Data with Destiny

Data with Destiny

In today's world, digital communication is by far the most common way of maintaining connections with others, from social media to dating apps. But what insights are gathered from your personal data??
​Sarah Villeneuve
Policy Analyst
Stephanie Fielding
Policy + Research Analyst
February 4, 2020
Print Page

From texting and email to media sharing across devices and platforms, digital communication is by far the most common way of maintaining connections with others in today’s world. Services ranging from online dating to genetic testing are becoming common practice when it comes to seeking out our most meaningful relationships and communities. We maintain several simultaneous profiles, some of which remain long after we pass away.[1] These practices are so pervasive that it is not necessary to be an active user to be represented online – networked connections, shadow and ghost profiles continue to challenge notions of consensual participation on social platforms.[2]

Communication + Media

The means by which individuals communicate with others has expanded beyond simple messaging to include various forms of media sharing and online social media platforms. Cloud-based applications, such as Google Gmail, offer many benefits to their users, including increased usability and convenience, and the ability to check messages from any location. Social media platforms and email allow us to stay connected with our extended communities over the internet. This involves both text and voice-based communication, such as through Facebook Messenger, Voice and Video Calling, Gmail, and Skype. Online services for photo sharing, such as Flickr and Ever, have enabled users to organize and share photos with family with ease and assurance of retention.

Some of these services have not been fully transparent with their users about how and where their data will be shared. Ever is a web-based photo storage platform accessible via web browser or app. According to Ever’s website, the company offers “free, unlimited private backup of all your life’s memories.”[3] When an individual makes an account, Ever collects personal information such as their name, email, phone number, and home or work address. Any photos, videos or other media files that an individual uploads are stored by Ever.[4] If an individual connects Ever to one of their social media accounts, such as Facebook, Ever will be able to access information included on their profile, such as their name, age, email address, and profile picture.[5] Ever’s Privacy Policy states that it will not share information that will personally identify a user.

Share

"Ever’s Privacy Policy states that it will not share information that will personally identify a user. However, in 2017, it was revealed that Ever shares user data with third parties, including law enforcement and the U.S. military."

However, in 2017, it was revealed that Ever shares user data with third parties, including law enforcement and the U.S. military.[6] More specifically, the company has been sharing user images to help train AI facial recognition systems. Ever’s own facial recognition software helped users group photos of the same individual together.[7] This feature may be convenient for parents who want to organize pictures of their children in personal albums, or photographers who need to organize and separate photos of different people. Ever’s financial capitalization of users’ data and personal images happened without prior customer awareness.[8] Like many other companies, Ever uses cookies and other tracking technologies to understand how individuals access and use Ever’s services. If an individual uses a mobile device to access Ever, the company may collect information related to the individual’s geolocation as well as their device model, manufacturer, and operating system (including which device is associated with individual photos).[9]

This is just one example of how facial recognition systems are often trained using photos taken by unsuspecting members of the public. Many organizations have trained their facial recognition algorithms using pictures scraped from public websites. IBM, for example, trained their facial recognition program using pictures from Flickr.[10] 

Online Dating

Online dating, used here to refer to both dating websites and mobile dating apps, is a popular way to meet romantic and sexual partners. A 2011 survey found 36 per cent of Canadians between the ages of 18 and 34 use an online dating service.[11] Personal data collection is an integral part of online dating, as it is required in order for users to create detailed personal profiles of themselves and match with individuals who share similar values and interests. This includes basic information, such as a user’s name, location, age, employment, and sexual preferences, but also more personal questions such as drinking and drug habits, hobbies, and partner demographic preferences are collected as part of a user’s account creation.[12] While some of this data is self-reported, some information, such as age or location, may be collected without the user’s knowledge, or inferred from user profiles or other sources such as linked social media accounts. Many online dating companies aggregate user data for marketing purposes, producing reports based on consumers’ personal information. Beyond the matchmaking possibilities, personal information and communication data collected by online dating companies has been used to study human behaviour, such as whether men are more likely to message women who are wearing makeup in their profile picture.[13] [14] The ethics of collecting and publishing research based on social media user data, particularly online dating platforms, is a heavily debated topic. Some hold that the datasets are public, and therefore need not be anonymized, while others concerned with privacy and research ethics maintain that without direct consent from users, any data scraped from a ‘public’ site is not ethical to use in any research study.[15] [16] 

"Beyond the matchmaking possibilities, personal information and communication data collected by online dating companies has been used to study human behaviour, such as whether men are more likely to message women who are wearing makeup in their profile picture."

