Magazine menu Close Magazine menu

Search results

Showing 23 results

global regulations

INFOGRAPHIC: How GDPR changed the world, and privacy regulation’s future

  • Digital transformation
  • min read
    • One piece of regulation has never before had such global impact as the EU Global Data Protection Regulation (GDPR.) It's firmly established data privacy in the public mind, giving extensive and unassailable rights and affecting behavior well beyond the EU's borders. GDPR legislation was a pioneer that other regions followed. The California Consumer Privacy Act (CCPA) came into force in 2020. The more expansive California Privacy Rights Act (CPRA) will replace it in 2023. While there is no federal nationwide data protection law in the US, all fifty states have regulated data safeguarding, disposal and breach disclosure. US data privacy is pointing towards giving consumers more rights. Africa and Asia, with few exceptions, have a way to go in privacy regulation. It may be fair to say data protection regulation follows economic and political development. But China has a different focus. Having enacted strong privacy regulation, it's regaining control of local Big Tech, starting with corporate dismemberment of Alibaba. It aims to control the massive amounts of data held by Chinese companies that may list overseas. New consumer expectations of data privacy GDPR and other regulations worldwide have raised awareness of privacy issues. There's a gap between what customers want and what businesses think customers want in their digital experience. Businesses think it's profiles (for example, offering relevant suggestions,) live help and price-matching. But consumers prioritize rewards, free shipping and data protection. Forced innovation is also good innovation Data protection is now front of mind for everyone. Many once saw security regulations as an innovation inhibitor adding friction to the customer experience, but now they're customer experience's new best friend. With today's cybercrime landscape, data protection has never had so much focus, driving the need for strong authentication. 3-D Secure is a great example. Ecommerce businesses saw the first version of 3-D Secure as an important tool for tackling fraud, but also the main culprit for customers not completing checkout. But the same businesses are finding the latest version, which includes new security features like biometrics, highly attractive for easier authentication across the whole customer experience. 3-D Secure's latest iteration links with new EU regulation's authentication requirements. Privacy expectations impact on cybercrime The COVID-19 pandemic has sped up changes in digital consumer behavior like never before. Security and fraud risk increased, triggering more stringent regulation. Ransomware gangs try to extort money from victims by encrypting their data, but also releasing it if the ransom isn't paid, adding data privacy insult to injury. Nations are stepping up to address ransomware, now the world's biggest cyberthreat. But it's early days. Attempts to reduce ransomware risk are sometimes surprising with little consensus on how to address it, like US proposals to make ransomware payments tax-deductible or, conversely, making paying a ransom illegal. Once a profitable niche, cyber insurance now struggles to stay afloat with increasing ransomware and skyrocketing demands. Emerging trends in data regulation and oversight Data protection and privacy regulations are now part of life. We also see several emerging trends. For example, increased data protection and privacy oversight; in the three years since GDPR, nearly half of UK businesses have been reported to the Information Commissioner's Office over breaches. With longstanding data breach disclosure laws in the US, a new bill could force businesses to report breaches faster. India has long deliberated its Personal Data Protection Bill (PDP.) We're also seeing financial and security regulations aligning. Financial services regulations now include extensive obligations overlapping with security. Penalties are no longer the sole domain of national data protection authorities but could come from any regulator. UK's Financial Conduct Authority fined Tesco Bank 16.4 million pounds sterling for failing to protect customers' accounts and not doing enough to prevent financial crime. And we see increased desire to control Big Tech. The most notable example started in China with Alibaba in 2019. New Chinese data protection regulation has more scope for oversight, as we saw with the crackdown on ride-hailing service Didi and others. China perhaps sees its companies listed overseas as a national security risk because foreign governments could scrutinize the massive amounts of data they hold. But there are other risks: Several shareholders sued Didi since their share price fell after regulatory crackdown. It's not just China wanting to rein in Big Tech and their data – security concerns led to Germany's data protection commissioner telling government organizations to shut down their Facebook pages. UK's draft Online Safety Bill proposes a new Big Tech oversight body to help tackle illegal and harmful online content. Another trend is increasing regulatory oversight of start-ups, especially in fintech. Stock trading app Robinhood must pay 30 million US dollars to the New York State regulatory body for cybersecurity and anti-money laundering failures. The Swedish financial regulator is investigating buy-now-pay-later firm Klarna for data privacy breaches. Coming soon: The data regulation to prepare for Data regulation laws are often challenged. In Europe in 2020, the Schrems II judgment invalidated Privacy Shield, the data-sharing mechanism between the EU and the US. Austrian activist Max Schrems scored a major win as his case questioning Facebook's legal basis to collect data was referred to the EU Court of Justice. Trump's US attempt to ban TikTok and WeChat shows this isn't confined to the EU. India's Reserve Bank banned Mastercard from issuing new credit and debit cards for not keeping to local data storage rules. Three years since GDPR came into force, regulators aren't standing still. In April 2021, the EU Commission published a draft proposal to regulate artificial intelligence in line with GDPR. With increased automation globally, this is one area to watch.
insight story ai machine learning

