Personal data protection in the age of mass surveillance

Multiple definitions for surveillance can be found in literature, depending on the field and point of view of the author. However, certain consistent characteristics are visible in definitions, such as watch or continuous observation [91] of, focused attention [59] on, or monitoring of [19, p. 499] a target, the nature of which can range from aerospace, cyberspace, surface, or subsurface areas, places, persons to things [44], for example. In this paper, we use the term surveillance to represent information technology that is based on data collection from individuals, also known as dataveillance [19, p. 499].

We observe that criminal activities and prevention thereof are a common theme in the language used to describe surveillance, and similar language is likewise used as justification for mass surveillance. This connection has quite probably contributed to the negative connotation attributed to surveillance [9,31,100]. This may be problematic if taken for granted, as the negative connotation conveys the idea that surveillance is obviously necessary for catching “bad people” However, mass surveillance is directed towards everybody and not just criminals, who can avoid most mass surveillance methods given reasonable technical expertise. Thus, the fuel of mass surveillance seems to be fear, and not the rights of citizens. However, the majority of people should not need to be under surveillance, especially if we are living a democracy that should protect the freedom and rights of members of society. People should be regarded as not guilty unless evidence to the contrary exists, and why is there a need for surveillance aimed at innocents in the first place? Moreover, mass surveillance may also be, and very likely is, used for economic purposes that cannot be justified with crime prevention – a problematic state of affairs in itself. One reason for collecting data is the rise of the data economy. Data economy has been implicated as a new and flourishing area of the economy that changes the world – and at the same time, it is seen problematic [2,79] as it is based on data colonialism, which has normalised the exploitation of humans through personal data [21].

In the case of individual or targeted surveillance, the goal is limited to a single known target, and the information gathering effort is premeditated. By contrast, in mass surveillance, the main goal is to gather as much information as possible on the population.

Thus, there exists a difference between personal and mass surveillance. Personal surveillance is [19, p. 499]

“[…] the surveillance of an identified person. In general, a specific reason exists for the investigation or monitoring.”

Mass surveillance is less focused on gathering information about a particular target, and rather focused on gathering information on a wider group of people. Surveillance parameters used for target selection include, but are not limited to, information such as the identity and nature of the target (e. g. the name of an individual, organisation, or physical location), the methods to be used, and ramifications on the use of those methods (spatial, temporal, or contextual; e. g. personal phone calls are not included in a surveillance case related to financial misuse, surveillance is limited by time or physical boundaries). As mass surveillance is not “personal” it can be experienced as a constant gaze that you cannot predict or expect, an overseer from the shadows of the digital Panopticon.

2.2. Mass surveillance – the Panopticon of the new millennium

The Panopticon theory of surveillance is based on the works of Jeremy Bentham, an 18th-century philosopher, who introduced the Panopticon as a prison that relies on continuous surveillance and complete lack of privacy for inmates [10]. The concept of Panoptic surveillance was further refined by Michel Foucault in Disclipine and Punish: The birth of the prison [29]. The Panopticon has also been used in a more modern context, such as electronic and workplace monitoring [58,104].

In essence, the Panopticon is a model for efficient surveillance and self-imposed control. The key idea is that perceived surveillance is as good as actual surveillance, and that surveillance – whether perceived or real – changes the behaviour of the subject towards whatever is “desirable”. This combination makes it possible to control and modify the behaviour of subjects even with perceived surveillance, making collective surveillance easier and less resource-intensive. When subjects perceive surveillance to be constant, they adapt their behaviour to match this perception, regardless of whether that perception is founded in reality or not.

The Panopticon was initially presented as a prison design that would make the inmates supervise themselves, and lead to change in inmate behaviour. In a Panopticon prison, the cells are continuously illuminated and arranged in a circle. The wall facing towards the centre is transparent, making everything in the cell visible to an observer. The prison guards are stationed in a tower, placed in the structure’s centre. Windows on the tower are opaque when viewed from the outside, and transparent when viewed from the inside. This makes it possible for the guards to observe the prisoners at any time. Because of the opaque windows, the prisoners are not able to see the guards at all, and cannot know whether they are being watched or not. This perception of surveillance essentially forces the prisoners to adjust their behaviour to the knowledge that they can be under observation any given moment. In this manner, panoptic surveillance changes the behaviour of its subjects by forcing self-censorship and adaptation to conform to the expected behaviour standard.

