When the House of Representatives recently voted to overturn a proposed ruling that would have limited internet service providers’ ability to share and sell customer data, cries of “foul” were heard throughout the Privacy and security practitioner communities. Privacy wonks are more likely to remain aggravated over the decision, but security practitioners have moved on in the month+, turning their attention instead to pressing matters which fit squarely into the “security” box. The problem with this, as with software development and the supply chain, is that security cannot extricate itself from issues not immediately under security’s direct authority. Uncontrolled proliferation of data puts both organizations and consumers at greater risk of loss, abuse, or destruction. Privacy and security are, therefore, not an “either/or,” but something that requires closer collaboration.
Consumers in the U.S. are conflicted about privacy. On the one hand, many believe it is citizens’ inalienable right to privacy (it’s not). On the other, it’s not uncommon to hear even the most privacy-minded complaining that privacy is all but a lost cause in today’s technology- and surveillance-heavy world. To the latter point, consumers do, absolutely, willingly surrender personal information in exchange for use of a website or app, when purchasing goods online, when filling out webforms, etc. Consumers may not be focused on the “giving up” part when they want access to something, but it’s no secret that data are king in today’s corporate world, and most companies with any kind of online presence have the lengthy terms and conditions to prove it.
Who wants to read twelve pages of terms and conditions to download a free app or buy a new pair of shoes? No one. Categorically no one. Except, maybe, lawyers. Shawn E. Tuma, who is a cybersecurity and privacy attorney himself, says that companies aren’t to blame. “The real problem,” he says, “is that people in the U.S. are not as concerned about privacy rights as EU citizens seem to be,” referring to the newly implemented General Data Protection Requirements (GDPR). The GDPR comes on the tails of many years of privacy legislation in the EU and is designed to not only allow consumers more direction over the use of their personally identifiable information (PII), but also requires companies to put improved security controls and policies in place, in theory, diminishing the probabilities of data breach. The idea is that if citizens and companies are working together on data oversight, the outcomes are better.
In the U.S., though, we don’t maintain the Right to be Forgotten and companies make it very difficult for consumers to understand the extent of how PII is used, sold, or secured.