Customer wins from AI require strategy, not just investment

  • Data and privacy
  • min read
    • There was a time when artificial intelligence (AI) had a menacing ring, but things have moved on. Chat GPT and generative AI apps are creating new roles or making some skills and careers obsolete, depending on who you listen to. Meanwhile, we see its benefits every day, like finding efficiencies and automating repetitive tasks. AI could soon be essential to most businesses. But it's not always clear how to use it. Kaspersky's new podcast, Insight Story unpacks emerging tech trends with global specialists and businesses successfully using the tech. In Episode 5, I speak with AI expert Dr. Romesh Ranawana (Sri Lanka,) customer loyalty consultancy Truth CEO Amanda Cromhout (South Africa) and Fabio Assolini, Head of Research in Latin America for Kaspersky's Global Research and Analysis Team. We examine how business should approach AI and machine learning to make the most of the opportunity while staying secure. Understanding what's meant by AI Romesh says we normally mean something more specific when we talk about AI. "All technology – be it Alexa, your car or washing machine – uses algorithms. An algorithm outputs something when you input something. For problems too big or hard to solve with software, a particular type of AI – machine learning – offers a new way to build algorithms, instead of a programmer writing lines of code." And this kind of AI is everywhere. "We hear much about how it's changing e-commerce and video streaming, but nearly every industry uses AI – from healthcare to retail to factories. Many of the biggest brands, like Amazon and AirBnB, owe their success to it." AI in customer loyalty Customer loyalty programs have long used AI to target customers with more relevant, personalized offers. Amanda's company Truth specializes in these. "Data is fundamental to customer loyalty programs. Everything we know about a consumer – whether the information they give or gained through transactions – has proven power." UK grocery outlet Tesco's Clubcard was one of the first schemes of its kind, with some 20 million members today. Amanda says their approach to data was groundbreaking: "Every quarter, Tesco sent out thank you vouchers with a small discount on your next shop. The vouchers were relevant to what you bought, and no set was the same." "It's a value exchange," says Amanda. Customers give their data because of what they get out of it. "Sometimes companies ask members or customers for data less overtly. Financial institutions may offer a reward to answer a questionnaire, creating a profile of your financial needs and propensity to borrow. They're paying so they can get a higher response rate to sales. If done well, it's win-win." Recent research, Global Data Privacy: What the Consumer Really Thinks 2022, found discounts and freebies were in the top three reasons consumers share data with brands. Amanda also thinks some companies confuse using data well with hard-sell. "They're not thinking through the value proposition. The younger generation especially knows their data's worth. They're asking, 'What am I going to get for that?'" Keys to success with AI Most companies investing in AI aren't getting immediate results. MIT research found only three in 10 companies investing in AI are getting a return on their investment. Who succeeds depends on how they approach it, Romesh says. He thinks why you're doing it matters too – it should be about changing how the company does business, not simply making savings. "If you look at AI as a way to automate what you do now, you'll get reduced costs but not much benefit. You need to mesh AI and people in your organization to generate value, so they're learning from each other." Amanda adds, "Many companies want to flick a switch and, in two hours, make it happen. They don't understand it has to be a strategic driver for the business." Romesh and Amanda both highlight good-quality training data as a critical success factor. Romesh says, "Customers and their behaviors change – what you train today may not be relevant in a week's time. AI systems must be continuously trained on real-time, up-to-date data. Companies need data collected continuously kept in a single space – we call it 'the data lake.'" Amanda also believes the C-suite must support an AI strategy, even lead it. "It doesn't start with marketing executives wanting to do this – it starts at the top, with the CEO and the board." But they shouldn't expect too much, too soon. "The leaders of any company must understand it's an ultramarathon, not a sprint." Romesh notes it's becoming possible for more people to work with AI. "AI systems are still complicated. It takes knowledge, data engineering and software skill. Over the last few years, more tools have come out – low-code or no-code tools – making AI more accessible to more people." How AI is changing cybercrime AI didn't need to be more accessible for cybercriminals to use it, which has implications for business. In research with Kaspersky's Global Research and Analysis Team, Fabio Assolini has seen several applications of AI in cybercrime. "AI is helping cybercriminals bypass new authentication methods. Some financial institutions and banking apps use biometric authentication, where the user must look to the right, to the left and smile. We've seen cybercriminals using AI tools to do this with only a victim's photo." How businesses should respond isn't straightforward – they need to identify more fraudsters while not misidentifying too many customers. "You can fine-tune authentication methods to better identify fraud attempts, but you may get many false positives. It's a balance," says Fabio. Fabio recommends businesses ensure AI training data is ethically gathered and complies with privacy regulation in countries they distribute to. "Some free apps for adding special effects to pictures collect and sell data sets for training AI. There's a privacy issue, especially in Europe with GDPR, but sometimes those collecting the data are in parts of the world without privacy restrictions." To comply with GDPR, AI systems that use personal data must be developed, trained and deployed with a clear objective determined at the design stage. It must be legitimate and compatible with the organization's goals. AI's future in business Amanda stresses the need for brands to understand what their data really means about every human behind it. "Data scientist Dr. Shorful Islam says, at the end of every data point is a human being we're trying to persuade to do something differently, or trying to make their engagement with a brand more pleasurable, or whatever the desired outcome. So you've got to think about behavior more like human beings, rather than robots." Romesh sees AI leading to powerful change in consumer behavior. "We're buying things we'd never have bought before because companies are pushing them to us. Amazon reports 35 percent of its revenue comes from recommendations." And those features will only get cleverer. "Systems will become more powerful because they'll have more data feeding in." Listen to the full Insight Story audio series on Podbean or your usual podcast provider.

