Where does my data go when I’m gone?

I tried today to log onto two wifi networks in Bangkok and, exactly 100% of the time, I was asked to provide my passport number.  I decided I could do without wifi.  Why a shopping centre or a coffee shop needs my passport number (overreaching?), I am not sure, but I am uncomfortable handing over that sort of data and then clicking the “I agree to the Ts and Cs” button in a foreign country.  What am I agreeing to and how will my data be used?

In another situation last year in which I felt similarly uncomfortable, I was finger-printed as I entered Johannesburg.  I was travelling there about 4 or 5 times a year at the time and the fingerprinting was done only that once.  I still wonder why.  And where that data is lurking.

Like the authors of this piece in the New York Times, I am of the view that we cannot put the privacy genie back in the bottle in a digitised world, and that the 20th century construct of “privacy” no longer applies.  We need to rethink data and its usage and, with it, privacy.  I also agree with their position that there ought to be safeguards around the liberties those who have our data can take with it:

“The answer is that we must regulate what organizations and governments can actually do with our data. Simply put, the future of our privacy lies in how our data is used, rather than how or when our data may be gathered. Excepting those who opt out of the digital world altogether, controls on data gathering is a lost cause.”

In another article, this time in The Atlantic’s CityLab, there’s a lot of good examples of just why we as individuals should be concerned about how our data may be being used.  Although the focus is the US and the overreach of power the US Federal Government is attempting under Donald Trump, the potential applicability to each of us (with our digital trails strewn across the world) is clear.  I was encouraged to read how some US cities are reacting to become “digital sanctuary cities”.  The article links to guidelines issued by the Sunlight Foundation, a not-for-profit US organisation that advocates for greater government transparency, with the stated intent of “communicating the kinds of policies and practices that will help local governments manage their data in a way that allows them to fulfill (sic) their public commitments.”  They are a sensible catalogue of what good husbandry of citizen data might involve:

Limit collection

• 1. Do not collect sensitive information (e.g., related to documentation status, national or religious identity) unless it is absolutely necessary to do so
  2. Where sensitive information is needed for decision-making, evaluate whether that information can be gathered without written documentation.

Improve storage practices

1. Regularly delete sensitive data where retention is not legally required.
2. Do not create or retain specialized, personally-identifiable databases of vulnerable groups of residents.
3. Where sensitive information is collected, do not store it with less-protective third parties.
4. Encrypt sensitive data and communications to limit the potential for data theft.

Improve oversight of data sharing

1. ​Inventory all policies and practices which result in the sharing of information on individuals’ citizenship or other sensitive status.
2. Publicly document all policies, practices and requests which result in the sharing of information about individuals’ citizenship or other sensitive status.
3. Create policies which limit individual employees’ discretion on data-sharing
4. ​Create a municipal oversight body to ensure that the city’s protocols for data protection are adequate, well-observed, and legal.

Reading these, I can’t help thinking that it’s unlikely my passport data at a shopping mall would be treated as carefully as these guidelines suggest and that I am right to be cautious.