Magazine menu Close Magazine menu

GDPR

Latest stories

Person looks down from high building as sheets of paper flutter past with numbers on them

The one data privacy principle no one talks about

  • min read
    • Let's say there's a short form on your organization's website visitors use to sign up to receive company news. They're asked to give their name and email address. One day, you hear colleagues in marketing are going to add something to the regular company news email those sign-ups receive: Promotions of partner companies' products. Are your data protection alarm bells ringing? They should be, but if they're not, you're not alone. Purpose limitation is a data security principle many are unfamiliar with. Understanding it will help you reduce data security and data privacy risks and show your customers you respect their data. What is purpose limitation? Purpose limitation has two parts. First, when you gather anyone's personal information, your organization must be clear about how it will use the information from the start. Second, you must not use the data for another purpose. Much data protection regulation around the world includes some kind of purpose limitation requirements, notably the EU's General Data Protection Regulation (GDPR.) Under GDPR, organizations must document the data's purposes and specify the purposes in the privacy information they supply. But why does purpose limitation matter? Surely if someone chooses to give their data, your organization can use it without limit as long as you keep it private? Not so fast. This is one tin of spaghetti that fast turns into a can of worms. The young woman, the chaplain and the hospital Some privacy trainers tell a story about a young woman who was asked to fill in a form when she was admitted to hospital. One question on the form is asking for her religion. Perhaps this information is important in medical care and she's been asked this question on forms before, so she dutifully fills in her religion as she always has. Why the question? This hospital uses the information to tell the hospital chaplain there's a patient who may appreciate a visit, but they don't tell the patient this. Small world – the hospital chaplain is a friend of the young woman's family. She is unmarried and is in hospital for a pregnancy-related issue. Her family doesn't know she's pregnant and she has no intention of telling them. Now, the young woman and the chaplain are in an awkward position. Apart from infringement of data use regulation, some might say the woman had free choice over whether to give the information, so the results are her responsibility. On the other hand, the trust patients place in hospitals is crucial to the hospital being able to achieve its purpose: To help patients get well. Can organizations live up to the trust customers need to place in them? Data recycling happens all too often Several incidents around customers surprised how companies used or sold their data, given why they provided it, have hit headlines recently. Take for example, the period-tracker app that fed customer data to Facebook, where it was used to market products for expectant Moms. One user found herself suddenly marketed to as though she were pregnant, when she'd only forgotten to use the app to log her period. It's easy to imagine how this kind of sensitive information re-use could emotionally harm some customers. Uber settled a complaint to the Federal Trade Commission out of court when it was found employees had used the software's 'God View' function to track the movements of politicians, celebrities and even ex-partners. Although Uber hadn't sanctioned these misuses, it had no effective processes to prevent it. Do companies, and their employees, understand their responsibilities in limiting how they use customer data? Can you recycle personal data? What the law says GDPR is up front on purpose limitation being a core principle of data protection. Article 5 section 1b outlines how personal data must only be collected when its use is specified and explicit. The data cannot be further used in ways that don't match the original purpose. There's exceptions for historic, scientific