ACM Europe Technology Policy Committee delivers comments on UKs data strategy

The Association for Computing Machinery (ACM) is the world’s largest and longest established professional society of individuals involved in all aspects of computing. Its Europe Technology Policy Committee (Europe TPC) promotes sound public policy and public understanding of a broad range of issues at the intersection of technology and policy. Europe TPC is pleased to submit the following comments

in response to the UK government’s consultation on a national data strategy and looks forward to ongoing dialogue with the government on these important matters. For further information, contact ACM Director of Global Policy & Public Affairs Adam Eisgrau at acmpo@acm.org.

The principal author of this document for ACM’s Europe Technology Policy Committee is Alejandro Saucedo, Engineering Director at Seldon and Chief Scientist at the UK-based Institute for Ethical AI & Machine Learning. Also contributing were: Chris Hankin, Fellow of the Institute for Security Science and Technology and Professor of Computing Science at Imperial College, London; Bran Knowles, Senior Lecturer in Data Science at Lancaster University; and Julie Williamson, Lecturer in Human Computer Interaction at the University of Glasgow.

For readers’ convenience, the government’s explanatory text and numbered consultation questions are reproduced below in sequence and in italics. Europe TPC’s responses appear in standard type (or in bold, as appropriate) immediately after each numbered question.

Consultation Questions and Responses

Q1. To what extent do you agree with the following statement: Taken as a whole, the missions and pillars of the National Data Strategy focus on the right priorities. Please explain your answer here, including any areas you think the government should explore in further depth.

Strongly disagree
Somewhat disagree
Neither agree nor disagree
Somewhat agree
Strongly agree

Q2. We are interested in examples of how data was or should have been used to deliver public benefits during the coronavirus (COVID-19) pandemic, beyond its use directly in health and social care. Please give any examples that you can, including what, if anything, central government could do to build or develop them further.

For question two, we are only looking for examples outside health and social care data. Health and social care data will be covered in the upcoming Data Strategy for Health and Social Care.

Data used by coronavirus applications should have been specifically collected for that purpose with appropriate consent. As emergencies like these come up, there is a risk of technologies and data being developed and utilized outside of the usual channels. While that may sometimes be necessary, it can result in risks, especially as sometimes a bad technology solution can have a worse effect than no solution. As the ACM Europe Technology Policy Committee (Europe TPC), we advise that domain experts from both technology and non-technology sectors be involved in the identification and evaluation of potential datasets and solutions.

We further recommend and request that Europe TPC’s recent Statement on Essential Principles and Practices for COVID-19 Contact Tracing Applications, be consulted. These principles include the recommendations that: all application and server code should be made public; an independent multidisciplinary scientific committee should oversee the deployment of such applications; legal safeguards against the abuse of such apps, infrastructure and data be developed; and the public and civil society should be actively engagement in all such efforts.

Open datasets have driven research into urban and social issues impacted by COVID-19. For example, data-driven research from organisations such as Urban Big Data Centre and Health Data Research UK have addressed issues such as urban planning, homelessness, and transportation. The impacts of COVID-19 on urban life can be better analysed if appropriate datasets are available and open.

Q3. If applicable, please provide any comments about the potential impact of the proposals outlined in this consultation may have on individuals with a protected characteristic under the Equality Act 2010?

The “responsible data pillar” seems appropriately designed to establish relevant accountability and governance structures to enforce and monitor compliance with the Equality Act 2010. It is, however, critical to identify key junctures at which relevant domain experts should be consulted and risk assessments can be carried out to identify the relevant level of scrutiny for compliance with the Equality Act proportionate to the risk involved.
The responsible data pillar satisfactorily describes the importance of individuals’ rights and recognition of the collective benefits of sharing data. It does not, however, include concrete strategies and tactics for engaging with the individuals most affected by these issues, particularly in statutorily protected communities. When analysing potential impacts of policies on individuals with protected characteristics the true experts are those individuals who may be marginalised or disadvantaged. Widespread consultation with a diverse set of individuals will provide the best insights into the impacts this proposal may have.

Q4. We welcome any comments about the potential impact of the proposals outlined in this consultation on the UK across all areas, and any steps the government should take to ensure that they take account of regional inequalities and support the whole of the UK?

Europe TPC recommends that the government utilize purpose-designed processes to address regional inequalities, including particularly that data from some rural areas in the UK is likely to be scarcer than from other urban or more urban areas.

Regardless of its origin point, some data may be less readily available, or data may be in a state that requires further processing to be machine-readable for relevant processing and analysis. Another important point to consider is that not only the datasets will be less readily available but also nuanced distributions will be differ- ent, which in some cases can make significant difference especially if policy decisions are being made. It is because of this there should be explicit mandates that ensure relevant representatives are able to contribute to the processes that ensure datasets are fit for the analysis they are feeding to.

