I-Chuan Wang, the Chief Executive Officer of the Democratic Progressive Party’s (DPP) Policy Research and Coordinating Committee, stated in a political talk show that it is possible to compare crowd attributes between protestors against the abuse of legislative power and participants of the May-19th gathering in front of the DPP headquarters as well as the campaign before the recent Presidential election. Regardless of how such comparisons were carried out in practice, the analysis of location-tracking data mentioned in Wang’s statement has already fallen under the scope of “another purpose of collection” as laid out in the Personal Data Protection Act (PDPA). (These regulations around the “specific purpose of collection” may also be too broad for the consumers to comprehend.) The Taiwanese Association for Human Rights (TAHR) urges the competent authority of telecommunications, the competent authority of digital advertising and marketing, and relevant political parties to further elaborate on the collection and usage of information such as cellular probe data analysis, base station location analysis, and Beacon indoor positioning and scrutinize whether the consumers’ rights to informed consent and opting out are promised.
Location-tracking data can reveal political orientations, religious beliefs, sexual orientation, personal interests, and social connections of an individual or a group. Even when the individual’s name and phone numbers are removed, their residence and workplace locations can still be determined through location-tracking, while their occupation and groups they often gather with can be inferred from such information. Additionally, if location-tracking data is solely used for statistical analysis of traffic volumes, it shall only require the total number of individuals in a crowd and would not need other information of population attributes collected through the combination of base station locations and telecommunication user data such as gender and age.
It is no news that Taiwanese telecommunication information is used for commercial purposes. In addition to local governments, real estate, digital advertising, and other industries have long been known for conducting market analysis or accurate advertising through telecommunication information. This aspect of real-life usage of telecommunication information demonstrates that such information is not truly “de-identified” as long as these data can be concatenated.
After the COVID-19 pandemic, people have learned from the “Wanhua Annotation Case” how the government and telecommunication firms determine higher-risk populations through location- and time-tracking data and annotate on their health IC cards without informing the subjects. The more personal information collected and maintained, the more labels prescribed onto these populations. Even in cases when telecommunication information are reused for only commercial purposes, competent authorities need to examine whether phrases in personal data consent forms such as “de-identify,” “statistics,” and “marketing" are sufficient for the consumers to be aware of the fact that their every-day activities are tracked for third-party accurate advertising or analyses on social and political movements such as gathering and protesting. Competent authorities and the industry need to investigate and answer questions such as: How is commercially used telecommunication information released? How do firms in the industry cooperate and conduct analyses? How to prevent any entity with sufficient financial power (such as the People’s Republic of China, scammers, and data brokers) from purchasing personal information and performing data analyses through concatenation?
This incident highlights that many data collectors in Taiwan have the long-held, corrupted belief that as long as data collected is not “personal information,” it can be used in any way they want. This belief ignores the fact that removing personal names and identification numbers does not stop any information from being “personal”. It also ignores the fact that “de-identifying” is a step of information processing required for establishing legal bases in itself. In addition, Metadata (data in relation to data) still allows for the possibility to identify individuals indirectly, which naturally makes such data personal information regulated by the PDPA. Thus, the processing and usage of Metadata needs to be scrutinized by relevant regulations as well.
To return to regular information governance, competent authorities shall have a good grasp on the legal bases from which relevant industries collect and use personal information, while reviewing whether categories and purposes of data collection and usage laid out in terms of service are clear enough and solidify measures protecting rights to personal information including the right to informed consent before provision and the right to control data afterwards. If there is a possibility to put together pieces of personal information, such data is not truly “de-identified” but has, at best, merely undergone a means for information security protection--which cannot replace the fundamental regulations in personal information protection. An overly naive understanding towards the definition of “de-identification” only increases the risks of dismantling existing personal information protection regulations.
To prevent manipulation, group labels, and division in our communities and to build a strong foundation for our democracy, each of our political parties and competent authorities need to focus on repairing the flawed measures protecting our privacy. Chasms in personal information protection measures are widening, and efforts for personal data concatenation and usage are fiercely attacking these gaps. To guarantee regular usage of information for data analyses and commercial uses that pose no harm to our democracy, we need to rely on better implementation of personal information protection and comprehensive supporting measures instead of cutting corners and naively explaining the definition of “de-identification” to escape responsibilities.
Press Contact: Kuan-Ju Chou, Deputy Secretary General, Taiwan Association for Human Rights
Mandarin version ：