and statistical uses, and "if the legitimate interests of that controller or a third party override the interests of the data subject." The European Commission gives guidance to help organizations know if what they're planning to do with data is consistent or inconsistent with its purpose. They suggest considering for example, whether the data is sensitive (including health information, political beliefs and more) and how further use could affect the person who gave the data. While penalties for breaching the purpose limitation principle so far haven't been huge, there's been a steady stream of reputation-damaging prosecutions. Norway's data protection authority fined the Norwegian Public Roads Administration the equivalent of 50,000 US dollars for using 'security' cameras to monitor contractors' work. Breaching the principle with just one customer's data doesn't mean lesser fines – Spanish authorities fined bank Bankia the equivalent of 50,000 US dollars for retaining and reusing one customers' data 16 years after they'd stopped being a customer. When considering fines, regulators punish not for violation of principle, but for the consequences. For example, if companies don't comply with data processing purpose limitation, they may also violate other GDPR requirements, such as having a legitimate reason to process the data. It's not just Europe that has enshrined purpose limitation in data use law. California added a purpose limitation clause to their California Consumer Privacy Act (CCPA) in 2018. The clause says businesses must, before collecting personal information, inform consumers how it will be used and need consumer agreement to use the data for another purpose. What do businesses do to meet purpose limitation obligations? "Every organization processes different kinds of personal data, in different ways, for different purposes," says Kaspersky's Head of Data Protection and Privacy for Europe, Alexey Testsov. "GDPR requires data controllers and processors keep records of what data the organization gathers, why they're gathering it and how long it's kept for. Alongside information auditing and data mapping, these records are vital in complying with purpose limitation responsibilities. "Employees must know how to collect, store and use personal data within the law. Given the high risks of data processing, it's more reliable to discuss changes in processes with a security officer or legal department. Employees should know how to consult internal experts and not be afraid to do so." Here are two examples of identified problems that can lead to failures to control data use purposes. Systems to keep data separate Effective safeguards to prevent any set of data being used for other purposes might have avoided some recent cases of data recycling. In the UK, the Information Commissioners' Office (ICO) fined a political campaigning organization and an insurance company 120,000 UK pounds (around 165,000 US dollars.) The ICO found personal information given for political campaigning had been used to market insurance. It highlighted ineffective data protection systems within the two organizations. "Systems for segregating the personal data of insurance customers' from that of political subscribers' were ineffective." Look for changes in how upgraded software uses data Hunter Nelson, President of Tortoise and Hare Software, says software developers should realize the potential privacy impacts of 'function creep.' He advises, "Controllers and processors must use care when developing systems not to breach privacy law as new features are released. A process checkpoint should be included in the release to review new features with a privacy lens." Regardless of the privacy legislation your organization operates under, knowing the importance of purpose limitation will help you uphold high data privacy standards. Ensure that when you ask customers for personal information, they understand how you will use it. Put in place systems to ensure their data cannot be used for other purposes. These actions will show your respect for customers' privacy and help build the trust that every organization needs.
global regulations

