Journalistic knowledge platforms (JKPs) leverage data from the news, social media and other sources. They collect large amounts of data and attempt to extract potentially news-relevant information for news production. At the same time, by harvesting and recombining big data, they can challenge data privacy ethically and legally. Knowledge graphs ofer new possibilities for representing information in JKPs, but their power also amplifies long-standing privacy concerns. This paper studies the implications of data privacy policies for JKPs. To do so, we have reviewed the GDPR and identified diferent areas where it potentially conflicts with JKPs.
interest is not crystal clear.
Data privacy has become a central topic of
discusJournalistic Knowledge Platforms (JKPs) are an emerg- sion for organisations and projects from private
coming generation of platforms which combine state- panies and governments to research activities in
uniof-the-art artificial intelligence (AI) techniques, like versities around the globe. Whereas there is no general
knowledge graphs and natural-language processing solution to privacy for everyone and specific solutions
(NLP) [
Thomson Reuters [
However, obtaining and representing knowledge 11, 12], a series of JKP architectures and prototypes. leads to data privacy concerns when personal data The current News Hunter platform is big-data ready from diferent sources is neither collected directly and designed to continually harvest and monitor realfrom the subject nor with the subject’s consent, al- time news feeds (e.g., RSS or web-sites) and social though some countries have exemptions that loosen media (e.g., Twitter and Facebook). It aims to analyse privacy requirements for journalistic research that is and represent news content semantically in knowlin the public interest or does not identify individuals edge graphs in order to provide better background directly. This exemption becomes even more complex information for journalists and to suggest news anwhen the national privacy policies that apply to the gles [13, 14, 15, 16, 17]. data sources and the JKP are distinct or the public As part of our News Hunter efort, this paper investigates the implications of the GDPR on JKPs. To do so, Proceedings of the CIKM 2020 Workshops, we asked ourselves which data privacy conflicts can October 19-20, Galway, Ireland. arise when JKPs when are used in journalistic work, eTmaraeiql.:AMl-aMrco.sGl malil@ofruei@b.nuoib(.Tn.oA(Ml- M.Gosallmloif)r;éAOncdarñeaa)s;.Opdahl@uib.no in particular when that work may be exempted from (A.L. Opdahl) some privacy regulations because it is in the public inorcid: 0000-0001-7637-3303 (M. Gallofré Ocaña); terest. To the best of our knowledge, there is no previ0000-0002-5296-2709 (T. Al-Moslmi); 0000-0002-3141-1385 (A.L. ous work discussing the possible data privacy conflicts Opdahl) © 2020 Copyright for this paper by its authors. Use permitted under Creative in JKPs. Our contributions are: (1) we review diferent CPWrEooUrckReshdoinpgs IhStpN:/c1e6u1r3-w-0s.o7r3g CCoEmUmoRns WLiceonrsekAsthtriobuptioPnr4o.0cIneteerdnaitniognasl ((CCC EBYU4R.0)-.WS.org) journalistic scenarios and personal data sources that can conflict with GDPR policies, and (2) we introduce an autonomous person that states must protect to prea personal data matrix framework to classify personal serve a democratic society, the concept of privacy in data conflicts and discuss the possible uses of this ma- the United States of America is understood primarily trix. as a physical notion that implies the “private space”
This paper is organised as follows: section 2 defines (e.g., bedroom, bathroom or the entire home) [
A typical JKP comprises a knowledge graph [23, 24, 25] along with AI, NLP pipelines, and semantic technology components. In a JKP, the Knowledge graph is filled with potentially news-related histories, information and current and archival news to support journalists in creating newsworthy stories, finding relevant information, events and story-lines, and validating and verifying news. The information in the knowledge graph is represented using standard identifiers and semantic knowledge representations with reasoning capabilities. The usage of standard identiifers facilitates data integration, which is the process of joining and merging diferent data sets or public data sources like Semantic Web [26, 27], linked open data (LOD) [28], including Wikidata and DBpedia, and Wikipedia. Data integration together with reasoning allows drawing new insights from information from across the data that would be impossible before with isolated datasets. This inherent ability of drawing new insights implies that new personal data may be derived and exposed in the knowledge graph.
subjects who are in the European Union shall obey the General Data Protection Regulation (GDPR) [29].
The GDPR is an extensive regulation which sets the basis for dealing with personal data in the EU or using personal data from the EU. This section highlights the most general concepts that restrict what and how to process personal data in JKPs.
The GDPR defines the concepts of personal data and processing (Chapter I, Article 4). Personal data is any information that can be employed to identify directly or indirectly a natural person (e.g., name, an identification number or online identifier) or sensitive data like health, biometric, genetic, economic, cultural factors or political opinions of a natural person. Data that has been de-identified, encrypted or pseudonymised but can be used to re-identify a person is considered as personal data too. By processing, the GDPR means processes such as collection, structuring, storage, alteration, consultation, use, disclosure, combination, restriction, erasure or destruction of personal data.
