COVID-19: Data privacy risks and potential opportunities

“With the pandemic, it’s a great opportunity to radically rethink what privacy is about. It’s not hard to imagine how we might build a new infrastructure, where we could be confident about how companies, especially, were using data. Such a regime would be about auditing data use and business models that are based on data.”

Lawrence Lessig, Member of AXA Research Fund’s Scientific Board

In our view, the pandemic represents an opportunity to reshape people’s trust in tech firms, to illustrate what is a legitimate use of data and then to change the way we – and technology companies – manage and regulate the use of personal data.

As explained by AXA Research Fund, Scientific Board member, Lawrence Lessig: “We can’t control access to data. It’s just not controllable. What we can control is its use.”

This is what we also identified from our engagement activities with tech companies, and we believe that the crisis could lead to a paradigm shift in the way we approach data privacy.

The risks are still real

COVID-19 did not change our findings and the key risks associated with data privacy. Corporations collecting and processing personal data are still exposed to reputational, operational and regulatory risks related to users’ and customers’ privacy. We built on our findings to run an engagement programme with tech companies exposed to data risks and opportunities. Given these conclusions, during 2020 we engaged with more than 20 technology firms in terms of how their way of working compares with the good practices we identified around:

• Transparency on data privacy policies and practices
• Oversight of the issue at board level
• Data collection minimisation
• Privacy by default

The first positive outcome of our engagement activities is that companies overall were transparent, and happy to have an open dialog with us on data privacy issues. Fifteen firms out of 20 responded to our requests. Of those we spoke to, we had in-depth, positive discussions on their approach to privacy and how the pandemic impacted their business. We also felt that tech companies now want to better understand investors’ expectations around data privacy.

Our engagement highlighted that tech companies are acknowledging the materiality of data privacy and taking steps to mitigate risks. Through public disclosure and our dialog with firms, we found that 65% consider data privacy as one the most material environmental, social and governance (ESG) issues they are facing - and is one of their sustainability priorities. With regards to management of privacy issues and day-to-day practices, we often got positive responses from companies. For example, some of the best practices we have seen through our engagement include, among others:

• A company that established a dedicated privacy committee at board level
• A company applying a strict non-content based and behavioural targeting
• A company that published a human rights policy that encompasses privacy issues

Lastly, we were glad to hear that tech companies we have been in discussions with, agree with the main message we have regarding data privacy. This is that responsible privacy practices are key in building and maintaining user trust, therefore allowing these to create and deliver sustainable, long-term value through the collection and processing of data. Of course, work still needs to be done. Some firms did not reply to our requests and we identified areas of improvement for tech companies; therefore, our engagement programme around data privacy will continue in 2021.

COVID-19 and the societal impact of tech firms

Since the beginning of the pandemic, tech companies have played a key role in helping society and the economy work. We believe that there are many potential investment opportunities in the sector, leveraging on the need for the sound use of personal data. In our view, there are two main areas where technology firms’ tools and solutions, demonstrated their ability to deliver positive societal impact.

First, from a personal perspective. Despite lockdowns and non-essential business closures, digital technologies allowed us to continue with our daily lives. They are helping people to connect with their families and relatives all around the world and to purchase goods and entertainment services online. In a period where social ties are strained, we believe it illustrates the societal benefits tech companies can bring – provided they are able to build trust by handling personal data in a responsible manner.

Second, digital technologies also helped us professionally. During the crisis, firms have allowed many companies to keep functioning and employing people as per normal, albeit from work-from-home environment for many firms. As an investor, we consider that this social opportunity is combined with a potential financial one. For example, many business-focused apps and platforms have seen a dramatic increase in usage - from both individuals and companies - during the pandemic.¹

Once again, trust is a major factor in tech companies’ current and future success. As a matter of fact, as the pandemic led everyone to rely even more on technology, it might also have had a positive impact on users’ trust in tech firms. According to Escalent² , “trust in tech is alive and well”. While trust was under pressure during the past few years, tech brands managed to earn user confidence by helping us live as normally as possible since the beginning of the crisis. It is quite consistent with the positive discussions we have had with companies, with many of these taking serious steps to tackle data privacy issues and understanding that protecting customer privacy is paramount in maintaining trust.

The role of technology in fighting the pandemic

Given their technical abilities, tech companies have a major role to play in helping to solve the crisis from a public health perspective. Technologies can help in diagnosis, as well as research and development for vaccines and treatment against the virus. Many firms are using artificial intelligence and machine learning to increase the speed and scalability of the fight against the pandemic. As an investor, we once again believe that financial opportunities and social benefits both exist here.

“There are several examples that illustrate how we can use AI and machine learning, more specifically deep learning and pattern recognition, to provide alternative ways for testing and diagnosing Covid-19.”

