Privacy, blockchain and the Internet of Things – can we keep control of our own identities?

An estimated 4.57 billion people access the Net regularly, with almost 90 per cent of Australians plugged into the online universe. Increasingly, societies and economies are organised around data, and there is a growing awareness that this poses major problems for privacy.

In one sense, we're still struggling to understand what 'privacy' actually means in an online world. It's not the same as data security and protection – it's about how individuals control their whole online identity, and expectations around that change from person to person and situation to situation.

By now we should have smarter technologies that recognise those changing contexts and preferences, but thus far that hasn't been a priority, so, in fact, emerging technologies like blockchain and the Internet of Things have the potential to further compromise people's privacy.

In the case of blockchain, the exact features that make it such a secure technology also make it a privacy minefield.

Blockchains use details of previous transactions, including participants identities and exchange values, to verify future transactions by embedding this information in the data chain, and the viability of the system depends on the uneditable nature of each block.

The European Court of Justice ruled European citizens have the right to be forgotten, but once someone's details are embedded in a blockchain, the system never forgets – yes, those details might be encrypted, but they are also part of an irreversible ledger, and one that's on the cloud.

As long as a blockchain is in existence, it clashes with the European ruling that people have the right to retract data.

Despite this problem, there are many benefits to the blockchain system, so more effort needs to concentrate on developing variations of the technology that retain its virtues while also taking the privacy consideration seriously.

For example, research conducted by Dr Anwaar Ulhaq, Professor Oliver Burmeister (both from Charles Sturt University) and myself, has looked at the Holochain platform, which uses a distributed hash table to break the blockchain up, and then the chain, instead of sitting on the cloud, sits where end users want it to sit.

This allows individuals to verify data without disclosing all its details or permanently storing it in the cloud, but there are also still a lot of questions to answer about how this affects the long-term viability of the chain and how it obtains verifications. Nonetheless, this example suggests there is scope to reimagine blockchain style platforms in a way that provides greater privacy consideration for the end user.

Privacy concerns are also surfacing among leading Internet of Things thinkers. Some years ago, I was at a presentation by Vint Cerf (Google's 'Chief Internet Evangelist'), and I asked him about privacy, and at the time, he thought it was irrelevant, a view he was then well-known for.

Whereas in 2017, he and a co-author wrote that privacy is one of the biggest issues facing the Internet of Things and he called for regulation – if we have millions of devices collecting data about life on Earth, who controls it, how can we use it and how can we opt out when we want to?

We have reached a crucial point where these considerations must be anticipated and addressed as an integral part of developing new technologies, rather than just treated as a secondary issue that can be tackled reactively and retrospectively.

We know that technologies disrupt society, and too often they do that in ways that we're not fully aware of when it is actually happening.

Researchers and technologists can apply ethical analysis approaches, like the one proposed by The Ethics Centre at Sydney University, to see how their innovations might disrupt society, both the positive and negative, and then develop ethical, practical processes to deal with those impacts on society before they occur.

In respect to privacy, I think the crucial first step is for the industry to develop a clear definition of what 'privacy' actually is – what we are trying to protect and why – and then agree standards to ensure those requirements are met across the board.

It shouldn't be an afterthought anymore.