Impacts From Regulatory Shortfalls

Introduction

As the world has transitioned into the age of big data, the need for data privacy and ethical data management process has increased. Unfortunately, regulations requiring ethical practices and the employment of unbiased models have yet to catch up. With many organizations only bound to create increased profit from the use of data, many ethical practices to ensure models are without bias are not mandatory but simply good practices. The first part of this paper will present ethics and fairness issues of data privacy among three New York Times Privacy Project topics. The second part of this paper will outline current efforts from the Data Privacy Lab to address the issues presented in part one. Finally, this paper will illustrate how the lack of regulations within the United States has downstream harm in several critical areas of data use regarding facial recognition model creation, anonymity, and identity protection and provide input on how to employ AI recommendation systems can thwart some current issues until legislation can catch up to current technology.

Part One

Privacy Protection Laws and Regulations

To highlight the need for more regulation outlining how the United States Government oversees data management and data sharing, Singer references the large gap in how the Government addresses several other areas of consumer protection. For example, when Apple discovered that laptop batteries could overheat and pose a fire hazard, the Consumer Protection Safety Commission issued a warning to inform apple users of potential harm (Singer, 2021). When it was identified that Fitbit wristbands began to cause skin rashes and blisters, the consumer safety agency issued a recall of the product to protect consumers (Singer, 2021). Unfortunately, the same level of oversight and protection for privacy does not currently exist within the United States.

Unlike Federal agencies created to ensure that consumers and citizens are protected from the harm created by faulty products, such as the Consumer Protection Bureau and the Consumer Product Safety Commission, the only regulatory body within the United States Government to address privacy is the Federal Trade Commission. While the overall purpose of the Federal Trade Commission is to enforce civil antitrust law and the promotion of consumer protection, they are woefully under-equipped and lack the empowerment from robust data protection laws to ensure federal compliance of data privacy. Compared to the European Union, bound by the General Data Protection Regulation (GDPR), current regulations within the United States are not relevant in overseeing data management and sharing to ensure all data is handled with privacy, fairness, and accountability. The GDPR was created in 2018 and consists of 99 individual articles that are considered the world’s strongest set of data protection rules, which enhance how people can access information about them and limits what organizations can do with personal data (Burgess, 2020). Unfortunately, the United States doesn’t have a singular law covering all data types. Instead, it has a mix of rules put together by the Health Insurance Portability and Accountability Act (HIPPA), the Fair Credit Reporting Act (FCRA), the Family Educational Rights and Privacy Act (FERPA), the Gramm-Leach-Bliley Act (GLBA), the Electronic Communications Privacy Act (ECPA), the Children’s Online Privacy Protection Rule (COPPA), the Video Privacy Protection Act (VPPA), and the Federal Trade Commission Act (FTCA) (Klosowski, 2021).

The lack of regulation has reverberating effects on how companies and organizations handle data. First, there are significant issues with re-identification from data sets because privacy and anonymity are not regulatory requirements in data sharing and machine learning (ML) model creation. Second, most states have yet to establish a current mandate to inform consumers how their data is used. As a result, companies can use, share, or sell any data they collect without notifying the consumer of what they are doing (Klosowski, 2021). The follow-on impact of the lack of informed consent is that companies can sell information to third parties that can further sell, aggregate, or share the data, all the while the individual never provided consent for their information to be proliferated throughout the public domain. Finally, because there are no laws requiring nondiscriminatory and unbiased data, models can frequently create biased and inaccurate systems that result in actual harm throughout society. Without robust legislation requiring organizations to be legally bound to manage data ethically, there is a concrete certainty that models will be created that enable organizations to prioritize profit or insights over the privacy and anonymity of the consumer or citizen.

Facial Recognition from Biased Data

To address data privacy issues regarding facial recognition software, this paper examined the project by Garvie, from 2019. The article presents vignettes that show common pitfalls from the misuse, bias, and pitfalls of facial recognition applications. While the report presents other data ethics concerns, such as informed consent of how our data is shared and provides examples of general anonymity concerns, the focus is how law enforcement leverages facial recognition technology from photos collected when Americans apply for a driver’s license. Unbeknownst to many citizens, our pictures that were taken when we applied for driver’s licenses have been used to construct training sets for facial recognition systems currently employed by the police. When the system is employed, the possibility exists that it will draw an incorrect conclusion and attribute a criminal act to an innocent citizen due to a biased model. Additionally, by the inclusion of these photos into law enforcement databases, the right to privacy is seriously infringed upon by the government.

