面对现实：数据货币化和隐私

1、Data monetization and privacyFacing RealityTHIS CONTENT MAY NOT BE DISTRIBUTED TO MAINLAND CHINASurveillance tech goes far beyond the tech sectorRegulators are running to catch upWe believe that a consumer backlash is possible where consent isnt clearOpting in to more regulationEvery day, billions o

2、f people around the globe interact with the world through smartphones and the internet. Consumers nominally accept the trade-off between their data and the services that companies provide. But as technology changes, data is being monetized in new ways and the issue of consent has become a concern. I

3、n the last two years, regulators in the EU, China and the state of California have granted consumers rights to some of the data that companies collect from them. And more regulation is on the way with the European Union set to unveil new rules for AI developers in “high risk sectors,” such as health

4、care and transportation.1 An increased focus from regulators reflects growing concerns about privacy. But regulators are running to catch up with technology.Data monetization goes far beyond techWhile ESG investors have long engaged with technology companies on gender diversity, human rights and/or

5、climate change, data monetization presents a different set of challenges. Further, we believe that the widespread use of surveillance tech poses risks to a far larger group of companies. In particular, consumer goods and services companies are finding new uses for consumer data. For example, auto co

6、mpanies are considering selling consumer data from on-board computers to diversify their revenue streams.The consumer paradoxWhile we believe that business models that are reliant on consumer data are vulnerable to consumer backlash, we think the backlash is more likely to occur where consent is les

7、s obvious or non-existent. A consumer that purchases Amazons Echo or Google Home has consented to a device that passively listens. But for technologies like facial recognition, there is not necessarily an opportunity to affirmatively consent. In this report we take a detailed look at seven global in

8、dustries that increasingly rely on data monetization. We also highlight companies exposed to risks related to data security, privacy and facial recognition.27 February 2020ESGUnited StatesTessie PetionHead of ESG Research, Americas HSBC Securities (USA) Inc. HYPERLINK mailto:tessie.d.petion tessie.d

9、.petion+1 212 525 4866Davey Jose*Thematic Analyst Disruptive TechnologiesHSBC Bank plc HYPERLINK mailto:davey.jose davey.jose+44 20 7991 1489Wai-Shin Chan, CFAHead, Climate Change Centre; Co-Head, ESG ResearchThe Hongkong and Shanghai Banking Corporation Limited HYPERLINK mailto:wai.shin.chan.hk wai

10、.shin.chan.hk+852 2822 4870* Employed by a non-US affiliate of HSBC Securities (USA) Inc, and is not registered/ qualified pursuant to FINRA regulations1 Bloomberg (22 January 2020) Google CEO thinks AI will be more profound change than fireDisclosures & DisclaimerThis report must be read with the d

11、isclosures and the analyst certifications in the Disclosure appendix, and with the Disclaimer, which forms part of it.Issuer of report: HSBC Securities (USA) IncView HSBC Global Research at:https: HYPERLINK / /Facial recognition and data privacyMany companies and governments use or have the capabili

12、ty to use data harvesting, facial recognition and/or surveillance servicesID107Amazon Web Services Rekognition and Microsofts Azure can identify faces - matching them in an online database in advertising or social mediaAIWith the widespread use of facial recognition and AI, technologies enable a sca

13、le of surveillance that has been impossible before nowcountries have legislation on data security and privacy, but most existing regulation only focuses on health records and financial servicesautoWith modern cars collecting up to 25GB of data per hour, drivers usually sign away their rights to data

14、 in the ownership or lease agreementalgorithm biasA study of 189 face recognition algorithms tested by the NIST found that false positives were10 to 100 higher for Asian and African American faces than for Caucasian facesSurvey resp nd nts c ncerned bout th r ine privacy (2018-2019)Many tech compani

