Project Overview and Research Themes

Information Law & Policy Project [ILAPP]

“Adapting New Zealand Law for the Information Age”

Background

The trustees of the New Zealand Law Foundation (NZLF) have established a $2 million research fund available for projects that will better prepare New Zealand for the challenges of the information age.

The New Zealand Law Foundation’s Information Law and Policy Project “Adapting New Zealand Law for the Information Age” (ILAPP) will explore and develop law and policy around IT, Data, Information, Artificial Intelligence and Cyber issues to help build New Zealand’s digital capability and preparedness.

ILAPP will bring together teams of experts to examine challenges and opportunities in areas like global information, cyber-security, data exploitation, and technology-driven social change.

Applications to the fund open on 24 August 2016 and we anticipate the research will be carried out over two-three years, with various component projects having their own timeframes within this three-year period. It is possible some projects may extend beyond this three-year timeframe.

Broad Project Aims and Expectations

The NZLF intends that this project and funding will act as a platform for collaborative research teams to develop their own research projects that are consistent with the broad project themes outlined below. The Foundation does not intend to be prescriptive but rather expects to act in the role of Sponsor for a wide range of research that falls within the scope of this project.

ILAPP will identify existing legal barriers, emerging legal barriers and incentives that could be created by the law (i.e. how Law can make better things happen).

By taking this broad approach we hope to explore how Law is helping or constraining our digital capability by looking at:

• The state of existing law and regulatory/governance models.
• IT/Data/Information norms, values and ethics for New Zealand and how the Law has/should influence their evolution.
• Building expertise in the legal profession in understanding ‘tech’ generally and its utility/risks and opportunities.
• Establishing an environment that will help New Zealand be adaptable to future change.
• Establishing an environment of high trust/high confidence for private interactions, government interactions and economic interactions, both domestically and internationally.
• Positioning New Zealand as a leader in the development of IT-based products and services and in the management and regulation of data and information.

Project Themes & Issues to prompt research thinking

What can Law do to help improve New Zealand’s digital competence? This is the essence of what this NZLF research project is all about.

To establish the focus for this project, NZLF has consulted widely with universities and held focus groups and individual meetings with representatives of the Office of the Privacy Commissioner, the Data Futures Partnership, private sector technology business, private legal practice, government departments and DPMC’s Cyber Security Unit, InternetNZ and the Innovation Partnership. From this comprehensive consultation we have developed the following broad themes for researchers to consider prior to the submission of applications for research funding under NZLF ILAPP.

Applicants should note that the work anticipated under ILAPP is not limited to the seven themes put forward here. Researchers are welcome to put forward other research ideas of their own, but the seven themes listed are intended to help focus the research on what our consultation has indicated is important, and therefore offer these themes as a guide for what is likely to form the basis of projects we would be interested to invest in.

The role of Privacy and Economics in research projects

Privacy

Research projects are to proceed on the premise that privacy is a common value/principle throughout all aspects of the research, as it runs through and behind all themes. We are not interested in research that tries to identify what privacy is or will be, but rather how privacy in many situations is affected and can be protected. It is also accepted that there may be arguability about privacy at the margins of many situations as a trade-off.

Consideration of other areas of law that people use to protect and restrict the flow of information about themselves should be considered. When considering issues of control of data, the issues of privacy should be addressed along with trust and inclusion, value and control.

We take as a given that there are changing perceptions of privacy and its violation that go beyond data and information into the areas of spatial, territorial, or bodily privacy, etc, and the Privacy Act does not provide the tools or requirements that will protect this. Understanding what New Zealanders’ perception of privacy is and what is valuable to them becomes important to consider and then how the common law/statute fits into this space.

Economics

Economic issues underpin most of the research themes outlined. We expect economic issues to be included as consideration of how New Zealand and its citizens can gain commercially, and be protected, through developments in technology is addressed. Particularly, how to allocate risks and benefits, behavioural issues, competition issues, issues of supply and demand, and individual commoditising of data – all should be considered across themes.