Even though the more obvious danger that can arise from police using facial recognition software is incorrect conclusions, other hazards challenge the legitimacy of the software for police use. As previously identified in this paper, there are significant impacts on particular groups without regulations to govern how ML systems are created and employed. The racial bias remains a persistent issue in many facial recognition systems due to a lack of transparency on what information created the model. Many technologies provide very high levels of accuracy in accurately identifying middle-aged white males but suffer to deliver accurate conclusions with other genders and racial groups. In a study conducted in 2018 entitled the Gender Shades Project, it was found that by evaluating facial recognition systems by IBM and Microsoft, error rates were up to 34% higher for darker-skinned females than for light-skinned males (Najibi, 2020). By employing facial recognition systems that fail to achieve an equal level of accuracy across all groups in the citizenry, negative repercussions to those incorrectly identified will prove inevitable.

The source of harm in many inaccurate facial recognition systems comes from a representation bias. Training sets used to create the models essentially comprise middle-aged white male images. While the systems are very accurate with the pictures it has been trained to identify, it does not represent the larger use population (Suresh, 2021). By constructing the training sets using adversarial learning and counterfactual models as seen in other ML systems to create fair conclusions regardless of the inclusion of sensitive variables such as race and gender, facial recognition systems training sets can be purposefully built to become more equitable and representative of their use population. Additionally, by performing ethical auditing by independent sources, facial recognition systems can be held accountable for methodological biases (Najibi, 2020).

When known bias exists in the training data set for facial recognition and is leveraged for police use, an Artificial Intelligence (AI) recommendation system could be employed to ensure outputs do not negatively impact specific population groups. For example, an AI system could be trained to identify when it is queried to produce results below-specified accuracy levels. Whether the error comes from a representation, learning, or aggregation bias within the data, a system designed to create an output and audit itself would benefit facial recognition systems. In practice, the system could be queried to provide a match from an image while simultaneously assessing the level of accuracy predicted based on the picture provided. The tool could provide an alert to ensure human involvement within the decision-making loop when it has been asked to identify individuals with low-accuracy predictions. By creating a system that can recognize areas where it struggles to provide accurate conclusions while taking additional steps to create more representative training data sets, facial recognition systems would make more fair conclusions for all groups.

Genomic Privacy

With the proliferation of companies offering genomic sequencing services to screen for disease and illuminate a family’s genealogy, privacy concerns have arisen. In The New York Times Privacy Project tackling this issue, Bala provides numerous examples of the dangers of enlisting direct-to-consumer genetic sequencing services and the impact that it can have on the customer’s family. The troubles arise from the amount of information that can be gathered from one person’s genetic code. When the saliva sample is provided to the company, the customer consented to share private health data for not only themselves but their entire family. In one example, if a parent shares their children’s genetic information on public websites, parents are forever exposing their personal health data well before the age of consent (Bala, 2020). Because of the lack of regulations governing de-identification practices, an environment exists where genomic privacy is almost unattainable to those who have opted to share their genetic sequence. In the example above, it is a certainty that the remainder of the extended family did not consent to have their genetic code shared when the parents decided to conduct genetic testing on their child. Not only do current regulations lack the mandate to adequately de-identify consumers, but they also fail to enact policies that ensure all persons identified through testing provide consent.

Bala continues the project by illustrating the negative repercussions of oversharing children’s personal information. Unfortunately, when parents share the child’s genetic information, they have taken the right to privacy away from the child and the right not to know certain information. Referencing the 1977 Whalen vs. Roe decision, Bale outlines two critical components of the right to privacy; the individual interest in avoiding disclosure of personal matters and the interest in independence in making certain kinds of important decisions (Bale, 2020). While it may be beneficial for a parent to understand if their children carry hereditary genes linked to disease, the parents have removed the right to privacy from the child by sharing the genetic sequence. Furthermore, when a genetic sequence is shared with the company, information can be gathered on the customer’s entire family, presenting challenges to informed consent.

The source of harm in the use of companies like 23andMe, MyHeritage, and GEDmatch does not come from an inherent bias within a model or database. Instead, it illustrates how a lack of regulation governing the right to privacy reverberates through generations of citizens. The United States follows a tradition of allowing parents to make legal decisions on behalf of their children. However, what happens when no regulation or law dictates what information a parent can share about their child? In countries like France and Austria, children can sue their parents for oversharing personal information. In the United States, there are no such regulations. Even though the American Academy of Pediatrics and American College of Medical Genetics and Genomics strongly discourage home-kit genetic testing on children, the practice continues. Personal medical information is shared, analyzed, and sold, forever sharing private information with the world (Bale, 2020).