15、es acknowledge that data security and privacy are material risks that can result in material costsFrance 54%US 52%China 48%Canada 44%Australia & Sweden 42%Japan 41%Russia 40%UK 39%Germany 36%20182019Russia 52%Australia 49%Canada & China 48%France, Japan & US 47%UK 43%Sweden 36%Germany 26%The median

16、cost consumers would be prepared to pay to maintain their data privacyUSD550mUSD7.8bnAmount Fortune 500 firms are spending on GDPRcomplianceAmount Facebook agreed to settle in a lawsuit over its use of facial recognition technology (Jan-2020)USD5 p/mSource: CIGI-Ipsos.2019. “2019 CIGI-Ipsos Global S

17、urvey on Internet Security and Trust,” UNCTAD, International Association of Privacy Professionals, Winegar & Sunstein (2019), NIST, McKinsey, HSBCPrivacy in the digital ageRegulation increasing but inconsistent: leaves consumer gapsUbiquitous data collection goes far beyond the tech sectorInvestors

18、need to face up to the risksWhose data is it anyway?Who owns your data?When Facebook CEO Mark Zuckerberg appeared before the House Energy and Commerce committee in April 2018, he said “people own all of their own content” on his platform. Though substantially all of Facebooks revenue is from adverti

19、sing, his statement reflects the idea that privacy is a fundamental human right. More typical from companies is the following: In February 2020, telecom companies sued the state of Maine after the state passed a law that requires users to opt in to the use or sale of sensitive data. 2 The lawsuit al

20、leges that giving consumers a right to control their data is an unconstitutional limitation on broadband companies. Therefore Maines law violates the companies First Amendment rights aka freedom of speech.3Instinctively it feels like we must be the ultimate owners of all our data. The UN Declaration

21、 of Human Rights says that privacy underpins human dignity, freedom of association and freedom of speech. But in practice its not quite so simple. Legal precedence for governments is well established. For instance, in 2012 the US Supreme Court ruled that the police violated a persons expectations of

22、 privacy by placing a tracking device on a vehicle without a warrant.The court determined that tracking someones public movements crossed the line from public observation to private identification. Now of course, we carry the trackers ourselves and that leaves us with two key questions how do corpor

23、ates handle our data and why dont they face the same restrictions as governments? The transparency reports published by tech companies detail the legal processes that governments must go through to access information on users. But only recently have companies begun to be more transparent about how t

24、hey use data.Its a question of consentIn general, conversations about privacy have been about products where consumers have a certain level of awareness. For instance, though there are concerns about how often voice assistants like Alibabas Tmall Genie, Xiaomis Xiao Ai, Baidus DuerOS, Amazons Alexa,

25、 OK Google, Apples Siri, and Microsofts Cortana mistakenly record conversations, in 2019 over 140 million smart speakers were sold around the world.4567 Consumers have technically consented to the use of their data.Weve all clicked through long terms of service agreements to get to the thing that we

26、 want. But in many sectors, consent is less obvious. And as facial recognition becomes more common, consent may not exist at all. In effect, all spaces and actions can become public.Vice (19 February 2020) Big telecom says it has First Amendment right to sell your private dataArsTechnica (18 Februar

27、y 2020) ISPs sue Maine, claim web-privacy law violates their free-speech rightsNortheastern University (14 February 2020) When speakers are all ears: Understanding when smart speakers mistakenly record conversationsBBC (11 April 2019) Smart speaker recordings reviewed by humansTech Crunch (17 Februa

28、ry 2020) Smart speaker sales reached new record of 146.9m in 2019, up 70% from 2018 7 Capemini Research Institute (2019) Smart Talk: How organizations and consumers are embracing voice and chat assistantsRegulation that is not customer-centered is destined to fall shortWorries about data leaks and t

29、heft are increasingBut ESG investors must define what they consider reasonable consent. In our view, consent is currently structured to allow companies to shift the responsibility for protecting data from the company to the user. Once users agree to an opaque agreement, the onus shifts to them. Both