Consideration should be given to how to release the economic value of data. New Zealand’s economy is predominantly made up of SMEs. These small businesses are frequently disadvantaged as they do not know how to go about this so usually do nothing which stops growth and innovation. Can the law enable this data to be unlocked? If so, how?

Other points

There are many ways in which the results of research can be expressed, or indeed that research collaboration can be achieved. One possibility, simply to illustrate what might be possible, is that researchers may find it useful to adopt a Model Law approach. Structuring a particular project in this way may create the opportunity for inspired solutions and thought, and consideration of what is distinctive for New Zealand or identify what is not already being addressed. This approach could possibly be applied in many areas, and could be focussed on outputs using collaboration from New Zealand and internationally, working across disciplinary boundaries.

Research Themes

Theme 1: The global nature of information, how we manage it and trade in it

With the fast pace in the growth of the global reach of trade and services, we are concerned about New Zealand’s ability to compete on the global stage. How can our law and regulatory approach create/maintain/grow the environment to allow ‘smart minds’ to succeed? How do we encourage growth of “weightless exports” and other trade in general when there are significant cross border and cross jurisdiction issues to take into account? There are many significant issues here that provide both opportunities and barriers to New Zealand’s economic growth, resilience and prosperity. The following points provide prompts for further consideration:

• Co-existence in the cyber world – searching for commonalities is important
• Transnationality/Extraterritoriality: how should these challenges be addressed?
• Multi-statehood issues
• Tax issues
• Conflicts of jurisdiction regarding privacy, freedom of expression, consumer protection, intellectual property rights, security etc.
• Emergent norms and behaviours; emergent customary law/behaviour
• Tensions when consensus does not exist as to how to regulate e.g. for online gambling, copyright
• Impact on international trade law
• How to ensure private sector and public sector co-operate and work especially for innovation
• Reciprocity of access to remedies
• Accountability deficit between intelligence and security agencies – and beyond into commercial realms

Theme 2: Cyber Security & Crime

Given that world cybercrime is a $400b “industry” that has surpassed the drug “trade”, how do we tackle it, what enforcement capabilities are needed and what should we expect from regulatory and investigative intervention to ready ourselves for the onslaught that has already begun?

Consideration should be given to protection of consumers, protecting personal information, and the necessary legal regimes that create incentives for business to do that effectively. Often it appears that the secure system needed in practice compromises privacy, so how do we strike a balance on this?

Our priority here is around consumers and creating legal regimes to allow business to act responsibly. We are not interested in research at government level, as the Government’s Cyber Security Unit is already addressing high level aspects of this. While its work should be taken into account, we do not want to replicate work that is being done. Having said that, we don’t want to let the traditional law enforcement response to this ‘off the hook’ either. For example, we have lost the battle on spam, but what about ransomware and other emergent technologies that we should have a regulatory regime for addressing, underpinned with technical capability, that ensures New Zealand is ahead of or at pace with these threats?

Points to consider:

• Understanding the phenomenon of cybercrime and how to tackle it, including enforcement capabilities
• Terrorism via the internet – the challenge for liberal democracies
• Maintaining the balance between freedom of speech ideals and protection
• Government’s Cyber strategy and the role of public and private actors
• Multi-lateral agreements, treaties, conventions and their impact, weaknesses, opportunity and potential
• Information security and enforcement

Theme 3: Social change following technological change

We need to consider how technology is affecting and will affect society and what Law can do about the issues. New Zealanders tend to be naïve and trusting and that will continually translate into higher levels of victimisation. How do we educate and protect? As part of this consideration, thought should be given to what New Zealand’s values and ethics, expectations and norms are around the use of their data, and also what impact New Zealanders’ use of and participation in global networks has on this.

