Digipower investigation Q&A

The Digipower investigation looks at how decision-makers can be influenced with the data collected about them. The project will coach 15 Finnish and European societal influencers to enable them to find out who collects data about them when they browse the web and use digital services, what data is collected and how it can be used to influence them. The participants include well-known and socially active influencers, such as political decision-makers and media representatives.

The final results of the investigation will be published in May 2022. Basic information about the project, its methodology and the list of announced participants is available on the Digipower page.

Below, you will find answers to some of the questions asked about the Digipower investigation.

Surveillance capital and misuse of data have been talked about for years. What’s new with the Digipower investigation? Is this kind of project still topical in 2021 and 2022?

Considering the extent and impact of the data economy, we still know surprisingly little about its impact mechanisms and operating principles. Our day-to-day lives are largely defined by ones and zeroes, but we barely know what data is collected about us and what is done with it.

Widespread social discussion about the topic is still scarce, considering the extent of the phenomenon. One of the goals of the Digipower project is to enhance this discussion by providing a useful knowledge base.

The ways in which companies use the personal data of people (including decision-makers) and how such use of their data affects our everyday lives, has not been investigated before. It is essential from the point of view of democracy to understand how the knowledge bases of decision-makers can be influenced – who collects the data, where it spreads to and how it is potentially used to influence decision-makers.

Why are not all political parties represented among the participants? Why have these individuals been chosen as participants?

Because of cost- and schedule-related reasons, the investigation focuses on a limited group of 15 participants. Individuals from all of Finland’s biggest political parties were invited, and we started with the members of Sitra’s Supervisory Board. All of the invited individuals were interested in the investigation, but some had to refuse or cancel their participation at the last minute due to scheduling issues. They often also gave us tips on who to ask next. Ultimately, we believe the participants represent a very broad political spectrum, from left to right.

How did the project ensure the data security and privacy of the participants? Who will get to know the websites they visit?

The participants, together with Hestia.ai, the company conducting the investigation, will form a “bubble” that cannot be accessed by outsiders. The participants choose whether to show their data to Hestia.ai, and can choose to keep certain parts private.

The volume and quality of the data investigated will vary by participant. The participants therefore will be able retain their privacy. The data security bubble between the participants and Hestia.ai is strongly protected.

Will the investigation provide a real view of the flow of the participants’ data, seeing as the data subjects will be able to decide what services they use on the test phone and what data to share with the project group?

The report focuses on how the organisations and companies that collect data operate – on who collects the data, what kind of data they obtain, where it goes and how is it used. We will receive enough information to understand this, even though the participants will use a limited number of services on the test phone.

For security reasons, we have excluded personal banking services and health data, for example, from the investigation. It is important from the point of view of privacy that the participants get to decide what data they share and what they do not.

How does the “monitoring app” installed on the persons’ test phones work?

It is an open source application called Tracker Control, developed at the University of Oxford by Konrad Kollnig (@KKollnig). Anyone who is interested can download the app on their Android phone and use it to monitor the flow of their data when using mobile apps.

In addition, using a development team in Geneva, Hestia.ai is building standalone web-based data-experiences into which participants can load their own data, either from Tracker Control, data downloads or SAR data returns. Participants get graphs, tables and various insights into the returned data to help them understand and explore it.

The participants will not use their own phones in the investigation; they have separate Android test phones so that they can choose for themselves which applications they want to be tested, while being able to delete the data accumulated by the phone.

What other ways, besides the monitoring app, will be used to analyse the data collected on the test subject?

Test subjects taking part in the Digipower study will deepen their understanding of the data concerning them in various ways. Everything is based on the goals set by the subjects themselves.

The test subjects will submit subject access requests (SAR) to businesses and organisations, use services and complete tasks on their test phones, and use the download dashboards of apps and services.

Together with their personal “data coaches,” the participants will review their data, explore it in depth, and examine the results of their subject access requests against the set objectives.

What is Hestia.ai, the company responsible for mentoring the decision-makers and data analysis?

Hestia.ai is a Swiss privacy-driven development and consulting firm that specialises in the challenges and opportunities of the data economy, especially from the point of view of individuals. It is headed by Paul-Olivier Dehaye, a mathematician and expert in the data economy who played a significant role in exposing the Cambridge Analytica scandal.

Why are all of the participants decision-makers or other societal influencers? Aren’t the problems associated with the data of the general public important?

We began to investigate the flow of the general public’s data in 2019 with the Digitrail project. At that time, one of the “ordinary” participants was also a politician (Tarja Filatov). The flow of her data got us thinking about the digital use of power more extensively.

We are all in the same boat when it comes to the failures of data collection, and in the data economy the roles of the influencer and influenced become blurred. For us, the general public, it is particularly important that decision-makers are familiar with the phenomena, parties and operating models of the data economy so that we in part acquire better regulation and that our right to both privacy and prospering companies is secured.

What can I personally do to find out what data is collected about me on different websites?

The European Union’s General Data Protection Regulation (GDPR) General Data Protection Regulation (GDPR) gives us a lot of rights. For example, you have the right to request that a company provide you with access to data collected about you and the company is obliged to respond to you within 30 days. Correspondingly, you can request data about you to be erased. Information is available in Finland from the Office of the Data Protection Ombudsman, for example, and with regard to cookies, from Traficom (Finnish Transport and Communications Agency).

However, a good start for protecting your own data is to check the privacy settings of your computer and phone and not accept unreasonable terms of use of applications.

How can I monitor the progress of the Digipower project?

You can monitor the progress of the Digipower project on the project page.

On Twitter, follow the discussion with the hashtag #digipower (#digimakt in Swedish and #digivalta in Finnish).

In addition, the test persons can share their experiences from their participation in the Digipower investigation through their own channels. The list of test persons will be updated on the project page.