TOTAL: {[ getCartTotalCost() | currencyFilter ]} Update cart for total shopping_basket Checkout

Privacy Perspectives | Why should we care about protecting data in our personal lives? Related reading: Op-ed: Tracking data in COVID-19 response raises ‘difficult challenges’

rss_feed
GDPR-Ready_300x250-Ad

As privacy practitioners, why should we care so much about personal data in personal lives? After all, the most prominent privacy regulations across the globe provide exemptions for household use.

In many countries, including where I was born, there is an absence of standard privacy regulations. In others, there may be some regulations in place, but it is still not always easy to implement privacy principles at organizations. Prior to being able to lobby new regulations or enforce existing ones, it is imperative to foster the “culture of privacy” such that respect for each other’s rights around personal data becomes second nature to people and not just because it is needed to check some boxes.

To foster this culture, we need to embed the concept of privacy in our day-to-day lives. A stepping stone to achieving this would be to debunk some common myths around privacy and data protection. Here are my top three myths.

Myth 1: The choice around privacy is binary (all or nothing)

More than a century ago, the “right to be left alone” was considered a basic human right. This was solidified by the Universal Declaration of Human Rights. What is the rationale for the right to privacy? In some cases, revealing sensitive personal data (such as race, religion, ethnicity, etcetera) may have undesirable or discriminatory consequences. However, many times, it is just a matter of choice.

If someone wants to be left alone, they have that right. No questions; no judgment. And the choice is also not always binary. In other words, most people fall between the two extremes of wanting to share everything and wanting a zero-data footprint. For example, we may be perfectly fine with publicly sharing our social media photos (what’s not to share about my fitness regime?), but at the same time not be OK with an application being able to detect what we did in our browsers (no one needs to know how many cookies I ordered).

Similarly, I may not mind sharing some photos of my kids on social media but may mind getting targeted for multilevel marketing “opportunities” that are meant specifically for moms. When it comes to such discomfort, “too much” is relative, and the feeling is not quantifiable. The best we can do is respect what people want if it is not obstructing our daily activities, causing harm, being misused to conceal crime or making any other significant impact (saving the cat from curiosity does not count).

Myth 2: Breaching privacy only comes from malicious intent

As frustrating as is it, asking a lot of personal questions could be a result of good intent in a community setting, which many of us city dwellers often miss out on. Traditionally, if someone mentioned they were going through a difficult time, people might ask them a lot of questions with the intent of being supportive.

When torn on how to act, my default strategy is to apply the privacy principles from the EU General Data Protection Regulation in such social situations, particularly purpose limitation and data proportionality. For example, before asking a grieving person a number of questions, I ask myself, "What is the purpose of asking this? Am I here just to console or take any action? Do I need all the information or just a subset to serve the purpose?"

Speaking of proportionality (or the lack thereof), sometimes additional questions are asked "just in case." One example of this is a travel insurance agent asking health questions before the information is actually needed. After all, storage limitation is another principle that needs to be dealt with when too much data is collected. We should perhaps try to educate our friends and family in a similar way, in hopes that their situational awareness for privacy will improve, while acknowledging their good intentions.

Myth 3: Pseudonymized data is not really personal data

Pseudonymization, the act of replacing personally identifiable information with artificial identifiers or pseudonyms, has been a hot topic over recent years because its use could help reduce some of the compliance burden of organizations processing personal data. However, unlike anonymization, pseudonymization is reversible and, if performed irresponsibly, can reveal the identity of individuals. This is why we shouldn’t think of pseudonymization as a "get-out-of-jail-free card." If we share someone’s personal information without permission but just remove their name (but keep many other attributes, such as where they are from, what they do, how you know them), we may be breaching that person’s right to privacy.

Here is a question for the reader. If I do not sign this article with my name, would you be able to find out who this working mother, city dweller, privacy practitioner, born in a country with no privacy regulations and sharing the same birthdate (but not year) as the day of universal declaration of human rights is?  I do not think it will be difficult based on the clues and available information on the internet, and I am not even famous. Whether in an organization or social settings, we need to try our best to not irresponsibly pass around personal information, wrongly assuming the identity of the data subject will not be easily revealed.  

Before we go about trying to implement and enforce regulation in the commercial space, it is important to debunk the common myths and raise awareness on the basic right to privacy in our personal lives, which is what I have aimed for through this article. Just like a good education, privacy awareness starts at home.

Photo by Dayne Topkin on Unsplash

4 Comments

If you want to comment on this post, you need to login.

  • comment John Berard • Dec 6, 2019
    By your example, pseudonymized data is personal data if you can be identified from the markers you leave behind, no?
  • comment Suman Taneja e/v Korenhof • Dec 7, 2019
    Thank you Husna for sharing. I agree, it all start with the ABC of Attitude, Behavior and Culture - your own. What better place to start then at home!
  • comment Simisola Belo • Dec 9, 2019
    Nice article. Just wondering whether, like me, you deliberately prefer to see privacy as 'the right to be left alone', when the Warren & Brandeis definition was actually 'the right to be let alone'?
  • comment Husna Siddiqi • Dec 11, 2019
    @John Berard, thanks for the comment. Yes I would agree that pseudonymized data that is reversible in computational capacity is personal data. Just like true randomness, true anonymity is quite difficult to achieve.  
    
    @Suman Taneja, I love the ABC reference. Thanks for sharing.
    
    @Simisola Belo, it is really smart to deliberately change the phrase to something more appropriate but I cannot take credit for that as it was not deliberate:-) I came across both in different resources but was not sure which is the earlier term. Thanks to you now I know now!