It may be necessary to collate, compare and contrast what has been done internationally to help determine what is needed and acceptable to New Zealand. This may be around informed consent; for example, considering whether there is a generational shift in values and the possibility of being able to contribute to global communities that exist on line as much as with distinctly New Zealand communities. Does that influence and/or erode New Zealand values and ethics?

It may be necessary to undertake a sociological or behavioural economics research project to inform several aspects of other strands of research. Consideration should be given to including this, to ground our understanding of what is genuinely going on before we can determine a correct foundation to build on. It may be necessary to establish where the views are coming from, what is driving the establishment of these views, ethics etc.

Often the economic and social behaviour and practice do not align when it comes to technology. For example, people may say they absolutely want to protect the integrity of their data, but when offered some fun app, then may readily sign over access to their data to use the app and its benefits. Understanding the tension between beliefs and behaviours, teasing this out and unpacking it may become important when establishing acceptable norms, ethics and values. Equally important might be questioning around ‘what do you believe about your data?’ contrasted with ‘what do you know about your data?’, identifying the lack of understanding people have around their data and its use, then determining what could and should be done to address the gap in understanding. However, if researchers decide to pursue this, the Foundation will demand a very high level of intellectual rigour and scientific method.

With specific consideration of legal issues, are there some commonalities about how to draft law in this very different world? Examples should be found of successful regimes that are doing well, keeping law at pace with technology and then consideration of what we could learn from these. Research could also consider new ways and modes of setting norms and resolving disputes looking at what will work or won’t work with technological change.

The shift in what is possible through technology is butting up against legal regimes. In a very short time technology is going to change dramatically and law needs to keep pace. The volume of data and the way we interrogate it will keep on growing and changing. While the technology will change fast and there will be many examples of redundancy, the data captured on the way through will still exist and will not be redundant, so separating out those two issues becomes important to consider. Can the courts and our legal processes keep up? Is our current legislation still relevant?

Conversely, these technological developments present opportunities, and the wrong sort of regulation or processes can stifle these opportunities, so it is important to find a way to navigate a balance for both sides of the coin that leads to innovation.

The impact of artificial intelligence (AI) also needs to be looked at as the impact of this is expected to be huge in the short term. How could it affect the outcome of court decisions, and law generally, including the practice of law, as well as the impact of AI on wider society? What is the human intervention that is needed to avoid pitfalls from predictive algorithmic analysis? Also the ethical values of society and the outcome of predictive decision making is only as good as the quality of the data that goes in. There is potential for this to reinforce any existing discrimination or prejudice that the system or data input person has.

Points to consider:

• Economic issues – How to maintain a resilient and prosperous New Zealand
• Navigating in a fast-changing world;
• Effectiveness of our laws and challenges to them;
• How do you draft law in this fast paced technological environment?
• Managing the new risks – technology provides potential and benefits – how to ensure regulations don’t stifle the innovation, but still provide protection?
• How to ensure our legal systems, eg courts, the profession etc, manage the scale and pace of change
• An indigenous perspective
• The use of data for public good and the concept of New Zealand as an open data, open society IDI for SMEs
• Social licences, digital sociology, behavioural research
• Impact of Artificial Intelligence

Theme 4: Ownership/Exploitation of Data

This is a significant issue for the research and we have identified several subsets within this theme for consideration.

Because, generally, New Zealanders are trusting of their technology and their technology providers, they do not understand where the risks are and who is responsible for mitigating those. Are there more effective ways to communicate with users on terms and conditions and policies for use of technology that are appropriate and simple so that these are better understood? As screens get smaller and we are presented with higher levels of almost unreadable, complex information in terms and conditions, what are more simple, but effective, methods of achieving understanding and informed consent?

As data collection rapidly grows, the concept of data portability becomes important and whether there is a role for the law to provide mechanisms that will facilitate consumer protection and choice. At its heart this has recognition of information autonomy, but as much information is held by international organisations, these concepts become harder to resolve. Issues related to ease of entry and exit enabling people to take their data with them becomes the challenge. It also creates competitive advantage which will lead to innovation, similar to the portability between power providers for example. We consider research on data portability would be very useful.

