[Intro]

Laura Vidal:
In today’s episode we will be talking to our friends at Internet Bolivia who have been working hard over the past few years to push for better data protection laws in a time of significant political polarization. We’ll talk to them about the events that have forced Bolivians to pay attention to data and privacy, and also about the process and the discussions behind the data protection law they’re promoting.

Laura Henderson:
Internet Bolivia has been one of the few organizations in the country working on these issues for many years, and it has only been recently that data protection has had traction with the public. We’ve talked on previous episodes about how hard it is to care about privacy if it is only an abstract concept, but once data is leaked or abused on a widespread scale, people start to care. Remember what happened in Ecuador when the data of nearly the whole country was leaked? Finally there was political will to pass the Ecuadorian data protection law.

Laura Vidal:
Well the same has been true in Bolivia- For a long time people didn’t understand the need for better data protection, but lately there have been more and more public issues dealing with leaked data and data misuse- and these instances have had significant consequences for the public.

Laura Henderson:
In Bolivia privacy protection is a constitutional right, but there’s no law to provide proper mechanisms, specify violations, or indicate sanctions. And more and more, there is demand from citizens to prevent harms caused by misuse and abuse of data.

Laura Vidal:
Now, when we think of bills, the first thing that comes to mind are groups of lawyers, work tables, negotiations, legislators, assemblies … In this case, that wouldn’t be the whole story. The Internet Bolivia Foundation has been working to capitalize on public interest in protecting their data and increasing political will for a comprehensive data protection bill at the national level, but the fascinating bit here is that they’re not only working on a bill that would set policies from the top; they have also taken advantage of Bolivia’s unique decentralized system, working with municipalities, local departments, and citizens to set the agenda in the discussion around data protection, from the bottom up.

[Introductory music]

Laura Henderson:
If you are here, it is because you care about personal data and privacy. Welcome to Privacy is Global, a podcast made in collaboration with Internews and the Heinrich Boell Foundation. I am Laura, Laura Schwartz Henderson, back in front of the mic…

Laura Vidal:
And I’m also Laura, Laura Vidal, coming back from a virtual visit to Bolivia with our friends at InternetBolivia.Org. This is our third episode in Latin America. Our first took us to Brazil, with our friends at Coding Rights in which we explored the inequalities and the oppressions that hide in plain sight with facial recognition… Our previous episode took us to Ecuador, with the FCD, Fundación Ciudadanía y Desarrollo, which told us about the immense process of collaboration and dialogue that led to an original law on personal data.

Laura Henderson:
And today we are here to talk with and about our partners at Internet Bolivia.org about their work promoting data protection and a national bill. If you haven’t heard the other episodes of Privacy is Global, don’t miss them. Most of the episodes are in English, but the ones we have about issues in Latin America, like this one, are also in Spanish… And of course, that also means you will find a Portuguese version of the Coding Rights episode. This podcast is made in collaboration with numerous organizations around the world dedicated to advocating for the defense of data and privacy as fundamental rights- with special contributions from the Heinrich Boell Foundation and Internews’ ADAPT project & partners.

[Music fades out]

Laura Vidal:
At the beginning we talked about events that shake us up and make us understand, on a personal level, things that were somewhat abstract before … It seems that something similar happens with data protection, don’t you think? When we find out our data has been mistreated- all of a sudden we care… Or rather, we’re forced to care.

Laura Henderson:
The impact of poor data protection practices really hits home for many people when they’re victims of a data breach, or when their data is misused in a way that impacts their everyday lives. In the case of Bolivia, in 2018 thousands of people discovered they had been registered as members of political parties without their consent. Not only did these registrations often fail to represent the individual’s actual political views, but these data mistakes and data leaks also came amidst increased political tensions and growing polarization in Bolivia…

Laura Vidal:
If you don’t already know, in Bolivia in 2019, there was a contested re-election of the leftist President Evo Morales, who was the country’s first indigenous head of state who has held power since 2006 and wanted to run for yet another term. In the years leading up to this election there had been mounting political polarization and during the election it all came to a head and exploded. The opposition claimed the elections were fraudulent and installed an interim president, opposition leader Jeanine Áñez- something that Morales denounced as a coup. Throughout 2020, there was political uncertainty, protests, arrests, and to make matters worse- the covid pandemic. Only in October of the year […] did elections take place; and they were won by the leftist party and Morales’ successor Luis Arce. In the time since, there have been arrest of political oponents and charges of sedition, terrorism and conspiracy.