A classic example of a Panopticon in literature is the telescreen in George Orwell’s classic book Nineteen eighty-four, in which a telescreen is a television-like device installed in every home. It provides the same functionality as a television screen, but also makes it possible for the authorities to observe those who are in the room. This observation happens without the knowledge of and any indication to those in the room. People are in turn aware that someone could be watching them through the telescreen at any moment. This kind of ubiquitous surveillance without any notification makes the telescreen an excellent example of a panoptic surveillance device.

Devices with similar capabilities as the telescreen do exist in real life, even though they have not been used in the same manner. For example, Microsoft’s Xbox 360 and Xbox One gaming consoles already had the capability, through the Kinect motion detection sensor, to identify whether there were people in the room, what they were doing, and record audio of what they were saying. The motion detection accuracy of the Kinect sensor [99] had been tested to be sufficient for applications such as gait analysis [101] and Parkinson disease monitoring [30], so it was definitely accurate enough to conduct surveillance. When Microsoft introduced Xbox One in 2013, one of the pre-release announcements was that the Kinect sensor was mandatory for the device to function. This requirement was later rescinded, partly due to resistance from consumers and privacy advocates.

The presence of smart devices in living rooms has been growing steadily and as the prevalence of such devices increases, security and privacy aspects also become salient. In March 2017, documents detailing an attack code named Weeping Angel that exploits vulnerable Samsung smart TVs [98] was published. Weeping Angel can turn a compromised TV into a device capable of monitoring its surroundings using the built-in microphone. Gathered data can be further processed and sent to the attacker. This kind of surveillance capability and method is eerily similar to the previously described telescreen example from Orwell’s classic book.

The Panopticon theory provides us with a compelling background upon which to examine the different manifestations of surveillance. The Panopticon indeed evokes mental images of an “all-seeing eye”, a concept perhaps best conceptualised by fictional entities such as Sauron in The Lord of the Rings. Sauron was depicted as a demigod capable of observing anything and anyone in the world with his giant eye, and it took the heroes great effort to avoid his gaze.

The Panopticon as a model has been widely criticised in the literature to be both inaccurate and unsuitable for modelling real-world surveillance [see eg. 6,8,13,36]. Haggerty [36] argues that the Panopticon is no longer a suitable model of surveillance, based on the vast number of different refinements to the model, and because “[e]ach new ‘opticon’ points to a distinction, limitation, or way in which Foucault’s model does not completely fit the contemporary global, technological or political dynamics of surveillance.” Indeed, the sheer number of different refinements indicates that the Panoptic model is not fully capable of capturing all nuances of surveillance.

Indeed, it is possible, and even tempting, to create ‘Yet Another Opticon’, to define a new Panopticon model to fit most surveillance scenarios. We argue that this is ultimately counter-productive. We should treat the Panopticon as what it is, a convenient tool for illustrating what complete and total surveillance could encompass, without trying to extend its scope. With mass network surveillance it has become possible to gain and control information about people, who cannot see who is watching them and why. The unit cost for surveillance has become a matter of physical resource – processing power or data storage – instead of human resource. This is the key difference between old world mass surveillance schemes in East Germany or the Soviet Union, and modern mass Internet surveillance systems.

2.3. Surveillance and behavior

Human beings have a tendency to behave rationally only in economic models, where the idea of people making rational, informed choices is assumed to be the norm. Actual human beings behave in unforeseeable ways and make decisions that are not optimal or rational for them, at least apparently. We all make “bad” choices all the time.

According to existing literature and research there is a strong connection between surveillance and behaviour. Surveillance or just the mere knowledge that others are paying attention changes our behaviour, sometimes quite dramatically. Already in the 18th century, Bentham [10] was keenly aware of the effect that constant surveillance has on its targets, and he was certainly not the first to perceive this phenomenon.

Solove [86] argues that we all have something to hide, whether we know it or not, and failure to realise this is due to a misunderstanding of the basic nature of privacy. He observes that those who support the nothing to hide argument generally tend to see privacy as negative – a necessity for hiding something harmful or illegal. Indeed, Schneier observes [82] that those who espouse the nothing to hide argument “accept the premise that privacy is about hiding a wrong.”

The chilling effect [80] is example of surveillance affecting behavior. The chilling effect can also be argued to apply directly to network surveillance. When one is aware that all Internet traffic is monitored for “suspicious” content, it is reasonable that one will avoid any behaviour that could be interpreted as even close to being suspicious. As “even lawful conduct may nonetheless be punished because of the fallibility inherent in the legal process” [80, p. 695], especially if it falls close to the border between accepted and unaccepted conduct.

