Top Data Privacy Issues: Examples and Solutions

Businesses and individuals are on different sides of the table of data collection and use. Businesses require data to serve their customers well, while the individual customer won’t release it until they are sure of the intended purpose.

This is a simple way of explaining the tussle between businesses, individuals, and governments on data privacy issues.

The existence of data-privacy-centric regulations like GDPR and CCPA, advanced digital surveillance and data mining technologies, and increasing dependence of businesses on data further becloud the issue.

In this article, we aim to explore the concept of data privacy, what it means for businesses and individuals, and viable solutions to these issues.

 

What’s Data Privacy?

Data Privacy simply refers to the control process of managing personal data in a way that abides by its intended use. How it is collected, stored, managed, and shared must comply with data protection laws and regulations.

This definition makes data privacy look more like a business policy than a consumer’s concern. Yet, consumers are key stakeholders, and they have a significant amount of influence on what happens with the data they give.

Data Privacy is also defined as “the right of an individual to keep their information private.” Thus, they exercise their rights if they refuse to give out their data or give out wrong information. However, this is unpleasant for data-driven businesses today.

Data privacy issues stem from this clash of interests of serving the customer’s rights and the business’s aim of making a profit. When consumers give out their information to businesses, they expect that it is used and kept as agreed. Sometimes that’s not the case.
The government is a third player in these privacy problems. It mediates between the consumer and businesses by establishing regulations and punishing offenders. An organization can be challenged by the government over its data handling practices and even fined if found wanting.

 

Data Privacy vs. Data Security?

The two terms are often used interchangeably to mean the same thing. But they are not.

Data Security refers to standards and protocols in place to prevent unauthorized access to digital data or any form of intentional or unintentional alteration, deletion, or disclosure of data.

Think of data privacy as allowing only people you want through your door. Data security is how you ensure that nobody enters your door till you let them.

Both concepts are connected but are different things entirely.

Data security focuses on protecting data from malicious attacks and preventing the exploitation of stolen data (data breach or cyber-attack). It includes Access control, Encryption, Network security, etc.

As explained earlier, Data privacy concerns the proper use of the data. Therefore, a set of practices that ensures data privacy is not enough. Businesses and individuals must take action to secure their data — they do that via data security practices.

Data security issues for businesses include how they protect data from compromise by external attackers and malicious insiders. Enforcing the security systems involves setting up processes and procedures that ensure proper data handling, hence data privacy practices.

As consumers, data security describes actions like setting a multifactor authentication system, clicking secured internet links, and using password managers. These actions will prevent illegitimate access to your personal information.

 

Data Privacy: Information Categories

Digital Data is classified in many ways. However, concerning data privacy and security, we can classify data into four they are as follows:

• public data
• general personal data,
• sensitive personal data
• anonymized data

 

Public Data:

This type of data is freely accessible to the public. It can be freely used, reused, and redistributed without repercussions.

Public data requires no authorization from anyone to be accessed or used. While little or no controls are required to protect the confidentiality of public data, some level of control is required to prevent unauthorized modification or destruction of public data. They are regulated solely by public laws.
Public data cannot be used to identify a person. They often describe demographics and not individuals.

In contrast, Personal Data includes information that can partially or outrightly identify an individual. This kind of data requires authorization before it can be altered or even collected.

 

General Personal Data

This form of personal data is already in the public record, such as a phone book and online directory. Ordinary personal data may include personal identification details such as name, address, date of birth, IP address, or other similar non-sensitive information.

This can include all personal data a user gives during online interactions. It can also include data like device IDs or cookies and others that cannot be fully used to identify a person in isolation.
However, some privacy laws hold that even cookies can be considered personal data because they can leave traces that adversaries could use in combination with other identifiers to establish a person’s identity.

 

Sensitive Personal Data

Some details are considered more personal than others. This type of data is known as “sensitive” information because it can be used to identify, contact or locate an individual or distinguish one person from another.

The following information is sensitive personal data:

Personally Identifiable Information (PII) — 

1. Names: full name, maiden name, mother‘s maiden name, or alias;
2. Personal Identification Number, such as Social Security number (SSN), passport number, driver‘s license number, taxpayer identification number, patient identification number;
3. Personal characteristics, including photographic images(especially of the face or other distinguishing characteristics), x-rays, fingerprints, or other biometric images or template data (e.g., retina scans, voice signature, facial geometry);
4. Student records: grades, transcripts, class schedule, billing details, and other educational records.
5. Information about a person’s sex life or sexual orientation

Personal Health Information (PHI) — Medical history, insurance information, and other health-related records.

Personally Identifiable Financial Information (PIFI) — Credit card numbers, bank account details, transaction history, or other data concerning a person’s finances.

Residential and Geographic Data —Address information, such as street address or email address.

Political Data — Details of racial or ethnic origin, political, religious, or philosophical beliefs, union membership, or affiliation.

Some of the above may be regarded as general personal data when used individually, but when linked, it is regarded as sensitive data.
For instance, if you have someone’s name, you hold their personal data. However, if you also hold data identifying them as union members, you hold sensitive information.

Anonymised Data

Anonymized data has been entirely stripped of all personal information. They cannot contain any key or additional information that could be used to link the information to an individual. This form of data is said to be de-identified.

