Sensitive-by-distance: quasi-health data in the algorithmic era

• Published in: Information & communications technology law Vol. 26; no. 3; pp. 229 - 249
• Main Authors: Malgieri, Gianclaudio, Comandé, Giovanni
• Format: Journal Article
• Language: English
• Published: Routledge 02.09.2017
• Subjects: algorithm; data protection; health data; legibility; Privacy; sensitive data
• ISSN: 1360-0834; 1469-8404
• DOI: 10.1080/13600834.2017.1335468

This article offers a new perspective on the boundaries between health and non-health data in the age of 'Quantified-Self' apps: the 'data-sensitiveness-by-computational-distance' approach-or, more simply, the 'sensitive-by-distance' approach. This approach takes into account two variables: the intrinsic sensitiveness (a static variable) of personal data and the computational distance (a dynamic variable) between some kinds of personal data and pure health (or sensitive) data, which depends upon computational capacity. From an objective perspective, computational capacity depends on the level of development of data retrieval technologies at a certain moment, the availability of 'accessory data', and the applicable legal restraints on processing data. From a subjective perspective, computational capacity depends on the specific data mining efforts (or the ability to invest in them) taken by a given data controller: economic resources, human resources, and the use of accessory data. A direct consequence of the expansion of augmented humanity in collecting and inferring personal data is the increasing loss of health data processing 'legibility' for data subjects. In order to address this issue, we propose exploiting the existing legal tools in the General Data Protection Regulation to empower data subjects (the right to data access, the right to know the logic involved in automated decision-making, data portability, etc.).