Recently, Stoycheff [89] has examined the connection of surveillance and the chilling effect. She found that a perceived hostile opinion climate negatively affects the willingness to speak out online, and that if people are aware of surveillance and feel that the surveillance is justified, they tend to conform their opinions to the perceived majority, and staying silent otherwise.

The effect of direct surveillance has been studied widely. Extant literature includes studying generosity of donations [14,53,67,88], the effect of images of eyes [40], robotic eyes [15], effect on littering [27], among others.

The reaction to perceived surveillance seems a profoundly human condition that exists irrespective of the technology used. Overt, direct surveillance provokes change in behaviour of its targets towards more desirable patterns from the viewpoint of those performing the surveillance. When this observation is put into context of mass Internet surveillance, a de facto chilling effect on online behaviour is revealed. Its root cause is the knowledge that all actions taken online are monitored and stored for further analysis. However, the intended targets of this surveillance – the terrorists, criminals and spies – can continue their operations normally, as long as they know how to avert surveillance by using strong cryptography and strict operational security procedures.

Real surveillance is done with massive amounts of collated metadata [81], and there the most privacy sensitive problems arise: the gathering of data and its subsequent consolidation and combination with other records, and then making assumptions based on meanings derived from incomplete or incoherent data. Mass surveillance through gathering and storing information for later analysis has become the go-to tool for mass surveillance. The reasoning behind this development is actually quite sound: because of the complexity of Internet communication systems and the sheer amount of data transferred combined with the difficulty of pinpointing the target of surveillance, it quickly becomes more feasible to just gather as much data as possible and perform analysis later.

One chilling result of systematic data gathering is in the ability to compound surveillance records over time. If every single thing that a person does online is stored permanently, this information can be used at a later date, even years or decades later. Any potentially harmful information could be used years after it was originally captured, for example, and the target has very limited power to affect how this information is stored and used – that is if the target is even aware of the existence of such data.

Security and privacy concerns have driven secure solutions for network communications to become more and more prevalent, but the default assumption of openness can be seen in the nature of various Internet protocols. HTTP and FTP traffic, for example, were originally sent by default in the clear, without any privacy or security. Nowadays, secure versions of most Internet protocols are used by default. In wireless networks, all receivers within range of the transmitter are able to listen in on the traffic sent by any other host; the fact that on the chipset level, most wireless local area network interfaces choose by default to ignore packets not meant for them can be considered to be an act of politeness, not a feature that brings robust privacy or security to wireless networking.

In our context, this is the Internet, but in principle it does not matter what kind of medium or encoding is used. These certainly have an effect on potential forms of surveillance, though. Computer networks are relatively well-organized by necessity, and this suggests that networks are also well monitored and administered. An administrator of a network is able to perform surveillance on their own network as a by-product of normal administration and troubleshooting duties. Essentially, no traffic is safe from the view of the administrator or operator of a network. This makes the service provider a single point of failure regarding security and privacy, and also a very tempting target for infiltration or some other kind of clandestine information gathering.

Finally, we observe that technical solutions to individual vulnerabilities and threats are important, but in-depth analysis is also out of the scope of this paper. This is because our solution is not technical and it does not aim to address specific concerns on particular technology, vulnerabilities or risks, but rather create a guideline for the whole field of computing on how to protect privacy and rights of individuals while simultaneously granting the possibility to use personal and person-derived information in various processes, but in a human-centric approach.

4.1. Datenherrschaft – mastery over data

Mass surveillance generates massive amounts of data. From the perspective of targets of surveillance, that data is derived from their persons, activities and contains significant amounts of personally identifiable information [95]. Here we have an opportunity to examine the ethical dimensions of mass surveillance, and approach it through ownership of data. We use the aforementioned concept of Datenherrschaft together with mass surveillance to explore possible ethically sound foundations for legitimate surveillance.

The definition for Datenherrschaft is given by Kainu & Koskinen [45, p. 54] as:

“the legal right to decide the uses of, and continuing existence of, in a database or another compilation, collection or other container or form of data, over an entry, data point or points or any other expression or form of information that an entity has, regardless of whether they possess said information, with the assumption that sufficient access to justice is implemented for a citizen to have this power upheld in a court of law.”