INFOGRAPHIC: How GDPR changed the world, and privacy regulation’s future

  • min read
    • One piece of regulation has never before had such global impact as the EU Global Data Protection Regulation (GDPR.) It's firmly established data privacy in the public mind, giving extensive and unassailable rights and affecting behavior well beyond the EU's borders. GDPR legislation was a pioneer that other regions followed. The California Consumer Privacy Act (CCPA) came into force in 2020. The more expansive California Privacy Rights Act (CPRA) will replace it in 2023. While there is no federal nationwide data protection law in the US, all fifty states have regulated data safeguarding, disposal and breach disclosure. US data privacy is pointing towards giving consumers more rights. Africa and Asia, with few exceptions, have a way to go in privacy regulation. It may be fair to say data protection regulation follows economic and political development. But China has a different focus. Having enacted strong privacy regulation, it's regaining control of local Big Tech, starting with corporate dismemberment of Alibaba. It aims to control the massive amounts of data held by Chinese companies that may list overseas. New consumer expectations of data privacy GDPR and other regulations worldwide have raised awareness of privacy issues. There's a gap between what customers want and what businesses think customers want in their digital experience. Businesses think it's profiles (for example, offering relevant suggestions,) live help and price-matching. But consumers prioritize rewards, free shipping and data protection. Forced innovation is also good innovation Data protection is now front of mind for everyone. Many once saw security regulations as an innovation inhibitor adding friction to the customer experience, but now they're customer experience's new best friend. With today's cybercrime landscape, data protection has never had so much focus, driving the need for strong authentication. 3-D Secure is a great example. Ecommerce businesses saw the first version of 3-D Secure as an important tool for tackling fraud, but also the main culprit for customers not completing checkout. But the same businesses are finding the latest version, which includes new security features like biometrics, highly attractive for easier authentication across the whole customer experience. 3-D Secure's latest iteration links with new EU regulation's authentication requirements. Privacy expectations impact on cybercrime The COVID-19 pandemic has sped up changes in digital consumer behavior like never before. Security and fraud risk increased, triggering more stringent regulation. Ransomware gangs try to extort money from victims by encrypting their data, but also releasing it if the ransom isn't paid, adding data privacy insult to injury. Nations are stepping up to address ransomware, now the world's biggest cyberthreat. But it's early days. Attempts to reduce ransomware risk are sometimes surprising with little consensus on how to address it, like US proposals to make ransomware payments tax-deductible or, conversely, making paying a ransom illegal. Once a profitable niche, cyber insurance now struggles to stay afloat with increasing ransomware and skyrocketing demands. Emerging trends in data regulation and oversight Data protection and privacy regulations are now part of life. We also see several emerging trends. For example, increased data protection and privacy oversight; in the three years since GDPR, nearly half of UK businesses have been reported to the Information Commissioner's Office over breaches. With longstanding data breach disclosure laws in the US, a new bill could force businesses to report breaches faster. India has long deliberated its Personal Data Protection Bill (PDP.) We're also seeing financial and security regulations aligning. Financial services regulations now include extensive obligations overlapping with security. Penalties are no longer the sole domain of national data protection authorities but could come from any regulator. UK's Financial Conduct Authority fined Tesco Bank 16.4 million pounds sterling for failing to protect customers' accounts and not doing enough to prevent financial crime. And we see increased desire to control Big Tech. The most notable example started in China with Alibaba in 2019. New Chinese data protection regulation has more scope for oversight, as we saw with the crackdown on ride-hailing service Didi and others. China perhaps sees its companies listed overseas as a national security risk because foreign governments could scrutinize the massive amounts of data they hold. But there are other risks: Several shareholders sued Didi since their share price fell after regulatory crackdown. It's not just China wanting to rein in Big Tech and their data – security concerns led to Germany's data protection commissioner telling government organizations to shut down their Facebook pages. UK's draft Online Safety Bill proposes a new Big Tech oversight body to help tackle illegal and harmful online content. Another trend is increasing regulatory oversight of start-ups, especially in fintech. Stock trading app Robinhood must pay 30 million US dollars to the New York State regulatory body for cybersecurity and anti-money laundering failures. The Swedish financial regulator is investigating buy-now-pay-later firm Klarna for data privacy breaches. Coming soon: The data regulation to prepare for Data regulation laws are often challenged. In Europe in 2020, the Schrems II judgment invalidated Privacy Shield, the data-sharing mechanism between the EU and the US. Austrian activist Max Schrems scored a major win as his case questioning Facebook's legal basis to collect data was referred to the EU Court of Justice. Trump's US attempt to ban TikTok and WeChat shows this isn't confined to the EU. India's Reserve Bank banned Mastercard from issuing new credit and debit cards for not keeping to local data storage rules. Three years since GDPR came into force, regulators aren't standing still. In April 2021, the EU Commission published a draft proposal to regulate artificial intelligence in line with GDPR. With increased automation globally, this is one area to watch.
marketing data privacy

