The Divided States of America(n Data)

The Divided States of America(n Data)

This Is Why We Can’t Have Nice Things – Like Our Own Version of GDPR.

The American Data Divide

Across the ocean, a much-publicized piece of holistic privacy legislation called the GDPR has transformed the relationship between citizens, businesses, and personal data. In 2019 it’s time to ask: why can’t the USA produce its own unified piece of federal data privacy regulation?

Data regulation in the United States is still a work in progress. At present it’s a patchwork quilt split along state and industrial sector lines, and for most consumers, it’s impossible to penetrate. Businesses are similarly hamstrung by the lack of harmonious regulation. Those that decide to play by the rules burn copious resources and frustrating man-hours just to understand what those rules are. And even after that expending all that effort, many (if not most) businesses still struggle to be compliant.

The Roadblocks to Reform

Why can’t Congress do something about it? The short answer is that there just hasn’t been enough momentum to get something passed federally. The FTC has long recommended that Congress enact a comprehensive set of privacy laws. The Obama administration, in its early days, even tabled a set of proposals for a Consumer Privacy Bill of Rights. Privacy practitioners lauded the document. But it quietly died as Silicon Valley ingratiated itself into the D.C. political machine over the first half of the decade. And although the new president is an avid social media user, the Trump administration has shown little appetite for data regulation.

It’s also possible to make a deeper cultural reading into the different data trajectories of the US and EU. The European Union has been, since its inception, a body with the power to legislate dynamically in reaction to the world around it. On the other hand, US legal and political culture remains staunchly Constitutionalist. Legislating for an issue like data privacy, nonexistent at the time the Constitution was written, can be slowed by the challenge of remaining faithful to the spirit of a document that’s over 200 years old.

The Prospects for Change

However, in 2020 there will be a presidential election and possibly a new administration in the White House. Have the dynamics changed sufficiently to inspire another tilt at federal regulation? The voting population seems more concerned than ever about the way companies use personal data. However, a vocal watchdog organization (à la MADD or the NAACP) has yet to emerge. We’ll return to this later.

The real change that’s taken place lies in the business community. Among business leaders, regulatory certainty is emerging as a key concern – even beyond getting favorable laws. Businesses just want the rules of the game to be consistent. And there’s a deeper acceptance that federal laws represent a huge efficiency improvement over the uncertainty and instability of state-by-state regulation. 

One unified piece of legislation would provide a single target on which to concentrate lobbying efforts, debate, and discussion. Consequently, many business leaders are already urging Washington to take action. Earlier this year 51 CEOs from some of the biggest tech and industrial companies in the world signed an open letter to Congress urging them to act on a “comprehensive consumer data privacy law.” 

Will Citizens Step Up?

Were it up to these business leaders, a federal data law would be a done deal. But legislators appear wary of acting while there’s an empty seat at the table. If anything is slowing federal data regulation down in 2019, it’s the lack of a high-profile citizen’s rights group that could sit down with political and business leaders and get the ball rolling.

To conclude, the landscape looks to be more conducive to a federal data privacy law in 2019. But wondering “why doesn’t it exist yet?” may be the wrong question for individual citizens to be asking. In the absence of a highly-invested consumer protection lobby in Washington DC, the correct question to ask may be: “how can we get a seat at the table?”

What’s the Difference Between Data Security & Data Privacy?

What’s the Difference Between Data Security & Data Privacy?

“Data Privacy” and “Data Security” are two terms that can sometimes be used interchangeably. Especially by those who aren’t in the field of data protection. However, in this particular sector of the industry, they mean two very different things. Understanding the relationship between them is essential for grasping the complexity of regulatory compliance. This article is a quick primer that illustrates how privacy and security differ and how they work together as building blocks of regular data operation.

Data Security vs Data Privacy

In simple terms, security means securing data against unauthorized access. Privacy is about managing and defining authorized access. Data security is a technical issue that involves building robust defense mechanisms in your digital infrastructure. Data privacy is questioning and tackling legal and legislative spheres.