This then leads into consideration of increasing choice for the individual as to how they use and commercialise their data. What are the economic and IP challenges? What does informed consent look like and how can users have the ability to contract out of aspects? What obligations are there on previous suppliers to delete data once it has been ported? Is it fair if after using a provider for free for a period of years that they should be denied continued access to the data you have provided over that time, or have they already extracted sufficient value? These are all important questions and input from economics disciplines would be very useful here.

The issue of market value of information asymmetry comes into play where one party in a transaction has more, or superior, information compared with another. This increasingly becomes more complex in a digital world, making it more and more difficult for a consumer to make an informed decision across a whole range of transactions that they enter into when they choose their providers, be it bankers, power suppliers, ISP, media player and so on. This has the potential to be a harmful situation because one party can take advantage of the other party’s lack of knowledge. This could lead to the establishment of ‘information brokers’ and ‘data agencies’ to help consumers through this complex world and help establish appropriate expectations and understanding around privacy settings and appropriate terms and conditions.

There is scope for analysis of the underlying regulatory models, taking it right through to an application that provides a solution to these issues.

Points to consider:

• Informational autonomy – How do citizens ‘follow’ their data and know who is using it and for what purposes? And how do we control this?
• How do citizens ‘monetise’ their data and its use?
• Balancing safe/secure with the ability to innovate
• Ease of entry/exit from information – Anti-trust issues
• Current state of our legislation to enable and protect
• Data portability – Possible creations of new data agencies to assist with these issues
• Data for public good
• Market value of information asymmetry
• Finding an effective way to communicate policies to people/consumers – how to present and achieve informed consent;
• How to allocate the risks and responsibilities in economic transactions.

Theme 5: Philosophical notions

This theme considers the impact of technology on the State and what that means for democracy and other constitutional issues. We have seen challenges to our democratic processes in recent times, e.g. the social media campaign that resulted in the ‘Red Peak’ flag being added to the flag referendum. It is also an example of a select community having a disproportionate influence, or was it an example of a ‘flawed’ process that did not allow for this groundswell of interest to be taken into account early enough? Regardless, technology driven issues are increasingly driving government, when traditionally government has led.

Is there a better way for organisations and even government using technology to ask people what they want and gain a simple consensus before launching products or releasing new policy? This is akin to the customer focus group approach in marketing and exploring whether there is value in obtaining and formalising digitising a response to inform policy development. Consideration then needs to be taken of the ‘digital divide’, access to appropriate technology, over-exposure and bias to those with literacy, connectivity, time and motivation. This would be coupled with the need for excellent communication of issues and then integrity of the responses.

But of course if we flip that around, we have elected representatives whose job it becomes to decide for us and take the consequences of those decisions, and officials who are public servants. Are there then downsides to pushing some of these decision making responsibilities out to the ‘crowd’?

Issues of how technology can allow people to exercise their citizenship rights and how it can work against them could be considered.

Issues to consider:

• Meta themes of democratic governance,
• State’s ability to govern, e.g. tax, trade standards, crimes that can’t be detected or prosecuted,
• Challenges to our democracy – constitutional issues
• People driving government e.g. the Red Peak and Awaroa Beach events

Theme 6: The Ethics of Inference

The Foundation considers an enquiry into issues of algorithmic decision making and its indications for society as a whole is needed. How these algorithms and modelling are going to affect citizens and policy development will become increasingly important in our lives. As a research proposition, we are less interested in the algorithmic impacts on issues such as our shopping habits (via Google’s ability to follow us through our smart phones), but we are specifically interested in how extending and extrapolating data from algorithmic decision making will have impact on social policy, and the co-option of these models for the application of coercive and State interventionist powers. Will these be deleterious to people’s liberty or affect the recipients of State services?

