Data repurposing

When talking about repurposing, I mean data being reused for something beyond the reason it was collected.
It’s often lawful, sometimes beneficial, and usually invisible.

To get an idea on the scale of data repurposing I’ve looked up some ballpark figures on how much our data is worth:

Meta (Facebook / Instagram / WhatsApp) made around $164 billion in 2024, largely from advertising which depends on user data.
Google (Alphabet) made over $250 billion in advertising related revenue in 2024.
Others like credit agencies, supermarkets and data brokers all turn insights from user data into commercial value.

1 | Meta (Facebook, Instagram, WhatsApp)

Meta’s platforms seem like they’re about connecting people but every like, pause and share also trains algorithms that decide what you’ll see next and which ads appear.

Meta have started using public posts to train AI models. It’s a prime example of data evolving beyond its original context.

2 | Google (Search, Maps, YouTube, Gmail, Android,Chrome)

Google’s tools help you search, navigate and remain productive – the activity behind them fuels personalised ads and product improvements.

Because one Google account links many services, the repurposing happens mostly internally but this also means the dataset is vast.

3 | Credit Reference Agencies (Experian, Equifax, TransUnion)

These organisations hold financial data on almost every UK adult.

They use it for credit scoring but also to offer marketing and analytics services, turning financial insights into broader consumer profiles.

4 | Supermarkets (Tesco Clubcard, Sainsbury’s Nectar, etc.)

I’m not a fan of loyalty card but I’m told they are supposed to make shopping cheaper and more convenient.

They also log every purchase against your profile.

That purchase history is used for stock planning, offer design and, increasingly, personalised pricing.

5 | Data Brokers & Advertising Networks

Companies like LiveRamp and Oracle Data Cloud specialise in combining datasets from multiple sources like loyalty programmes to create marketable audiences.

Most of us have never heard of them, but they’re a core part of the online advertising ecosystem.

How

1. Inference data

Even when a company doesn’t store your exact words or photos, it may infer interests, habits or attitudes from your behaviour — and those inferences drive ads, offers and recommendations.

2. AI training

Public posts, product reviews and images can be reused to train machine‑learnings models, developing incredibly powerful models with your data.

Large ecosystems like Google, Meta, Amazon share insights across their own products to improve features and advertising efficiency. The more you use, the more the network learns.

Thoughts

When I first started writing about data privacy, I thought it was all about keeping data safe as that has been my professional focus for so many years but I think it’s increasingly critical we all have an understanding of where our data goes and what the impact is of trading our data for services.

Repurposing isn’t automatically bad as it keeps many services free and it’s how the digital economy has evolved.
But it raises important questions about transparency, control, and purpose.
Understanding it helps us make informed choices about what we share and with whom.

The UK’s data protection laws give everyone rights to access and challenge how their data is used. Most large organisations now offer dashboards where you can review, export or delete your information.

Check Your Data: Dashboards & Privacy Tools

Meta (Facebook / Instagram)Facebook Privacy Settings

Meta (WhatsApp)WhatsApp Privacy Settings

GoogleGoogle Account – Privacy & Personalisation

Experian (UK)Experian Data Access

Equifax (UK)Equifax Data Reques

TransUnion (UK)TransUnion Data Access

Tesco ClubcardTesco Clubcard Privacy Hub

NectarNectar Privacy Policy

LiveRampLiveRamp UK Privacy Portal

Oracle AdvertisingOracle Advertising Privacy Portal

Why Data Protection Assessments Are Crucial for Digital ID

On 26 September 2025, the government published a Digital ID scheme explainer and news release, stating a Digital ID will be rolled out and that it will be mandatory for Right to Work checks within this Parliament.

This is an interesting one, I hadn’t been paying attention to the Digital ID debate until I was asked what my opinion was on them. I didn’t have one, so set about reading to inform myself in the hope it may inform an opinion.

It was also coincidentally while I was writing another article about data privacy, which was convenient as it gave me a lens in which to start investigation.

So I looked, but it turns out currently there is no information published about what data is stored, processed and who it will be shared with, how this is shared, what the data retention is, what alternatives are available for those without access to smart phones – we have no detail currently to make any kind of judgement.

