Data privacy has been a hot topic of late. There has been a recent surge in the usage of Signal a competitor to Whatsapp because of data privacy issues. There has been a widely reported talk by the Apple CEO, Tim Cook taking aim at companies like Facebook. There have been hard questions asked in the US about the impact of social media on fake news and conspiracy theories.
A recent paper by Apple describes a scary scenario – a father & daughter go to the park and during that process, a lot of data gets collected & tracked. Some of the key points made in this paper include:
- Personal data is being harvested by a large ecosystem – Apps, Websites, social media, third party brokers & ad-tech firms. In most cases, the data is harvested without the knowledge or consent of the people.
- On an average, there are 6 trackers embedded in an App which collect and share data with data brokers as well as other Apps. So my data, which I have consented to be shared with one App is also going to other Apps and data brokers. One of the data brokers, according to this paper, collects data on 700 million people and they have created profiles with over 5000 characteristics
- Many Apps, ask for more access to data, than what is required to provide the service and the user is not aware of this
- There are alternatives to this widespread collection of data – Apple talks about a few principles:
- Collect as little data as required for the service
- Process the data on the device itself rather than storing it elsewhere
- User should know and give consent to the data being harvested
Apple has announced two big changes. The first change is the introduction of an App Privacy section in the App Store – each App’s product page has to show a summary of developers’ privacy practices. However, it is unlikely that many users will view this before downloading the App.
The second change announced by Apple is more interesting and has caused the furor with Facebook, namely “App Tracking Transparency” which will be introduced soon. Once this is introduced, an App will be required to explicitly get the user’s permission before tracking their data across apps or websites. Without permission, the App will not be able to access the unique advertising identifier (IDFA) on the iPhone. Facebook has responded with plans to help users enable the tracking.
While the ecosystem players, notably Facebook, argue that the data collected, is being used for offering personalized ads to consumers thereby helping them – it is also true that the data is misused in many cases – fake news ads during elections & hate campaigns have been well documented.
In India, currently there are ongoing discussions in a joint parliamentary committee, of the draft Personal Data Protection bill which is likely to be debated in the Parliament soon. The final bill is likely to include compliance requirements for personal data, strengthening the data rights of an individual & introduction of a central data protection regulator.
But there is a more interesting discussion happening in India – on how sharing of data can bring benefits to the people. As Amitabh Kanth, the CEO of Niti Ayog put it – “In India, we not only need stronger data protection, but also data empowerment: everyday Indians need control over their own personal data to improve their lives.” For example, if there is data about GSTN transactions of a small businessperson, a bank can give the person working capital credit, even though the person doesn’t have a credit history. Similarly, personal loans can be given to individuals based on their digital payment history. To enable this, a draft “Data Empowerment and Protection Architecture(DEPA)” document has been published for discussion. The key aspects of DEPA are as follows:
- Ability for individuals to access their personal data generated across silos
- Ability to digitally give consent for the use of the data – through the introduction of private “Consent Manager institutions”. These Consent Managers will also ensure protection of data rights.
- Technology architecture – The Consent Artefact, a technology standard for programmable consent; Open APIs for data sharing; Industry information standards( financial industry has been developed)
These are interesting times indeed for data privacy. While in the US & Europe, there is debate on restricting data sharing as data is used primarily to sell things to the user, in India, there is a movement towards data empowerment – to benefit the user to access services. As has been said – in today’s digital world, data is the new oil – how it is handled, will determine the future of societies.