The Six Principles of Data Protection: Facebook fails

The Six Principles of Data Protection: Facebook fails

Facebook may believe that dubious data collection and security practices justify a more connected audience: the incoming General Data Protection Regulations say differently.

Once again, data privacy is in the headlines. But this time, it isn’t a credit agency or department store that has fallen short of consumer expectations: instead, it’s Facebook. Much credit is due to Carole Cadwalladr and her team at The Guardian, who first broke the the Cambridge Analytica story.

#DeleteFacebook was trending on Twitter for a while, and I myself was considering ditching my account – not least because I simply don’t use Facebook often. While I’ve decided against deletion, I was genuinely saddened – although, in retrospect, not surprised – to come across the leaked 2016 “Ugly Truth” Memo from a Facebook executive Andrew “Boz” Bosworth. You can see the Memo in full at Buzzfeed, but the part that hit me hardest reads as follows:

We connect people. Period.

That’s why all the work we do in growth is justified. All the questionable contact importing practices. All the subtle language that helps people stay searchable by friends. All of the work we do to bring more communication in. The work we will likely have to do in China some day. All of it.

The natural state of the world is not connected. It is not unified. It is fragmented by borders, languages, and increasingly by different products. The best products don’t win. The ones everyone use win.

“Questionable contact importing practices”? By Bosworth’s own admission, “the ugly truth is that we believe in connecting people so deeply that anything that allows us to connect more people more often is de facto good.”

The General Data Protection Regulations (GDPR) say differently. With less than two months to go until the implementation date of 25 May (!) I’ve set out a little refresher on the main responsibilities for organisations below.

Article 5 of the GDPR contains Six Principles of personal data collection and processing. The data controller (the company collecting or otherwise controlling the data) are responsible for, and must be able to demonstrate, compliance with these principles.

(A) Processed lawfully, fairly and in a transparent manner.
A company collecting data must make it clear as to why the data are being collected, and how the data will be used. The company must provide details surrounding the data processing when requested to do so by a person whose data is collected (the “data subject”). “Questionable practices” are likely neither fair nor transparent!

(B) Collected for specified, explicit and legitimate purposes.
Have you ever filled in a form, only to think, “why am I being asked this question?” This principle states that organisations should not collect any piece of personal data that doesn’t have a specific purpose, and a data subject must give explicit consent for each purpose. A lawful purpose could mean fulfilling a contract: for example, your address is required for shipping something you bought online.

(C) Adequate, relevant and limited to what is necessary.
Companies strive to understand customer buying behaviours and patterns based on intelligent analytics, but under this principle, only the minimum amount of data required may be stored. Asking for one scanned copy of a drivers’ licence may be adequate, but asking for a drivers’ licence, passport, and birth certificate might be more than necessary.

(D) Accurate and, where necessary, kept up to date.
Controllers must ensure personal data is accurate, valid and fit for purpose. Accordingly, data subjects have the right under Article 16 (Right of Rectification) to rectify any personal data held about themselves.

(E) Kept for no longer than is necessary.
This principle limits how data are stored and moved, and for how long. When data is no longer required, it should be deleted. This is closely related to the Right of Erasure (“Right to be Forgotten”) under Article 17, which I previously wrote about in respect of the Google case in England.

(F) Processed in a manner that ensures appropriate security.
This principle is perhaps what most people think about when they think of data protection. It means that IT systems and paper records must be secure, and the security must be proportionate to the risks and rights of individual data subjects. Negligence is no longer an excuse under GDPR!

In 2016, a Gallup study found that Millennials (those of us born between 1981 and 1996) are generally aware of potential data security risks, but less likely to be concerned about them. Prior to familiarising myself with these principles, I simply thought data protection was another phrase for “IT security”. I thought it was just about firewalls, encryption, and outsmarting hackers.

But in the months I’ve been helping clients to get ready for the GDPR, I’ve realised that compliance is about more than just having strong passwords: it really is a mindset. That’s what’s so disappointing about Facebook’s apparent attitude towards the end consumer, in which people are seen only as a series of clicks or “likes” which can be analysed, predicted, and manipulated – at any cost. My Facebook account may remain active, but I for one will certainly be less engaged.

Photo credit – Book Catalogue

Google prepares for the first “Right to Be Forgotten” trials in England

Google prepares for the first “Right to Be Forgotten” trials in England

All human beings have three lives: public, private, and secret.
― Gabriel García Márquez

The European Union’s Court of Justice decision in Google Spain v Agencia Española de Protección de Datos, Mario Costeja González (“Google Spain”) confirmed the “right to be forgotten” for European citizens. This right is further enshrined in the upcoming General Data Protection Regulations (GDPR). Accordingly, European data protection law grants individuals a qualified right to have personal data relating to them removed from search engines.