Given the lack of detail, currently I’m neither for nor against a proposed Digital ID until I can see much more detail BUT if we are doing this, which from what I have read it seems we are, I think it makes sense to build trust through transparency at the earliest opportunity. Prevent speculation but removing the mystery.

That starts with publishing if assessments with meaningful scrutiny.

The government have stated there will be a public consultation but has not given any clues as to the schedule. This lack of detail has unfortunately lead to a lot of speculation and disinformation across social media and an uneasy feeling for some people.

Given the potential impact of this proposal, public trust and confidence will depend on timely transparency in the form of a Data Protection Impact Assessment (DPIA) done before beginning to implement, an independent ethics assessment aligned to the UK Data Ethics Framework, and a transparent consultation that invites scrutiny of the risks and mitigations.

Data Protection Impact Assessment

Under UK GDPR Article 35, controllers must conduct a Data Protection Impact Assessment where processing is likely to result in a high risk to individuals’ rights and freedoms. The ICO advises that the DPIA should start early and be completed prior to processing; “innovative technology,” large-scale processing, and special category data are indicators that a DPIA is needed.

After mitigation, if residual high risk remains, Article 36 requires prior consultation with the ICO.

A mandatory Digital ID for the entire population meets multiple high risk criteria (scale, sensitivity, novelty). While we will argue scope or design choices and how they risk, it is cautious to assume high risk and detail mitigation early.

A credible DPIA could look like:

Description of data flows and actors (data items; sources; storage; transfers; processors and sub-processors).
Necessity and proportionality analysis with alternatives considered (other designs and analogue alternatives.
Risk analysis identity theft, function creep, discrimination, exclusion, security failures, secondary use.
Mitigations data minimisation; access controls ; encryption; audit logging; retention & deletion policies.
Consultation internal, external experts, and public where feasible.
Governance updates; accountability; assurance.

Publishing DPIAs is not legally mandated in every case, but for a population-scale scheme, transparency is part of the control environment. Redact sensitive information and publish as much as possible.

Ethics assessments

DPIAs focus on data protection law. Ethics assessments focus on power imbalances, social impact, long-term effects, and edge-cases.

The UK’s Data Ethics Framework provides principle of transparency, accountability, fairness

Public consultation

What we might expect from the public consultation:

Before consultation

DPIA published responsibly, with necessary redactions. Data flow diagrams, lists of processors/sub-processors; retention schedules.
Ethics assessment aligned to the Data Ethics Framework (who benefits, who’s does not, controls for function creep and other risks).
Human rights and equality impact analyses
Alternatives analysis why other potential options were discounted and what benefits the proposed system would have.

Independent review with questions on the DPIA and ethics assessment
Deliberative engagement with those communities that will not be able to access a Digital ID for whatever reason.

During consultation

After consultation

Government response detailing how feedback has been assessed and what impact this had on the proposed design.
Updated DPIA/Ethics
Technical architecture published responsibly, removing only sensitive data.

Cool – so if this is the first step, what is our track record for this kind of thing in recent UK projects?

NHS Test & Trace (2020) — DPIA done late

Public trust was impacted but it could be argued this was unavoidable given the circumstances.

The government revealed this was late following a legal challenge from Open Rights Group. The outcome was that urgency didn’t change the legal duty to do a DPIA.

Live facial recognition by South Wales Police (2017-2020) — DPIA existed but was deemed inadequate
in 2020 the Court of Appeal ruled the deployment unlawful, finding failings including non-compliance with data protection impact assessment duties and the Public Sector Equality Duty.

This demonstrates the quality of a DPIA matters, which is reassuring.

NHS Federated Data Platform (2023–24) — DPIA published with engagement mechanisms in place
NHS England published a DPIA with acknowledgements of limits and commitments to ongoing updates and public panels.

This is promising. A step towards proactive transparency.

Digital immigration status: “View and Prove” (2020–25) — DPIA published; clearer description of flows and governance

Published a DPIA for View and Prove with data-flow detail, mitigations, and governance.