The difference between Datenherrshcaft – mastery over data – and ownership as property rights can be condensed to four key differences. First, Datenherrshcaft is nontransferable [47, p. 102]. While ownership of data can be transferred to another, the mastery over data is permanently bestowed and thus prevents the irrevocable transfer of “ownership” – like human rights. Koskinen notes that the mastery over patient information can only be given to the person from whom the information is derived from.

Second, Datenherrschaft is not a compensation or a reward [47, p. 102]. Koskinen observes that while work is done by someone is seen as a justification for granting that someone immaterial property rights to the result of that work, in some contexts this is not applicable. In the context of healthcare, the compensation comes in the form of salary, so there is no need to compensate the person who compiles data about the health of a patient into patient information with ownership of that immaterial property.

Third, Datenherrschaft is bestowed by default to the person from whom the data or information is derived [47, p. 103]. It is commonplace to pass on intellectual property rights to parties that have done no actual intellectual work in creating protected information. For example, in Finland, it is possible to transfer the intellectual property rights of an invention made by an employee to the employer. In contrast, Datenherrschaft is inherently a part of the originator of the data [45], and thus cannot be transferred to another entity as it is inalienable from the person. To summarise, Datenherrschaft should be understood similarly as human rights are, instead of object economical transaction that seems to be the case nowadays.

The fourth and final difference is that while intellectual property rights are originally based on an artistic process or efforts to create the property, Datenherrschaft can rather be used to protect the individual right for privacy and control about themselves, and thus should not be compared with property rights [47, p. 103]. Thus, we see that idea of legislating personal information with IPRs [96] is not the right path, as it reveals that people are a source of information and as individuals, are usually the weaker part compared to corporations due to fewer resources to defend their rights.

4.2. Ethical data-driven surveillance

Datenherrschaft has been previously used to examine and outline ethically sound and justified approaches to the ownership of patient information [47–51]. Patient information systems contain significant amounts of data on a person and their private matters. Patient information should thus be seen as sensitive, and that it needs explicit protection from misuse and unnecessary observation by others.

While Datenherrschaft regarding patient records and health information has already been discussed in the literature, surveillance and Datenherrschaft has only been discussed in a cursory manner by Hakkala [38]. This work aims to fill this research gap, opening the discussion on the applicability of Datenherrschaft to surveillance data and offers a new approach instead of relying on problematic property view on the information.

Concepts such as the Panopticon give us tools to observe how omnipresent surveillance works and how all aspects of society are being harnessed as sources of data for surveillance. Datenherrschaft gives us a framework through which we can observe surveillance in an ethically justifiable manner, and gives the potential to create practices that are better in protecting the individual citizen of the networked information society.

Koskinen [50] illustrates the problems with patient information ownership. They observe that traditionally the ownership of intangible things such as information is governed through intellectual property rights. Patient information, however, is not suitable for being governed by the same legal framework. Even though patient information is immaterial, it is still irrevocably bound to the source of the original information – the patient.

Now, let us consider the data that is used as the basis of mass surveillance. This, similarly to patient information, is immaterial information that is bound to the originating source – the person. This data is also used to make surveillance-related decisions that can have an effect on the person on various levels, even including their health. This parallel that can be drawn between patient information and data that is used to conduct surveillance serves as the basis of the argument that Datenherrschaft can also be used as a solution in protecting citizens of the networked information society from undue violations of privacy.

In an ideal world, the information that is gathered with the express purpose of tracking people should be governed by the principles of Datenherrschaft. The person from whom the information is directly derived should have control over that information, even though it is used by other parties. Indeed, the concept of the data double previously discussed in Section 2 gives some credibility to the demand for application of Datenherrschaft. If the information that is, in the virtual world, considered to represent a person (or even to be that person), it is only natural that the person should have a degree of control over the data double.

If we examine information that can potentially be used for surveillance, we immediately encounter the problem of defining the information to be protected by Datenherrschaft. Particularly, we should be able to identify the different kinds of data that are collected from us. Previous research, as observed above, has focused on patient records, but if we are to extend the scope of Datenherrschaft to other kinds of data, we must be able to accurately identify the information to which the principle of mastery over data is to be applied. As most surveillance is driven by metadata, this is where we must proceed next.

4.3. Datenherrschaft and metadata

When we consider metadata from the perspective of Datenherrschaft, we immediately encounter some questions. At what point does data derived from data cease to be under the mastery of the source of the data? Should we also own and have mastery over data about data from us? This is a central issue with applying Datenherrschaft on personal data used for surveillance.

