Data economy part 1: what's your data identity?

Reportedly the world's first set of principles for the use of AI and data analytics in finance, the Monetary Authority of Singapore ("MAS") guidelines promote "FEAT" - fairness, ethics, accountability and transparency.  Self-evident, perhaps, but as data becomes more commoditised, data governance needs to strike an increasingly delicate balance between promoting the data economy and protecting the individual subjects of that data.

Data as a global commodity

MAS managing director Ravi Menon claimed that such guidelines pave the way for global data transfer "in an environment of trust and security", predicting that "data connectivity agreements [...] will become as important as today's free trade agreements".

In today's data-driven world, this prediction is less remarkable than it might once have been.  Indeed, the EU has approved new rules to enable free movement of non-personal data as part of its ongoing digital single market strategy, while the UK and EU have agreed to "facilitate cross-border data flows".

Trust, privacy and convenience

As well as needing regulatory freedom to process and trade data, the data economy fundamentally relies on the willingness of individuals to part with their data.  While both users and governments are increasingly cautious about which companies they trust, convenience can be a powerful motivator to share even the most personal data.  One example is the increasing popularity of biometrics (the use of biological data to identify a user - such as fingerprint or facial recognition).

In Menon's words, "We are who we are": biometrics can make it much easier to prove your identity to relevant parties but, unlike your password, your biometric data are intrinsically linked to your real-world identity.  While the collection and use of personal data is more tightly regulated than non-personal data, data subjects can still give consent to companies they trust.  Where there is a risk that users are motivated to consent without understanding what data they are generating and how it might be used, is "an environment of trust" enough?