One of the most popular dating apps available today is Tinder. Tinder is a location-based dating app, freely accessible through a web browser or to download onto a smartphone or tablet. Users can either sign up using their Facebook log-in, or by providing their phone number. By signing up using Facebook, users agree to allow Tinder access to and use of certain information from their Facebook profile and “Likes”, as well as information about their Facebook friends.[17] Information from an individual’s Facebook profile, such as their name, date of birth, gender, and sexual preference, is used to automatically generate a Tinder profile. When creating a profile, Tinder also asks for details about an individual’s personality, lifestyle, and interests. Users can also upload photos and videos of themselves, and grant Tinder access to their camera or photo album or their Instagram account.[18] If users choose to subscribe to Tinder Plus, the premium paid version of the dating app, their financial details will be recorded by the company.[19] Geolocation data is important for Tinder, given its emphasis on location-based dating.[20] If an individual consents to share their location data with Tinder, the app will collect their precise geolocation using GPS, Bluetooth, or WiFi connections in order to recommend other users who are nearby.[21] Tinder also collects information about in-app user activity, including the date and time of log-in, searches, clicks, and features that have been used, as well as interaction with other users, such as the time and date of interaction, and number of messages sent and received.[22] Tinder also uses information from your profile and location to inform targeted ad strategies.[23] According to Tinder’s Privacy Policy, users’ information may be shared with service providers, partners, and other companies owned by the parent company, Match Group (such as OkCupid and Plenty of Fish), as well as  upon request  legal authorities.[24] 

Users are able to request a copy of their personal data through Tinder’s website.[25] According to Tinder’s Privacy Policy, the company will delete or anonymize user information upon deletion of their account or two years of continuous inactivity. Data will only be retained in its original form if it is legally required; for example, for compliance with statutory retention obligations.[26]

Commercial Genetic Testing

Commercial genetic testing has risen in popularity in Canada in recent years. Companies such as AncestryDNA23andMe, and MyHeritage use personal DNA information extracted from customer saliva samples to provide insights into an individual’s ancestry, familial connections, health predispositions, carrier status, and physical traits such as facial features and sense of smell. Genetic testing offers individuals a number of opportunities to obtain insight into one’s genetic makeup, particularly in relation to genetic heritage. However, genetic test results may also spark anxiety or stress related to predisposition to certain diseases or illnesses. Additionally, the sharing of DNA carries significant privacy risks – particularly in relation to pharmaceutical companies, insurance companies, and law enforcement agencies.[27] [28] [29] 

"Law enforcement officials in the US were able to identify the Golden State Killer, Joseph DeAngelo, using long-range familial searching from GEDmatch...."

The use of genetic testing is increasingly being adopted by law enforcement as a means to identify suspects in criminal investigations. Law enforcement officials in the US were able to identify the Golden State Killer, Joseph DeAngelo, using long-range familial searching from GEDmatch, an open source personal genomics database and genealogy website that aggregates genetic profiles from popular testing services.[30] Rather than relying on the highly regulated forensic databases commonly available to law enforcement, using commercial genetic databases allows law enforcement to access a much wider range of data without a court order, including individual health information, relatives, and other personally-identifiable data.

