'How we manage personal data is like Asbestos...'

'We need to rip it out and replace it..'

I had a great chat about personal data and DataPal a couple of weeks back with Deborah Webster and James Duthie. In that discussion, Deborah came out with the above quote, and I just thought it was the best i’ve heard on the matter. We’ve all heard the old ‘personal data is like…. the new oil, oxygen, currency, asset class etc. But that asbestos analogy just nails how things are now. There is no route back within the current model. The alignment of incentives is all wrong, it causes all sorts of downstream problems (e.g. social media, massive fraud, bias); and AI has super-charged that toxicity. Just like asbestos; there is no option but to rip it out and start again.

And then at IIW last week I heard a yet more worrying quote, from someone well placed to comment. That was ‘The Internet as as we know it has about 18 months maximum left before it drowns in AI driven content and turns to sludge’.

Sadly I think that is also true.

So what do we do about that?

My main suggestion is to recognise the urgency of the situation and take action fast. Action that creates something new, does not try to fix the un-fixable Sludgernet.

I think what needs to and will happen is that there will be multiple forks established within The Internet. That is to say sub-networks in which particular rules and governance models emerge to enable the good aspects of the networked economy without the bad.

That forking is not necessarily a bad thing. The Sludgernet can just do its own thing until someone pulls the plug; that will be for environmental reasons as much as anything else.

These forks will amount to ‘governed data ecosystems’. There is one that will certainly emerge around personal data. By that I mean there will be a sub-set of The Internet that opts-in to a set of rules and a trust framework governing how personal data is gathered, managed and used. It will be governed by contract law, and underpinned by the local privacy, data protection and other regulations in each geography. Actually there will be many such governed data ecosystems. It is concievable that the entire UK Government ‘Smart Data’ collective of schemes could be one. EU are already doing something similar with their Data Spaces initiative.

I suggest contract law as the primary governance vehicle because I think it is the logical choice when setting up something new. Consent clearly does not scale, and looks backwards. We will be aided in this by the standard emerging from IEEE7012 that defines information sharing agreements (contracts) from the individual perspective.

The original UK Open Banking Framework is a good example of such an ecosystem, but in itself needs to be updated for the age of AI, and now specifically for the possibilities that emerge from Federated ID and FIDC. The individual as a robust, technology supported and enabled actor on The Internet is the game changer. There’s no asbestos in that model….