Part Two

Current State of Regulatory Shortfalls as seen in Sorrell v. IMS Health

Previously identified in this paper are instances where the need for regulations within the current United States civil code allows for companies to behave in their best interest rather than with a priority placed on data privacy. The privacy lab project that addresses how the current framework of United States privacy protection laws are at the discretion of State regulatory agencies curtailed by a patchwork of National Acts and rules is an evaluation of U.S. Supreme Court Case Sorrell v. IMS Health Inc. The project explores issues that have arisen from the HIPAA 1990s styled protection and references how more effort can be taken from organizations that collect medical information to still reap benefit from the collected data while protecting the patient’s privacy (Sweeney, n.d).

The court case presents an argument from Sorrell (the Petitioner) that IMS Health (the Respondent) fails to properly de-identify patient information under established Vermont State and Federal HIPAA regulations. Under Vermont State Law and HIPAA regulations, all patient data must be sufficiently de-identified before sharing it beyond the pharmacy that collected the information in the care of the patient (Sweeney, n.d.). During the hearing, the Petitioner argues that the de-identification approach used by IMS does not adequately protect the patient’s identity. Patient data shared by IMS health include the prescriber’s name and address, the name, dosage, and quantity of the drug prescribed, the date and location at which the prescription was filled, and the patient’s age and gender (Sweeney, n.d.). Through modern practices, re-identification of the patients was possible, and the court was presented examples where Sweeney was able to accurately identify 20 out of 22 participants in a data set taken from similar information that IMS Health released (Sweeney, n.d.).

Overall, the case illustrates weak privacy regulations’ impact on privacy protection. As the monetary value from data analysis and customer information becomes more valuable, additional rules are required to ensure customer and patient anonymity while maintaining the benefit from research. Unfortunately, current HIPAA regulations and U.S. State guidelines for de-identification have proven to be inadequate in ensuring that companies conduct data sharing and data sales to third parties achieving anonymity of the participants in the data set.

Facial Recognition De-Identification Efforts

Part one of this paper presented projects illuminating the harm that can occur from biased facial recognition systems as the technology gains acceptance despite its privacy shortfalls. However, facial recognition systems and video surveillance issues can be solved by employing novel technologies. To protect the privacy of individuals, images captured in standard surveillance systems should be de-identified. When coupled with facial recognition software, a system that fails to de-identify individuals in a city-wide surveillance system could effectively track single individuals throughout the coverage area (Newton, 2003). While the New York Times project in part one describes what could occur from inaccurate systems, other efforts exist to ensure that uninformed citizens’ privacy and anonymity are achieved through de-identification from standard video surveillance practices. The technique presented by Newton in the data privacy lab project illustrates how facial recognition systems can continue to be used without infringing on the right to privacy of the citizenry (Newton, 2003).

In the privacy lab project, Newton makes a point to reiterate the value of surveillance systems. The systems proposed attempt to enable the sharing of video data with scientific assurances of privacy protection while keeping the data practically useful (Newton, 2003). The project’s goal was to de-identify the facial features to a level where anonymity is achieved while leaving key defining characteristics while simultaneously encrypting the image for re-identification purposes. Previously attempted techniques, such as covering the eyes or altering pixel colors, failed to adequately protect images from facial recognition software.

There would be several privacy implications if Newton’s techniques were widely adopted. First, there is a decreased risk that an individual could be discriminated against through inaccurate facial recognition software running against common video surveillance. As presented in part one of this paper, significant accuracy issues negatively impact specific groups. Next, when de-identification is conducted before analysis in facial recognition software systems, another layer of protection is afforded to the privacy of historically infringed groups. Finally, citizens are now afforded the right to privacy. When data sets are shared containing images using Newton’s technique of pre-processing facial images before the faces are included in a data set, the people in the data set are safe from re-identification without an encryption key. The owner of the data set of facial images will now be free to share the encrypted images without violating participants’ privacy.