Mission one: Unlocking the value of data across the economy

Data is an incredibly valuable resource for businesses and other organisations, helping them to deliver better services and operations for their users and beneficiaries. How- ever, there is increasing evidence to suggest that the full value of data is not being realised because vital information is not getting to where it needs to be. Our first mission is to create an environment where data is appropriately usable, accessible and available across the economy – fuelling growth in organisations large and small. We will create a clearer policy framework to identify where greater data access and availability across and with the economy can and should support growth and innovation, in what form, and what government’s role should be, in the UK and globally.

Data availability: For data to have the most effective impact, it needs to be appropri- ately accessible, mobile and re-usable. That means encouraging better coordination, access to and sharing of data of appropriate quality between organisations in the public sector, private sector and third sector, and ensuring appropriate protections for the flow of data internationally.

Q5. Which sectors have the most to gain from better data availability? Please select all relevant options listed below, which are drawn from the Standardised Industry Classification (SIC) codes.

Accommodation and Food Service Activities
Administrative and Support Service Activities
Agriculture, Forestry and Fishing
Arts, Entertainment and Recreation
Central/Local Government inc. Defence
Charity or Non-Profit
Construction
Education
Electricity, Gas, Steam and Air Conditioning Supply
Financial and Insurance Activities
Human Health and Social Work Activities
Information and Communication
Manufacturing
Mining and Quarrying
Transportation and Storage
Water Supply; Sewerage, Waste Management and Remediation Activities
Wholesale and Retail Trade; Repair of Motor Vehicles and Motorcycles
Professional, Scientific and Technical Activities
Real Estate Activities
Other

Q6. What role do you think central government should have in enabling better availability of data across the wider economy?

Europe TPC affirms that ensuring the lawful interaction between organisations and the data they use, store and collect should be among government’s top priorities. This encompasses ensuring not only that the use of data is aligned with applicable laws, but also that the laws pertaining to the overarching practice and use-case are fit-for-purpose. Furthermore, governments – in conjunction with relevant expert bodies – should work to empower and encourage best practices for the storage, collection, standardisation, processing, and use of data. Such collaboration could include liaison with relevant sectoral industry organisations, as well as supporting academic research with public grants such as those currently made through the “Innovate UK” programme. Efforts also may be pursued to encourage best practices through public standardisation bodies like BSI, or professional bodies like the British Computer Society. Furthermore, the government has an important role in incentivising the private sector to contribute towards data sharing with the objective of providing improved local and national public services.

Q6a. How should this role vary across sectors and applications?

The overarching role of the strategy should be consistent across sectors to ensure a principle-based approach while also tailoring implementation of that strategy to each sector. Having said this, each sector will have nuanced requirements that benefit from having specialised mandates and underlying execution frameworks to ensure the best use of data. In some sectors, for example, data may more commonly be personally identifiable data. In others, it may not directly relate to individuals (such as information on assets or resources), but use of the data could still affect them. It is also important that the responsibility for a consistent approach across all sectors should be vested in a single government department (such as DCMS).

Data foundations: The true value of data can only be fully realised when it is fit for purpose, recorded in standardised formats on modern, future-proof systems and held in a condition that means it is findable, accessible, interoperable and reusable. By improving the quality of the data, it can be used more effectively to drive better insights and outcomes.

Q7. To what extent do you agree with the following statement: The government has a role in supporting data foundations in the wider economy. Please explain your answer. If applicable, please indicate what you think the government’s enhanced role should be.

Strongly disagree
Somewhat disagree
Neither agree nor disagree
Somewhat agree
Strongly agree

Q8. What could the central government do beyond existing schemes to tackle the particu- lar barriers that small and medium-sized enterprises (SMEs) face in using data effectively?

Legacy systems and datasets that are not machine-readable (or sufficiently so) impede the ability of all businesses, particularly small- and medium-sized enterprises, to use data to maximum effect. Government’s assistance in addressing these issues would be particularly impactful in segments of the economy with substantial public sector involvement, e.g., transportation, construction, and healthcare.

The Smart Data Review in 2019 consulted on ways to make evolving schemes more coordinated across banking, finance, telecoms and energy. The focus of Smart Data is citizens asking their providers to share information about them with third parties.

Q9. Beyond existing Smart Data plans, what, if any, further work do you think should be done to ensure that consumers’ data is put to work for them?

Left intentionally blank.

Mission two: Maintaining a pro-growth and trusted data regime

Building on our status as a world leader in technological innovation and our robust data protection standards, we will maintain a data regime that supports the future objectives of the UK outside of the EU and promotes growth and innovation while maintaining public trust. This regime will not be overly burdensome for the average company, nor will it be unnecessarily complex or vague; it will help innovators and entrepreneurs use data legitimately to build and expand their businesses, without undue regulatory uncertainty or risk at both the domestic and international levels.