One clear requirement for managing and combining metadata in any larger form or shape is that it cannot be identifiable or traceable to a single individual, a reasonably sized group of individuals, or a certain demographic. Anonymisation of data, in other words, is a clear prerequisite when any larger sets of personally identifiable data are processed.

Unfortunately, even anonymised data can be de-anonymised (see c.f. [25,66,92]). With current technology, algorithms, and a sufficiently large body of metadata, it is possible to trace entries back to the individual in most, if not all cases. Thus metadata has to be considered as a part of personal, person-derived data, even when some claim that metadata is anonymous.

Can we infer from this societal requirement – it is indeed societal, as it stems from legislation and the perceived need for such – that we should also have mastery over surveillance data and metadata that is derived from and used to surveil us? We continue to exert influence, albeit non-personalized, on how data about us is handled. An obvious counter-argument is that surveillance is by necessity a covert operation and that to give the subject or subjects of surveillance a notification let alone some actual power over this surveillance process would be ridiculous and counter-productive.

We come into apparent conflict with Datenherrschaft, which argues that the individual should have the right to decide how their data is used. This conflict can be resolved with an inherent property of Datenherrschaft – mastery over ones data confers not only rights but also responsibilities. Justifiable situations exist where the Datenherrschaft of a person over their own data can be overridden. Koskinen [50] outlines that prioritising life, health and liberty over possessions is justifiable, and thus Datenherrschaft can be superseded in these cases.

4.4. Why Datenherrschaft matters

We see that parts of the ideal of Datenherrschaft already exist in some legislations, especially in the GDPR, which underlines that people have an intrinsic right to privacy and protection of personal information. However, the rights of other people can supersede and override an individual’s mastery over their data whenever there are ethically “higher” values to be defended by violating Datenherrschaft. Therefore the individual rights can limited in some justified cases, such as in the state of emergencies, combating epidemic diseases and when individuals violate the rights of others.The guideline for limiting Datenherrschaft should be to be as non-intrusive as possible and respecting Datenherrschaft as much as possible. These exceptional situations should be codified separately with extreme deliberation.

The existence of the above limitations on Datenherrschaft means that a person cannot exercise their Datenherrschaft to stop the use of their data in lawful and ethically justified use. Investigations that are conducted according to legal guidelines certainly fulfil this criterion, but now we face another problem: what should be considered as lawful use, i.e. how should the law be written?

The difference with Datenherrschaft when compared the protection of privacy and personal information e.g. in GDPR is that by Datenherrschaft it is a clear articulation of that individual as a source of information posses the mastery over this information. Thus, the idea is not that privacy and personal information need only to be protected. The core idea is that the control of information use is given to people and that they should possess legitimate power to decide how information is used. The strength of Datenherrschaft lies in that it is not too detailed to be mere legal jargon. Instead, it straightforwardly states that people have the right to decide how information is used and when they decide so, the use of information needs to end. There is a demand for clear rules that can be understood by laymen, even though there is also a need for detailed legal texts. The kind of statement that Datenherrschaft offers is needed to clarify what should be the rights of people when using information derived from themselves. If this approach is taken seriously, it could be the foundation for self-regulation of data collection and hence drive policies in such a direction where people could truly decide how information is used – if organisations commit to following the idea of Datenherrschaft.

The legislative discussion in detail is clearly out of the scope of this article, rather being a task for professionals of jurisprudence. The observations made earlier in this paper give us a starting point when considering the negative effects of surveillance. Balancing these negative effects with the rights of the citizen is a difficult task, but Datenherrschaft has the potential to be the underlying guideline that facilitates ethically acceptable and justifiable choices as it gives the real possibility to act against unwanted use of information. Thus, Datenherrschaft should be considered in a similar manner as a constitutional right that can be limited only in certain, well-justified circumstances; collecting information for necessary governmental tasks or protecting justified rights of others that would be jeopardised without accessing information under Datenherrschaft. Purely commercial use is not a justification for overriding Datenherrschaft.

Currently surveillance is performed by both public and private instances: companies such as Facebook and Google have made their entire business dependent on practices that approach (or practically are) surveillance. The EU is actively taking the stance that individual rights for privacy and control over information are stronger than the rights of private companies, as is evidenced by the adoption of GDPR. However, by further implementing Datenherrschaft we could underline this and make it explicit. In the case of mass surveillance, Datenherrschaft should be used to provide general ground rules and any violations should be justifiable. Next, we examine the issues that must be taken into account when violations of Datenherrschaft are considered.