The Government of Canada has responded to privacy concerns related to the sharing of genetic data through the establishment of the Genetic Non-Discrimination Act in 2017, which requires voluntary consent prior to any request for genetic testing, and the strengthening of the Personal Information Protection and Electronic Documents Act (PIPEDA), which protects against the commercial use of genetic testing results, including activities and requests from private insurance and pharmaceutical companies.[31] [32] However, Canadian law enforcement agencies are currently using genetic genealogy techniques, including a partnership between the Vancouver Police Department and Parabon NanoLabs, a US company, on an unsolved murder case.[33] 

23andMe is a popular commercial genetic testing service. A recent report from MIT Technology Review states that close to 9 million people from around the world have provided DNA samples to 23andMe.[34] 23andMe offers two services individuals can choose from. The first, Health + Ancestry, allows users to learn about genetic health predispositions, ancestry, wellness, carrier status (for inherited conditions such as Cystic Fibrosis), and traits such as taste, smell, and facial features.[35] The second option, Ancestry + Traits, provides users with information on their  ancestral composition, family tree, traits report, maternal and paternal haplogroups, and DNA relative finder. In order to use one of these services, individuals will need to create a 23andMe account, which requires them to share personal information such as their name and email, along with credit card and IP address. For either service, customers provide their saliva by spitting into the collection tube, and mailing it back to 23andMe’s labs in pre-paid packaging.[36] Customers receive an email once their results are ready, and view them by logging-in to their online account. According to 23andMe’s privacy policy, customers can decide whether or not they want their saliva sample stored and if they can be identified by relatives.[37] Customers have the ability to request for their saliva sample to be discarded at any point after it has been analyzed, and can delete their account and related data at any time. However, any research that has been conducted using their data can not be reversed, undone, or withdrawn.

According to the company’s privacy policy, 23andMe does not sell, lease, or rent individual-level information to any third party for any purpose, including research. However, they do use and share aggregate-level information with third parties for research, business development, and marketing purposes.[38] Aggregate-level information does not contain personal details, such as an individual’s name or contact information. While a complete picture of how customer genetic material is used remains unclear, it was recently revealed that GlaxoSmithKline, a prominent pharmaceutical company, has received exclusive access to 23andMe’s customer data for research purposes.[39] [40] Individuals, however, can explicitly grant permission for their individual-level information to be used for research purposes.[41] 23andMe, in partnership with AirBnB, now also provides individuals with customized recommendations for vacations based on their genetic lineage, often referred to as “heritage tourism”. It’s currently unclear what kind of data sharing agreement has been put in place between 23andMe and AirBnB to enable the recommendation of destinations.

This is part of a series of articles exploring personal data collection practices in Canada. Check out our previous article on Public Spaces + Services, and stay tuned for our final article detailing what we’re planning next.

Technology and policy related to this topic are constantly evolving. If you think we have missed something, see an error, or want to get involved in this project, please contact Sarah Villeneuve (sarah.villeneuve@ryerson.ca).  


[1] It can be difficult to delete these social traces; Facebook, for example, makes this nearly impossible. See: The Walrus Staff. 2019. “What Happens to Your Social Media Accounts after You Die.” The Walrus, May 29, 2019. https://thewalrus.ca/death-what-happens-to-your-social-media-accounts-after-you-die/.

[2] Brandom, Russell. 2018. “Even If You’re Not Signed up, Facebook Has a Shadow Profile for You.” The Verge, April 11, 2018. https://www.theverge.com/2018/4/11/17225482/facebook-shadow-profiles-zuckerberg-congress-data-privacy.

[3] Ever. “Ever | Make Memories.” Accessed October 18, 2019. http://www.everalbum.com.

[4] Ever. “Privacy Policy.” Accessed October 18, 2019. http://www.everalbum.com/privacy-policy.

[5] Ever. “Privacy Policy.” Accessed October 18, 2019. http://www.everalbum.com/privacy-policy.

[6] “Millions of People Uploaded Photos to the Ever App. Then the Company Used Them to Develop Facial Recognition Tools.” Accessed October 18, 2019. https://www.nbcnews.com/tech/security/millions-people-uploaded-photos-ever-app-then-company-used-them-n1003371.

[7] Vincent, James. “The Ever Photo App Turned Users’ Private Snaps into AI Facial Recognition Fodder.” The Verge, May 10, 2019. https://www.theverge.com/2019/5/10/18564043/photo-storage-app-ever-facial-recognition-secretly-trained-ai.