Stronger on publication timing than many programmes

National ANPR Service (2013–2025) — DPIA published with regular updates

Demonstrates iterative review and publication

Pensions Dashboards Programme (2023–25) — Explanatory DPIA and transparency blog
The programme published a DPIA and a public explainer on why it was published explicitly linking transparency to trust.

This trend demonstrates progress towards the type transparency that I believe the public needs before we are able to assess the impact to the population’s data privacy.

As of 11 October 2025, I have not seen a published DPIA, ethics assessment – nor have I seen promise of one yet.

There is an official explainer and news release on GOV.UK and various speculation in the press but as far as I can see, no schedule for the public consultation.

That means the first public DPIA/Ethics documents are still to come, but if they do not, the consultation is the place to insist on them.

Privacy ≠ Secrecy

“I have nothing to hide.”

It’s the most common response when people learn about pattern of life data collection.

I feel there is some misunderstanding between Secrecy and Privacy – Lets explore:

Secrecy vs. Privacy:

Secrecy is actively keeping specific information from being known. You keep your surprise party plans secret. You keep business negotiations confidential. You keep your gift purchases hidden until the right moment. Secrecy serves many legitimate purposes—protecting others, maintaining competitive advantage, preserving the magic of a surprise, or simply choosing the right time to share news.

Privacy is different. Privacy is your default right to control access to information about yourself and to exist without constant observation. You close the bathroom door not because what you’re doing is secret, but because you deserve personal space. You don’t want cameras in your bedroom not because you’re hiding anything wrong, but because intimacy requires privacy. You have curtains on your windows not to conceal secrets, but to create a boundary between public and private life.

Why Privacy Matters

Consider this: Your pattern of life data reveals:

When you’re home alone (and when you’re not)
Your medical conditions inferred from searches, GP records and pharmacy visits
Whether you’re job hunting (valuable to your current employer)
Your political beliefs, religious practices, sexual orientation
Financial stress that could be used by those you’re in negotiations with
Your daily routines, vulnerabilities, and points you may be most easily influenced

None of this requires you to be keeping secrets. You might openly discuss your health with friends, but that doesn’t mean private companies should use this data to increase their chances of selling you something.

You could be involved in activism, a protected democratic right under UK law, but more authoritarian regimes could track your associations with political activist groups. You might have nothing to hide, but could have quite a lot to lose.

In the US, Target famously identified a pregnant teenager through her shopping patterns before her father knew. She wasn’t keeping a secret—she simply hadn’t found the right moment to share her news. That privacy violation happened regardless of her intent to conceal.

https://www.forbes.com/sites/kashmirhill/2012/02/16/how-target-figured-out-a-teen-girl-was-pregnant-before-her-father-did/

Surveillance as default

When every moment is tracked, catalogued, and analysed, you lose more than secrecy—you lose the freedom to be yourself.

Psychologists call this the Panopticon effect: when people know they’re being watched, they change their behaviour. They self-censor. They conform. They become less authentic, less creative, less willing to explore ideas or make mistakes.

Privacy isn’t about hiding who you are. Privacy is the right to keep your personal life, information, and decisions free from unnecessary intrusion, surveillance, or exposure.

Your pattern of your life data is yours to do what you will with, which includes having the option to trade the privacy of some data for convenience but it should not be something to be collected, analysed, and sold without your meaningful consent.

Understanding Pattern of Life Data

No one is hiding somewhere watching you, but machines are collecting, storing and processing your data – and thats so much more efficient.

Every day, we generate thousands of data points about ourselves—where we go, what we buy, who we talk to, even how we feel. Individually, these breadcrumbs might seem innocent but throughout an average day, they create something far more revealing, they create a rich story of how you live – this is your pattern of life.

You may think that this historical archive of your ever movement, activity, communication, transaction – even biometrics you are not conscious of, like your heartbeat, stress levels – is fine, who cares where I’ve been and what I’ve done? I’ve got nothing to hide.

That’s cool, and there’s nothing wrong with that, such granular data about your past makes it incredibly easy to predict your future. Which I think is more concerning.

Continue reading →