Moreover, the GDPR establishes a set of principles for processing personal data (Chapter II ) which define how data have to be processed, stored and maintained. 2.2. Privacy These set of principles establish that data shall be proPrivacy is a historically and culturally situated con- cessed within the initial purposes and purposes comcept. For example, whereas privacy in Europe is tra- patible with them (purpose limitation), only what is ditionally considered as an inalienable basic right of necessary to the purpose (data minimisation), personal data shall be accurate and kept up to date (accuracy), not present a problem with the GDPR. However, the and stored for no longer periods than the necessary for data can be made it publicly accessible by the subject the purpose (storage limitation). It also defines the law- itself in social media networks (e.g., posts like tweets fulness of processing which determines when personal in Twitter or forums and groups like Facebook groups) data can be processed, e.g., when data subject gives or in the subject’s verifiable social media accounts and the consent or for a task carried out in public interest. personal web sites without providing explicit consent Under the GDPR, some research by journalist and aca- for its collection to the JKP. In that case, apart from demics is understood as public interest. Likewise, the having to follow the source’s data policies, it raises GDPR limits the processing of sensitive data which is the ethical questions whether the consent is implicit prohibited in general terms but with some exceptions, because it is publicly available, when we should cone.g., when data subject gives explicit consent, it is nec- sider that it is publicly available and under which essary for reasons of substantial public interest, or the conditions. data subject has manifestly made it public.
The GDPR also details when and which information 3.2. Personal data from third parties have to be provided to the data subjects (Chapter III ).
In the case of personal data that is not obtained di- When the data is not collected directly from the subrectly from the subject, it determines which data have ject, instead, it has been made accessible by a third to be provided, e.g., the source of the personal data party and subject may ignore its existence, we have and whether it came from publicly accessible sources to consider two possible scenarios: or the categories of personal data. Nevertheless, it also The first scenario, when news-related information establishes some exemptions, e.g., when the provision is gathered from the web (e.g., online news, RSS, webof such information proves to be impossible or is likely sites or social media), JKPs can extract personal data to harm the objectives of the processing objective. from the content to represent and combine it in the knowledge graphs. E.g., from “We know the classic 7layer dip, made with Bush’s Beans, is a fan favorite for 3. Privacy conflicts in JKPs game day snacking celebrations, Kate Raferty, the consumer experience manager for Bush’s, told Fox News.” 1, we can extract information like “Kate Raferty is a person who works as consumer experience manager at Bush’s Beens company at Knoxville, Tennessee” which can be considered as personal data, as it can be used to identify a natural person. According to the GDPR, the subject should be notified, and the JKP has to provide a mechanism for the subject to protest. Even though, on a large scale, two issues arise: the number of notifications that famous people will get and how to contact subjects if the content information is missing.
The second scenario, when personal data is gathered from publicly available sources or open sources like Wikipedia, Wikidata or telephone/address books, it is clear that the personal data is already public. However, it may not be released with subject’s consent. In that case, it opens the question about: why should the JKP not be allowed to store copies of personal data which is already public?
conflict with the GDPR we must consider the source of the personal data, distinguishing between the data gathered directly from the subject, the data harvested from other sources like news or social media and the inferred data.
In the context of GDPR, some data processing by journalists is exempted when it is conducted in the public interest. However, this exemption exclusively applies to journalistically relevant (newsworthy) personal data, not to any personal data processed in the JKP, and sensitive data may be less exempted or not exempted at all. Therefore, we must also consider how relevant the personal data is for the public interest from a news perspective. This includes the assessment of newsworthiness [30] along with the type of news. E.g., a corruption scandal and a private event in the life of a famous person may both be highly newsworthy, but corruption is most likely more important for the public interest.
instead, it is inferred using the actual data (either from the data subject, collected from news or gathered from
1Drew Schwartz, VICE: This 70-Layer Bean Dip Is the Most Vile Thing I’ve Ever Seen (https://t.co/qKyyNevpBh) public sources) and reasoning techniques. E.g., from Table 1 the text “The European Court of Justice (ECJ) said that Personal data matrix Oriol Junqueras had become an MEP the moment he Consented Collected Inferred was elected in May, despite being on trial for sedition.” 2, Impersonal Data ✔ ✔ ✔ we can represent the person “Oriol Junqueras” as the Personal Data ✔ ! ! entity Q116812 from Wikidata, from which we can Sensitive Data ✔ !! !! derive that he is a member of a political party (P102) and the political party is “the Republican Left of Catalonia” (Q150068). With this information is it possible 4. Personal data matrix to infer the subject’s political ideology (P1142) from the political party information such as “republican- After reviewing the previous scenarios, we classiism” (Q877848) and “Catalan pro-independence move- fied the diferent situations that can cause a conflict ment” (Q893331). In this scenario there is not a direct with the GDPR into a two-dimension matrix (figure 1) source of subject’s personal data or political opinions, framework. The personal data matrix aims to help instead, there is a source of related information used journalists and JKP developers to classify the personal for inferring knowledge which can be either in the data in JKPs and its possible issues with privacy polisame knowledge graph or from external sources. cies.
