Last week I was in one of my favourite cities – Istanbul. Not for pleasure unfortunately, but for our EMEA QBR. I was passing time in the airport lounge, flicking between news stories on my iPad, when I was struck by the amount of articles on the ‘right to be forgotten.’
ENISA – the European Network and Information Security Agency – defines this concept as ‘any person having the right to have personal data rectified, erased or no longer processed.’ This essentially means that, should a member of the public want a website or company to delete his or her personal data, this request should be obliged.
The right to be forgotten, which may soon become part of EU Data Protection Regulation when member states vote in June, has caused quite a bit of controversy. From the public’s perspective, the right to be forgotten is only a good thing; growing concern regarding inaccurate or misleading information on the web has caused certain individuals to speak out about how Google searches on past failures, employment history or debt have damaged reputations today.
Despite the general consensus from the public, member states in the EU are at an impasse. Vivian Reding, the EU justice commissioner, champions the initiative, with a view to imposing serious fines on companies refusing to oblige requests to erase personal data. Yet, nine member states of the EU want to opt-out of the legislation, concerned that it’s a form of censorship that threatens online free speech. It’s worth noting the proposed legislation does not include journalistic archives, comments or articles on posts from bloggers, who are exempt under the freedom expression.
In addition to the right to be forgotten, the EU is asking for companies to notify affected individuals of personal data breaches within 24 hours. From a security perspective, any company that frequently handles consumer data should always put the customer’s interests first. Today’s “knowledge assets” are lucrative targets for cyber criminals. But determining the best course of action to protect consumer privacy is not an easy task. Transparency in how consumer data is being used and by whom is key, and implementing data governance programmes that allow businesses to monitor sensitive information is part of the solution. If customers ask for their information to be deleted from archives, then the onus is on the business to manage this process with the customer in mind.
However, it’s not just the responsibility of the business to protect customer information assets. Consumers themselves also have a role to play in ensuring their own information doesn’t fall into the wrong hands. Personal data can leak in a variety of ways. A recent survey by The Guardian asked readers on their experience of internet privacy and common complaints. These were:
· Difficulty with erasing social media accounts and all associated data
· Problems with Google Search function elevating outdated or incorrect results to the top of the page
· Lack of control over pictures posted by other people
The last complaint is a common problem for people who share their passwords with loved ones. According to a recent McAfee / MSI International survey, 56% of the 1,000 respondents had shared their email details with their partner, while 50% shared other passwords such as phone PIN or social media logins. This ‘what’s mine is yours’ mentality can backfire and lead to content being posted online that wasn’t intended.
The internet is the stereotypical elephant – it never forgets. As we go about our daily lives, sending emails, writing articles online or updating social media pages, we’re leaving a digital footprint tracking our every move. While some of us may fall foul of inaccurate Google searches or dusty company archives, the best way we can protect ourselves is by controlling what we put online in the first place.