Could this voluntary charter fix data ethics in big tech?

  • Digital transformation
  • min read
    • We know some people and businesses will, given the chance, use personal location data in unethical ways. When automotive cybersecurity experts Karamba Security posted a fake vehicle control unit online, they saw 25,000 attempted breaches in three days. Stalkers have used AirTag, Apple's coin-sized device for finding lost keys or other property, to track victims. Regulations like the EU's General Data Protection Regulation (GDPR) define minimum standards of data ethics, but the case for going further is strong. To that end, what can help those tech businesses who want to stay ahead of the data exploitation curve by upholding the highest data ethics standards? Learning to foresee the unforeseen International non-profit the Locus Charter promotes a higher standard of responsibility for professionals and businesses when it comes to location data. They want to avoid unforeseen privacy breaches by working out what can go wrong and pinpoint big problems before they're exploited. They champion public interest by showing businesses how to prevent unintentional harm. The charter is based on ten principles that balance moral behavior with economic benefit, like realizing opportunities and understanding impacts. Location data is one of many frontiers. As veterans of data policy in and out of government, the charter's founders want to be part of all kinds of data discussions. Automation challenging data ethics "The most important focus in data ethics is exploring the power granted by the accumulation of data so everyone can recognize how that power can be used and misused," Ben Hawes, Technology Policy Consultant and co-author of the Locus Charter, told me. He continues, "There's an assumption automated systems and digital technologies are always better. Economic pressures mean companies prefer the promise of greater productivity at all costs, which can be alarming when people are unaware of many potential data misuses, accidental or deliberate." "Some risks in business going digital crop up in all sectors," said Hawes. "We often see 'designer biases,' where developers center their own experiences, leading to alienating people who don't fit the same racial, economic or physical profile. Another issue is automation making back-end processes more complex until they're opaque. There are also sector-specific issues." With the digital world's size and potential, regulating the space is an uphill battle. New ways to exploit data are appearing faster than lawmakers can address them. Is self-regulation enough? Hawes doesn't support a relaxed approach to data ethics. "It's unwise to avoid oversight and critical regulation in the hope self-regulation may be enough, as it rarely is." A 'wild west' model is attractive for short-term gains by freeing emerging markets from red tape, but loose protections don't create conditions for long-term growth or stable markets, especially in an age of social pressure on brands to be ethical. Can whitewashing be cleaned up? With limited regulative authority, a non-profit trade initiative likely isn't eager to bicker with companies they're working with. Organizations like Locus may be better placed, approaching economic ethics from a collaborative angle. Of course, some companies are only interested in the PR boost of appearing ethical by whitewashing their marketing because they don't want to be the only ones following the rules in a competitive arena. They end up paying lip service alone, without taking the issues seriously. Hawes thinks despite this, there's still benefit in working in good faith. "To get ethically reluctant companies to behave well with data, is it better to give them the benefit of the doubt or be critical and accusing? I think, better to have a company aspire to a good standard, even if it's empty promises, because they can at least be held to those standards in some way." Less direct ways of influencing A cooperative strategy may create the best conditions in a self-regulating atmosphere. When ethics groups collaborate with business, they influence thousands of staff members, creating internal pressure for higher standards in the boardroom. It's also worth championing an ethical company for consumers looking to do the right thing with their money. Though strategies like these can't do it all, they have worked, motivating large companies to produce net-carbon zero plans and banks to create green investment options. But data misuse is not the same as pollution. "It's harder to see and analyze compared with other high-profile scandals, so it's hard to translate into a common grievance that can unite people," says Hawes. Will something have to go badly wrong for the world to take it seriously? Hawes considers, "If authorities avoid developing solutions until a problem causes substantial harm, they'll still need about a decade to develop tools that would be effective in this complex market. Governments should be working on this yesterday." In other words, have a fire extinguisher ready when playing with matches, rather than trying to invent one as your house burns down. Reforming data use culture The task of reforming fast-evolving data industries is daunting. Hawes' recommended method involves slowly, steadily establishing ethical practice as the norm. "The UK has the Digital Regulation Cooperation Forum for sharing information and approaches. It lets regulators gain knowledge of the risks data and digitalized business generate, so they can manage them sector by sector. We need a forum like that on an international scale," says Hawes. "Understanding risks like explainability, transparency and bias creates a foundation for building standards that address the problem and brings stability to the data economy." This pressure can also come from outside industry, and often flavors the expectations that filter into business. "More public debate on how we can avoid driving digital inequalities would go a long way," says Hawes. "This is particularly important in social media, which is the frontline of data ethics in many ways." While data privacy issues haven't seen the emphasis Hawes and his peers would like, they're eager to change the culture. Business can choose to be part of the solution and be heralded as ethical data use champions for their efforts.
Proglove digital twin