30、 the EUs General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA) require companies to ask for consent prior to data collection processes and give users the right to know what data will be used for what purpose. But the evidence tells us that most people dont know how

31、 much of their activities are being tracked. Therefore, regulation that makes the customer responsible for considering all of the ways in which a company uses their data is destined to fall short.How are consumer attitudes towards privacy evolving?As we wrote in Facebook: Initiate at Reduce: Digital

32、 dignity deficit disorder? (4 December 2019), academic literature has catalogued users relative indifference to privacy. A recent academic paper found that the median consumer would be prepared to pay just USD5 per month to maintain data privacy.8 In 2019, Facebooks advertising revenue per user was

33、USD29.25. Another recent study found that the average Facebook user would require more than USD1,000 to deactivate their account for a year.9 That was after a year of data privacy scandals, and it helps demonstrate the paradoxical fact that while mistrust of Facebook and other social media platforms

34、 may be at all-time highs, consumers wont easily abandon platforms that rely on their data.However, the data suggests that more frequent data breaches are causing customer concern about the ways companies use their data. In China, there have been financial scams that exploit leaked data. According t

35、o a survey from the China Consumers Association, 85% of people in China had suffered a data leak, such as their phone number and email address being sold to spammers.10 Worries about data theft are not the same as concerns about privacy. But the two sentiments often overlap.Survey respondents in Aus

36、tralia, Brazil, Canada, Great Britain, India, Italy, Japan, and Mexico are now more concerned about their online privacy than a year ago, according to the 2019 CIGI-Ipsos Global Survey on Internet Security and Trust. In the US, China, France and other markets the number of respondents now more conce

37、rned than in the previous year has gone down or stayed flat. But we believe that these numbers still present warning signs for companies as nearly half of respondents in some markets are more concerned about their online privacy than a year ago.Percentage of CIGI-Ipsos survey respondents more concer

38、ned with their online privacy compared with one year ago20142016201720182019Australia54%56%57%42%49%Brazil83%72%65%63%64%Canada54%49%51%44%48%China64%55%55%48%48%Germany56%44%46%36%26%France48%55%52%54%47%Great Britain53%59%49%39%43%Indonesia61%54%61%56%54%India83%65%70%71%73%Italy55%50%51%39%42%Jap

39、an62%53%50%41%47%South Korea73%62%57%52%51%Mexico80%54%63%63%65%RussiaN/AN/AN/A40%52%Sweden46%43%43%42%36%United States63%57%60%52%47%Source: CIGI-Ipsos.2019. 2019 CIGI-Ipsos Global Survey on Internet Security and Trust”Winegar, A.G. & Sunstein, C.R. (1 July 2019) How much is data privacy worth? A p

40、reliminary investigationPLOS One (19 December 2018) How much is social media worth? Estimating the value of Facebook by paying users to stop using itFortune (20 August 2019) “Chinas lax attitude about privacy is shifting- data sheet”GDPRs opt-in has caused some consumers to rethinkMyth that Chinesec

41、onsumers dont care at all about privacyA 2020 paper studied the effects of the GDPR on the ability of firms to collect consumer data, identify consumers over time, accrue revenue via online advertising, and predict their behavior. The study found a 12.5% drop in observed customers post GDPR. However

42、, the remaining customers became more valuable to advertisers, which offset most of the losses from customers that opted out.1112.5%Drop in consumers post GDPRThe difference in attitudes between government and companiesWe have observed that consumers trust governments more than corporates with their

43、 data. For instance, a recent Pew survey found that 56% of Americans trust law enforcement agencies to use technologies like facial recognition responsibly.122019 survey of US adults about whether its possible to go through daily life w/o companies collecting data2019 survey of US adults about wheth

44、er its possible to go through daily life w/o the government collecting dataIs not possible 38%Is possible62%Is not possible Is possibleNo answer1%36%63%Source: Pew Research, HSBCSource: Pew Research, HSBCWhile many Chinese consumers are willing to exchange some of their data for the sake of convenie

