ICO Publishes Its Report On Big Data And Data Protection

On 28 July, the ICO released its report 'Big data and data protection' (the 'Report').

The Report defines 'Big Data' and sets out the data protection and privacy issues raised by Big Data, as well as compliance with the UK Data Protection Act 1998 ('DPA') in the context of Big Data.

The ICO defines Big Data by reference to the Garter IT glossary definition, and further explains that processing personal data must be of a significant volume, variety or velocity.

When announcing publication of the Report, Steve Wood, the ICO's Head of Policy Delivery, stated that "Big Data can work within the established data protection principles....The principles are still fit for purpose but organisations need to innovate when applying them".

Under the DPA 1st Principle (fair and lawful processing), the Report emphasises that the complexity of Big Data analytics should not become an excuse for failing to seek consent where required, and that organisations must process data fairly, particularly where Big Data is used to make decisions affecting individuals. A study by Barocas and Selbst entitled 'Big Data's Disparate Impact' found that Big Data has the "potential to exacerbate inequality", and use of Big Data that resulted in discrimination would violate the fairness principle.

The Report addresses the significant issue of data collection when using Big Data analytics, and stresses that an organisation must have a clear understanding from the outset of what it intends to do with, or learn from, the data to ensure that the data is relevant and not excessive for the purpose. The Report seeks to address the growing concern that Big Data analytics tends to involve collecting as much data as possible, but that under the DPA, data minimisation remains an essential element of Big Data.

The Report also cautions that organisations seeking to use analytics must...