Prof. Thomas Lukasiewicz, AXA Chair in Explainable AI in Healthcare

Digital technologies are also needed in following the evolution of the virus, identifying at risk populations and locations. The main tools for this purpose are tracing apps. The aim here is simple – identify and notify all those who encounter a carrier of the virus. To do this, some tech brands have been working with coronavirus researchers and public health authorities to build large-scale, efficient tracing apps. This has led to both praise and criticism – while everyone wants to combat the spread of the virus, people are also concerned by their right to privacy and leery of sharing personal data with governments and tech firms.

Figure 1. Simulation results for various levels of exposure notification app uptake

Image

 Source: Oxford University and Google Research, September 2020.

Digital tracing can be a useful and powerful supplement to manual tracing. It will not replace social distancing and barrier gestures, but it could be a powerful solution to curtail new infections and hospitalisations.

A study³  conducted on the household and occupational structure of three counties in the US state of Washington attempts to illustrate this. It shows that in a model in which 15% of the population used tracing tools, “digital exposure notification systems could reduce infections and deaths by approximately 8% and 6%, effectively complementing traditional contact tracing”. The effect on the pandemic is obviously more significant with higher levels of app adoption but it demonstrates the positive impact of digital technologies, even with low adoption rates.

On the criticism side, digital tracing raised significant privacy concerns, with many actors – especially governments and tech firms – having access to personal data. Fighting the pandemic should not be done at the expense of protecting individuals’ right to privacy and responsible data handling practices. In our view, tracing apps will be even more efficient if they respect robust privacy standards that we have identified through our research. Data used for digital tracing should be:

• Based on contact tracing and not tracking people’s location
• Voluntary with the explicit consent of users
• Limited to public health purposes
• Deleted after the effort against COVID-19
• Minimised and ensuring only necessary information is collected
• Transparent on what is acquired, from where, how it is used and who has access to it
• Stored in a decentralised manner i.e. all or almost all data stays on personal devices

We conducted an analysis of 47 tracing apps that have been deployed across the globe.⁴  We examined them in terms of their alignment with the good practices highlighted above, and we identified apps that are using tech companies’ tools – 14 out of 47. We found that tracing apps using tech companies’ tools are always more in line with robust privacy standards than apps which don’t. This illustrates the fact that tech companies are helping in fighting the virus and at the same time adopting strong privacy safeguards.

Figure 2. Tracing apps using tech companies' tools are better aligned with robust privacy standards

Image

 Source: MIT Technology Review, AXA IM

If tracing apps follow the example of tech companies’ solutions alignment, with strong privacy safeguards, we believe that they will prove to users that their personal data is safe. In our view, this should result in an increase in adoption rates, and therefore help the flattening of the virus curve.

“The one thing we need to combat this pandemic effectively is easy access to contact tracing data. Once we know somebody has the disease, we need to identify who this person has been in contact with […]. In a pandemic, that is a perfectly legitimate use of data. But if you want to use that same data for another purpose […] that wouldn’t be a permissible use. In that case, you would be using public data that affects me personally in a way that I would have no reason to agree to – and for which there is no “public good” justification.”

Lawrence Lessig, Member of AXA Research Fund’s Scientific Board

In a way, the crisis is a good illustration of the fine line that separates the data opportunity and risks related to large-scale personal data use. It also provides an example of what is a legitimate use of data. When combined with responsible data privacy practices, it highlights the societal benefits tech companies can potentially bring – especially during these tough times.

Combined societal benefits and financial returns

Since the publication of our previous research piece and the beginning of the pandemic, many things have changed in our approach to data privacy and technology companies. Through our engagement activities, we found that firms acknowledge the materiality of privacy risks and have taken action to tackle them. The crisis also revealed the positive societal impact tech companies can have – and of course, the pandemic has accelerated the digital transformation and boosted online trends.

Given the reliance on technology in 2020, tech stocks performed well, with the NASDAQ index up 42.87% over the year, while the MSCI World index achieved 13.83% - although past performance is not as an indicator of future returns.

Figure 3. NASDAQ vs MSCI World price change over 2020

Image

Source: S&P Market Intelligence, AXA IM

“Over the last several months, many of us have experienced first-hand the importance of technology in our everyday lives in order to work, learn, shop and socialize. Broadly speaking, the technology sector is seen as a beneficiary of the pandemic and share prices have reflected this. The adoption of many digital technologies by businesses and consumers alike is supportive of long-term growth.”

Jeremy Gleeson, Fund Manager – Technology, Digital Economy and Robotech at AXA IM

Beyond the recent financial returns for many technology firms, we believe that the COVID-19 crisis has allowed us to take a step back and think about the societal role of tech companies. It might be the time to build a new paradigm around data privacy, which could boost peoples’ confidence regarding how their personal data is used. The pandemic has further revealed that data has a value for companies, investors and the whole society. As a responsible investor, we therefore want to push for socially beneficial usage of personal data. It means an environment where governments and tech firms should be able to make a clear argument for collecting and processing personal data in order to help solve problems – such as the current crisis – and additionally, bring value to individuals sharing their data.