45、nce, Chinas citizens care about their data privacy.13 In March 2018, Baidus founder, Robin Li, suggested that the Chinese would trade privacy for convenience. According to Chinese state media, Lis comments uncovered discontent with the companys data collection practices.14 The Internet Society of Ch

46、ina has reported that 54% of the nations internet users think issues involving personal data breaches are “severe.” In December 2019, SenseTime, one of Chinas leading facial recognition companies, stated that the public was paying increasing attention to the industrys privacy and security problems.A

47、ridor, G., Che, Y., Nelson, W., & Salz, W. (29 January 2020) The economic consequences of data privacy regulation:Empirical evidence from GDPRPew Research Center (5 September 2019) More than half of US adults trust law enforcement to use facial recognition responsiblyMIT Technology Review (28 March

48、2018) “Chinas citizens do care about their privacy actually” 14 Slate (7 February 2019) “Chinas privacy conundrum”Case study: The Zao app in China In September 2019, the Zao app allowed users to swap faces with celebrities in movies or TV shows using artificial intelligence and machine-learning tech

49、niques. It went viral as a tool for creating deepfakes. Deepfakes are typically videos that have been edited with an algorithm to replace the person in the original video with someone else, in a way that makes the video look authentic. Concerns soon arose as people noticed that Zaos user agreement g

50、ave the app the global rights to use any image or video created on the platform for free. After a public outcry regarding these controversial user privacy terms and questions over data safety, the company clarified that the app would not store any users facialinformation. Zao is owned by Momo Inc.Ch

51、inese consumers care about how corporations use their dataWhile citizens increasingly care about data privacy, we have found limited evidence that this is an area of focus for Chinese investors.A survey by the Nandu Personal Information Protection Research Centre in China found that 74% of survey re

52、spondents want the option to choose traditional ID methods over facial recognition. Between 60-70% of respondents believe that facial recognition makes life safer and more convenient but were worried about their personal information being leaked and wanted more control over their data. The survey re

53、sults illustrate our initial assertion. Consumers are worried that the operators of facial recognition systems might be lax at data security. They have concerns about the ways that corporations might use their information they are less concerned about the fact that the government may receive the inf

54、ormation.15Financial Times (5 December 2019) “China survey shows high concern over facial recognition abuse”Regulation and remediesUS states are taking on data security and privacyAs is EuropeIn our view, global regulators are still debating how to intervene on data security and privacy but interven

55、tion is inevitable. According to the United Nations Conference on Trade and Development (UNCTAD), 107 countries have legislation on data security and privacy.16 However, most of the already existing regulation focuses on things like health records, financial services, etc. The US does not have a bas

56、ic federal online privacy law.In the US, new privacy laws have been enacted at the state level, not the federal level. The California Consumer Privacy Act of 2018, which came into effect in January of 2020, gives new data privacy rights to California residents. Californias SB-327 regulates the secur

57、ity of data in connection with internet-connected devices. Illinois Biometric Information Privacy Act (BIPA) requires affirmative consent for companies to collect biometric markers from their customers, including fingerprints and facial recognition models. BIPA gives Illinois residents the right to

58、sue companies for up to USD5,000 per violation. In 2019, Maine passed a law intended to protect broadband user privacy.17 The law requires telecom companies to disclose what data they collect and who its sold to. It also requires that users opt in to the sale of sensitive location or financial data.

59、18At the federal level, the US Constitutions Fourth Amendment protects citizens against unreasonable government intrusions, and the Supreme Court has applied it to digital technologies in recent years. For example, in 2018, the court ruled that the government may not access historical mobile-phone l

60、ocation data without a warrant.19 We believe that very broad uses of technologies like facial- recognition could face similar challenges, especially because a facial-recognition database differs significantly from a database of fingerprints or DNA in that it is likely to contain records on people wh