How digital factory clones are bringing new efficiency to industry

  • Artificial intelligence
  • min read
    • Tech entrepreneur Elon Musk thinks robots could do any job better than humans. And according to US billionaire investor Warren Buffet, automation replacing humans is no bad thing. Whether you agree or not, today, we're a long way from robots replacing humans in manufacturing. But factories are increasingly using smart technology to boost speed, improve quality and reduce waste. The shift is so important that this new era of connected, intelligent factories has a nickname: The fourth industrial revolution, or Industry 4.0. Ilhan Kolko, chief product officer at German-based smart factory tech firm ProGlove, doesn't see robots replacing humans anytime soon. He thinks future factories will involve machines collaborating with people for faster, safer manufacturing. "It's not a competition between humans and machines," says Kolko. "But any technology that augments human beings and helps us make better decisions in the industrial setting will take the driver's seat." Digital process copies help identify potential improvements Kolko thinks human-machine collaboration – blending human thinking and action with machine capabilities – will be at the heart of a post-COVID industrial renaissance. One technology ProGlove sees as leading the way is the human digital twin. A human digital twin is a digital clone of a manufacturing process, object or an entire environment in near real-time. Industry uses these twins to optimize business performance. A global professional services consultancy Accenture 2021 survey of over 6,000 IT and business executives found nearly two-thirds think their organization will increase investment in digital twins in the next three years. Among other sources, digital twins rely on data collected by smart technologies like internet of things (IoT) devices. Companies use the data to improve their manufacturing processes and even product design. ProGlove's products add new data points to manufacturing's digital twins: Human motion and tasks. They feel this extra data builds a next-level digital twin. "The human digital twin makes the workers' motions virtual and combines it with the data from tools and machinery on the factory or warehouse floor," Kolko explains. "We want to enrich the environment the person operates in with more context, so you can analyze everything happening on the shop floor." Wearables speed up processing and improve safety Founded in 2013 and now employing 200 people from 30 countries, ProGlove makes wearable, connected barcode scanners for industries from retail to transport. World Economic Forum named ProGlove as one of 100 technology pioneers for 2020. Their wearable scanners are designed to be small, lightweight and fast. Workers wear the scanner on their wrist so they can scan a part or product hands-free. It takes two seconds, compared with six seconds for a handheld scanner. Seconds add up when someone scans thousands of pieces a day. Customers of distribution center workflow designers Procensis are among ProGlove's users. "ProGlove lets them work faster without more effort and improve accuracy and safety, being hands-free. It also reduces distractions," says Ed Kennedy, Procensis founder and chief executive. Workers who wear ProGlove can keep their eyes on their task. "It's little different than wearing a watch and weighs about the same." ProGlove has added software that gives customers insight using machine learning models and data analytics. They're seeing significant gains: A parcel customer minimized worker movement by 25 percent while keeping performance the same and an airline reduced flight delays by 15 percent just by standardizing catering tray preparation. "As we collected human motion data and data around the tools workers use while picking, sorting, and assembling components, and time spent on activities, we realized we can add more data points, like machine data," says Kolko. How the human digital twin works ProGlove scanners already collect human motion data like step count and downtime. It can identify which tools a worker uses based on acceleration data points. The scanner's camera picks up other data points about processes and information from items' barcodes. Customers already use this data to optimize processes, whether to redesign the shop floor or improve productivity. The scanners can connect with WiFi, ethernet and Bluetooth, meaning they can interact with other shop floor systems – from mobile devices to wireless keyboards to IoT sensors. Kolko explains, "It's like seeing everything as if you were there, sat next to a worker or following them on the assembly line." Device security and worker privacy Cybersecurity has long been a concern for industrial IoT. Kolko says it's slowed down the adoption of technology like digital twins. "Logistics and manufacturing ideas like digital twins are now almost a decade old, but a big reason some aren't in common use are security concerns." To address these concerns, ProGlove built protections into its software, like encryption of data in the cloud. They allow integration with customers' existing security protocols like network segmentation or secure connectivity. In the age of data regulation such as the EU's General Data Protection Regulation (GDPR,) privacy concerns are also high on the agenda. Kolko says they anonymize ProGlove's data when it leaves the scanner and becomes process data for the analytics software. The end goal: AI-driven process optimization The human digital twin can be applied in many industries. Healthcare could use digital twins to simulate treatments before giving them to patients. It may be some time before the technology is robust enough for that, but Kolko thinks manufacturing is closer to implementing it widely. The main benefit for industry is allocating resources more efficiently. Kolko says a typical facility collects trillions of data points. The digital twin consolidates the data then interprets it. This is where AI comes in: Finding patterns and anomalies in processes. Today, facility supervisors who receive the insights must still translate them into processes that mean productive changes. ProGlove wants to move from enabling micro-efficiencies to true AI-enabled optimization in the next two to three years. "We're expanding our software capabilities. I see the next-generation product being able to solve optimization problems on its own," says Kolko. Industry's future is close That same 2021 Accenture survey found 63 percent of executives thought that since the COVID-19 pandemic, the pace of digital transformation in their organization is hotting up. Accenture identified digital twins as one of 2021's transformative technologies to watch. Kolko also sees the signs companies want to make their workflows, environments and workforces smarter. "In the post-COVID world, everyone wants to build resilience and make their processes futureproof," he says. The key thing, he thinks, is to make sure people aren't competing with machines but feel part of a collaborative environment. Luminaries like Musk and Buffet may be right that robots can do many things better than humans, and that's no bad thing. But the intelligent, automated factory of the future will still have an efficient human crew. The human digital twin may build a bridge between humans and machines, but humans will still be essential in solving human problems.

Should corporations take action for democracy?