Great marketers do more than just follow privacy law

  • min read
    • Why is privacy the word on everyone's lips today? Perhaps because according to the Kaspersky Global Privacy Report 2020, a third (34 percent) of consumers have had someone access their private information without consent. And that's just those who know it happened. Governments around the world – including in Europe, the US and Brazil –have brought in new personal data protection laws. Others, like Japan, are being revised. Regulating new technologies, like biometrics and facial recognition, is controversial because it extends the fine line between privacy to protect society and state surveillance. Data breaches are becoming more common and more expensive. In 2019, the average data breach cost the affected business 1.4 million US dollars. The new rules of marketing Marketers now have new rules to follow when collecting data about website visitors, sending marketing email and using customer relationship management (CRM) software. Not complying means hefty fines and reputational damage. In 2020, the Italian Data Protection Office fined a telecommunications company over 27 million euros for making marketing calls without consent. On the bright side, we may be increasingly trusting and engaging with businesses that respect our privacy. A 2018 Harvard Business School study found customers were 40 percent more likely to visit a website's recommended products when wording made clear the recommendations were informed by their browsing behavior. Similarly, in a 2020 study by Cisco, three in four companies said complying with data protection laws had increased their customers' loyalty and trust. Marketing must adapt to new regulation, but it looks like there is potential for this change to make marketing better. Laws marketers should know about As privacy legislations cover more of the globe, it's challenging to keep up with what applies to your company. Here's a primer on legislation already out there or coming soon. Europe: General Data Protection Regulation (GDPR) The GDPR applies to all organizations in the European Economic Area (EEA) or that process its citizens' personal data. Data protection authorities for different countries in Europe regularly publish clarifying guidelines, such as the Irish Data Protection Commission's 2020 guide on how and when websites may use cookies – text files containing users' data downloaded onto their device, used for personalizing content. Brazil: Lei Geral de Proteção de Dados (LGPD) Like GDPR, Brazil's new data protection law (going into effect in 2021) applies to all organizations operating in Brazil, offering services or goods to the Brazilian market or processing data of those living in Brazil. Unlike GDPR, LGPD does not explicitly address marketing. Nonetheless, marketers with Brazilian customers should understand it, because it directs how they should handle customer data, including sensitive personal data, such as health or political preference. California Consumer Protection Acts (CCPA) California's new data protection law came into force on in January 2020. It applies to companies that operate in California, US and make 25 million US dollars, make more than half their money selling user data or gather data on more than 50,000 consumers, households or devices. It regulates some marketing activity. For example, companies must let users opt out of sale of their data with a clear "do not sell my personal information" link. It also sets out rules for how companies may store and handle customer data. When marketers don't follow the rules While making your marketing privacy-friendly could improve customer loyalty, failing to comply with data protection laws can be costly. Heavy fines Most famously, French data protection authority Commission Nationale de l'Informatique et des Libertés (CNIL) fined Google 50 million euro. According to CNIL, Google didn't give users clear enough information about how their data would be used and didn't give them enough control over its use. The cost of non-compliance varies. Under GDPR, the maximum fine is 20 million euros or four percent of your total worldwide annual turnover, whichever is higher. Under the new Brazilian law, the maximum fine for each violation is 50 million reais (nearly US$1 million), plus daily penalties for not stopping violations after an order from authorities. Keep in mind that you can also be fined under several different regulations at once, so 20 million euros under the GDPR and 50 million Brazilian reais under the LGPD for a similar violation. Being fined in one country or region doesn't exempt you from further prosecutions. It's not just big, high-profile businesses like Google getting stung either. European data protection authorities issued over 428 million euros in fines in 2019. Legal hot water On top of fines, companies that don't protect customer privacy risk being sued by customers or governments. Facebook has had its revenue affected by privacy lawsuits. Aside from financial pain, the bigger risk is damage to reputation. Despite its marketing campaigns trying to fix its tarnished reputation, many no longer trust Facebook with their personal information. Making marketing more privacy-positive Getting creative can make your marketing more privacy-oriented and appealing to customers. You'll also need to watch for where others have fallen foul of the law. Accept and follow the law After GDPR required cookie consent from users, many turned to dark patterns: Interface designs that try to trick the user into doing something like agreeing to marketing emails or consenting to cookies. In some cases, websites use dark patterns to prevent users reading a privacy policy or opting out of sale of their personal information. Dark pattern techniques violate data protection laws. Companies that use them can be fined or see their reputation damaged. Tumblr learned the hard way when people began Tweeting about dark patterns in their cookie consent form. Give privacy options, even when you don't have to Build customer trust by giving them privacy options, even when the law doesn't require it. For example, if you're running a contest on social media, let people enter privately with a direct message or through a website form. While this may decrease numbers of tags and hashtags that increase your contest's reach, it builds a privacy-friendly reputation and increases participation. Ask for consent Beyond cookie banners and newsletter opt-ins, ask customers for consent whenever you run a marketing campaign. For instance, when gathering feedback through a survey, ask participants' consent to use their feedback publicly, even if it's anonymous. Asking shows you respect their privacy and preferences. Protect your customers' data To put customer privacy first and follow data protection law, you must invest in cybersecurity. Even one data breach can lower trust in your company. Reflect on how you collect and use personal data, how it's stored and what tools you use. Find out if your customer management system has reported data breaches recently or your email marketing platform has been fined for privacy violations. Keep up your education about privacy Privacy laws and industry standards will evolve. Educate yourself, constantly. A good place to start is Undatify's blog (a Kaspersky Innovation Hub project), for explanations of data protection law, privacy advice and monthly news roundups. Knowing what's right will give you confidence you're doing your job right and treating customers' privacy with the care it deserves.
data security supply chain

