Data Privacy Protection: A Modest Proposal

Apologies upfront to all you Jonathan Swift fans, but this article on data privacy protection isn’t going to be a satire--I’ve already read way too many postings on this very serious matter that seem little more than that. Data privacy protection has, in fact, become a vital issue in recent years as mobility, social media and advertising-supported web services have redefined the relationship between consumer and service provider. My purpose here today is to clear up a bit of confusion around exactly what privacy is, but, more importantly, to present a simple--and, hence, modest, proposal--that I think will go a long way toward strengthening and sustaining that critical relationship.

What is Data Privacy?

Let’s start with definition. First and foremost, privacy is most certainly not the same as security, despite many people using the terms interchangeably. Security is about policy, of course, but also the mechanisms relating to authentication (and, thus, identity, which we’ll return to later), encryption, physical security and the overall integrity of any given IT solution. Security, then, is the what and how, and will always be the one area of IT--and, increasingly, our personal lives--where the job is never “done.”

Privacy, on the other hand, is social and thus political. It's the information about ourselves we wish to (and are legally allowed to) keep proprietary or made available to a limited number of designated and approved "others," be they individuals, groups or corporations.

For example, essentially everyone in the United States has a Social Security number. This number is supposed to be used only for Social Security and tax purposes, not for identification--it says so right on the card. However, Social Security numbers are used for identification--and identify--along with such items as one’s date of birth. We make these elements available to suppliers of services so often that it invites compromise; in fact, compromise is inevitable. And, of course, once any piece of identifying information is compromised, it remains so forever. The bad guys really don’t have to work very hard because the social ethic surrounding privacy, along with the laws that should be in place to protect us here, simply do not exist.

With that said, there is hope for progress in this area. The European Union's GDPR regulations, for example, are law only in the EU, but they are having a global impact on privacy. Key requirements include careful protection of consumer data and the ability for consumers to control any gathered information. Penalties for non-compliance are potentially severe, but we’ll see how that element plays out. The problem with GDPR is that it’s amazingly complex, and still requires both legal testing and clarification in more than a few places. Plus, it doesn't benefit organizations that don't do business outside the United States.

Keeping it clean

So, here’s the modest proposal: All proprietary identifying information about a particular individual shall remain confidential and proprietary to that individual unless and until that individual explicitly and knowingly discloses such information to another party, with such disclosure only made under the terms of an appropriate agreement. “Appropriate” is of vital importance, as the privacy statements used by essentially all online service providers today are so complex as to be useless for this purpose in many if not most cases. Regardless, they do little to curb the surrendering of far too much information, which serves only to enrich the “supplier” at the expense of the consumer, as we saw with the recent Facebook debacle.

For the record, we have recommended that individuals never post anything about themselves on Facebook, and we leave it to the reader to review Facebook’s agreements and policies to understand our position here. But, again, given that recent debacle, it shouldn’t be hard to understand why we take this position--one thatcould easily be applied to almost every other consumer-based online service today. Bottom line: You are their product, and the more they know about you, the more valuable you are--to them. And with no meaningful regulations (again, absent a GDPR-like law) in place, you are pretty much out of luck here with respect to your personal privacy--which, in fact, disappears and with your help, no less!

In effect, I’m arguing for opt-in only in any relationships between individuals and other individuals or groups when it comes to personally identifiable information. Simple as that.

The slippery slope

You might think that most information isn’t all that interesting, but if, just for example, you’re a purveyor of Mac spyware or ransomware or worse, it might be interesting to know who’s using the Safari browser, which only runs on Apple products. That information can be obtained from a Website you think you can trust, but that's selling such data without so informing you. More than a few seemingly minor tidbits are indeed sensitive, and, to the degree that these elements identify a particular individual, the potential for damage to an innocent person is enormous. Just think: Your location right now could be in the hands of people you wouldn’t trust with a dime.

Many mistakenly assume that there is a Constitutional right to privacy stemming from the Fourth Amendment. However, the Constitution covers only the relationship between individuals and the government--not those between individuals or groups such as corporations. As such, new laws are required--ideally at the federal level, but let’s get started regardless.

At the root of all of this mess is, I believe, a fundamental failure at the societal level to address not security or privacy, but identity and authentication--or, the act of proving that you are whom you claim to be. Maybe, when you’re born, you should get a private key that’s yours for life. But such is a topic for another day; if I’ve just raised a tiny bit of awareness today, I’m happy--but just for now.