Genomic Privacy Protection Efforts

Work by Malin included in the data privacy project aims to illustrate how current de-identification protocols when anonymizing genomic data fails to fully protect from re-identification. As previously mentioned in this paper, medical information is protected using HIPPA regulations. Still, as seen through previous court cases such as Sorrell v. IMS Health, those policies are ineffective enough in today’s data-rich environment where genetic information is readily shared for scientific and medical benefit. Although advocates of de-identification address the issue of maintaining privacy with the best intentions when guided only by HIPPA regulations, they often fail to maintain anonymity, and participants can be re-identified (Malin, 2003). Additionally, when following de-identification guidelines, anonymized data can be related to publicly available information to identify specific individuals (Braun, 2009).

Malin proves that even when using several known de-identification methods, re-identification can still be achieved. Through evaluating the breadth of dangers described in the New York Times Privacy project showing the hazards from the oversharing of personal genetic information, it is apparent that further research and regulations are required to protect individual identities. Not only do researchers need to establish effective techniques to de-identify genetic information, but careful consideration should also be taken to determine if direct-to-consumer genetic services are beneficial enough to warrant the inherent loss of privacy.

Conclusion

Throughout this paper, several key privacy issues were illustrated by comparing existing privacy projects from the New York Times against ongoing academic and scientific efforts to address existing data privacy issues. As the data economy expands, ensuring individual privacy will remain a constant hurdle. This paper has shown how the need for a foundation of privacy and ethical management of identifiable information will only be achieved through additional regulations governing how data is protected and secured. Only after those regulations are created that address current technological advancements will individuals be safe from re-identification from genomic information and protected from inaccurate conclusions drawn from biased facial recognition programs.

References

Bala, N. (2020). Why Are You Sharing Your Child’s DNA Information?. New York Times. Retrieved January 28, 2023 from https://www.nytimes.com/2020/01/02/opinion/dna-test-privacy-children.html

Braun, R., Rowe, W., Schafer, C., Zhang, J., Buetow, K. (2005). Needles in the Haystack: Identifying Individuals Present in Pooled Genomic Data. PLos Genetics. Retrieved February 22, 2023 from https://www.ncbi.nlm.nih.gov/pmc/articles/PMC2747273/

Burgess, M. (2020). What is the GDPR? The Summary Guide to Compliance in the UK. Wired. Retrieved February 18, 2023 from https://www.wired.co.uk/article/what-is-gdpr-uk-eu-legislation-compliance-summary-fines-2018

Garvie, C. (2019). You’re In A Police Lineup Right Now. New York Times. Retrieved January 27, 2023 from https://www.nytimes.com/2019/10/15/opinion/facial-recognition-police.html

Klosowski, T. (2021). The State of Consumer Data Privacy Protection Laws in the US (Any Why it Matters). Wirecutter. Retrieved February 15, 2023 from https://www.nytimes.com/wirecutter/blog/state-of-privacy-laws-in-us/

Malin, B. (2003). Why Pseudonyms Don’t Anonymize: A Computational Re-identification Analysis of Genomic Data Privacy Protection Systems. Carnegie Melon University. Retrieved January 28, 2023 from https://dataprivacylab.org/dataprivacy/projects/linkage/lidap-wp19.pdf

Najibi, A. (2020). Racial Discrimination in Face Recognition Technology. Harvard University. Retrieved February 20, 2023 from https://sitn.hms.harvard.edu/flash/2020/racial-discrimination-in-face-recognition-technology/

Newton, E., Sweeney, L., Malin, B. (2003). Preserving Privacy by De-Identifying Facial Images. Carnegie Melon University. Retrieved January 27, 2023 from https://dataprivacylab.org/dataprivacy/projects/video/paper.pdf

Singer, N. (2019). The Government Protects out Food and Cars. Why Not Our Data?. New York Times. Retrieved January 26, 2023 from https://www.nytimes.com/2019/11/02/sunday-review/data-protection-privacy.html

Suresh, H., Guttag, J. (2021). A Framework for Understanding Sources of Harm Throughout the Machine Learning Life Cycle. Massachusetts Institute of Technology. Retrieved February 20, 2023 from https://ucwv.mrooms3.net/pluginfile.php/1285783/mod_page/content/1/A%20Framework%20for%20Understanding%20Sources%20of%20Harm.pdf

Sweeney, L. (n.d.). Patient Privacy Risks in U.S. Supreme Court Case Sorrell vs. IMS Health. Privacy Lab Project. Retrieved January 26, from https://dataprivacylab.org/projects/identifiability/pharma2.pdf