The Personal Data Free-for-All

Have you noticed that we’re currently in a time that’s ripe for raising awareness about the importance of our information in the digital world? Perhaps because of the (very) frequent data breaches, the indiscriminate sale of information online as reported by the media, the Facebook/Cambridge scandal, the laws being debated or implemented—well, I’m not sure. Regardless, the important thing is that the time has come, and it’s very welcome.

As a professional in the field of information security and data protection, it has always bothered me greatly to provide my personal information for certain things I wanted or needed to do, whether in the virtual or real world. Sometimes I found it so absurd to provide important information in a given situation that I would even argue with the person requesting it. And in those moments, I realized that these people had absolutely no idea of the risk involved in that simple action. On several occasions, when I asked my basic question—“How can I be sure you’ll protect this information?”—I’d notice that strange look, as if I were an alien, a paranoid person, or just some kind of idiot. “What kind of question is that?” my conversation partner would think. And the truth is exactly this: people are unaware of the risk. What harm could there be in taking your full name, your CPF number, your address, and attaching a photocopy of your ID and proof of residence?—as happened to me at a real estate agency when I went to pick up the keys to an apartment I wanted to view for rent.

There really is a lot of naivety involved in many of these processes, but, on the other hand, we know there’s an entire industry dedicated to the use and sale of information for all kinds of businesses. And the net is closing in on indiscriminate use. After all, who likes being harassed by unsolicited emails, by phone calls when they get home from work, by ads for the running shoes they looked up—now flooding every website they visit—by the manipulation of “their” tastes, desires, and opinions (the Brazilian election!? Brexit!? Trump!?) and, worst of all, the possibility of becoming a “straw man” at a bank or having a debt on some account you have absolutely no idea how or by whom it was opened?

The prevailing culture today is that companies can do whatever they want with the data they collect—often without any real need for the customer’s core business—but we can’t pass up the opportunity to get more information, right? After all, information is power. Pharmacy chains love to collect my data to “offer discounts.” I met someone who said they felt like a hypochondriac after having a health issue and needing to buy several medications. After that, they started receiving a flood of advertisements for pharmaceutical products and medications in every possible way—and even recommendations from friends! It doesn’t seem to me that pharmacies (among thousands of other examples) are being transparent and fair with their customers.

 But what's changing?

If I had to sum up this new awareness in a single sentence, I think the following would work: The data and information collected do not belong to the company; they belong to the customer.. That sums it all up. If the data doesn’t belong to the company but to the customer, I have to explain why and for what purpose I’m collecting it, I have to ensure that I’ll protect it so it isn’t used for any other purpose, and, most importantly, I have to obtain the customer’s permission. Everything else follows from that. And this in no way hinders the work of data scientists, which is in such high demand today. It just makes the process more transparent and fair.

 But is it really changing?

Perhaps not everyone has caught on yet, and because of that, governments around the world are pushing to raise awareness. And it’s becoming law, because the times demand it. It’s a battle between citizens and big corporations, which use tactics such as: “If you want to use this search engine, you must agree to all of our policies.” And keep in mind that, aside from being an abusive condition, you can be sure that not everything they do with our information is actually outlined in those policies. That’s why we need legislation to regulate a situation where citizens could be harmed.

Brazil has been debating its privacy law for some time now and is behind schedule. Some provisions are already included in the Brazilian Civil Rights Framework for the Internet, but they are not enough. In the U.S., there are already some laws on the subject, as there are in other countries. But the key player in this new movement is GDPR – General Data Protection Regulation, a law enacted by the European Community for all its members. Debated, re-debated, and approved in 2016, with an expected effective date of May 2018, it provides for heavy fines, underscoring its serious nature. Europe has taken the lead, and the GDPR will undoubtedly serve as the foundation for the rest of the world. It’s all there. It had the boldness to cover not only European companies but all companies worldwide that operate on the continent or hold data on European citizens. This is the work of leaders who perfectly understood the moment and the need. Privacy is a fundamental right, and we can expect a new culture and the beginning of the end of corporations’ free-for-all with my data, your data, and our data.