One counterargument from Governmental viewpoint is that without mass surveillance it is possible that we cannot find real security threats for society, as surveillance is the best tool for finding them. However, if this is considered plausible logic, then we can also justify systematic house searches, breaking inviolability of letters etc. by merely stating that with these violations of our basic rights, the real criminals or terrorists can be caught. The problem is that in that kind of society, the government itself has transformed to one that is a threat to the people themselves [see e.g. 57,63].

The idea of giving the possibility for overriding Datenherrschaft is to secure the rights of others, and thus the override has an ethically defendable goal, even though not entirely without gaps. However, to override Datenherrschaft, the threat to others should be significant in its quality and probability. Especially in mass surveillance, this seems to be a problematic issue. With mass surveillance, most individuals who are targeted are not a real threat to anyone. Thus, their Datenherrschaft should not be violated, as it limits their freedom and privacy without proper justification. Constitutional rights can be overridden only on a very strong basis. The same should apply to Datenherrschaft, and we claim that with mass surveillance, this strong ethical basis is missing. Democratic societies should be based on the rights of the individuals, and Datenherrschaft is offering a ground rule – empowering the individuals – to resist data colonialism, where people are seen as mere exploitable subjects under algorithmic control [see 21]. Hildebrandt [42] shows that there is a need for transparency to illuminate the logic behind information collecting technologies and algorithms. As in the definition of Datenherrschaft – the legal right to decide the uses of,… – it is vital that the people have the right to decide how information is used, and this can be achieved only by transparency, for which Hildebrandt offered five recommendations when using data mining algorithms for profiling users [42]. First, collaboration between engineers, designers and end-users and affected parties is required. All parties affected by data mining activities should have representation in the design phase of the data collection and analysis process. Second, data collecting mechanisms should be made visible to see what these data collecting systems can do. Third, all trials should be reported to reveal the possible problems and biases of those algorithms. Fourth, the data and the methods used should be verifiable by lawyers and software engineers when public interest requires it. Fifth, the results of any data mining operations should be constantly evaluated and examined to confirm that they conform to the rule of law.

Likewise, there is need to make non-technical aspects of data collection and use more transparent – why and for what purposes the information is used by different actors – to ensure that people can decide the use of information that Datenherrschaft protects.

There should be a clear justification for surveillance and thus violating Datenherrschaft. When someone is targeted for surveillance, probable cause and clear procedure should be the norm. Additionally, if the result of surveillance is that no severe crimes were committed, the target of surveillance should be informed, all collected material should be presented and people should be given the right to verify to what purposes the information is used for and when. All gathered information should be erased afterwards. Likewise, there should be further discussion on compensation for individuals whose Datenherrschaft has been violated. To avoid unnecessary and heavy-handed use of surveillance, the process should be sufficiently rigid (afterwards) that should there be no severe threat to others, surveillance is not done just in case.

In light of Datenherrschaft and demands set for justified exceptions for surveillance, mass surveillance – as it is defined in Section 2 – cannot be accepted. We need new informed ways to use the information collected from people in such a manner that people can understand and control it. While this is not an easy task, it does not make it any less important but rather an issue that should be focused on.

5.1. Justification of surveillance by governmental authorities

However, surveillance can be justified in some situations. Few can argue against just and laudable goals, such as the need to fight crime and terrorism, and these two are indeed commonly cited reasons for using surveillance. Another aspect of generally acceptable surveillance is monitoring known dangerous places and massive events with large crowds, for example, so that emergency response is not delayed unduly in the case of an accident or other undesirable event.

What is more interesting in this regard is that many may even consider surveillance a good thing. This is evidenced by the prevalence of people who espouse the “I have nothing to hide” argument. They are perhaps confident that surveillance will target people other than themselves, and even if they should be targeted, nothing bad will happen as they are innocent and indeed have nothing to hide, and thus nothing to fear. Such attitudes towards surveillance have been found in studies [see c.f. 41].

The existence of valid reasons for surveillance, and even for mass surveillance in some cases, makes it very difficult for a society to limit the use of these powerful tools to the bare minimum of acceptable use cases and scenarios. Interception of private messages by law enforcement authorities is referred to as lawful interception. This is done acting under the colour of law, usually with a court order or a warrant, depending on the jurisdiction. Lawful interception of protected communications is an important part of law enforcement and criminal justice as a method for obtaining intelligence on unlawful activities.

