Your Data Is Shared and Sold…What’s Being Done About It?
Earlier this month, California Gov. Gavin Newsom signed into law amendments to the California Consumer Privacy Act (CCPA), the most sweeping state data privacy regulations in the country. The law, which takes effect on Jan. 1, regulates how data is collected, managed, shared and sold by companies and entities doing business with or compiling information about California residents. Some observers contend that because no business would want to exclude selling to Californians, the CCPA is de facto a national law on data privacy, absent an overarching federal regulation protecting consumer information.
“The new privacy law is a big win for data privacy,” says Joseph Turow, a privacy scholar and professor of communication at the Annenberg School for Communication at the University of Pennsylvania. “Though it could be even stronger, the California law is stronger than anything that exists at the federal level.” Among other stipulations, the CCPA requires businesses to inform consumers regarding the types of personal data they’ll collect at the time they collect it and also how the information will be used. Consumers have the right to ask firms to disclose with whom they share the data and also opt out of their data being sold.
The CCPA comes on the heels of the EU’s General Data Protection Regulation (GDPR), which took effect in May 2018. According to the United Nations Conference on Trade and Development, 107 countries have data privacy rules in place including 66 developing nations. In the U.S., there was a “significant” increase in data privacy bills being introduced this year, with at least 25 states and Puerto Rico starting such legislation, according to the National Conference of State Legislatures. Notably, this bill count doesn’t include related legislation on topics such as cybersecurity.
Meanwhile, the increase in data privacy regulations has companies worried about how they are to comply and how much it would cost. According to a 2019 survey of senior executives by Gartner, the acceleration of privacy regulation and related regulatory burdens is the top emerging risk faced by companies globally. Sixty-four percent of executives identified it as a key risk, especially those from the banking, financial services, technology, telecommunications, and food, beverage and consumer goods sectors. Moreover, they view this regulatory risk as having “very rapid velocity” — meaning it could bring potentially large fines and brand damage if firms violate the rules.
In part to head off more stringent laws, companies and computer scientists are collaborating to provide computational and business solutions to strengthen data protections while not hampering innovation and operational efficiency. Google, Facebook, Amazon, Apple and others have come forward with changes that give users more control over how they are being tracked and how their data is being used. “Privacy is personal, which makes it even more vital for companies to give people clear, individual choices around how their data is used,” wrote Google CEO Sundar Pichai in a May 2019 opinion piece for The New York Times.
Some recent changes include the following: Google users can now choose to opt in to save their audio data collected by Google Assistant, which uses it to better recognize their voices over time. They can also delete their interactions at any time and agree to a human reviewer of the audio. This month, Facebook’s Instagram rolled out a new feature that lets users manage which third-party apps have access to their data. In September, Facebook said it has suspended tens of thousands of sketchy apps from 400 developers. Amazon also is cracking down on third-party apps for breaking its privacy rules while Apple said it will no longer retain audio recordings that Siri collects by default, among other things.