To encourage the widespread uptake of digital technologies, we will also work with regulators to provide advice and support to small- and medium-sized businesses to help them expand online and develop sector specific guidance and co-regulatory tools to accelerate digitisation across the UK economy.

Q10. How can the UK’s data protection framework remain fit for purpose in an increasingly digital and data driven age?

Cross functional collaboration by experts with both technical and non-technical backgrounds is critical in order to develop and extend data protection policies fit for purpose across a broad range of industries. Specifically, input and assistance should be solicited from experts in such diverse fields as: software development and design, law and policy, and business and industrial organization. Academics with a background in from a broad range of technical disciplines, the humanities and social sciences should be equally engaged.

In section 7.1.2 we lay out the functions of the Centre for Data Ethics and Innovation (CDEI), set up in 2018 to advise the Government on the use of data-driven technologies and AI.

Q11. To what extent do you agree with the functions set out for the Centre for Data Ethics and Innovation (CDEI) - AI monitoring, partnership working and piloting and testing potential interventions in the tech landscape? Please explain your answer.

Strongly disagree
Somewhat disagree
Neither agree nor disagree
Somewhat agree
Strongly agree

Q11a. How would a change to statutory status support the CDEI to deliver its remit?

Left intentionally blank.

Mission three: Transforming government’s use of data to drive efficiency and improve public services

There is massive untapped potential in the way the government uses data. We will implement major and radical changes in the way that the government uses data to drive innovation and productivity across the UK. In doing so, we will improve the delivery of public services, as well as our ability to measure the impact of policies and programmes, and to ensure resources are used effectively.

To succeed, we need a whole-government approach led by a Government Chief Data Officer from the centre in strong partnership with organisations. We need to transform the way data is collected, managed, used and shared across government, including with the wider public sector, and create joined-up and interoperable data infrastructure. We need the right skills and leadership to understand and unlock the potential of data – and we need to do so in a way that both incentivises organisations to do the right thing, as well as build in the right controls to drive standardisation, consistency and appropriate data use.

The government is going to set an ambitious package of work in this space and wants to understand where we can have the biggest impact.

Q12. We have identified five broad areas of work as part of our mission for enabling better use of data across government:

Quality, availability and access
Standards and assurance
Capability, leadership and culture
Accountability and productivity
Ethics and public trust

We want to hear your views on any actions you think will have the biggest impact for transforming government’s use of data.

Please see response to Q.8 above.

Q13. The Data Standards Authority is working with a range of public sector and external organisations to create a pipeline of data standards and standard practices that should be adopted. We welcome your views on standards that should be prioritised, building on the standards which have already been recommended.

Key practical areas where standards would be critical include:
Metadata management and metadata compatibility as data is moved across systems;
Baseline requirements for the capabilities necessary to ensure reproducibility of data transformation across processing pipelines to ensure provenance;
Audit trail requirements for data as it is collected, used or accessed;
Accountability structures for analytical or predictive modelling that is carried out/built from underlying datasets;
AI interpretability capabilities across tooling and processes to ensure analytical and predictive modelling carried out can be explainable.
Such standards should include frameworks that allow for domain-specific or use- case-specific risk assessment, and that specify processes by which they will be enforced.

Mission four: Ensuring the security and resilience of the infrastructure on which data relies

In the UK, the government already imposes safeguards and enforcement regimes to ensure that our data is handled responsibly. But we will also take a greater responsibility for ensuring that data is sufficiently protected when in transit, or when stored in external data centres. The government will determine the scale and nature of risks and the appropriate response, accounting for emerging trends in the market landscape. We will also determine whether current arrangements for managing data security risks are sufficient to protect the UK from threats that counter our missions for data to be a force for good. And we will consider the sustainability of data use, exploring inefficiencies in stored and processed data, and other carbon-inefficient processes. The infrastructure on which data relies is the virtual or physical data infrastructure, systems and services that store, process and transfer data. This includes data centres (that provide the physical space to store data), peering and transit infrastructure (that enable the exchange of data), and cloud computing that provides virtualised computing resources (for example servers, software, databases, data analytics) that are accessed remotely.

Q13. What responsibilities and requirements should be placed on virtual or physical data infrastructure service providers to provide data security, continuity and resilience of service supply?

infrastructure service providers should be required to observe accepted core practices and principles of data security, continuity and resilience. These include: assuring metadata provenance; creating audit trails; defining and following security protocols; consistently applied risk assessment procedures; and ongoing expert assessment of the success of these practices. The UK’s current Cyber Assessment Framework in support of implementation of the NIS Directive might provide a model for how to support this aspect of the NDS.