This right is however considered by some to be a uniquely European phenomena, which resulted from one unusual CJEU judgement. Now, two upcoming cases against Google will be the first time in which the “right to be forgotten” will be considered by the English Courts. 

Two unnamed claimants, known only as NT1 and NT2, are bringing a companion case against Google to enforce their right to be forgotten. (NT1 v Google and NT2 v Google,  [2018] EWHC 67 (QB) (Rev 3))

Continue reading “Google prepares for the first “Right to Be Forgotten” trials in England”

Silent Witness: silent on data protection officers

Silent Witness: silent on data protection officers

Silent Witness is a BBC crime drama about a team of forensic pathology experts and their investigations into various crimes – it’s a bit like American hit shows Bones and Law & Order. In a recent episode, a cyber hacker steals the files of 30,000 patients from a hospital, and then extorts the hospital for payment. As medical secrets are leaked, several murders are tied to the data breach.

In addition to the criminal investigations, boardroom drama ensues when the hospital chief is questioned about the (apparently awful) cyber security firm he selected. It was at this point that I turned to my husband in disbelief and said, “where on Earth is the hospital’s data protection officer!?”

Of course, television dramas are entitled their artistic licence. I’m not sure data protection officers make for enthralling plot devices, if I’m honest. But shows like this demonstrate just how mainstream data breaches, cyber security and hacking personal data have become. In fact, many non-lawyers are now familiar with at least some concept of data protection legislation.

With just four months to go until the new General Data Protection Regulations (“GDPR”) come into effect and replace the Data Protection Act 1998, here is a reminder as to when a private organisation is required by law to have a data protection officer (“DPO”).

Continue reading “Silent Witness: silent on data protection officers”

A Soundtrack for Data Security

A Soundtrack for Data Security

So much of the explosion in innovation in the music industry is around technological processes. But artists still need to focus on their art. To do so, they need to surround themselves with tech-savvy people. And hire a good lawyer.
– Gigi Johnson, Director of the Center for Music Innovation, University of California Los Angeles

Privacy policies are painful to read, not least because they’re very technical, boring, and long. According to a recent study, if the average person read every privacy policy for each website they visited in a given year, it would take approximately 244 hours, or 40 minutes each and every day. In spite of this, privacy policies have begun to attract mainstream attention.

Continue reading “A Soundtrack for Data Security”

Cyber security gets Hollywood makeover

Cyber security gets Hollywood makeover

Hacking is a major issue for many industries – but Hollywood is an especially tempting target. The new Entertainment Security Operations Center in Los Angeles hopes to provide a secure system for studios to control their valuable creative content.

HBO, Sony Pictures, and Netflix have all been hacked in major security breaches. In addition to embarrassing information being made public and loss of consumer confidence, infiltration can cost a film or television company big bucks. According to a Carnegie Mellon University study, films leaked online before official release can lose nearly 20% of their box office revenue. Furthermore, paid subscriptions for Netflix or HBO become less appealing to viewers if they can simply watch their favourite shows elsewhere for free.

Why is Hollywood so poorly equipped to safeguard itself from data breaches? Outsourcing may be partially to blame. Special effects, musical scores, set engineering, and technicians are often provided by independent contractors and freelancers. While workers could be brought in-house, doing so would be expensive and limit flexibility when sourcing the best talent. Unfortunately, many of these small firms and individuals simply lack the resources to defend against sophisticated attacks. As a result, the hundreds or even thousands of people working on a project’s creation and distribution become security risks. Continue reading “Cyber security gets Hollywood makeover”

GDPR Spotlight on media platforms

GDPR Spotlight on media platforms

Personal Data has been Hollywood’s rising star over the last few years. But will the introduction of Europe’s new General Data Protection Regulations steal the spotlight?

I had a bit of a migraine this weekend, so I spent the better part of the last two days on the couch watching Narcos and a few period costume dramas on Netflix. As I scrolled through the recommendations deciding what to watch, I smiled to myself thinking of how confusing my behaviours must appear to the algorithms used by Netflix. My tastes vary from watching FBI agents in 1970s Columbia, to Miss Elinor Dashwood in rural Georgian England.

Me Before You is apparently a 95% match to my preferences, despite being a film I have no desire to see. On the other hand, Blackfish, the whale documentary I’ve seen three times, is only a 54% match. Of course, Netflix only knows what my online behaviour reflects. And while it may not be perfect, when my behaviour is combined with my personal data, Netflix recommendations are fairly accurate most of the time. The advancement in behavioural analytics is big business in the world of media consumption – and it’s only getting bigger.

Continue reading “GDPR Spotlight on media platforms”