This modelling could be used to predict the future potential of citizens thereby determining for example, such things as what schools children could go to or whether or not they should go to university. However, good predictive legitimacy does not necessarily justify the exercise of coercive powers. The issue is not how accurate these algorithms actually are, or whether we can accurately predict outcomes using them, but rather it is more about the nature of the relationship between the citizen and the State, and further extending that to being able to give the citizen the opportunity to correct, modify or remove the prediction made by the algorithm, and the transparency around this.

There are population based models that are useful for informing public policy and resource allocation at a macro level but they are not a reliable tool for interventions or operationalising on an individual level. However, our enquiry reveals that increasingly these sorts of models are being used in society, without necessarily having regard to false positives and the impact of what this might be.

So what does the future look like? Big data can do almost anything in terms of predictability and will get more accurate but there is a question of how much ‘surprise’ we want to have left in our lives or whether we want the answers already mapped out so we take that identified path rather than fighting it? As more and more data is collected, are our choices being limited, and therefore how much information should be aggregated about individuals? Whether is it in a court room, in a social agency, or whether it is by a parole officer, they all have access to significant amounts of information and computerised tools to make their decisions, so what are the legitimate boundaries of those decisions? If predications are being used for beneficial interventions, decisions might be different from when they are being used to make predictions to offer coercive interventions, when judgements on values around such things as the colour of skin, ethnicity etc, could add bias and affect validity.

Value and risk of what we can do better with our data could be considered: do we abandon using data, or do we make it worse using data? Do we need a baseline about the way we are making decisions now, the information we use, etc? There are many aspects to consider under this theme.

Points to consider:

• Impact of algorithmic decision making
• How to build a high trust/high confidence environment;
• Predictive technology and its effects – particularly between the citizen and the state, and a person’s right to prove the algorithm wrong
• Impact on marginalised groups
• Coercive and state intervention powers and people’s rights
• Data analytics issues – transparency and how to navigate the models, etc
• Data models and their assumptions

Theme 7: The exclusionary effect of technology

This is a large and growing issue facing New Zealand as we rely more and more on technology in our daily lives. Aspects of this have been picked up in the discussion across some of the other themes, but we consider a specific look at this is needed.

There are many obvious examples of potential issues for private citizens as more and more of our interactions, particularly with government for example, move online, but the exclusionary effect of technology on New Zealand business should also be addressed, together with how we should fund and encourage innovation in New Zealand for small businesses.

Most SMEs do not understand the rules and what they can do around data and what they can share etc. This means they are put off from moving forward because they don’t know or are unsure, so do nothing. It stops them from considering international expansion as well. There is an argument for there being broad public good in the provision of open data that unlocks potential business opportunities but the problem is that most of business operations aren’t at the scale and don’t have the skills or time to invest in achieving this. That’s a gap that needs to be addressed if New Zealand business is to grow and prosper.

There could be a project examining the ramifications for New Zealand of having an open data, open society for the small business sector; an IDI for the private sector. Is there a Model Law approach to this? Any work in this area should include input from those people who are affected by technology and users of technology, when looking for solutions.

If increasingly data is opened up to allow people the ability to examine data in a way that gives them a better ability for innovation, how do they access this or acquire or hire the necessary skill set to do the analysis? This is often difficult for private citizens or small business, so what is a fair and reasonable way for this sector to have access in a way that lets them utilise data to aid their success?

Points to consider:

• How does/will the lack of access to technology impact of New Zealand citizens?
• What will be the impact of government’s increasing focus for online engagement with government processes and the sharing of information across government agencies?
• Is New Zealand’s technology infrastructure able to keep pace with the speed of development and if not what is the impact of that?
• Expertise building – what is needed to grow New Zealand expertise?

Some NZLF expectations

What this project is about

This project is not about exploring existing ‘hobby horses’, but rather stretching and inspiring research into future focussed areas.

