Please, can we keep in touch?
By: Jonathan Rez
Tags: Hcd, Policy Design, Legal Design, Ucd, Service Design

It’s been a year since GDPR came into effect. All in all it’s been a terrible administrative headache for organisations and many are still grappling with interpretation and compliance. But outside work, as consumers we’re supposedly more in control of our personal data and happy to have purged a big chunk of spam from our inboxes a year ago today.

It is however mind bending to consider the billions of emails that had to be sent out to facilitate this. Billions of emails, most of which were not read by their recipients. Billions of emails sent by thousands of companies that each wrote their version of practically the same email.

Photo by Ben Harritt on Unsplash

Beyond the issue of data protection, GDPR is the story of someone or something at the beginning of a certain chain-of-events not considering how someone or something further down the line will have to enact / implement / operationalise decisions which were made upstream. It provides great insight into lawmaking, highlights how lawmaking is not user-centred, and demonstrates why it’s time for transformation in the way legislation happens.

The GDPR story of my inbox

“Ping”.

An email arrives. I somehow know it’s another GDPR email. I think Might have developed a sixth sense. Or an allergy. Or who knows what.

Do you remember those emails? When they started trickling into my inbox in early 2018 it became clear quite quickly that something was not properly thought out. “Am I seriously going to receive the same, but not-the-same email every few days? Did someone seriously think that I will read each of these?” Hand-on-heart, how many of those have you read?

Between early 2018 and early 2019 my inbox was assaulted a total of 127 times by GDPR emails from companies, big and small, each asking me to read their updated privacy policy, often also their T&Cs and then let them know whether I agree for them to keep in touch with me.

The keen ones started trickling into my inbox as early as February 2018, initially only one every few weeks. The flow intensified with GDPR emails in full spate by May 2018. Saturation point was, as you’d expect, during the final 48 hours before GDPR became law, as companies scrambled to join the party. Throughout the 24th of May 2018, a total of 28 GDPR emails poured into my inbox.

By that point I had already switched off email notifications to avoid the constant distraction and I was eagerly awaiting the GDPR emails cease fire. But as in real life, some folks just show up to the after-party; GDPR emails were still dripping in to my inbox into 2019.

Such is the scale of the noise caused by the legislation as shown through one person’s inbox.

Graph showing the arrival of GDPR emails into my inbox. The big spike was on the eve of the legislation.

A year later, as I scroll through my collection of GDPR emails, shouting at me with subject lines like “IMPORTANT”, “ATTENTION” and “ACTION NEEDED” not always, but often in capital letters, one subject line smiles out at me, trying to console and cheer me up.

“Please, can we keep in touch?”

It was a refreshingly light touch in amongst all the perfunctory drivel, as if the senders of this email acknowledged that we’ve all been forced to partake in this seriously ill-conceived lawmaking. Why not take it lightly and do it with a smile?!