At Ci, we are focused on empowering people and building trust. Our recent blog post looked at public attitudes to trust, data and digital rights and set out the plans we had for our Your Data, Your Rights (YDYR) project in Corsham. We talk more about the results from our survey below and what we are planning to do next.
GDPR and the public: do they care?
With the implementation of the General Data Protection Regulation (GDPR) just days away on 25 May, there is still a big gap in engagement and communication with the public on what the GDPR means for people. The Information Commissioner’s Office (ICO) carries extensive material to help businesses comply with the regulation but, to date, there has been nothing focused on the public – although its new Your Data Matters campaign will be launched on the day of GDPR implementation.
Following the Facebook/Cambridge Analytica scandal, earlier public engagement around data protection, privacy and ownership now feels like a missed opportunity. We carried out our Your Data, Your Rights survey shortly after the news broke and asked our respondents some questions about its impact on their attitudes:
- 80% said that the events had made them think more about their data and what they share online
- 40% said it had changed the way they feel about organisations having access to their data ‘a lot’, with a higher impact on the over-65s (60% answering ‘a lot’) than the 16-25s (only 10%).
In response to our other survey questions, there was also a clear demand for more information on how people could use their new digital rights.
In stage 2 of our project, we want to address this demand: working with the local community to develop their understanding of personal data, and how they control, share and protect it. You can read more about our project, our approach and the local survey results by clicking the button.
Below we explore some of the more notable findings which either suggest differing levels of knowledge and awareness between different demographic groups, or where the local and national comparison is significant.
Also, to give our local survey some context, we have pulled together more of the recent national survey findings on people’s attitudes to data sharing in the slideshow below.
Understanding of personal data
We started our survey with some questions about people’s existing levels of knowledge on data and found that many people are unsure about the essentials. When given four definitions of ‘personal data’ to choose from, including the accepted ICO definition, 48% of respondents either selected the wrong response or admitted they didn’t know. Knowledge was poorest among the over-65s; and, in response to a question inviting respondents to identify all the types of data they would consider to be ‘personal’ (such as date of birth, mobile phone records, health data etc.), fewer of the younger generation (16-25 year olds) correctly classed their political opinions, genetic data and their name as personal data.
In terms of knowledge about how much data was collected about them, only 18% of our respondents overall said they knew a lot about the collection of their data, similar to the 20% of people in the Eurobarometer survey who felt they are ‘always informed about data collection and the way data are used’. Seventeen percent of our Corsham respondents said they knew nothing at all about what their data might be used for.
But, for Corsham residents, the collection of their data was important to them: 60% of respondents said they care a lot about what organisations might use their data for (rising to a staggering 87% among over-65s), while only 3% said they didn’t care at all and 4% said they hadn’t thought about it before. Overall, however, these figures are much lower than the 94% of respondents to doteveryone’s digital attitudes survey who said it was important to know how their data is used.
Attitudes towards data use
Our survey showed that people had different attitudes to their data being used for different purposes. People report being most happy for organisations to use their data:
- To comply with legal requirements (75%)
- To provide the product/service they want (64%)
- To help the NHS (62%, a figure far higher than a UK survey for the ODI would suggest, where 47% of respondents would share medical data about themselves if it helped develop new medicines and treatment); and
- For local councils to provide better services (50%; which contrasts with the ODI’s survey that found only 26% were willing to share their data if it helped identify which new public services should be funded).
Our respondents were least happy with organisations selling their data for profit (only 1% indicated they were happy with use of data for this purpose), to receive marketing/advertising (6%) and to share with partners for services (7%).
Attitudes towards control of data
In our survey, only 2% of respondents said they felt they had full control of their data but, when asked how much control they would want, 77% answered ‘full control’ (which is lower than the 90% answering the same to the Pega European survey in 2017, and the 91% who replied to the doteveryone survey to say it was important to be able to choose how much data they share with companies).
Only 1% of our respondents wanted no control, which aligns with the Big Brother Watch Survey where 0.7% responded similarly.
We ran the survey with just over a month to go before the implementation of GDPR. Sixty percent of our respondents said they knew about it and what rights it will give them. Although this suggested high levels of awareness of GDPR as an event (according to Kantar TNS' GDPR Awareness Index, only 34% of the general public were aware of GDPR in February), only 19% said they knew a lot about how to use the new rights it would give them.
One of the most interesting aspects of our survey was the responses to a series of questions on the new rights that individuals would be granted under GDPR, which we set out in our survey results update. Taking the right to erasure as a point of comparison with other surveys, national surveys have suggested that 62% welcome the right to erasure (SAS) and, at a European level, that up to 93% of people would erase their data if they weren’t comfortable with how they thought companies used it (Pega). In our Corsham survey, people said they would be less likely to ask for erasure than to rectify their data. Again, those over-65 were most likely to ask for their data to be erased: 87% were either likely or very likely to do so.
So, we have lots to explore further with the community, and we will be interested in their feedback on our findings. In the coming months, Ci will work with local Corsham community groups, organisations and individuals to discuss the survey results and identify, then co-produce, the information they need to help them understand their rights, and how and when they can use them.
Ci will use the insight and evidence gathered via from the community to feed into our Digital Trust project, where we are working with partners to influence a regional and national debate with policymakers, other influencers and organisations. We will report back on the next stage of that work here soon.