Where you should tighten the privacy links in your data supply chain

  • min read
    • A chain is only as strong as its weakest link. Your business is responsible not just for upholding your customers' data privacy inside your organization. Everyone who uses the data on your behalf must be as privacy-conscious as you. Those data-handling partners may include accountancy, telecommunications and cloud storage, even office security and maintenance contractors. Personal data regulation takes privacy very seriously There's a legal reason strong privacy links in your supply chain matter, as well as a moral one. Privacy is at the core of the European Union's stringent General Data Protection Regulation (GDPR.) It applies to personal data processed by organizations in the European Economic Area (EEA) and those outside that offer goods or services to those within. GDPR is the gold standard for data protection. Many other legislative frameworks have used it as a model, like California Consumer Privacy Act (CCPA,) Brazil's Lei Geral de Proteção de Dados (LGPD) and the proposed strengthening of Australia's Privacy Act 1988. Complying with GDPR won't always mean you're complying with other jurisdictions' regulations, so if you're sending personal data across borders, get local advice. GDPR is built around defining what it means to be a data controller or data processor, and what each must do. A controller decides what personal data to collect, gathers it and decides how to use it. A processor receives personal data from another party and processes it as directed, but doesn't decide how it's used. The law says controllers must use only processors with technical and organizational structures that ensure data privacy. Data breaches mean business disruption and reputational damage. Then there's the money. Under GDPR, controller and processor may face huge fines: 20 million euro or up to four percent of the previous year's turnover – whichever is greater. In 2019, British Airways faced a record-breaking 183 million British pounds for a breach. Privacy holes affect businesses of all sizes Although GDPR came into force in 2018, many companies still aren't paying attention, says Jamel Ahmed of UK data privacy consultants Kazient Privacy Experts. "It's true for large enterprises to small- to medium-sized businesses. I often find bigger companies have excellent internal data security processes. The compliance people will ask the right questions and demand evidence. But along the supply chain, there's a massive gap relating to personal data. It's to do with a lack of understanding, and limited awareness and expertise." Peter Wright agrees. He's Managing Director of UK's Digital Law, specializing in online, data and cyber issues. "It's been overlooked in the past. And while there's more awareness now, that doesn't mean it's enough." How to tighten the links 1.    Ask data-processing suppliers the right questions Do your due diligence when you start a relationship with a supplier that involves passing data. Ahmed says, "As a minimum, check new suppliers are registered with UK's Information Commissioner's Office (ICO,) or your country's equivalent. Check they have good policy and practice. Check they understand their data privacy obligations and responsibilities. "Do they have a dedicated data protection officer (DPO,) and what are their qualifications and experience? I'd also want to see evidence they've spent time developing good practices rather than just complying with a checklist they've downloaded from somewhere." 2.    Have a contract that goes above and beyond The GDPR says there must be a written contract between data controller and processor, and what the contract terms must be, including type of data, how long it may be kept for and the nature and purpose of data processing. Data privacy experts think agreements between controller and processor should go further, drilling down to detail, showing the controller is giving enough oversight. 