Why consumers must start demanding greater data privacy

American Senator Sherrod Brown seems to have had enough of privacy policies: The ones that exist solely to get permission to take your personal data, which they will take anyway. His proposed legislation, the Data Accountability and Transparency Act, released in June, seeks to restrict the collection, usage and sharing of personal data to when it is strictly necessary to carry out 12 permissible purposes. It also calls for a regulator to protect individuals’ privacy.

Needless to say, it is highly unlikely to find the required legislative support to pass. After all, it hacks at the very business model of the Internet age — sell a product for ‘free’; In return, collect personal information of the buyers, and sell that for much higher profits. Take for example, Facebook, one of the most valuable companies in the world. Facebook users don’t ‘pay’ a dime, while 98.5 percent of the revenue that gave it its $650 billion market capitalisation came from advertising.

What is Facebook’s USP? It targets ads at those who are most likely to use the products, to know who to target, their algorithm follows you all over the Internet tracking your activity (not just on the Facebook app or website) — what you search for, who you speak to, what articles you read, how each of them make you feel. Some companies’ algorithms can figure out whether you’re angry after reading an article, or thrilled. Let’s say, they notice you have become angrier after reading articles about the country’s response to the coronavirus pandemic, they might show you content that shows the ruling party in a good light —  paid for by the said party, of course.

***

Facebook is not an exception. The purported reason for the Indian government’s ban on 59 apps is that personal data belonging to Indian users were being sent to servers based in China, perhaps even shared with the Chinese security apparatus. Some of these were illicit. For example, in early May, Forbes had reported that mobile phone-maker Xiaomi might be collecting data about your browsing habits even when you are browsing on ‘incognito’ mode — clearly deceiving users. Xiaomi made amends in mid-May, announcing that it was changing this policy.

Many others, such as the activities of apps such as Camscanner and ShareIT, however were within the standard rules of conduct. Before allowing use of their services, they demand access to the data (documents, photos) scanned or shared using the app.

However, it is important to remember that this is not just something that happens with Chinese apps. Gmail, for instance says “We also collect the content you create, upload, or receive from others when using our services. This includes things like email you write and receive … ”. Users consent to such data collection when they send emails through Gmail without realising the complete loss of privacy.

So it turns out, free comes with a lot of strings attached.

***

However, the danger is not just unauthorised data collection. A hugely profitable (and often, behind the shadows) industry exists that could make money out of analysing data and selling its results to those trying to influence customers. Let’s say, your Internet activity could indicate you are prone to anxiety — pharma companies could target you with content that exaggerates your symptoms, along with suggested medicines. Location data could give a good idea of an extramarital affair — data indicating that two people who have never crossed each other meet at either of their residence periodically for short periods, for instance — a tool for blackmail.

Pornhub, the world’s largest pornography site, releases data about the site usage annually. For example, the 2019 report tells us that female visitors spent 23 seconds longer than males, and that there was a growth in visitors in the age group of 25-34 years to the site; even as the number of visitors in the 18-24 year and the 35-44 years demographic was falling. It is fascinating analysis, till the penny drops: ‘How does Pornhub know one’s age and gender?’

The fact is websites know much more about you than you realise; and are making money off you. Website builders and app developers know that people don’t really read privacy policies. Even if people had a concern, would they choose not to avail of a free service because of a suspicion that data may be potentially misused? If that is the case, then why go through the charade of taking consent in the first place?

***

Brown’s formula might simply mean that the Internet would simply become much more expensive — as Internet companies will be forced to charge its users, like normal businesses do. That is simply an impractical solution, given how used we have become to ‘free’. However, it should not mean that we should shy away from asking hard questions to Internet companies.

For starts, data collection must be restricted to activity on the site or app collecting data. Facebook, for instance, has no business following you around the Internet adding to their profile of yours. Second, policymakers can also consider imposing hard boundaries within which data analytics must operate — what data can be collected, what it can be juxtaposed with, and who it can be sold to.

Companies should be forced to give clearer graphic guidance on what they propose to do with the data collected. Privacy-minded users should have the option to consent to sharing only the data that is necessary to avail of the service, rather than a carte blanche ‘yes or no’. We must also consider whether the time has come to impose privacy standards, and minimum requirements — just like we have quality standards in the physical world.

The present unregulated framework for the Internet developed when we were still unaware of the damaging effects of widespread data analytics. That doesn’t mean it should stay that way.

Abraham C Mathews is an advocate based in Delhi. Twitter: @ebbruz. Views are personal.