Laura Henderson:
That’s an extremely quick synopsis of an extremely complicated and fraught political situation, but this is just to make clear that polarization has been a significant problem from many years and party identification is extremely sensitive in this political moment- and therefore any leaks of this data and public misclassifications can have really serious consequences for individuals.

[Insert – tweets]

I demand an explanation! … On the “Yo Participo” page I appear as a member of the Left Revolutionary Front (FRI). I must definitively clarify that I was never a member of any party, nor am I currently a member.

Turns out I am also a member of a political party. I never registered! I just found out that I will “participate” in the #Prima

[End of insert]

Laura Vidal:
What we heard just now are just some of the enraged tweets that people posted online. The conversation can be found under the hashtag “falsa militancia”, in English “false political affiliation”. These people were trying to understand how their data was misused to falsely register them for political parties they did not consent to join. They found out through websites such as “Yo participo”, and to correct the error, which was vital for many Bolivians, especially those looking to work in electoral courts, they had to seek certificates of non-membership in the courts of justice. How complicated could that be, you may ask. Well, quite… Obtaining a certificate of non-membership is money and paperwork. Esther Mamani, Internet Bolivia’s communications coordinator can tell us more

Esther Mamani:
It is a whole process, like so many bureaucratic procedures in Bolivia. A lot of people had to wait for hours, queuing at the departmental electoral courts for hours, to be able to disaffiliate. Perhaps in another context, despite being an abuse, many people would not even have bothered to do the procedure, but given the highly polarized political context, being registered in one or the other party can make it difficult for you to access a job, for example, or even keep your job. Now, this was in November 2018. From that moment until now the database has not been updated. But beyond all of this, the question is, how did these lists end up inside political parties databases? Where did the names, identity card numbers and signatures come from? It seems that there are huge databases with people’s data for sale, just like you would see in a store. And we’re asked to give away data constantly… […] We’re talking about daily errands. A very Bolivian example is photocopies. They’re now a tradition in Bolivian bureaucracy, especially photocopies of your national ID. They ask for photocopies everywhere, for anything, and people don’t know what is being done with all that data, who shares it, who cross-references it with other data…

Laura Vidal:
So there’s this need for people to be more aware and have official means to protect data…

Esther Mamani:
Exactly. That’s why we’re advocating for a data protection law. The Constitution takes into account respect for privacy and intimacy, but we need a lot more. And all this also happens through a process of increasing awareness, to understand that many of the problems we are seeing today, including problems related to handling bank accounts, with annoying advertisements, with spearfishing messages or even the publication of intimate images as a form of violence against women, are privacy and data protection problems …

Laura Vidal:
Diandra Céspedes, a personal data protection officer at the InternetBolivia.org Foundation, had more to say about the importance of a data protection law.

Diandra Céspedes:
It is possible that because we don’t have a data protection law, that civil society and the authorities are sometimes ignorant of the process and importance of the handling of personal data … So, perhaps among the difficulties we have had is that the issue is still usually poorly understood and very technical, so we must find the easiest way to explain that it is related to fundamental rights with human rights and that finally our personal data is constantly exposed.

Laura Vidal:
People tend to be resistant around these matters and say “why should I care?” What would you tell them? What makes a data protection law useful?

Diandra Céspedes:
What doesn’t make a data protection law useful, we should rather ask. It is very important to have a data protection law… We need to understand that this digital age is also the age of data. It is even said that personal data is the new oil because many things can be done with data analysis and with the handling of personal data; on the positive side, companies, for example, can often improve services. What’s also important to understand is that these companies make profits off of our personal data. Then there’s the data that’s being handled by public institutions. They have basic information about us, like our name and age, but also sensitive information, such as health status… Not having a specific regulation translates to a higher possibility of leaks, or unauthorized exposure of personal data with all that this implies. There could be minor incidents and very important ones. We also need to think of those among the population who are vulnerable… Having a concrete specific regulation will allow us to at least have a guarantee that the way in which data is handled has security mechanisms and that there will be sanctions if people’s data is mishandled…

Laura Henderson:
What does the Constitution say around privacy?

Diandra Céspedes:
Our constitution has something that’s quite positive; according to the constitution we have a right to privacy and intimacy, but there’s another interesting aspect; known as “information self-determination”. That means that we’re the owners of our own data, that we have the right to know who handles our data, and we are the ones who decide what can be done with it. So, there is a framework, protected also by international treaties, but we still need a law that can regulate what can be done in this context, and how to enforce these rights.