  • Leadership
  • min read
    • Democracy defenders around the world face an uphill battle in fighting for freedom, human rights and democracy. The 2021 Freedom in the World report from non-government organization (NGO) Freedom House found authoritarian rule increased in 2020. In many countries, leaders used the pandemic as an excuse to clamp down on protests and other organizing. Then, on January 6, 2021, thousands stormed the US Capitol Building, hoping to stop Joe Biden being sworn in as the 46th US president. Five people were killed. One thing that came next was perhaps a little surprising, historically speaking. Many businesses and CEOs across the US quickly condemned the attack. "The chaos unfolding in the nation's capital is the result of unlawful efforts to overturn the legitimate results of a democratic election," Business Roundtable said in a statement on the day of the attack. "The country deserves better. Business Roundtable calls on the President and all relevant officials to put an end to the chaos and facilitate the peaceful transition of power." Statements like this are part of a growing movement of business leaders acting to preserve and strengthen democracy. After decades of the prevailing view from economists like Milton Friedman being "the business of business is business" — meaning corporations shouldn't get involved in political or social issues — are the winds changing? And should they? Trust in business runs high Edelman's 2021 Trust Barometer found business is now the US's most trusted institution. Business achieved a 61 percent trust rating, ahead of government on 53 percent and the media at 51 percent. Edelman also reported 86 percent of respondents expect CEOs to speak out about social and political issues. 68 percent say CEOs should step in when the government doesn't fix society's problems. What would this look like in practice? In 2017 Patagonia, a global retailer specializing in outdoor clothing and accessories, pushed back against federal government administration efforts to allow oil and gas drilling on publicly owned land and reduce numbers of national parks. Its public lands campaign included a documentary, petitions and encouragements to contact elected officials. The Leadership Now Project was founded by a group of Harvard Business School alumni to bridge the gap between business and politics, aiming to strengthen US democracy. Co-founder and CEO Daniella Ballou-Aares says divisions and political issues are too important for businesses to ignore — especially when business trust is high. Leadership Now is one of several groups guiding business leaders who want to engage in democracy-related issues. Civic Alliance and Business for America help businesses advocate for voting rights and ensure company policies give employees time to vote and take part in civic activities. Ballou-Aares said the pandemic increased trust in business. Workers across sectors looked to their employers for safety guidance in and out of the workplace. Leadership Now sees this shift as a chance for companies to show support for democracy. But actions like those Leadership Now proposes can backfire if corporate spending also seems to support people or causes seen as anti-democratic. A panel at the Stanford University School of Business Conference on Corporations and Democracy in December 2020 addressed these potential pitfalls and advised on how to avoid them. "This is a risk-management issue. Corporate boards have a [trust] responsibility to manage risk, and set the policies that govern what the companies are doing politically, ensuring the company is not put at risk," Bruce Freed, President of Washington, D.C.-based Canter for Political Accountability, said during the panel. In some cases, supporting democracy can also be good for the bottom line, as Hong Kong's yellow economic circle showed in 2020. As the pandemic restricted pro-democracy demonstrators from taking to the streets, protestors turned to supporting restaurants and other businesses that had pledged support for democracy. "We might not be able to come out and protest, but supporting yellow shops in our daily life is something everyone can do," democracy advocate Mary Ma told Reuters in May 2020. Businesses may have trust from citizens but entering political conversation still involves risk. Leadership Now, Civic Alliance and Business for America recognize the pressure leaders face and work to build coalitions that can take advantage of strength in numbers. "Companies are nervous about being seen as political actors, even if that's what they are," Ballou-Aares said. "We have a coalition of companies and associations setting some minimum standards around what support for democracy demands and looks like in practice." From surveillance capitalism to humane technology As businesses think about how to become involved in supporting democracy, they're also stepping back to consider how they might have contributed to growing polarization and a technological environment that allows false information to flourish. In her book, The Age of Surveillance Capitalism, Harvard professor and social psychologist Shoshanna Zuboff argues social and digital advertising are used to manipulate consumers and prioritize maximum profits over democracy, freedom and human nature itself. Zuboff's book and 2020 Netflix documentary The Social Dilemma argue social media has turned consumer attention into a product. Companies