In the days following the latest Facebook scandal, in which we learned that Cambridge Analytica collected and misused the personal data of potentially 50 million American Facebook users, we have seen:
Facebook, like its peers and rivals, is in fact preparing for a new European Union – General Data Protection Regulation (GDPR). If you aren’t aware, GDPR is a new law (effective May 25, 2018) that aims to protect the privacy rights of EU residents. GDPR was created by the European Commission to protect against the marketing practices of companies like Google and Facebook, who use the personal data they collect about you to market to you in all kinds of ways.
GDPR is a revolutionary law that mandates significant improvements to security and data privacy practices, with huge fines for noncompliance – 4% of annual revenues, or €20 Million, whichever is larger. If GDPR had already been in place, in addition to the huge loss in value, European Union Regulators could conceivably fine Facebook an additional €1.31B (or $1.63B, based on 2017 revenues of $40.65B).1
Ironically, Facebook appears to be taking GDPR preparation seriously, and has appropriately taken measures to inform the public of its preparation efforts. Under GDPR, Facebook operates as both a personal data ‘Controller’ and a ‘Processor.’ After the law comes into effect, Facebook management will have responsibility to monitor all ‘Processors’ of the personal data it shares. That means, Facebook will have to audit the security and data privacy practices of marketing companies like Cambridge Analytica.
If Facebook sees intentional, or even accidental misuse of these personal data, Facebook’s Data Privacy Officer (DPO) would be held accountable by EU regulators to report Cambridge Analytica’s violations within 72 hours of discovery; not years later and only after a whistleblower does it first. News outlets have been reporting about Cambridge Analytica’s sinister practices since its involvement in US politics prior to the 2014 mid-term elections. The shock and awe we are experiencing in March 2018 should have been first felt much, much sooner.
As it turns out, Cambridge Analytica has been mining and exploiting privacy data of people all over the world to influence the political courses in Nigeria, Kenya, the Czech Republic, India and Argentina. Cambridge Analytica even developed content to influence “persuadable” voters to support Brexit.2
While EU Regulators have promised to vigorously enforce GDPR around the world, the law only protects the privacy rights of EU residents. As American citizens, we aren’t granted the same protections, but our companies will be forced to implement security and data privacy controls to vigorously protect the personal data of EU residents, if they market or sell goods or services to EU residents. An estimated 57% of American companies will be impacted by GDPR regulations.3 It remains to be seen whether US companies will ensure privacy protection for US and EU citizens equally.
And why shouldn’t companies like Cambridge Analytica and Facebook continue to exploit the personal data of American citizens? We have no omnibus privacy law like GDPR to protect us. Facebook has been conducting psychological experiments on its users for years, specifically placing ads in your line of site based on the information we give up. We don’t pay any money to use it, which means they have to make money selling targeted advertising they think we want to see. They alter the newsfeeds to influence our emotions.4 What once started as a dream to build a great online community has morphed into a great psychological weapon sellable to the richest buyer.
Where are our political leaders in all of this? Why doesn’t their response match the act? Americans deserve the same privacy rights as the Europeans.
With all of the talk about Identity Theft, protecting our personal data is made much more difficult by the fact that companies retain our personal data in their systems without our consent. Most of the time, we don’t know who has it or what they do with it. If a company holding your personal data is breached, you have to wait to find out if you were affected, or if they adequately protected your data. Did you receive a letter from Equifax in the last year informing you that your data was breached?
Data Privacy Laws in the United States just don’t protect us sufficiently.
If you live in the US, there is no regulation that protects your purchasing, Internet surfing or consumption habits and preferences. We have no single omnibus law that protects our privacy. Instead, we have law enforcement officials claiming that privacy has gone too far, and that those laws get in the way of counterterrorism intelligence efforts.5 I am certainly not advocating that law enforcement should be precluded from reasonable means to investigate potential criminal or violent activity. However, that reasoning shouldn’t stop lawmakers from drafting bills to protect us from corporate predatory practices. As an advocate for Privacy, and as I consider all of the looming threats within the cyber sphere, I believe its time for the US to adopt a similar approach to privacy.
Its time to develop a GDPR for the rest of us!
Secure Compliance Solutions is the trusted security advisor for Chicagoland’s small-to-medium businesses. We offer a variety of services that promote a strengthened security posture and a culture of compliance. Our solutions include: risk advisory services, strategic cybersecurity planning, security and privacy awareness, regulatory guidance, penetration testing, and managed security services. We tailor our engagements and solutions to align with your cultural needs and business objectives; not the other way around. We keep your appetite for risk, budget constraints, and timeline in mind to define strategy and operational tactics that maximize your return on investment. At SCS, we help you navigate the course of your cybersecurity journey.