This week in IT: Tackling privacy breaches in an era where data is the new oil

When Facebook’s Mark Zuckerberg founded his social networking empire, privacy would have been least of his concerns.

It was mid-2000s, a different time as business models around social networking were just evolving and he was competing with Google’ now-defunct Orkut.

In the decade that followed, Zuckerberg’s successful business structure that made revenue by mining user data and selling to advertisers did pay dividends. It made him one the richest men in the world and also one of the most influential.

In 2019 though, one could say it is this very business model that made Zuckerberg super rich has become a double-edged sword.

Last week the Federal Trade Commission (FTC) had fined Facebook $5 billion for breach of privacy, the largest fine ever awarded by the regulator  after it found that the company misled its users on how its handles their information.

That was not all though. The Commission also mandated Facebook to create an independent privacy committee on its board to ensure that Zuckerberg does not have complete decision-making powers over privacy related issues.

Will that be enough to actually address the privacy concerns raised? We are yet to see, say experts as in recent times, Facebook has been facing severe backlash in the light of privacy breaches. This includes a security lapse that led to the hacking of 50 million Facebook user profiles and users' inability to control what data can be accessed despite the privacy features offered.

This incident led to a series of privacy breach investigations. This is of importance to India as well considering that India accounts for about 270 million users, the highest followed by the US at 190 million, according to Statista.

European Union’s privacy watchdog fined Facebook $62 million for violation of General Data Protection Regulation (GDPR) in May 2018, when it was first implemented. Ireland's privacy regulator is investigating a case about Facebook’s storage of user’s password based on the allegation that the company is storing it plain text instead encrypted text. The penalty for this could go up to $2.2 billion. In October 2018, the European Union began a fresh investigation into a case where a security bug in Facebook’s system allowed hackers to access information to close to 50 million accounts. If  proved of misconduct, the fine will be close to $1.63 billion.

FTC’s mandate to put in more measures to ensure privacy would definitely make Facebook take another at how its user privacy is handled. This would probably include more features that enable users to have some autonomy over data.

But with the lack of privacy regulation in the US, it makes one wonder whether it would make a difference in the way Facebook operates. Unlike the EU, the US does not have an umbrella policy for regulating privacy except for the state of California.

That is why, according to a Bloomberg article, the privacy committee and other features will create no significant impact on how Facebook collects, stores or shares data.

“It will have little to no effect on the company’s advertising business. And all that added scrutiny and oversight? In practice, it’s likely to amount to some added paperwork and bureaucracy that a company of Facebook’s means can weather with ease. As for that headline-grabbing penalty, that's hardly going to hurt,” the report noted.

As the report pointed out, Facebook had always been able to get away by paying a fraction of their revenues. The company's registered revenue was $17 billion for the quarter that ended on June 20, 2019.

At a time when the massive amount of data generated can get in the hands of organisations, the only solution is probably to go the EU way by having a law that governs data privacy, something that many countries are recently implementing, including India. Going by reports, India’s data protection bill is likely to be passed in the current parliamentary session.

It still might not be enough, but the fact that there is a data privacy and protection regulator in place will be reminder that it a consumer’s data cannot be taken for granted like before.  ​