In the section above we have described some thematic areas, but have tried to go beyond this where possible by outlining concrete examples that might provoke researchers to consider broader and wider needs. We haven’t provided priorities as we want to leave the field reasonably open for researchers to create their own projects within the scope provided; but through our commentary we hope to have given a steer on some of the issues we think are important to address.

How we expect teams to work

Project teams will be multi-disciplinary, multi-institutional and collaborative across institutions so that the best expertise available within New Zealand can be utilised. When applicants consider membership of their research teams, we stress the need for them to address this inter-disciplinary and multi-disciplinary collaboration. This is essential and will be critical to ensure the research will be transformational.

Potential collaborators should include economists, sociologists, philosophers, technologists, business, government/public sector, CRIs, users, civil society and NFP organisations, to name a few. This wide collaboration is important because of the small pool of legal IT-capable expertise available in the country. Researchers need to extend their expertise by developing strong collaborations and partnerships that give the researchers the confidence to go beyond the areas of their comfort zone. Consideration should also be given to including small business people and other users who are affected by both the barriers and the opportunities created by changing technology.

Applied research

In many areas we expect researchers to look at the abstract principles, but at the same there is an opportunity for applied research to provide solutions and there may be inter-relationships between the two that should and can be taken into account. Research funding is available for this purpose.

Expressions of interest/Research Applications

Research teams will have the freedom to propose any project. They are able to propose issues not raised by the NZLF, but they should be guided by the themes proposed in this paper.

There will be no limit to the number of research projects that can be proposed, but as there may be limits on expertise and availability, research teams will have to justify how they can manage multiple pieces of work (particularly if there are researchers who are contributing to more than one project). Expected timeframes, particularly where some projects might overlap, will be important to establish and clarify. This is where good communication and cross collaboration will be critical to success.

Acceptance of research proposals

The NZLF will liaise with project teams and review all expressions of interest and research proposals put forward. These will be considered by the NZLF board after discussion and review by the independent Advisory Review Committee appointed by the NZLF. The NZLF will then liaise with the nominated team leaders for the respective research proposals, decide whether additional information is needed, and finally decide whether to allocate grant funding using the Foundation’s existing grant decision processes.

In addition to providing a project plan, methodology, budgets, timeframes etc, expressions of interest will be expected to indicate the range of expertise available within the research team, the different faculties within institutions who will collaborate (beyond just the Law Faculties), the linkages forged with international interests who could contribute, other private sector or industry collaborations, etc. Basically, the expressions of interest/applications should include anything relevant to indicate the level of interest, expertise and collaborative input that will be brought to the project.

A statement identifying the likely research outputs and impacts from each project will be required. No application will be considered without this.

Research teams that are collaborating across institutions will need to establish between themselves the percentage of research funding that will be allocated to each member institution and faculty. The NZLF will direct funding in accordance with the preference and agreement of the research teams.

In line with its usual grant processes, the NZLF will then give final approval for each strand of research, approve funding and the work can begin.

Refer to the “Apply for ILAPP funding” page for more information.

How the NZLF ILAPP project will be managed and independent oversight

Project Management

The NZLF has set up a secretariat in its office for management and oversight of the wider project, ensuring good communication and cohesion between the sub-projects and the Foundation. Management of, and overall responsibility for, the wider project will sit with the NZLF, not in any individual law faculty or institution granted funding. However, we expect each discrete research team to have a team leader who will liaise with the NZLF secretariat on all projects supported within the ambit of the broad NZLF Project.

Advisory Review Committee

The NZLF has appointed a high level Advisory Review Committee (ARC) which will act as an independent specialist advisory body to the NZLF for this project and its sub-projects. The ARC will operate under clear terms of reference and will report directly to the NZLF board. From time to time, the ARC is likely to seek reports from or provide input and feedback to the team leaders of the respective projects, either directly or via the NZLF secretariat. In the early stages when expressions of interest are being sought, the Foundation board will seek input from the ARC to assist with finalising aspects of projects to be supported. Details of ARC members are available on this website.