The personal data matrix (figure 1) classifies personal data based on the privacy level and the data 3.4. Possible solutions source. The first dimension (privacy level) classifies To comply with the GDPR’s Chapter III, in any of the the data whenever it does not represent personal data previously discussed scenarios it is important to iden- (impersonal data), it represents personal data or it reptify the data source and personal data category (e.g., resents “sensitive data”. There is an explicit distinction name, ID number, online identifier, health data, po- between personal and “sensitive data” because in the litical opinion). Thus, it will be possible to identify GDPR “sensitive data” have much more restricted limboth the source and data and take actions accordingly. itations. The other dimension, the data source dimenAlthough the main responsible of complying with the sion, classifies data based on the data collected with GDRP in the first place is the data provider (i.e., news the subject’s consent (consented), the data directly website, social media platform or telephone/address collected from the content and the inferred data. Only books), JKPs should follow the GDPR to safeguard the when data is either explicitly consented or it is not subjects of privacy and consider the policies and re- personal data its treatment is straightforward. Othstrictions established by the data provider. The JKP erwise, as discussed in the previous section, each of must always take independent responsibility for pri- these combinations has its issues and open questions vacy, and it cannot trust its sources to safeguard pri- regarding the application of the GDPR and its origin. vacy. In a truly international and global set-up, where The data matrix can be also regarded as a cube, diferent privacy policies apply, JKPs may have to be where the public interest represents the third dimendesigned with diferent knowledge graphs for difer- sion. This third dimension determines to what extent ent legal domains or geographical regions, each graph the GDRP exemption to data processing for journalisonly being accessible from its own privacy domain. tic purposes in the public interest applies, taking into When this is infeasible, the most restrictive policies to consideration the newsworthiness component of the guarantee personal data privacy must be adopted. data.
Moreover, JKPs should also implement automatic The proposed matrix can be used by JKP researchers mechanisms to notify subjects with both the personal and developers to ensure – as automatically as possidata and the sources when this information is iden- ble, but in practice aided by human data privacy stewtified, a process that can be done by email. It is also ards – that privacy regulations are never violated. The possible to set up an automatic system for subjects to matrix should be used in the design of JKPs to ensure protest, complain, request or ask about personal data. that personal data is protected by default. E.g., developers of JKPs can use the matrix to evaluate the system and identify which processes or collected data can lead to privacy conflicts; implement the matrix as part of the news creation workflow so that journalists can automatically check data privacy compliance before collecting, re-combining or using any personal data; 2BBC: Jailed Catalan leader ’should have had immunity’, rules EU court (https://www.bbc.com/news/world-europe-50808766) it can be utilized as metadata for each piece of data in the knowledge graph to automatise its recognition and privacy assurance; and the matrix can be used when dealing with data under diferent regulations to find divergences between them.
JKPs need to deal with personal data which in many cases will be integrated into knowledge graphs without the explicit consent from the subject. Thus, JKPs need to safeguard data privacy. For that reason, we have presented a framework for classifying personal data in journalistic knowledge graphs and identified diferent scenarios and personal data sources that potentially can conflict with the GDPR. We believe the identified scenarios, sources and presented matrix will be helpful as a reference for related projects and similar domains.
We want to continue exploring the open questions highlighted in our discussions in section 3, as well as questions such as how to deal with diferent privacy regulations that may apply in international settings, how to represent and efectively use GDPR in JKP processes, and how to deal with personal data about children. Data linking transparency is another open question which would help to identify situations that conflict with privacy and identify which data can be stored and which data cannot be stored in JKPs according to the GDPR and other privacy policies and regulations. Besides that, as anonymisation, encryption and blockchain technologies are presented as potential solutions to safeguard privacy and control copyrights and data access, we want to research how efective they are in the context of JKPs and how they can benefit JKPs.
Apart from that, one critical aspect when dealing with data from external sources, which has not been considered in this work, is the copyright and intellectual property regulations which have a direct relation with the data that can be processed and stored. In this context, we want to explore how to efectively manage them in JKPs (e.g., using ontologies).
PLUSS project 275872 News Angler, which is a collaboration with Wolftech AB, Bergen, Norway.