Lawful interception is, for the majority of cases, targeted surveillance. The goal is to obtain particular information, or to follow only certain people, thus inherently narrowing the scope of surveillance to only intended targets. In most civilised countries, for example, the permit for telecommunications interception must be granted by a district court or equivalent, and the surveillance must be specifically targeted to a certain case, person, and topic.

However cynical it may seem, we can postulate that when a tool for targeted surveillance, such as monitoring telecommunications, network traffic, or traditional mail, becomes useful in existing mass surveillance, the umbrella of tools and methods deemed as lawful interception in a jurisdiction tends to expand to cover the use of new, useful tools. This is regardless of the original intent of the law regarding mass surveillance. This can be speculated to be a kind of function creep, where something that has been found useful in smaller scale is simply taken into use in a larger context. The concept of rhizomatic surveillance discussed in Section 2 describes this development quite accurately.

Using data mining for identifying anomalies from Internet traffic requires storing and analysing massive amounts of data to establish a baseline. While this can be seen as lawful interception, establishing the baseline requires processing a lot of data from individuals that are not being suspected of any crime.

Dictatorships and oppressive regimes have used surveillance as a method for control and suppression throughout history, and there are no indications that the method would have lost its effect, at least judging by the continued use of surveillance in contemporary societies. One timely example is the downfall of Afghanistan, which also has a connection to surveillance of people. Here, personal information collected from people that have been working with the collapsed regime or otherwise have been acting against the interests of the Taliban can be extremely dangerous for those individuals. What is notable that most of information is collected via private companies, such as social media, which underlines the fact that mass surveillance is a global phenomenon that exceeds the boundaries of governments and companies that cannot be controlled by any single actor.

5.2. Forced trust in surveillance society

Methods for controlling such an institutionalised infrastructure surveillance are rarely, if ever, technical, but rather based on softer controls such as legislation and customs. The main problem, in this case, is trust and specifically, lack of trust. How far can we trust that our data that is collected to provide a service is not used against us in the future?

A concept that describes this situation is known as forced trust [39]. In the context of information systems and information society, the users of an information system or the members of society are at a significant disadvantage regarding what systems they are supposed to use or in what systems their data is processed in. Decisions on what systems are used, who builds them and who administers them are something that ordinary users or people cannot affect in any way. Thus they are forced to trust that the security and privacy of such systems are in order, that their data is handled properly, and that there are no adverse effects from using such systems. In the case of critical governmental information systems that are responsible for many services in information societies, this is a significant problem. Surveillance systems fall arguably to this category as well, and the data gathered with surveillance is something that ordinary people have no power over. That is, unless we implement Datenherrschaft and give mastery over data to individuals, even in such situations.

5.3. Consequences of surveillance society for individuals and organisations

When mass Internet surveillance and data gathering is combined with modern efficient data analysis techniques, new associations and links between people are created; events and concepts that, however improbable or trivial, can be used to show connections and intent not based in reality [60]. The use of such information in a malicious manner is a serious concern for individual security and privacy. Even if this data is used in good faith to pursue justice and uphold “national security”, because of the disconnect between events and intent inferred from data and reality, mistakes are bound to happen. Connections will be made between people and events that have no basis in reality. For example, correlation of location data of people to movements of a target of interest can result in a person being targeted for surveillance just because they are in the same physical location as a person under targeted surveillance.

If an illegal act is erroneously associated with a person, what would the effect on society be if those falsely attributed allegations were aggressively prosecuted to the full extent of the law? For example, terrorism is a naturally a very serious crime for someone to be charged of. In the current societal climate, however, even the mere suspicion or illusion of association with terrorism can be dangerous. The publicly stated purpose of many mass surveillance programs is to increase national security and combat terrorism, so such crimes are routinely investigated in those programs. Therefore it would stand to reason that the erroneous accusations would be more serious. As it was noted previously when discussing the chilling effect, the legal system is not perfect, and even such erroneous accusations may lead to sentences. This would understandably enhance the chilling effect, as people would be more inclined to stay away from any topics of controversy to maintain an appearance of blamelessness.

