Me and My Big Data: Understanding Citizens Data Literacies - Final report

We all leave data traces as we move through our digital lives. Some of this is intentional as we sign up to services or make purchases, but much of it is not. In some if not many cases, our actions online are tracked coercively and without our knowledge. This may be cookies and apps tracking us across our various internet interactions or data we post into social media about ourselves. Much of it may be collected, amalgamated, and processed by the platforms we knowingly use, or passed on to third parties for such purposes as advertising, marketing, or political campaigning. How much do we as citizens know about where our data goes, the uses to which it is put and what impacts this might then have upon us? These questions form the heart of the ‘Me and my big data – developing citizens’ data literacies’ project. The project was conceived before many recent events and incidents that highlighted the issue of how data about us, as citizens, is collected, processed, and used. In the UK and the USA the Cambridge Analytica scandal, issues of ‘fake news’ and mis-/dis-/mal-information in social media, and concerns about COVID-19 tracking apps are examples of developments that have brought questions of data use to the fore. Yet as we finish writing this report citizens in Afghanistan are actively deleting social media profiles for fear of the abuses and surveillance that the new government can do with their data. There are also fears about the potential uses the Taliban regime may make of the e-Tazkira system a biometric identity card used by Afghanistan’s National Statistics and Information Authority. This includes fingerprints, iris scans and a photograph, as well as voter registration databases. Suddenly citizens become aware of their data traces, as they are of stark concern and potentially deadly consequence. The political and civil rights issues of such systems also remain important in the UK, Europe, and the USA. Here we see contrasting models of minimal, decentralised and citizen-controlled data sharing (such as the EU vaccine passport) compared to centralised amalgamated data systems such as the original plans for NHS contact tracing system. One addresses user privacy rights while the other may create a data set of use to medical research. The data traces we leave can therefore have material consequences, both good and ill, for individuals, communities and societies and are becoming bound up in our civil, consume and personal rights. Much prior research has focused on technical solutions to data sharing, its regulation or on broader questions of data and digital rights. In this project we have focused on the exploring the extent of citizens understanding of how their data may be collected and utilised by platforms, companies, organisations or the state. The intention being to develop potential policy intervention recommendations or educational materials to improve citizens ‘data literacies’. As both the project data collection and external events unfolded, the complexities of the issues, the size of the gaps in knowledge and significant differences in awareness between different demographic groups became very clear. Overall, it seems we lack key awareness of what is happening to our data, nor are we the engaged data citizens we might hope to be and that may be needed in a highly ‘datafied’ society. This report focuses on the main research findings along with our basic policy and education recommendations and principles. A following educational and intervention guidance report will provide a more practical set of ideas for activities that organisations, groups and policy makers might wish to undertake