[8] Fussell, Sidney. 2019. “The AI Supply Chain Runs on Ignorance.” The Atlantic, May 14, 2019. https://www.theatlantic.com/technology/archive/2019/05/ever-strava-ai-human-ignorance/589306/; Solon, Olivia, and Cyrus Farivar. 2019. “Millions of People Uploaded Photos to the Ever App. Then the Company Used Them to Develop Facial Recognition Tools.” NBC News, May 9, 2019. https://www.nbcnews.com/tech/security/millions-people-uploaded-photos-ever-app-then-company-used-them-n1003371.

[9] Ever. “Privacy Policy.” Accessed October 18, 2019. http://www.everalbum.com/privacy-policy.

[10] Liao, Shannon. “IBM Didn’t Inform People When It Used Their Flickr Photos for Facial Recognition Training.” The Verge, March 12, 2019. https://www.theverge.com/2019/3/12/18262646/ibm-didnt-inform-people-when-it-used-their-flickr-photos-for-facial-recognition-training.

[11] The Canadian Press Staff. 2015. “By the Numbers: The Rise of Canada’s Online Dating Scene | Globalnews.Ca.” Global News, July 15, 2015. https://globalnews.ca/news/2111560/by-the-numbers-the-rise-of-canadas-online-dating-scene/.

[12] Hilts, Andrew, Christopher A. Parsons, and Masashi Crete-Nishihata. 2018. “Approaching Access: A Look at Consumer Personal Data Requests in Canada.” The Citizen Lab and Munk School of Global Affairs and Public Policy. https://citizenlab.ca/2018/02/approaching-access-look-consumer-personal-data-requests-canada/.

[13] Rosenfeld, Laura. 2014. “OkCupid Founder’s Book ‘Dataclysm’ Tells Us More about Ourselves than We Want to Know.” Tech Times. September 10, 2014. https://www.techtimes.com/articles/15307/20140910/okcupid-founders-book-dataclysm-tells-us-more-about-ourselves-than-we-want-to-know.htm.

[14] “Lessons From My Online Dating Experiment – Irrational Labs – Medium.” Accessed October 18, 2019. https://medium.com/@IrrationalLabs/lessons-from-my-online-dating-experiment-8fb390b18597.

[15] Zimmer, Michael. 2016. “OkCupid Study Reveals the Perils of Big-Data Science.” Wired, May 14, 2016. https://www.wired.com/2016/05/okcupid-study-reveals-perils-big-data-science/.

[16] Fortune. “Researchers Caused an Uproar by Publishing 70,000 OkCupid Users’ Data.” Accessed October 18, 2019. https://fortune.com/2016/05/18/okcupid-data-research/.

[17] Tinder. “Tinder – Meet Interesting People Nearby.” Accessed October 18, 2019. https://tinder.com.

[18] Tinder. “Tinder – Privacy” Accessed October 18, 2019. https://tinder.com. https://www.gotinder.com/privacy

[19] Tinder. “Tinder – Privacy” Accessed October 18, 2019. https://tinder.com. https://www.gotinder.com/privacy

[20] “Profiling and Automated Decision-Making at Tinder – Tinder.” Accessed October 18, 2019. https://www.help.tinder.com/hc/en-us/articles/360003082172-Profiling-and-automated-decision-making-at-Tinder.

[21] Tinder. “Tinder – Meet Interesting People Nearby.” Accessed October 18, 2019. https://tinder.com.

[22] Tinder. “Tinder – Privacy” Accessed October 18, 2019. https://tinder.com. https://www.gotinder.com/privacy .

[23] “Profiling and Automated Decision-Making at Tinder – Tinder.” Accessed October 18, 2019. https://www.help.tinder.com/hc/en-us/articles/360003082172-Profiling-and-automated-decision-making-at-Tinder.

[24] Tinder. “Tinder – Privacy” Accessed October 18, 2019. https://tinder.com. https://www.gotinder.com/privacy .