buy that attention with hyper-targeted digital advertising, using information collected by social platforms and tracking cookies to serve content that keeps people on these sites longer. And what keeps us glued to social channels isn't necessarily what's accurate nor in the interests of our human rights. Many countries are now pushing back with regulation, like EU's General Data Protection Regulation (GDPR) and Australia's efforts to make Facebook and Google pay news publishers for content. But there's more needed to move away from the model. Could businesses be the right entities to lead the way? Ethan Zuckerman, Associate Professor of Public Policy, Communication and Information at University of Massachusetts and Founder of Institute for Digital Public Infrastructure, says businesses sometimes act in ways governments can't or won't. For example, after the 2018 shooting at Marjory Stoneman Douglas High School in Parkland, Florida, students unsuccessfully tried to lobby Florida's legislature to change gun regulations. They found more success pressuring companies like Dick's Sporting Goods and Wal-Mart to stop selling military-grade weapons. "Employees care about businesses, and they're exempt from traditional left-right politics," Zuckerman said. "In this information vacuum, business drives the narrative." Businesses taking a bolder stance on social and political issues can also be a competitive advantage for recruiting, particularly among younger generations who want to work for a company that shares their values. LinkedIn's 2018 Workforce Culture Trends report found 86 percent of Millennials and 71 percent of all professionals would consider a pay cut to work for such a company. Zuckerman points to Salesforce using this dynamic to its advantage by focusing on responsible use of technology and stakeholder capitalism: Prioritizing employees and customers over shareholders. "I wonder if we'll see more corporations standing up and fighting for social values, making it possible for employees to organize, and affirmatively committing to diversity," Zuckerman said. Future ethics and empathy Whether you support democracy or advocate for responsible technology practices, taking the plunge into activism at work should not be taken lightly. It needs strong empathy and ethics. Neither are on most computer science and engineering curriculums, so businesses should find ways to educate employees. Sarah Drinkwater, Director of responsible technology at Omidyar Network, pointed to its Ethical Explorer as a starting point to learn to identify problem behavior in your organization, find opportunities to discuss and design solutions. Drinkwater was an academic before working as a journalist then moving into the tech world. She led Google's Campus London before joining Omidyar Network. Knowing how both scholars and business leaders think, she feels their disconnect keenly. "Business and academia don't speak the same language," says Drinkwater. "The ability of business to positively impact society is huge, but many tech workers have only come to these conversations in the past few years. Scholars have been thinking about them since they were undergraduates." Drinkwater goes on to say, "The Ethical Explorer tool is meant to help people without an ethics background find their way into these conversations. Teams can take what comes of this conversation and make change." Ballou-Aares recommends business leaders who want to become more civically engaged start locally, where resources are often stretched, and officials need technology and cybersecurity expertise. "Business can play a role in tackling disinformation and voter participation," she says. Pushing back against authoritarianism Stanford University political scientist Larry Diamond, an expert on authoritarian efforts to undermine democracy, argues business worldwide can play a role in fighting kleptocracy. Supporting independent journalists and NGOs working to expose corruption and pushing back against authoritarianism would be a good start, Diamond believes. "The best defenses against kleptocracy are usually found in countries where it originates. It demands more than rewards for a few daring whistleblowers. We need to do much more to support the frontline defenders of the global rule of law," Diamond writes. He gives the International Consortium of Investigative Journalists, the coalition of 267 investigative reporters that broke the Panama Papers story, as an example of an organization businesses could support. The public's trust in business can back tough decisions around giving information to customers and employees. "We've seen Facebook get way more comfortable with countering misinformation and disinformation," Zuckerman said. "A key moment was around pandemic information… there wasn't a ton of hand-wringing about freedom of speech. I'm curious to see if that continues." Drinkwater also pointed to Facebook's oversight board and statements by the Business Roundtable as steps in the right direction. But the C-suite (senior management) needs to be on board with action, or it will seem more like PR than a genuine attempt to make democracy work. "Smart CEOs have read the tea leaves and are asking the right questions about what role they will play in democracy," says Drinkwater. "But these decisions need a high level of intent and care. CEOs need to care about their decisions to make an impact."
unexpected data collection