One of the most important relationships to note is that data privacy pre-supposes security. The GDPR doesn’t contain prescriptive instructions for how organizations should fortify their network because the only way for its privacy provisions to get followed is with data security. If a cybercriminal steals someone’s PII, it’s evident they are violating someone’s privacy rights.

So, data privacy assumes data security. Does the reverse hold? Does data security include data privacy? No, but organizations fall into the trap of making this assumption often. In so doing, they can avoid taking necessary regulatory compliance steps.

Conclusion

It’s not enough to protect data from outside attacks. Managing and enforcing internal permissions – i.e., managing privacy – is a vital piece of the puzzle for any business to be compliant with the latest data regulation. Internal privacy controls can be complicated and time-consuming in a large company. Something as simple as employees copying files onto personal flash drives can sink a carefully constructed operation. However, the effort to keep data processes watertight is an essential cost of doing business in 2019. Moreover, the cost of failing to invest in both security and privacy can prove disastrous.

How Online Experience Varies by Purchasing Power

How Online Experience Varies by Purchasing Power

When people discuss issues with data privacy, class ranking is rarely part of the conversation. Even though the internet has been a markedly business-driven project for some years now, the old perception endures that URL life isn’t getting marked by the same dividing lines that mark IRL society. However, this is false. The realization that data privacy gets inextricably tied to economic status is becoming more widely accepted.

Predatory Advertising

As the old technology adage goes: when the product is free, you are the product. Nowhere is this truer than online. Those with less disposable income are prone to having data leveraged in a more aggressive and potentially predatory fashion. Moreso than those who are affluent. Under previous lax data regulation, the robust flow of third-party data meant that advertisers could know with near-certainty the sort of online users that might be vulnerable to risky purchase propositions. In other words, they could target and exploit weak consumers with impunity.

A recent New Republic article highlighted some of the industries that are engaged in predatory online advertising practices. Among the culprits are bookmakers, payday loan companies, and for-profit colleges. It cites author Cathy O’Neil’s claim in the book Weapons of Math Destruction. “A potential student’s first click on a for-profit college website only comes after a vast industrial process has laid the groundwork.”

Advertisers can use anything from Google search history to educational questionnaire data. It data used to target individuals at their moment of peak susceptibility. It’s not that advertisers couldn’t use these techniques to target more affluent consumers. It’s that more affluent consumers are less driven to make such risky purchases, which get often borne from economic desperation. Furthermore, poorer consumers are more likely to have their information washing around ad-targeting databases. It’s because they’re more likely to fork over data for free access. The net result is, in the words of Michael Fertik, “the rich see a different internet than the poor.”

Higher Standards of Privacy

Through this lens, one begins to understand the impact of recent and forthcoming data regulation. It’s not a flat line across classes. It should work to disproportionately decrease the vulnerability of poorer online consumers. Especially because they are the most vulnerable to exploitation in the first place. Governments will continue increasing control over the use of data, and there will be the decreasing ability of companies to license third-party data without consumers’ knowledge. Combine both of those with increased penalties for data processors that violate their rights, and consumers will be less susceptible to predatory advertising and more in control of the data that they hand to companies.

Of course, no one assumes that new data regulation will magically turn profit-seeking enterprises into virtuous pursuers of the highest common good. However, we at Ethyca believe that organizations showing commitment to a higher standard of privacy protection will be rewarded in the long run by increasingly data-savvy consumers. With this in mind, beyond legally-required data practices, we recommend that companies make an effort to spell out all the data processing activities that they undertake on owned properties – to actively educate, in other words. Here at Ethyca, we settled on a “Nutrition Table”-style visualization that we think is crisp and instructive. Got a better idea to keep users informed? Feel free to describe in the comments! 

Published from our Privacy Magazine – To read more, visit privacy .dev