3.    Have a plan in place for what the controller does when there's a breach Under GDPR, all businesses handling data must keep a breach log, recording details of security incidents. Controllers should expect to be able to see anything in the processor's log that relates to its data. Ahmed thinks businesses should go further again, having a detailed plan for what the processor must do if a data breach happens. Ahmed goes on to say, "The GDPR obliges the processor to tell the data controller as soon as they become aware of a breach. But the contract needs to explain what constitutes a breach and what "as soon as you become aware" means." 4.    Bake risk management into your operations Having a watertight supplier contract is just the first step. Wright and Ahmed stress data controllers should manage risk along the supply chain in a proactive and ongoing way. That means regular risk audits and going back to check data policies with clients and suppliers when circumstances change. Wright advises, "Regulators look at how businesses show compliance. They don't want you to hold up a contract audit that says, "Oh yes, we looked at this two years ago and it was fine." They want to see continuous updates. If the worst happens and there is a breach of personal data, they want to see evidence the business did all it could to comply with legislation. "You need to show you've looked regularly at your risk register and updated it after meetings. If a supplier changes its terms, show you investigated, asked questions and reviewed their answers. Regulators want to see the regular auditing, questioning and managing of risk baked into your operations." 5.    Be wary of how behavior changes may impact privacy Our changing ways of life and work mean we need to be vigilant about what's happening with our data. Wright says, "Homeworking has been adopted in ways never envisaged when IT systems were set up. You may have signed up to terms in 2017 and reviewed them during your 2018 GDPR due diligence, but the supplier may have since changed systems. "Say your teleconferencing provider, because of increased demand, says, "We're revising our terms because our servers are no longer in the EU. We have a new web services provider, but we can't confirm where your data is processed. Hope that's OK."" Businesses should insist on full disclosure of what's changed and whether there are knock-on effects on privacy. "Big questions need answering," says Wright. "Where's your data going? Is it following GDPR? Are they transferring business call recordings to servers outside the EEA? What security is in place? Is the data encrypted end to end?" 6.    Consider everyone in your supply chain One of the greatest pitfalls is not realizing your data is passed along the supply chain at all. The golden rule is to assume every business you work with is a data processor. Otherwise, lapses can happen, even with the most sensitive personal information – material classified as "special-category data" under the GDPR. That's anything that could be used for unlawful discrimination such as ethnic origin, sexual orientation, health records or biometric data. Ahmed has a cautionary tale. "One of my clients looked for third-party software to do psychometric testing for graduate recruitment. Throughout the procurement, they didn't realize this involved special-category data under GDPR. There was potential for serious repercussions in failing to assess the data protection impact." In the age of big data, ignorance is never a defense. If personal data is in your possession, you must stay up-to-date with legislation, but also ethics and best practice. Raise awareness of risks and responsibilities, inside and outside your organization. Doing so will reduce the chance of a data breach and ensure your customers know you're looking after their interests.
data toxic waste

