Customers are being asked to hand over more and more personal information, but there are dangers for firms that go too far
When Antoine Gounel, a Belgian entrepreneur, tried to design a pan-European online advertising campaign, he came up against an unforeseen obstacle. His advert gave users the chance to sign up to a newsletter, but that offer would have had to comply with 28 different data-protection regimes. In some countries, a user can agree to receive a newsletter by ticking a box. In others, they need to click on a button saying “I approve”. Since most small businesses cannot afford to pay for lawyers in each country, they “develop less good services because they always have to be very careful”, Gounel says.
The majority of businesses that use the internet – from e-health companies to software developers, from data-managers to hardware manufacturers – agree that something needs to be done about data protection in the European Union. They also tend to argue that regulators underestimate the power of consumers to punish companies that fail to respect privacy.
If users are reassured when using technology and the internet, it will be better for business, for the wider economy and for human rights, says David Hoffman, Intel’s global privacy officer and director for security policy. So far so good. But the cracks begin to appear between regulators and companies – and between companies themselves – when answering the question: how much responsibility should users and customers bear for protecting their own data?
Unsurprisingly, companies whose business model relies in large part on using personal data, such as Facebook, believe that users should shoulder the greater burden. Facebook stresses that it makes tools available to users so that they can carefully manage what data is stored and what data is visible.
“Personal data is essential for producing new user experiences,” says Gounel, whose app Relike TV is on Facebook. But “just like in the high street”, internet users need to check out who they are dealing with before they start handing over personal information, he says. He believes that many users will refuse to provide non-essential information and, if there are complaints, Facebook will remove the app in question.
Michel van Eeten of the Delft University of Technology in the Netherlands argues that regulators should take comfort from the fact that there will always be a small number of users who actively try to keep companies in check.
The tussle that took place between an Austrian law student and Facebook is one such example. In 2011, Max Schrems used EU law to force the social networking site to disclose all the data it had stored from his account. The 1,200+ pages it handed over led to changes in the company’s privacy rules.
“One Austrian law student provided more transparency than all [European] data protectors,” says Van Eeten. Hoffman agrees that empowering consumers is vital. “It is important that consumers have a common set of rights and that they are aware of this,” he says.
Consumers’ preference for security and data protection already exerts a huge influence over some companies. Intel has 30 staff dedicated to working with designers during the product development phase to guard against inadvertent privacy issues.
That Intel enjoys a positive reputation in security matters is “fundamental” for the company, says Hoffman. The company spent almost €6 billion in 2010 on buying McAfee, a security software company. Firms looking to promote their commitment to privacy and safety can sign up to informal industry standards that confer product labels guaranteeing a certain level of protection for users.
Schrems’s case illustrates the way in which users can have a distinct advantage over bodies set up to protect data: they deal with specifics. “Data-protection agencies have the problem that they have to apply highly abstract rules to very detailed, varied and often changing situations,” says Van Eeten. To get around this dilemma, regulators ought to limit themselves to a broad approach, with general principles that can be applied to different sectors and to changing technologies, he argues.
Regulations written in black and white will have a hard time coping, says Hoffman. A few basic principles provide a good starting-point for dealing with the challenges, with bodies made up of different stakeholders well-placed to issue guidelines explaining how the rules might apply.