CS Jul-Aug 2023

privacy crisis
an inconsistent picture across data
requests to companies. Responses varied
dramatically: of all the access requests
put out, rates ranged from 65% of
companies not responding to one
volunteer to just 10% not responding to
another. Under GDPR laws, companies
are required to respond to consumer
requests - but many did not or made the
process difficult and time-consuming.
The study also found that processes put
in place to help consumers have more
control over their information online in
fact made them more likely to give it
away. The biggest gateway to personal
data for most users is the GDPRcompliant
'cookie banners' - but Demos
concluded the banner's design often
actively sought to dissuade users from
changing data permissions "through
nudges to incentivise you to agree to the
most permissive settings".
The study also found "accepting all"
on cookie banners frequently gave
companies permission to sell consumer
data onto data brokers - creating a black
hole in their ability to protect customer
data. "One of the biggest problems right
now is companies gathering enormous
amounts of data on people, selling it
off to data brokers and even they don't
know where it ends up," commented one
volunteer.
DOUBTS RAISED
This made them question whether they
wished to continue buying from that
company, explaining: "It's not necessarily
that I don't trust them as a brand not to
misuse my data - it's the fact that I don't
know who they're selling it to and who
that broker is selling it on to".
Study volunteers were also surprised by
the inaccuracy of profile information
companies had compiled about them,
based on their online activity. This
'propensity data' is intended to help
advertisers target users who are most
likely to be interested in their products.
However, this data is also used to make
decisions which have far-reaching
ramifications in the real world, such
as whether an individual would qualify
for a mortgage or credit card.
The study states: "We found a chaotic
system that profits from our data, while
doing little to empower users to exert
their rights: data is collected and inferred
about us, and used to make decisions in
the dark about what sort of person we
are, what sort of products and services
we should be offered - from health
insurance to mortgages."
PANDEMIC HANGOVER
Allan Dunlavy goes on to explain that
much of the issue was born out of
the Covid 19 pandemic: "For many
companies, the rush to move to
an online business model during the
pandemic resulted in shortcuts being
taken. We are seeing a lot of data privacy
codes of practice overlooked, despite
the best of intentions - with many
companies often unknowingly
contravening data legislation through
poorly set up processes. But with privacy
becoming a key focus for consumers,
companies need to take these issues
more seriously.
"It's time every company took a long,
hard look at how confident they are of
their data ethics. This is a strategic
reputational problem that
needs addressing in the
boardroom - not in
isolation by a
marketing or IT
team."
Law firm
Schillings
commissioned
the study as part of its 'Accept All:
Unacceptable?' campaign, highlighting
and addressing the urgent need for
society to do more to protect personal
privacy online. Volunteers from the
study can been seen in the documentary,
'Accept All: Unacceptable?', which was
also commissioned by Schillings, now
available to view on YouTube here. The
film sets out to answer the question :
"Why should we care about online
privacy?"
Allan Dunlavy, Schillings: we're in the
middle of the largest privacy crisis in
history.
www.computingsecurity.co.uk @CSMagAndAwards July/August 2023 computing security
13