The one data privacy principle no one talks about

  • Data and privacy
  • min read
    • Let's say there's a short form on your organization's website visitors use to sign up to receive company news. They're asked to give their name and email address. One day, you hear colleagues in marketing are going to add something to the regular company news email those sign-ups receive: Promotions of partner companies' products. Are your data protection alarm bells ringing? They should be, but if they're not, you're not alone. Purpose limitation is a data security principle many are unfamiliar with. Understanding it will help you reduce data security and data privacy risks and show your customers you respect their data. What is purpose limitation? Purpose limitation has two parts. First, when you gather anyone's personal information, your organization must be clear about how it will use the information from the start. Second, you must not use the data for another purpose. Much data protection regulation around the world includes some kind of purpose limitation requirements, notably the EU's General Data Protection Regulation (GDPR.) Under GDPR, organizations must document the data's purposes and specify the purposes in the privacy information they supply. But why does purpose limitation matter? Surely if someone chooses to give their data, your organization can use it without limit as long as you keep it private? Not so fast. This is one tin of spaghetti that fast turns into a can of worms. The young woman, the chaplain and the hospital Some privacy trainers tell a story about a young woman who was asked to fill in a form when she was admitted to hospital. One question on the form is asking for her religion. Perhaps this information is important in medical care and she's been asked this question on forms before, so she dutifully fills in her religion as she always has. Why the question? This hospital uses the information to tell the hospital chaplain there's a patient who may appreciate a visit, but they don't tell the patient this. Small world – the hospital chaplain is a friend of the young woman's family. She is unmarried and is in hospital for a pregnancy-related issue. Her family doesn't know she's pregnant and she has no intention of telling them. Now, the young woman and the chaplain are in an awkward position. Apart from infringement of data use regulation, some might say the woman had free choice over whether to give the information, so the results are her responsibility. On the other hand, the trust patients place in hospitals is crucial to the hospital being able to achieve its purpose: To help patients get well. Can organizations live up to the trust customers need to place in them? Data recycling happens all too often Several incidents around customers surprised how companies used or sold their data, given why they provided it, have hit headlines recently. Take for example, the period-tracker app that fed customer data to Facebook, where it was used to market products for expectant Moms. One user found herself suddenly marketed to as though she were pregnant, when she'd only forgotten to use the app to log her period. It's easy to imagine how this kind of sensitive information re-use could emotionally harm some customers. In 2017 Uber settled a complaint from the Federal Trade Commission out of court. Part of the complaint included that some employees had used the software's 'God View' function to track the movements of politicians, celebrities and even ex-partners. Although Uber hadn't sanctioned these misuses, it had no effective processes to prevent it. Do companies, and their employees, understand their responsibilities in limiting how they use customer data? Can you recycle personal data? What the law says GDPR is up front on purpose limitation being a core principle of data protection. Article 5 section 1b outlines how personal data must only be collected when its use is specified and explicit. The data cannot be further used in ways that don't match the original purpose. There's exceptions for historic, scientific and statistical uses, and "if the legitimate interests of