Q14a. How do clients assess the robustness of security protocols when choosing data infrastructure services? How do they ensure that providers are keeping up with those protocols during their contract?

This is often done through procurement procedures that delineate for suppliers processes and procedures required for the business and infrastructural continuity of data storage and processing systems. This, in turn, requires not only confirmation that such processes exist, but that they be documented and reviewed on an ongoing basis. The extent to which such requirements are imposed should be assessed for and aligned with specific use-cases, the potential for risk each scenario presents, and the criticality of the process at issue.

Q15. Demand for external data storage and processing services is growing. In order to maintain high standards of security and resilience for the infrastructure on which data use relies, what should be the respective roles of government, data service providers, their supply chain and their clients?

Please see response to the previous question.
Q16. What are the most important risk factors in managing the security and resilience of the infrastructure on which data use relies? For example, the physical security of sites, the geographic location where data is stored, the diversity and actors in the market and supply chains, or other factors.
The greatest risk to the security of data and the resilience of the infrastructure on which data use relies is posed by inadequate protocols and procedures to protect them. This is true both at the level of technological infrastructure level and at an individual process level. It also is critical that personnel who handle data itself and are responsible for the implementation of such procedures – and their review and enforcement – have the relevant professional training and skills required to succeed in their roles.

Q17. Do you agree that the government should play a greater role in ensuring that data does not negatively contribute to carbon usage? Please explain your answer. If applicable, please indicate how the government can effectively ensure that data does not negatively contribute to carbon usage.

Strongly disagree
Somewhat disagree
Neither agree nor disagree
Somewhat agree
Strongly agree

Internet and Communication Technology (ICT)-enabled efficiency improvements (a.k.a. 'digitalisation') across the economy will be critical if the government of the UK is to meet internationally agreed climate targets. Reducing carbon emissions associated with data use, operation and storage must play a key role in achieving those goals and commitments. While there may be exceptions where carbon- emitting ICT use-cases will be essential within a reduced carbon economy, governments should actively promote reduction of digital technology's carbon footprint, specifically by providing clear carbon targets for the ICT sector. Please see Europe TPC’s June 2020 Comments on the EU Climate Ambition for 2030 and for the Design of Certain Climate and Energy Policies of the European Green Deal.

At present, the carbon footprint of the ICT sector continues to grow despite continual efficiency improvements. It is important that emissions attributable to the ICT sector not increase (or, at minimum, rise to a level that undermines or undoes the carbon savings enabled through digitalisation efforts.) To enable informed policy making in this area and assure public understanding and evaluation of the bases for such policy, we urge that the carbon impacts of technologies used to mitigate ICT sector emissions be fully and transparently documented to ensure that anticipated savings from digitalisation are accurately forecast and realistic.

Mission five: Championing the international flow of data

In our hyper-connected world, the ability to exchange data securely across borders is essential.

As the UK leaves the EU, we have the opportunity to develop a new UK capability that delivers new and innovative mechanisms for international data transfers.

Using our reputation as a world leader in digital, a champion of free trade and the rules- based international system, and an engaged, rule-abiding member of the global commun- ity, we will build trust in data’s use, creating the regimes, approaches and tools to ensure personal data is appropriately safeguarded as it moves across borders. We will also facilitate cross-border data flows by removing unnecessary barriers to international data transfers that promote growth and innovation. And we will seek to promote data standards, data interoperability, and UK values internationally.

Q18. How can the UK improve on current international transfer mechanisms, while ensuring that the personal data of UK citizens is appropriately safeguarded?

Europe TPC urges the UK government to assure that all European citizens who wish to do so can interact with arms of the government in efficient and secure ways fully compliant with UK privacy law and the GDPR.

We will seek EU ‘data adequacy’ to maintain the free flow of personal data from the EEA and we will pursue UK ‘data adequacy’ with global partners to promote the free flow of data to and from the UK and ensure it will be properly protected.

Q19. What are your views on future UK data adequacy arrangements (e.g., which countries are priorities) and how can the UK work with stakeholders to ensure the best possible outcome for the UK?

The priority should be to ensure that existing academic and economic collaboration between the UK and EU countries are not hindered by the inefficient, insecure or unsafe use, collection or transfer of data. It will be particularly critical to ensure that robust technological and legal structures are established to assure that the data flow between UK and external services is secure, transparent, trustworthy, reliable and respectful of individual rights.

Author: Communication from ACM Europe

Date: 2020-12-03

URL: https://sciencebusiness.net/network-updates/acm-europe-technology-policy-committee-delivers-comments-uks-data-strategy

sciencebusiness.net