Data – the new oil, or potential for a toxic oil spill?

  • min read
    • Both of these statements were once controversial, but today, they're commonsense. If Equifax, the CIA, the NSA, The Office of Personnel Management, Facebook and dating sites can't keep our secrets secret, then neither can your business. In truth, industry's old, ill-placed confidence in the security of data was always an example of motivated reasoning. Collecting data is so cheap and storing it is so easy, and there were so many analysts and investors and hustling grifters exclaiming that "data is the new oil" that it seemed fiscally irresponsible not to collect everything you could, and retain it forever. Who knew how that data could be put to profitable use in the future? It was raining soup, so it was time to fill your boots – even if you couldn't find a market for soup-in-a-boot today, there was no doubt that such a market would appear in the foreseeable future. Given such a value proposition, it's not surprising that the people doing the collecting and the retaining of data talked themselves into the idea that both activities could be undertaken safely. But of course, they were wrong, and as history has caught up with them – as breach after breach has hit in ever-increasing waves – the rationale has changed. Now, rather than arguing that breaches are inevitable, the story goes that breaches aren't a big deal: every time there's a data breach, company spokespeople recite the catechism: "We take our customers' privacy very seriously. None of the data that leaked was compromising." Some of that is "privacy nihilism" – it was all going to leak eventually, so what's the difference? But there's a more insidious version of this, which argues that breach data isn't a problem because bad people can't do much with it. This isn't just nihilism; it's denialism. Breach apologists argue that the data they leak isn't compromising because it's anonymized, or because key identifiers were removed from it. This profoundly misunderstands how data is used – and abused. Re-identification of anonymized data-sets is a hot research topic for computer science today, with researchers creating automatic tools that piece together disparate data-sets to identify the people in them: for example, you can merge a health authority's database of anonymized prescribing data (doctor, medicine, date and time) with a breached database of taxi journeys that includes trips to hospitals that coincide with the prescribing times to infer who is taking antipsychotic medications, or antiretrovirals or cancer therapeutics. Many data-protection vendors have promised that they can inject noise into data-sets to prevent re-identification, but those promises rarely survive contact with security researchers who evaluate their claims. It's been years since the first significant re-identification theoretical work was done, and things keep getting worse for those who insist that anonymization is possible. Re-identification methods tell us a lot about how digital criminals operate and their incredible frugality and resourcefulness. Usernames and passwords can be recycled in credential-stuffing attacks that allow them to break into security cameras from Ring and Nest, order takeaway meals, or track and immobilize entire fleets of corporate vehicles. Breach identities can be used to overwhelm regulatory proceedings with plausible fake comments or to create fleets of Twitter identities. Criminals operate by combining and recombining data-sets, using one company's breach in combination with a public data source, and a third company's anonymous data release to wreak incredible havoc. They might even get enough data fragments to fraudulently obtain a duplicate deed for your house and sell it to someone else while you're on holiday. Never mind that no one can point to a specific piece of data you're liable to lose control over someday and say, "That, that's the data-point that will cost someone their house, or let their stalker find them or expose their retirement savings to thieves." It's similarly true that no one can point to a specific droplet of dioxin in a factory's illegal effluent pipe and say, "That, that is the carcinogen that will kill a young mother of three, some five miles downstream of the pipe." This doesn't stop companies that poison the water or the air from paying the price. The harms from breaches are stochastic (i.e., randomly determined), not deterministic. So far, remedies for those who have been injured by breaches have been severely limited, but they're getting stiffer. Home Depot's 2014 breach cost it $0.34/customer in direct compensation. But that was then. Breached Yahoo! customers may get compensated $100 each. Facebook just got hit with a $5B fine, and the party's just getting started. The harms from breaches are cumulative: like toxic waste in nature, breaches build up in the information environment, and they are effectively immortal in their potential for damage. As the public – and the law – come to grips with this, we're likely to see greater and greater remedies for those whose data has been released into the wild (forever). Remember, breaches affect everyone alike – all political persuasions, rich and poor, including the governing classes and lawmakers themselves. Inevitably, we will see the framework for breach remedies transformed to look more like the remedies for other probabilistic harms, such as environmental harms. When that happens, it might be too late for you: the data you're warehousing today might already have been ex-filtrated from your network without you even knowing that it's happened – until one of your customers finds out the hard way that you've compromised them, and seeks legal remedies. Your insurer isn't going to write policies for you – or errors and omissions policies for your board – if you're warehousing all this digital toxic waste in leaky digital barrels, not once the penalties for losing control over it start to turn into real money. Maybe you could still justify all that risk if the profits from all that data were commensurate with it. But as researchers keep discovering, the benefits from data are wildly oversold – the efficacy of ad targeting based on users' behavior is almost identical targeting based on the content of the pages where the ads appear, which requires no user data. But if you're an ad-tech company or a Big Tech platform like Facebook or Google, the mystique about the ability of data to convert customers allows you to sell your product as a massive premium, while intimidating potential competitors who think that they will never get started because they can never collect as much data as the companies that are already in the space. The people who claim data is the new oil are people who are selling the data, and the claims they make about the ways that this data lets you do amazing things are sales literature, not peer-reviewed studies. Data was never the new oil. It was always the new toxic waste: pluripotent, immortal – and impossible to contain. You don't want to be making more of it, and you definitely should be getting rid of the supply you've so unwisely stockpiled so far. Data minimization isn't just good practice; it's good business. Collect as little data as you can, and keep it as briefly as you can. If your privacy policy fits on the back of a napkin – because you're collecting almost nothing and processing it only for specific purposes, and then deleting it forever – you're on the right track! This article reflects the opinions of the author.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries