to take an approach of fully identifiable<\/strong><\/em> data collection, where participants have agency and attribution. Patting myself on the back for originality, David was quick to share his experiences of reclaiming data<\/em><\/a>through projects with children and young people in which he and colleagues such as Liz de Freitas projected electrodermal activity (EDA) data onto walls, playing with the performativity of the children, their bodies, and their interaction with their own sub- and unconscious data. This data represents just a portion of the pervasive data collection practices that the world of commerce engages in to access the unconscious psycho-physiological systems resting at the core of human existence. In their work, Rousell and colleagues embody this data through iMotion technology and enable children to reclaim what is theirs.<\/p>\n