These observations apply to any nation with a strong government and permissive legislation on mass surveillance. For example, one of the main problems for US-based tech companies is that they have no means for defending against allegations of cooperation with intelligence agencies. If the US government wants access to data in the possession of a US company, they can issue a national security letter. It compels cooperation under the threat of imprisonment for company executives, and also forces everything related to the letter to be kept secret. The recipient of a national security letter cannot thus divulge to any third party that they have in fact received one. Warrant canaries [32] – public statements on the company web page stating that no warrants have been issued to the company – have been formulated as a defence against this kind of government action, but their effectiveness is yet unclear.

The problem with assurances of non-compliance with authorities is that cooperation is practically mandatory. The US is a key Internet hub with a significant share of traffic routed through it, and the US is also one of the key suppliers of Internet technologies. A significant part of big data is also stored in data centres, in locations under US jurisdiction. For example, Lavabit, a secure email service provider used by Edward Snowden, was forced to shut down for the owner of the company to avoid prosecution and possible imprisonment [56]. Naturally, this option is not available for technology giants such as Google, Microsoft or Apple; They must comply with any valid requests for data by the government, as shutting down a company that large is simply not an option, and they cannot risk consequences that would arise from even discussing the details in public.

5.4. European data economy as an example of possibilities of Datenherrschaft

Building a European data economy is part of the European digital single market strategy and it is based on the free movement of non-personal data [20]. However, the data economy is also heavily based on the use of personal information, which in turn is based on GDPR and the portability of personal data. Data portability is relevant to data economy, as it provides the basis for transferring information and controlling personal data to be used in digital societies [23]. Thus, to overcome the lack of trust and risks for ethical society, there is a need for a new approach to data economy that is people-centric and transparent [52]. As a concept, Datenherrschaft is in line with GDPR’s aim to protect individual privacy and to give “ownership” of information to individuals. Especially when data is seen as an asset or resource [12,24,35] Datenherrschaft is a strong statement as it gives the mastery to individuals for that asset. It also helps individuals protect them from corporations as it fundamentally differs from property rights, as Koskinen noted:

“The Datenherrschaft differs substantially from property rights in four specific ways. First, when ownership of property can be moved from one party to another one that is not case with Datenherrschaft. Datenherrschaft is irremovable from the individual who has it. It is the individuals choice of to make or not to make the criminal act, and is not removable form what the actor then is – even the driving forces behind the act can be interpreted. Datenherrschaft can be only be given to the person from whom the information is. It is notable that the person cannot give up the Datenherrschaft even they want to. This makes Datenherrschaft so unique.” [48]

However, before it can be applied, Datenherrschaft opens questions and areas of research, some of which are already shortly covered in this article. Nevertheless, there is one specific outcome of concept that makes the difference. If data gathered from an individual is seen as an inseparable part of that individual, we need to investigate new ways to distribute information and simplify the agreements between individuals and organisations that use the information. One proposed approach for this is called MyData, where agency for individuals is seen as a central issue, supported by data operators who provide tools to individuals for controlling information sharing and consent [55,71]. Although the MyData approach is not yet ready or perfect, it shows that the current system can be altered if there is the will to do it. The European model for Data economy could be based on the idea of Datenherrschaft, as it is a strong statement towards human-centric data economy, also visible in and supported by GDPR.

However, legislation cannot be replaced with Datenherrschaft. Legislation needs to be more accurate and give more detailed guidance for actors under it. These kinds of details are missing from the concept of Datenherrschaft. In this weakness also lies the strength of Datenherrschaft. By being straightforward and short, it is intuitively approachable and could serve as the understandable goal which different actors could aim for. It could be seen as soft law6

Future work in this area should include a comprehensive analysis on the applicability of Datenherrschaft to the case of lawful interception and surveillance. The nature of personal and privacy-sensitive information should be analyzed similarly as Koskinen [47] has done to patient and health information, through the different ethical theories. This will shed light on the suitability of Datenherrschaft to this problem and gives an ethical foundation on which to build the future of the networked information society.

A key observation made by Koskinen [47] about Datenherrschaft is that it seems to be intuitively suitable for also other kinds of private information rather than just patient records. The idea of applying Datenherrschaft to other kinds of data is thus tempting. Surveillance has its own inherent problems with privacy and freedom of speech, and thus approaches for ethical solutions to managing surveillance and the vast data associated with it in a morally and ethically justifiable manner are quite desirable. Datenherrschaft has the potential to be the ethically sustainable solution to this difficult problem and the initial step that is desperately needed in managing person-derived data. Further research is required before this potential can become reality.