[25] Tinder. “Profiling and Automated Decision-Making at Tinder.” Accessed October 18, 2019. http://www.help.tinder.com/hc/en-us/articles/360003082172-Profiling-and-automated-decision-making-at-Tinder.

[26] Tinder. “Tinder – Privacy” Accessed October 18, 2019. https://tinder.com. https://www.gotinder.com/privacy

[27] Tinder. “Tinder – Privacy” Accessed October 18, 2019. https://tinder.com. https://www.gotinder.com/privacy

[28] Gills, Charlie. 2015. “D.I.Y. Genetic Testing: Risky Business.” Macleans, May 23, 2015. https://www.macleans.ca/society/health/d-i-y-dna-genetic-testing-at-home/.

[29] “It’s not just your personal information, it’s information about your parents and your offspring, so there are other people implicated.” – David Fraser, Privacy Lawyer. The privacy implications of DNA testing kits that can alter your life’; Why genetic self-test kits should not be allowed into Canada.

[30] Molteni, Megan. 2018. “A New Type of DNA Testing Is Entering Crime Investigations.” Wired, December 26, 2018. https://www.wired.com/story/the-future-of-crime-fighting-is-family-tree-forensics/.

[31] “The Genetic Non-Discrimination Act (GNDA), or Bill S-201, passed into law on May 4th 2017. The bill, along with amendments in the Canadian Labour Code and the Canadian Human Rights Act, prohibits companies and employers from requiring genetic testing or the results of genetic tests. It also prevents companies from denying services based on the results of genetic tests.” The Genetic Non-Discrimination Act – An Overview, Civil Liberties Society of Canada.

[32] Office of the Privacy Commissioner of Canada. 2017. “Policy Statement on the Collection, Use and Disclosure of Genetic Test Results.” Office of the Privacy Commissioner of Canada. https://www.priv.gc.ca/en/privacy-topics/health-genetic-and-other-body-information/s-d_140710/#fn1.

[33] Parabon NanoLabs. 2019. “Engineering DNA for Next-Generation Therapeutics and Forensics.” Parabon NanoLabs. 2019. https://parabon-nanolabs.com/.

[34] Regalado, Antonio. “More than 26 Million People Have Taken an At-Home Ancestry Test.” MIT Technology Review. Accessed October 18, 2019. https://www.technologyreview.com/s/612880/more-than-26-million-people-have-taken-an-at-home-ancestry-test/.

[35] 23andMe. “Our Health + Ancestry DNA Service – 23andMe Canada.” Accessed October 18, 2019. https://www.23andme.com/en-ca/dna-health-ancestry/.

[36] “How It Works – 23andMe Canada.” Accessed October 18, 2019. https://www.23andme.com/en-ca/howitworks/.

[37] 23andMe. “Privacy and Data Protection – 23andMe.” Accessed October 18, 2019. https://www.23andme.com/privacy/.

[38] 23andMe. “Privacy and Data Protection – 23andMe.” Accessed October 18, 2019. https://www.23andme.com/privacy/.

[39] Such companies often allow for their customers to request to have their saliva destroyed after the genetic material has been extracted; however, they provide no option for one’s genetic material to be destroyed. 23andMe explicitly states in their privacy policy that genetic material will be used for research purposes (see section 3(d)(i)). 23andMe. n.d. “Privacy Highlights.” Accessed August 29, 2019. https://www.23andme.com/en-ca/about/privacy/.

[40] Molteni, Megan. 2018. “23andMe’s Pharma Deals Have Been the Plan All Along.” Wired, March 8, 2018. https://www.wired.com/story/23andme-glaxosmithkline-pharma-deal/.

[41] 23andMe. “Privacy and Data Protection – 23andMe.” Accessed October 18, 2019. https://www.23andme.com/privacy/.

For media enquiries, please contact Lianne George, Director of Strategic Communications at the Brookfield Institute for Innovation + Entrepreneurship.

​Sarah Villeneuve
Policy Analyst
Stephanie Fielding
Policy + Research Analyst
February 4, 2020
Print Page

Share