Laura Vidal:
When these rights have been violated, none of those responsible have faced any kind of consequences. In the false militancy example, there were around 35,000 people affected but no one faced any kind of sanction. What does the law you propose contemplate around this?

Diandra Céspedes:
We do not have a specific proposal yet. We should see what penal figure can be used in which case. In the case of false militancies, for example, there are other aspects that are important, like forgery of signatures, for example. Some crimes can be identified in matters linked to the processing of personal data, such as, for example, the unauthorized exposure of personal data or identity theft. In the last version of the bill we were working on, there will be no criminal sanctions, only administrative ones. There would be different levels of infraction, with different levels of sanction.

Laura Henderson:
Should institutions also be sanctioned? And how?

Diandra Céspedes:
Indeed, yes. Institutions can be responsible entities and as such could be sanctioned. There could be monetary sanctions, for example. Institutions could be fined depending on the type of leak, or misuse of data. As I said before, there are different levels of severity. From not having informed consent, to selling information that you did not have the right to sell. Institutions could be the responsible party in many of these cases, and as such, they could indeed be fined…

[Transition music]

Laura Vidal:
So, this is where the work of Internet Bolivia.org comes in to create a data protection bill… They are engaging in this kind of advocacy at the national level and working with experts and policymakers to draft legislation that could prevent something like the falsa militancia scandal, and provide citizens with a way to fight back data leaks and abuses… But they’re also working on another strategy as well- something, like we said before, going more from the ‘bottom up’…
This more grassroots strategy has to do with Bolivia’s unique political system, which gives municipalities more authority and autonomy than in many other countries. Cristian León, Internet Bolivia’s Executive Director, explained:

Cristian León:
A particularity of the political configuration of the Bolivian State is its level of decentralization at the plurinational level, this is interesting since there are different levels of decentralized and autonomous territorial entities, from the departmental, the regional, the Municipal and finally the indigenous. These territorial authorities can make their own rules and in some cases, such as the indigenous autonomies, they can even have their own justice systems. That is, something called “plural justice.” This opens an opportunity because at that level it is possible to generate unique proposals for digital inclusion, data protection, access to information, among other issues that are normally addressed from digital rights. As an organization we aim, although we are still developing that, we aim to generate intercultural frameworks regarding digital rights, taking advantage of this plurinational approach. We imagine, for example, how indigenous communities can understand data protection and Internet access, will it be the same as the modern Western approach? Is it alternative, is it different? How can these populations also be part of the debate, even proposing visions of how these digital rights are understood today.

Laura Vidal:
Esther also spoke about the particular strengths of working with municipalities to advocate for data protection:

Esther Mamani:
We are working not only with the groups of experts that typically advocate for a bill, but we are also approaching the municipalities, which in the case of Bolivia, have autonomy, which implies that they can make their own laws. This is very important so that the regulations proposed are consistent with people’s experiences. In this regard, the municipalities are very important, because they have closer contacts with the citizens they serve. They know the locality’s complaints, the challenges, the advantages … And for this it is also important to think about rural areas and the data that go beyond the digital world.

Laura Henderson:
Data protection that isn’t digital? That sounds counter-intuitive.

Laura Vidal:
But it’s a key part of InternetBolivia’s work, particularly rural municipalities. Let’s go back to Diandra for more.

[Music transition]

Diandra Céspedes:
Here you have to understand that sometimes when we talk about the issue of personal data, we tend to believe that it is only the digital part; but there’s another part that happens offline or let’s say, physically. We leave data in different places and this would also involve rural areas, because for example, Bolivia’s General Personal Identification Service and the Civic Registry Service, they have our information including our name, our address, and our telephone. We are also talking about the processing of personal data that comes from other sources that are not necessarily digital, or connected to the internet. The law we’re proposing also aims to regulate the use of such data, to ensure that these public and private entities that handle our data, handle and treat them properly […] People share data when they do their taxes, or their registry. So, the strategy is to bring these conversations (that are often seen as characteristically important in urban areas) to rural areas.

Laura Henderson:
And this also means that Internet Bolivia is doing a ton when it comes to building expertise and knowledge on these issues within these municipalities and with local policymakers.

