Introduction
In 2008, a flowchart was distributed by the Information Commissioner Office (ICO) in the United Kingdom as part of its Anonymisation Code of Practice. Both the flowchart and the code of practice were published and circulated to organisations and individuals who handle and manipulate different kinds of information, to aid them in determining when information is to be considered personal data. The flowchart, and the Code of Practice it was embedded in, was issued under the Data Protection Act 1998,38 which is the piece of legislation that regulates what count as personal data in the UK, and how it should be dealt with. The flowchart proposes that data controllers - that is, individuals or organisations managing different kinds of information - should ask the following questions when presented with data deemed to be personal:
Can an individual be identified from the data? Does the data relate to the identifiable living individual? Is the data obviously about a particular living individual? Is the data linked to a particular individual so that it provides particular information about that individual? Is the data used, or is it to be used, to inform or influence decisions affecting an identifiable individual? Does the data have any biographical significance in relation to the individual? Does the data focus or concentrate on the individual as its central theme
rather than on some other person, or some object, transaction or event? Does the data impact or has the potential to impact on an individual, whether in a personal, family, business, or professional capacity?39
Each combinatory possibility offers a different outcome that determines whether, from a legal point of view, ‘data’ - opinions, transactions, interactions, movements, beliefs, sentiments, and conversations, to name a few - should be considered personal or not.
The first legal case that was decisive in configuring a legal interpretation of personal data in the United Kingdom was that of Durant vs. Financial Services Authority (FSA). This case was paradigmatic in framing a definition of personal data for the legal system. The claimant Durant was in dispute with Barclays Bank, and made a complaint to the Financial Services Authority (FSA). This led to a confidential enquiry by the FSA into the bank’s proceedings in relation to Durant. The claimant, who had already lost various law suits against the bank, requested access to all records held by the FSA ‘which mentioned his name or in were in any way “related to” him, on the grounds that they were “personal data” of which he was the subject and to which, by ss7(1) and 8(2) of the 1998 Act, he thus had rights of access’ (Edwards 2004, 344). The legal case focused on defining ‘how widely the phrase “relate to” in s1(1) should be interpreted’ (Edwards 2004, 344). A wide or narrow definition of the phrase ‘relate to’ would ultimately determine what information the claimant had the right to see. The English Court of Appeal opted for a narrow
39 Information Comissioner Office, Draft Anonymisation Code of Practice, for Consultation
definition of personal data, based on one of two definitions taken from the Shorter Oxford Dictionary for the phrase ‘relate to’ (Edwards 2001, 343). The narrower definition stated that the phrase ‘relate to’ should be understood as ‘“having reference to, concern’” (Edwards 2004, 343), whereas the wider definition should be understood as ‘“having some connection with, be connected to”’ (Edwards 2004, 323). It was argued that the narrower definition was more appropriate to serve the legal purpose of the 1998 Act because it entailed giving Durant ‘information about himself’ only, and not information specific to any other things or persons per se, like documents or third party individuals. From then onwards from a legal perspective, ‘whether any particular information amounted to “personal data” would in general depend on where it fell in a “continuum of relevance or proximity” to the data subject’ (Edwards 2004, 344; my italics).
I use these juridical examples as an introduction to this case because they clearly illustrate how the configuration of data as personal is dependent on different framings and framing devices operating within a range of fields in society at large. The flowchart can be thought of as a framing device that, when applied to a particular case, can determine whether a piece of data is deemed to relate to or be about a person. The legal dispute however brings into focus how the application of dictionary definitions was instrumental in defining as impersonal the relation between a physical person and some documents containing that person’s name. The continuum of relevance and proximity between persons and data is articulated by framing devices that operate to extend and collapse this relevance and proximity. This case explores how the introduction of relatively new digital technologies like web-based search engines re-define the relation between data and persons. It also investigates how the
relation between data and persons has been historically configured by well- established devices like informed consent and anonymisation, traditionally deployed as part of ethical research protocols in a range of scientific disciplines.
The case study repurposes a search keyword data leak, the events and materials that this leak unleashed, and the devices and techniques for the framing of data that the leak either afforded or rendered visible for analysis. These are ‘cased’ as a way of studying the making and unmaking of personal data via the workings of techniques and devices, looking at how data becomes contextualised as being about persons on the one hand, and detached and disentangled from persons on the other. The case study suggests that data becomes personalised or depersonalised depending on the workings of different framing techniques and devices. The overflow of data and its subsequent reconfiguration as a case study makes it possible to observe how framing devices of data personalisation and depersonalisation work, and how they are being deployed as part of different practices, genres and protocols. The first technique that I want to engage with is that of a reidentification demonstration. Reidentification demonstrations are statistical techniques deployed for identifying and invoking persons out of anonymised databases. The case study also discusses different techniques being used in the production of data art. One of these techniques is the sequential reordering of data, that is, the repurposing of data found organized in a serial order in a database. The second data art technique is the articulation of a nameless biography, that is, a biography whose function is independent of the use of a personal name. Finally, the case study also looks at the devices of informed consent and anonymisation as part of research ethics protocols that became visible as part of the data leak. Informed consent is a procedure which, by securing a particular form of
informational exchange, provokes research subjects to arrive at a decision about their participation in different forms of data extraction and manipulation. Anonymisation is a device designed and deployed to delete the link between persons and data.
The case is comprised of two Chapters. The first Chapter – entitled The Technical
Redoing and the Aesthetic Reordering of Search Keywords - looks at the emergence
of search keywords as personal data, and analyses the devices and techniques which enable this articulation to take place. It describes how search engines have configured search keywords as an expression of subjective intentionality. The Chapter then moves on to analyse the techniques of reidentification demonstration, sequential reordering and nameless biography as described above. I argue that the public reidentification demonstration of a woman via the re-enactment of her search query history constitutes a framing technique for domesticating search keywords as personal. I also claim that reidentification demonstrations can be conceived of as framing techniques that articulate ‘merographic connections’ (Strathern 1992), and as mechanisms for the ‘technical redoing’ (Goffman 1974) of data. The Chapter then proceeds to analyse a piece of data art that was also created with the aid of materials that emerged from the leak. I analyse this artwork as a frame that enables search keywords to become configured as personal, but more specifically as a frame that facilitates a nameless biographical account to emerge. I suggest that the artwork challenges the historical function that personal names have had in configuring different data arrangements as personal. This Chapter concludes by offering some reflections on whether traceability (Latour 1999, 2010) - the framing of data to refer back to a point of origin - can be understood as a form of technical redoing (Goffman
1974) and if so, whether this means that processes of inscribing or making data should be understood as irreversible.
In the second Chapter, Ethical Devices and the Economisation of Personal Data, the case study focuses on how the devices of informed consent and anonymisation enable a particular economy of data to unfold by disentangling and reframing the relation between data and persons in specific ways. I firstly explore the device of informed consent and claim that it aids in the enactment of a particular type of research subject equipped with autonomy, self-determination and entrenched in frames of privacy. I also suggest that the device of informed consent enables a transfer of data which would otherwise be deemed illegitimate, and can thus be understood as a ‘surrogate property contract’ (Waldby and Mitchell 2006). Secondly, the Chapter looks at the device of anonymisation as a data economisation device. It examines how the economisation of data requires the framing of data as separate from the person to which it was linked, a separation which is enabled by anonymisation. The Chapter also discuses how the anonymisation of data can be thought of as a device that suppresses the author function, thereby undoing data’s capacities to be an object that can be appropriated and owned by data subjects. In the conclusion, the Chapter offers suggestions at what should be taken into account in the design of research ethics for newly emerging datascapes and analytical techniques.