A de-identified dataset might be re-identified depending on the system of de-identification. If the data was encrypted, i.e., scrambled beyond recognition using cryptographic techniques, re-identification is possible. All that is required is a key, a cryptographic key.

A pseudonymized data can also be re-identified. Such data is de-identified by changing the ‘personal’ elements so that it cannot relate to or identify any individual. The data set is re-identified by matching additional information.

Please note that true anonymization of data is not reversible.

 

3 Common Data Privacy Issues

Leading a privacy-centric digital life may seem almost impossible. There are many obstacles and issues to resolve to ensure your internet experience is genuinely private. Here are three of these pressing issues and what you can do to solve them.

 

Access Control Is Difficult

Controlling who has access to data affects how the data is handled. For businesses, this is the Achilles of any data management strategy. It is not enough to specify who has and does not have access to data; strict compliance with these rules is necessary.

As individuals, controlling access to your data is a bit tricky. You can’t just pick and choose who receives information. Malicious agents can gain access to your device and data even without your permission.
What can be done?

• Use Incognito Mode when you have to browse the internet with sensitive information. This prevents any unauthorized persons from accessing the data via your device.
• Use password managers. They help you keep track of your online passwords and keep them safe. This way, you retain control over who accesses your online accounts.
• Avoid public connections. They are hotspots for malicious agents to gain entry to devices and steal data.
• Update your device’s software regularly to fix security flaws that may grant intruders an entry. The best thing is to configure your software for automatic updates. In a case where that’s unrealistic, make a schedule to allow for timely updates of your system software.

 

Tracking Seems Inevitable

Advertisers, websites, and other agents deploy various strategies to track and identify internet users. Third-party cookies and browser fingerprinting are examples of such strategies; even IP addresses tell a lot about you on the internet.

What can be done?

• Use privacy-centric tools like anti-detect browsers. 
  Anti-detect browsers like Incogniton enable you to enact whatever level of anonymity you need for your browsing session. You can create virtual browser profiles, each with a unique browser fingerprint, enabling you to go beyond internet tracking techniques like browser fingerprinting.
• Use VPNs or Proxies.
  Proxies and VPNs mask your IP addresses. VPN adds an extra layer of protection by encrypting the data you send and receive.

Though VPNs are recommended tools to limit internet tracking, the question remains: are VPNs safe?

We have seen instances where VPNs are found wanting, especially free ones. Also, VPNs are powerless in the face of sophisticated tracking techniques like digital fingerprinting.

Using VPN or proxies with anti-detect browsers is a great combination to experience the internet in a truly private manner.

Personal Data Can Be Stored for an Infinite Amount of Time

Websites like Facebook and Google ask for data and collect activity data on their sites and store it for an infinite amount of time. This becomes an issue when you no longer wish to keep such information.

What can be done?

• Delete stored data. 
  Websites are obligated to delete your data if you ask. Google, Facebook, and Instagram all have options to delete activity data and accounts.

Regulations on Data Privacy

Governments across the world have spelled out rules to enforce data privacy practices for businesses and protect their citizens. Though these regulations differ slightly in their wordings, they seek to achieve the same thing: businesses operate in ways that respect their citizen’s privacy.

Notable examples of privacy-centric regulations include European Union’s General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), and the Australian Privacy Act.

Companies get fined up to 4% of total revenue if they are found to flout GDPR.

These regulations also make businesses liable in case of data breaches. Customers can demand compensation for improper handling of their data.

How Are Businesses Responding?

Nowadays, businesses cannot operate without processing personal data in some way. Therefore, they, especially data-driven ones, are quickly reappraising their operations to remain competitive and profitable. Some even use data privacy as a competitive edge (think Apple and its iPhone’s Privacy 2021 update).

Some of the ways we have seen businesses adapt to the new rules include the following:

• Collecting less data
• Hiring dedicated personnel to manage data handling
• Training employees on data handling
• Establishing a culture of data privacy

Data-driven businesses, before these regulations, rely on individual data to personalize their services. These changes force them to adopt a marketing system that focuses on their audience. Instead of collecting lots of personal data from everyone, they collect fewer data, and it is not exactly unique to you.

Google’s Privacy Sandbox explores this concept further in its aims to make the internet more privacy-centric.

Another effect of these regulations is increased transparency on how businesses treat their customers’ data. A 2019 survey revealed that nine out of ten consumers believe that how their data is handled reflects how they are treated as customers. In this kind of world, businesses that thrive tell customers what they do with their data.

Governments keep passing more data privacy regulations and expanding the scope of these rules. Therefore, businesses will continue to play catch up. The way they will adapt will also keep changing. And hopefully, these changes will help make possible a truly private internet experience for users.

Conclusion

As digital technology continues to evolve, more ways to collect data from consumers spring up. For example, the Internet of Things opens up a world where everything is connected. This can lead to unauthorized surveillance and other security threats.

The question of how well to handle data is one both the individual consumer and businesses must answer. Both parties must take proactive measures to prevent the catastrophe that happens when malicious agents get access.

While businesses try to utilize data to serve their customers well and make profits, the customers must also be aware of how they give out their sensitive data.

Data privacy is a necessity as we continue to live in this digital world. It is a basic need of our digital life.

If you would like to read more on this topic, please read this article.