Diandra Céspedes:
Many of these departments and municipalities don’t have the mechanisms to understand and deal with these issues yet –probably because we do not have a law–, but they do understand that these issues are important, and that it is important to tackle them, as part of civil society. For example, they told us quite a bit about scams on WhatsApp; or that sometimes young people upload too many photos to the internet and they see this as potentially dangerous… So, perhaps they’re not fully aware, but they do understand the importance of these issues, they have an idea of their importance. Both people and the authorities have an idea of it all, but are still unsure of the ways they could handle these issues, what mechanisms they can put to use, etc…

Laura Vidal:
This relates to something that we have talked about on previous episodes- one of the most important challenges is educational; and it also has to do with making conversations about privacy, security and data occupy more spaces, making and people in general, discuss and debate. Experts say that the most important task at the time of working on a bill and advocating for it, is putting the debate on the table, making people talk about it, giving their opinions…

Laura Henderson:
This is exactly what the work with the municipalities is about. As Esther explained…

Esther Mamani:
The idea is to promote the law at the national level, with regulations that come from the State and the rest of the population, but with the municipalities we work on effective digital inclusion and approaches to electronic government so that the movement also goes from the bottom up.

Laura Vidal:
The question now is… What does this bottom-up work consist of? Here’s Cristian:

Cristian León:
We have started with an assessment regarding how municipal governments are treating the protection of personal data and we have also done a study on the competencies that they may have in this matter, taking into account that of course, there are issues that necessarily come at the national level and others at the subnational level. From that we have developed a prototype legislation proposal … a proposal anchored in the regulations and from that we have also generated guides for municipal authorities so that, at the same time that they have this prototype of law, they can adapt it to their own local contexts, why they are doing it, how they can strengthen it, and what extra elements they can include among others, right? That is to say, a guide that can give you more ideas on how to proceed, but of course this is not only about the authorities and representatives having to be convinced. Actually, it is with the people, it is the people that you have to convince. That is why a large part of our work has been to get closer to people whose data, or those of their loved ones, are more exposed. For example, we have met with parents’ associations, associations of people with HIV, LGTBI groups, among others so that, first, these people know that there are ways to protect their information or protect their loved ones, they can also know that There are rights and from that they can help us and also speak with the authorities, and help us convince the authorities so that together we can promote these much-needed regulations. So a bottom-up approach.

Laura Vidal:
And the challenges?

Cristian León:
We have had a lot of challenges. Perhaps challenges that we initially confused. Thus, at first we believed that it would be difficult to introduce the issue of personal data protection and make it a common currency. But, for example, in one of our first socialization meetings, which we held in the Neighborhood Council of El Alto -El Alto is a city known for being one of the largest cities with informality in Bolivia, with the highest poverty among other problems. When we met with the neighborhood council, there were no technicians in the room, no experts, they were mostly parents, shopkeepers, people who live from day to day. At first we had doubts if this topic was going to be of interest to them. But as soon as we made the presentation of the bill, there was significant participation from several of the people who were present.

Laura Vidal:
And finally, what is inspiring Internet Bolivia to pursue this work, this bottom up strategy?

Cristian León:
Why go from the bottom up? The debate on technologies and their uses is a debate that has been held in groups of experts and from a technical point of view, when it is the common people who are being most affected by digitization. As long as the discussion is only technical, it is exclusive, and beyond that, it serves a certain type of interest. We know that there are lobbies of technology companies, government interests engaged in shaping this type of legislation. But what are people really interested in? How to protect people’s rights? People’s information, what is really at stake in the digital age. That is, for us, one of the battles that we have to fight. More than even having a law. It is important that the most vulnerable groups that are being affected are those who demand greater protection of information; and not only NGOs, foundations or these groups of experts. When we see people themselves being the ones talking about the subject, analyzing and making demands to protect their rights and the privacy of their data, we will know that we have done something right.

Laura Henderson:
And that is the end of our show!

Laura Vidal:
Thanks so much to our friends at Internet Bolivia for making this episode possible. Our very special thanks to Esther Mamani, Cristian Leon, and Diandra Céspedes.
Privacy is Global is a podcast made in collaboration with Internews and the Heinrich Boell Foundation. It is produced by Laura Vidal, Dana Floberg and myself and we mix with Ura Design. Follow us on social media! You can find us @InternewsADAPT on Twitter and @Internews_ADAPT on Instagram. These are the spaces in which you’ll find more and more material about the podcast, its episodes and the organizations that make it possible. You can also contact us there, and if you’re listening to us on Anchor, you can leave a voice message. Thanks for listening!