The Basics of Data Privacy
By: Seth Lee
Tags: Technology, Personal Data, Data Science, Privacy, Data Privacy

What is Data Privacy?

A lot of talk in the news in recent times has been on the subject of data privacy. Most people have heard of the Facebook-Cambridge Analytica Scandal and Google+ Bug, but the actual definition of data privacy is something that escapes a lot of us. In today’s tech-savvy society, where personal information is increasingly being stored as digital data, it is important to understand how one’s personal data can be used by others, and also how to safeguard against the misuse of personal information.

In the article Data Privacy Concerns: An Overview for 2019, Rhonda Bradley, writing for The Manifest, lays out what constitutes as personal data and how it can be misused by both big companies and cyber-criminals.

In short, personal data is personal information that can be used to identify a specific individual. This includes, but is not limited to one’s email address, phone number, date of birth, credit card information, and social security number. More recently, this has also come to include one’s facial and voice recognition data.

The focus of data privacy is often on how to safeguard personal data against malicious activity of criminals. Once scammers have a hold of someone’s personal data, they could use that information to send them robocalls and emails, hack into their social media accounts, gain information about their family members, and even access their banking and credit card information.

Hackers can potentially access banking and credit card information using the personal data of their victims.

But being the target of malicious activity by criminals is not the only data privacy concern people need to be aware of. Many reputable companies that play a large role in our daily lives — such as Facebook, Google, and Uber — have been found to be negligent in their handling of the personal data of their users.

All three of those corporations have experienced a massive privacy breach. Instead of alerting users that the security of their personal data had been compromised, they decided to keep the news to themselves upon discovering their respective privacy breaches. It was not until much later that the companies finally admitted to their mistakes, either by their own admission or through the emergence of a whistleblower. This has brought to light the topic of corporate responsibility in protecting users’ privacy, and there is now a lot of discussion regarding how much responsibility corporations must bear, and how much users themselves must be held accountable for.

Big companies collect huge amounts of data on their users, but are not always responsible in their handling of users’ personal information.

Case Study: FaceApp

Developed by Russian company Wireless Lab, FaceApp is a mobile app that uses the picture of the user’s face to create realistic transformations of their face using artificial intelligence. The company’s website brands the product with the slogan: “Transform your face using Artificial Intelligence with just one tap”. Using FaceApp, users can upload a picture of their face and instantly receive a realistic image of how they would look either older or younger. While the app’s capabilities are innovative and entertaining, the company’s use of users’ data has been more than questionable.

Using FaceApp, users can transform their face to see how they would look with different ages and genders. Image from: FaceApp

The controversy surrounding FaceApp is regarding the fact that the app’s creators are harvesting the metadata from users’ pictures. The terms and conditions (as of November 2019) on FaceApp’s website state:

“FaceApp, its Affiliates, or Service Providers may transfer information that we collect about you, including personal information across borders and from your country or jurisdiction to other countries or jurisdictions around the world. If you are located in the European Union or other regions with laws governing data collection and use that may differ from U.S. law, please note that we may transfer information, including personal information, to a country and jurisdiction that does not have the same data protection laws as your jurisdiction. By registering for and using the Service you consent to the transfer of information to the U.S. or to any other country in which FaceApp, its Affiliates or Service Providers maintain facilities and the use and disclosure of information about you as described in this Privacy Policy.”

Users’ photos may be transferred to foreign countries and used for unknown purposes there, all without the knowledge of the users themselves. The more alarming news is that FaceApp is not the only app, or even only photo-editing app, with weak privacy protections.

Granted, a lot of the concern over FaceApp being able to harvest such data from their users is the fact that the company behind the app is Russian. Due to the close relationship between Russian companies and the Russian government, the fear is that the Russian government will collect this user data and use it for its own purposes. However, despite the fact that tech companies and users in the US enjoy a higher level of legal protection from the government in general, users of American-made apps should still be cautious of how their data could be exploited.

While American companies such as Snapchat and Instagram try to comply with privacy laws in general, incidents such as the Facebook-Cambridge Analytica scandal show that large tech companies can still fail at protecting the privacy of their users’ data. Regardless of the origin of the company, app users should be cautious of how their information could be used, even by the largest and most reputable of companies.

How to Protect Your Data

In this day and age, it is important to know how to safeguard one’s personal information.

While there are data privacy regulations in place, such as the General Data Protection Regulation (GDPR) that protects netizens in the European Union, companies cannot be trusted to always follow the rules. Also, cyber-criminals will simply ignore data protection laws, or they will operate from countries where these protections do not exist.

So how should users go about protecting their personal data?

Use passwords for all devices

Ensure passwords are both strong and changed regularly

The same password should not be used more than once

Free WiFi services should be avoided

Privacy and sharing settings on social media accounts should be checked regularly, and inactive online accounts should be closed

Ultimately, users may never be 100% safe from cyber-criminals, but staying aware of the latest scam tactics and knowing how to protect personal data against these scams will reduce the risk of becoming victimized by cyber-crime.

While it is almost impossible to be integrated into today’s digital society without giving out personal data to big tech companies, being aware of these companies’ policies, and being informed of the latest tactics used by cyber-criminals will help users to understand how best they can protect their personal information.