As privacy practitioners, why should we care so much about personal data in personal lives? After all, the most prominent privacy regulations across the globe provide exemptions for household use.
In many countries, including where I was born, there is an absence of standard privacy regulations. In others, there may be some regulations in place, but it is still not always easy to implement privacy principles at organizations. Prior to being able to lobby new regulations or enforce existing ones, it is imperative to foster the “culture of privacy” such that respect for each other’s rights around personal data becomes second nature to people and not just because it is needed to check some boxes.
To foster this culture, we need to embed the concept of privacy in our day-to-day lives. A stepping stone to achieving this would be to debunk some common myths around privacy and data protection. Here are my top three myths.
Myth 1: The choice around privacy is binary (all or nothing)
More than a century ago, the “right to be left alone” was considered a basic human right. This was solidified by the Universal Declaration of Human Rights. What is the rationale for the right to privacy? In some cases, revealing sensitive personal data (such as race, religion, ethnicity, etcetera) may have undesirable or discriminatory consequences. However, many times, it is just a matter of choice.
If someone wants to be left alone, they have that right. No questions; no judgment. And the choice is also not always binary. In other words, most people fall between the two extremes of wanting to share everything and wanting a zero-data footprint. For example, we may be perfectly fine with publicly sharing our social media photos (what’s not to share about my fitness regime?), but at the same time not be OK with an application being able to detect what we did in our browsers (no one needs to know how many cookies I ordered).
Similarly, I may not mind sharing some photos of my kids on social media but may mind getting targeted for multilevel marketing “opportunities” that are meant specifically for moms. When it comes to such discomfort, “too much” is relative, and the feeling is not quantifiable. The best we can do is respect what people want if it is not obstructing our daily activities, causing harm, being misused to conceal crime or making any other significant impact (saving the cat from curiosity does not count).
Myth 2: Breaching privacy only comes from malicious intent
As frustrating as is it, asking a lot of personal questions could be a result of good intent in a community setting, which many of us city dwellers often miss out on. Traditionally, if someone mentioned they were going through a difficult time, people might ask them a lot of questions with the intent of being supportive.
When torn on how to act, my default strategy is to apply the privacy principles from the EU General Data Protection Regulation in such social situations, particularly purpose limitation and data proportionality. For example, before asking a grieving person a number of questions, I ask myself, "What is the purpose of asking this? Am I here just to console or take any action? Do I need all the information or just a subset to serve the purpose?"
Speaking of proportionality (or the lack thereof), sometimes additional questions are asked "just in case." One example of this is a travel insurance agent asking health questions before the information is actually needed. After all, storage limitation is another principle that needs to be dealt with when too much data is collected. We should perhaps try to educate our friends and family in a similar way, in hopes that their situational awareness for privacy will improve, while acknowledging their good intentions.
Myth 3: Pseudonymized data is not really personal data
Pseudonymization, the act of replacing personally identifiable information with artificial identifiers or pseudonyms, has been a hot topic over recent years because its use could help reduce some of the compliance burden of organizations processing personal data. However, unlike anonymization, pseudonymization is reversible and, if performed irresponsibly, can reveal the identity of individuals. This is why we shouldn’t think of pseudonymization as a "get-out-of-jail-free card." If we share someone’s personal information without permission but just remove their name (but keep many other attributes, such as where they are from, what they do, how you know them), we may be breaching that person’s right to privacy.
Here is a question for the reader. If I do not sign this article with my name, would you be able to find out who this working mother, city dweller, privacy practitioner, born in a country with no privacy regulations and sharing the same birthdate (but not year) as the day of universal declaration of human rights is? I do not think it will be difficult based on the clues and available information on the internet, and I am not even famous. Whether in an organization or social settings, we need to try our best to not irresponsibly pass around personal information, wrongly assuming the identity of the data subject will not be easily revealed.
Before we go about trying to implement and enforce regulation in the commercial space, it is important to debunk the common myths and raise awareness on the basic right to privacy in our personal lives, which is what I have aimed for through this article. Just like a good education, privacy awareness starts at home.
Photo by Dayne Topkin on Unsplash