that controller or a third party override the interests of the data subject." The European Commission gives guidance to help organizations know if what they're planning to do with data is consistent or inconsistent with its purpose. They suggest considering for example, whether the data is sensitive (including health information, political beliefs and more) and how further use could affect the person who gave the data. While penalties for breaching the purpose limitation principle so far haven't been huge, there's been a steady stream of reputation-damaging prosecutions. Norway's data protection authority fined the Norwegian Public Roads Administration the equivalent of 50,000 US dollars for using 'security' cameras to monitor contractors' work. Breaching the principle with just one customer's data doesn't mean lesser fines – Spanish authorities fined bank Bankia the equivalent of 50,000 US dollars for retaining and reusing one customers' data 16 years after they'd stopped being a customer. When considering fines, regulators punish not for violation of principle, but for the consequences. For example, if companies don't comply with data processing purpose limitation, they may also violate other GDPR requirements, such as having a legitimate reason to process the data. It's not just Europe that has enshrined purpose limitation in data use law. California added a purpose limitation clause to their California Consumer Privacy Act (CCPA) in 2018. The clause says businesses must, before collecting personal information, inform consumers how it will be used and need consumer agreement to use the data for another purpose. What do businesses do to meet purpose limitation obligations? "Every organization processes different kinds of personal data, in different ways, for different purposes," says Kaspersky's Head of Data Protection and Privacy for Europe, Alexey Testsov. "GDPR requires data controllers and processors keep records of what data the organization gathers, why they're gathering it and how long it's kept for. Alongside information auditing and data mapping, these records are vital in complying with purpose limitation responsibilities. "Employees must know how to collect, store and use personal data within the law. Given the high risks of data processing, it's more reliable to discuss changes in processes with a security officer or legal department. Employees should know how to consult internal experts and not be afraid to do so." Here are two examples of identified problems that can lead to failures to control data use purposes. Systems to keep data separate Effective safeguards to prevent any set of data being used for other purposes might have avoided some recent cases of data recycling. In the UK, the Information Commissioners' Office (ICO) fined a political campaigning organization and an insurance company 120,000 UK pounds (around 165,000 US dollars.) The ICO found personal information given for political campaigning had been used to market insurance. It highlighted ineffective data protection systems within the two organizations. "Systems for segregating the personal data of insurance customers' from that of political subscribers' were ineffective." Look for changes in how upgraded software uses data Hunter Nelson, President of Tortoise and Hare Software, says software developers should realize the potential privacy impacts of 'function creep.' He advises, "Controllers and processors must use care when developing systems not to breach privacy law as new features are released. A process checkpoint should be included in the release to review new features with a privacy lens." Regardless of the privacy legislation your organization operates under, knowing the importance of purpose limitation will help you uphold high data privacy standards. Ensure that when you ask customers for personal information, they understand how you will use it. Put in place systems to ensure their data cannot be used for other purposes. These actions will show your respect for customers' privacy and help build the trust that every organization needs.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries