Speaker 1: Get in touch with technology with tech Stuff from how
Speaker 1: stuff Works dot com either and welcome to tech Stuff.
Speaker 1: I'm your host, Jonathan Strickland. I'm an executive producer at
Speaker 1: how Stuff Works in I love all things tech, and
Speaker 1: today we're going to tackle a fairly topical subject, something
Speaker 1: that really came into play in the spring of and
Speaker 1: chances are you have received an email or two or
Speaker 1: two dozen or more from various companies about new policies
Speaker 1: that relate to g d p R. Often they will
Speaker 1: ask you for your permission to continue to communicate with you.
Speaker 1: So what's it all about? A Well, g d p
Speaker 1: R stands for General Data Protection Regulation and it's a
Speaker 1: data protection law, as the name suggests, and it's from
Speaker 1: the European Union or EU. But the Internet, as it
Speaker 1: turns out, is a mobile entity, so even if you
Speaker 1: do not live in the EU, you will likely be
Speaker 1: affected by this new law. In this episode, I'm going
Speaker 1: to go through the history of the law, what the
Speaker 1: law is actually all about, and how companies are doing
Speaker 1: as far as complying with that law. And here's a hint,
Speaker 1: there are some companies that are not even close to compliance.
Speaker 1: But we'll get to that First, let's look back to
Speaker 1: nineteen That's when the European Union adopted the Data Protection
Speaker 1: Directive or d p D. There was a different world
Speaker 1: back in the Worldwide Web was still a baby. Heck,
Speaker 1: I was still in college in n The heart of
Speaker 1: the Data Protection Directive was an effort to protect the
Speaker 1: privacy of citizens in the EU, and the EU as
Speaker 1: a whole has placed a high value on privacy, something
Speaker 1: that has been treated with uh, let's say, a more
Speaker 1: casual ual demeanor here in the United States, except in
Speaker 1: cases where something has gone terribly terribly wrong. The directive
Speaker 1: specifically covered how data can be processed and in what
Speaker 1: context it might be processed within the European Union. It
Speaker 1: didn't matter if the data was collected manually or automatically
Speaker 1: as and it didn't matter if there was a human
Speaker 1: in charge of it or if it was an algorithm.
Speaker 1: The rules were a broad overview, leaving up specifics to
Speaker 1: the member countries to actually adopt those those rules and
Speaker 1: incorporate them into their own laws. But some of the
Speaker 1: general tenants included that personal data could only be quote
Speaker 1: collected for specified explicit and legitimate purposes and not further
Speaker 1: process in a way incompatible with those purposes. End quote. Further,
Speaker 1: only the data needed for those purposes should be collected.
Speaker 1: There should not be a case of an entity collecting
Speaker 1: practically everything if that entity stated purpose is to run
Speaker 1: a process on just a narrow scope of all that data.
Speaker 1: This might remind you of the old days of Facebook apps,
Speaker 1: where you could uh or add ons. You know, there's
Speaker 1: little things that you could attach to your Facebook profile
Speaker 1: and they would ask you for permission to view certain
Speaker 1: parts of your information. Well, in the old wild West days,
Speaker 1: that could be anything, it could be absolutely everything, even
Speaker 1: though the app itself may only use a tiny bit
Speaker 1: of information at any given time, especially for whatever the
Speaker 1: app was supposed to do. Well. Eventually, Facebook cracked down
Speaker 1: on that and said, you know what, you should only
Speaker 1: ask permission to get access to the data you need
Speaker 1: to do whatever it is that you do, and otherwise
Speaker 1: you should leave everything else alone. That's kind of what
Speaker 1: was going on back in with this this directive. Further,
Speaker 1: the data was meant to be as accurate as possible,
Speaker 1: and if there were any indications that the information was
Speaker 1: inaccurate or it was out of date, it would be
Speaker 1: quote erased or rectified. End quote. And finally, the data
Speaker 1: would have to be kept in such a way that
Speaker 1: the identity of the individuals involved would only be knowable
Speaker 1: for as long as it was necessary to run the process.
Speaker 1: Once the entity has done whatever it needed to do
Speaker 1: with all that information, it was supposed to anonymize the
Speaker 1: data so that there would be no way of knowing
Speaker 1: who it pertained to. So once you had finished running
Speaker 1: whatever the process was, you had to make sure that
Speaker 1: the information would no longer be traced back to the
Speaker 1: people who gave you the information. In addition, the directive
Speaker 1: required entities to obtain user consent before collecting their information
Speaker 1: in the first place, and that consent had to be unambiguous.
Speaker 1: In addition, the data collector was under the obligation of
Speaker 1: providing the individuals with information about who was ultimately getting
Speaker 1: the data and to what purpose, as well as provide
Speaker 1: for an opportunity for the individual to review the data
Speaker 1: for any potential errors, so that way, you, as the
Speaker 1: person involved, could say, well, let me take a look
Speaker 1: at what you've gathered and make sure that you don't
Speaker 1: have any information that is inaccurate or out of date.
Speaker 1: Now already it might sound to you like this directive
Speaker 1: might have been a challenge to implement for a lot
Speaker 1: of reasons. In two thousand eleven, the European Data Protection
Speaker 1: Supervisor published an opinion titled quote a Comprehensive Approach on
Speaker 1: Personal Data Protection in EU end quote as sort of
Speaker 1: an update to this policy. By two thousand eleven, the
Speaker 1: Internet was much more mature than had been back in
Speaker 1: at least in the sense that there are a lot
Speaker 1: more people and businesses using it. There's still no shortage
Speaker 1: of immature content on the Internet anyway. By two thousand eleven,
Speaker 1: e commerce was a really big deal, and Internet access
Speaker 1: was increasingly being viewed as a right. But that also
Speaker 1: brought with it threats to privacy. Many of the Internet
Speaker 1: connected services we enjoy are constantly collecting data on us,
Speaker 1: either about no information about us in particular, or tracking
Speaker 1: our behaviors over time, and that data is kind of
Speaker 1: like currency. It's got value to it, So you and
Speaker 1: I might enjoy a service while simultaneously supplying information to
Speaker 1: the service provider, which in turn could potentially sell that
Speaker 1: information off to other buyers. This applies for everything from apps,
Speaker 1: to social media networks to smart devices. On January two
Speaker 1: thousand twelve, the European Commission proposed a reform of the
Speaker 1: data protection rules that came from in order to better
Speaker 1: represent the new digital landscape and protects in privacy while
Speaker 1: simultaneously supporting the digital economy, which is a really tough job.
Speaker 1: You've gotta balance a lot of stuff that way. So
Speaker 1: it was in fact so difficult it would take four
Speaker 1: years just to draft the new rules. In fourteen, the
Speaker 1: European Parliament voted on adopting a new set of rules,
Speaker 1: though those rules were not yet actually written. This was
Speaker 1: just the Parliament saying, yeah, I think it's time for
Speaker 1: us to actually have new rules. Regarding this, six votes
Speaker 1: were in favor of developing new rules, only ten votes
Speaker 1: were against it, and there were twenty two abstentions. The
Speaker 1: various governing bodies of the EU reached an agreement on
Speaker 1: the g d p R rules on December fifteen, two
Speaker 1: thousand fifteen. On April two thousand sixteen, the EU officially
Speaker 1: adopted the g d p R set of rules, but
Speaker 1: they would not be enacted for another two years. In
Speaker 1: other words, they said, hey, everybody, you have two years
Speaker 1: to get your act together. Here are the rules that
Speaker 1: you need to abide by go, You've got two years
Speaker 1: to get there. This decision also, by the way, repealed
Speaker 1: that previous nine directive. It said, it's not in addition
Speaker 1: to that directive. This replaces it entirely. As of the
Speaker 1: spring of the g d p R s provisions became
Speaker 1: directly applicable and all member states of the EU, and
Speaker 1: late in the spring, the EU published a corrigendum to
Speaker 1: the regulation. That means the EU published a list of
Speaker 1: corrections and clarifications relating to the law. And in the
Speaker 1: interest of full disclosure, I have to admit I needed
Speaker 1: to look up the word corrigendum because I don't think
Speaker 1: I've ever seen it before. One of the biggest differences
Speaker 1: between the g d p R and the earlier Data
Speaker 1: Protection Directive is in its binding nature. The dp D,
Speaker 1: as I said, was a set of policies that had
Speaker 1: to be transposed into the national law of each of
Speaker 1: the members of the EU, which created a somewhat fragmented
Speaker 1: and messy set of policies. The g d p R, however,
Speaker 1: is different. It has direct legal effect on all EU
Speaker 1: member states, with no need for the policies to be
Speaker 1: incorporated into those nations laws. So let's start talking about
Speaker 1: the specifics in the law. What does it cover and
Speaker 1: in what ways might a person's data still be used
Speaker 1: without their knowledge or consent. Much of the regulation affirmed
Speaker 1: the earlier Data Protection Directive, but here are some of
Speaker 1: the key points. And first I'm gonna look at the
Speaker 1: opening statements of the g d p R. The EU
Speaker 1: has identified the protection of persons in relation of the
Speaker 1: processing of personal data as a fundamental right, and that
Speaker 1: right includes the right of protection of personal data. At
Speaker 1: the same time, there's a need to allow for the
Speaker 1: free flow of data between member states of the European Union,
Speaker 1: so any regulations in place must not create obstacles between
Speaker 1: different member states. Citizens of the EU are allowed to
Speaker 1: move freely through the EU taking jobs in different member states,
Speaker 1: so their data should also be free to move through
Speaker 1: the EU with their consent. This next bit is pretty important,
Speaker 1: so I'm going to quote it directly. Quote the processing
Speaker 1: of personal data should be designed to serve mankind. The
Speaker 1: right to the protection of personal data is not an
Speaker 1: absolute right. It must be considered in relation to its
Speaker 1: fun in society and be balanced against other fundamental rights
Speaker 1: in accordance with the principle of proportionality. The regulation respects
Speaker 1: all fundamental rights and observes the freedoms and principles recognized
Speaker 1: in the Charter as enshrined in the Treaties, in particular
Speaker 1: the respect for private and family life, home and communications,
Speaker 1: the protection of personal data, freedom of thought, conscience and religion,
Speaker 1: freedom of expression and information, freedom to conduct a business,
Speaker 1: the right to an effective remedy and to a fair trial,
Speaker 1: and cultural, religious, and linguistic diversity. So, in other words,
Speaker 1: they were saying, yes, this is a fundamental right, but
Speaker 1: it does not take precedence over other fundamental rights. So
Speaker 1: there will come times when you have to take various
Speaker 1: things into consideration and you can't just say the privacy
Speaker 1: is the most important element in this particular scenario. You
Speaker 1: have to consider all the different parts and weigh them
Speaker 1: against each other. But what do we mean when we
Speaker 1: say processing data. Well, essentially, it means any sort of
Speaker 1: operation on information, whether performed automatically or manually. That includes
Speaker 1: collecting data, recording data, structuring it in different ways, organizing it,
Speaker 1: altering it or adapting it, consulting the data, using it
Speaker 1: in some way, transmitting the data, or even erasing the data.
Speaker 1: All of that is considered processing, so essentially, if you
Speaker 1: touch that data, you're processing it in some way. The
Speaker 1: document goes on to acknowledge that it is increasingly difficult
Speaker 1: and complicated to protect personal data in today's world. Globalization
Speaker 1: and the rapid exchange of information, coupled with platforms that
Speaker 1: encourage people to share their personal data, either explicitly or otherwise,
Speaker 1: have made it pretty hard to regulate. Gdp ARE also
Speaker 1: identifies two major categories of parties in addition to EU citizens.
Speaker 1: These are the data controllers and the data processors. The
Speaker 1: can trollers are the entities that determine why and how
Speaker 1: data will be used, and the processors are the entities
Speaker 1: that actually carry out those operations on behalf of a collector.
Speaker 1: One single company can be both a collector and a processor,
Speaker 1: or they could partner with other companies. All right, those
Speaker 1: are the basics. When we come back, I'll get into
Speaker 1: more specifics with the g d p R, but first
Speaker 1: let's take a quick break to thank our sponsor. One
Speaker 1: tricky thing in the policy is that it covers all
Speaker 1: entities that process data that belongs to EU citizens, even
Speaker 1: if those entities themselves are not in the EU. So,
Speaker 1: for example, let's say I have set up a new
Speaker 1: social networking platform and I'm calling it Strict Book. So
Speaker 1: I've got Strict Book, and I've built a data center
Speaker 1: in my garage here in the United States. But there
Speaker 1: are bowl in the European Union that have made accounts
Speaker 1: on my platform. And let's say that I make money
Speaker 1: by dealing in data to parties that want that information.
Speaker 1: So I gather information from my users and I sell
Speaker 1: it to various entities that want access to it. Maybe
Speaker 1: they want to market to my users directly some advertising
Speaker 1: to them. Well, I would be the subject to the
Speaker 1: regulations of g d p R because there would be
Speaker 1: EU citizens using my service even though my services located
Speaker 1: in the United States. So as long as those EU
Speaker 1: citizens were using my services while they were in the EU,
Speaker 1: I would have to play by this policy's rules. From
Speaker 1: the EU g DPR dot org site quote, the g
Speaker 1: d p R will also apply to the processing of
Speaker 1: personal data of data subjects in the EU by a
Speaker 1: controller or processor not established in the EU, where the
Speaker 1: activities relate to offering goods or services to EU citizens,
Speaker 1: irrespective of whether payment is required, and the monitoring of
Speaker 1: behavior that takes place within the EU. Non EU businesses
Speaker 1: processing the data of EU citizens will also have to
Speaker 1: appoint a representative in the EU. So essentially, what that's
Speaker 1: saying is, if you want to use the data that
Speaker 1: our citizens create, whether it's to market to them or
Speaker 1: you're tracking their information for some other purposes, you've got
Speaker 1: to play by our rules. Doesn't matter that you don't
Speaker 1: have your operations here in the European Union. The introduction
Speaker 1: also explains that the policy does not protect in all cases.
Speaker 1: For example, it says this regulation does not apply to
Speaker 1: issues of protection of fundamental rights and freedoms or the
Speaker 1: free flow of personal data related to activities which fall
Speaker 1: outside the scope of Union law, such as activities concerning
Speaker 1: national security. This regulation does not apply to the processing
Speaker 1: of personal data by the Member states when carrying out
Speaker 1: activities in relation to the Common Foreign and Security Policy
Speaker 1: of the Union. Likewise, in the case of law enforcement
Speaker 1: conducting an investigation, the policy does not protect personal data.
Speaker 1: The policy does, however, point towards other regulations in the
Speaker 1: EU that govern how law enforcement can access personal information,
Speaker 1: because it's not just willy nilly, they have to go
Speaker 1: through the proper procedures. However, they say there are obviously
Speaker 1: cases where persons private data may become an important element
Speaker 1: in some state level or law enforcement level UH process,
Speaker 1: and in those cases this does not protect him. You can't,
Speaker 1: as a citizen say no, police, you can't look at
Speaker 1: my personal data as part of this investigation, even though
Speaker 1: you lawfully obtained it by going through all the right processes.
Speaker 1: That would not be allowable under g d p R.
Speaker 1: Another limitation of the g d p R is that
Speaker 1: it applies only to information for a person who is
Speaker 1: identified or is identifiable by that information, which includes suit oonymization.
Speaker 1: What means the data is quasi anonymous, that if you
Speaker 1: were presented with the information, you might not be able
Speaker 1: to immediately identify who that information pertained to, but that
Speaker 1: with additional information you would be able to identify the person.
Speaker 1: So this is pretty important stuff, it turns out, because
Speaker 1: not that much information is actually needed to identify a person.
Speaker 1: For example, here in the United States, there was a
Speaker 1: Harvard professor named Latanya Sweeney who conducted the study a
Speaker 1: few years ago, and she discovered that all she needed
Speaker 1: was a zip code, a gender, and a birth date
Speaker 1: to identify up to eight seven percent of all people
Speaker 1: in the United states that's it. Three data points. Those
Speaker 1: three pieces of data was all it would be needed
Speaker 1: in order for you to say that those pieces of
Speaker 1: information specifically refer to this person, and it worked eighty
Speaker 1: seven percent of the time for all us adults. It
Speaker 1: doesn't take much to single someone out. That is why
Speaker 1: the pseudo not nymization term is used. It's pseudo anonymous.
Speaker 1: The policy goes a little bit further with this, stating
Speaker 1: that if it were to take an unreasonable amount of
Speaker 1: effort or money to ascertain the identity of a person
Speaker 1: based on this limited information, it's probably okay because it's
Speaker 1: unlikely anyone would actually go to those lengths. But the
Speaker 1: easier it is to identify a person based on the data,
Speaker 1: the more it falls under the protection of g d
Speaker 1: p R. But then, what about anonymous data? What about
Speaker 1: data that really seems to have no connection with any
Speaker 1: particular individual. The g d p R does not protect
Speaker 1: truly anonymous data. If there's no way to identify a
Speaker 1: single person out of a collection of anonymized data for
Speaker 1: statistical or research purposes, that's fine. So if you were
Speaker 1: doing an academic study that took demographics into account and
Speaker 1: the population size, you were looking at were sufficiently large
Speaker 1: enough to ensure no respondent could be identified from the information,
Speaker 1: you'd be all set. Not if you're worth king with
Speaker 1: a really small population size, anyone who is an outlier
Speaker 1: would be easily identifiable, and that would therefore fall under
Speaker 1: g d p R because it's not truly anonymous data.
Speaker 1: But if you're working with really big data sets, then
Speaker 1: outliers you will have enough of them to kind of
Speaker 1: make sure that anonymity is preserved, So again it's all spectrum.
Speaker 1: The g DPR also does not apply if you happen
Speaker 1: to be dead, but then at that point you're probably
Speaker 1: past caring about your personal data. Also, it's hard to
Speaker 1: have personal data if you, you know, if you're no
Speaker 1: longer a person. The g DPR also says that any
Speaker 1: party that intends to collect and process data must be
Speaker 1: transparent in its policies. So those policies have to be
Speaker 1: easy to find, and they have to be written in
Speaker 1: such a way as to be easily understood. You aren't
Speaker 1: supposed to obfuscate your intentions with unnecessarily complicated jargon or
Speaker 1: legal lease. This includes not just how data is collected,
Speaker 1: but to what purpose that data will be put so,
Speaker 1: if a cop he wants to collect information in order
Speaker 1: to sell it to other parties, it would have to
Speaker 1: disclose that in this policy and do so in a
Speaker 1: way that was pretty transparent, easy to understand, and the
Speaker 1: g d p R does not mess around. When it
Speaker 1: comes to the concept of a user consenting to have
Speaker 1: his or her data collected or processed, I quote, consent
Speaker 1: should be given by a clear affirmative act establishing a
Speaker 1: freely given, specific, informed, and unambiguous indication of the data
Speaker 1: subjects agreement to the processing of personal data relating to
Speaker 1: him or her, such as by a written statement, including
Speaker 1: by electronic means, or an oral statement. This could include
Speaker 1: tacking a box when visiting an Internet website, choosing technical
Speaker 1: settings for information society services, or another statement or conduct
Speaker 1: which clearly indicates in this context the data subjects acceptance
Speaker 1: of the proposed processing of his or her personal data. Silence,
Speaker 1: pre ticked boxes, or inactivity should not therefore constitute consent.
Speaker 1: Consent should cover all processing activities carried out for the
Speaker 1: same purpose or purposes. When the processing has multiple purposes,
Speaker 1: consent should be given for all of them. If the
Speaker 1: data subjects consent is to be given following a request
Speaker 1: by electronic means. The request must be clear, concise, and
Speaker 1: not unnecessarily disruptive to the use of the service for
Speaker 1: which it is provided. So yeah, it's a big deal,
Speaker 1: and companies are supposed to be real clear about this
Speaker 1: whenever they present a user with the option to opt
Speaker 1: into this kind of data collection and processing. Moreover, consent
Speaker 1: should be just as easy to withdraw as it is
Speaker 1: to grant, so if a user decides after giving consent
Speaker 1: to revoke that consent, it has to be possible to
Speaker 1: do so, and the entity collecting or processing the data
Speaker 1: has to knock it off. Citizens are will allowed to
Speaker 1: ask for all their data from a controller, and then
Speaker 1: those citizens can even send that data to another controller. So,
Speaker 1: in other words, potentially the g d p R could
Speaker 1: allow citizens to act as their own data brokers. Granted,
Speaker 1: personal data on an individual level is not worth all
Speaker 1: that much. It's mostly valued when it's in bulk, when
Speaker 1: you have thousands of people's data. Selling one person's data
Speaker 1: not that big a deal unless you're talking about things like,
Speaker 1: you know, credit card numbers and stuff like that. Even
Speaker 1: then it's not that expensive, So you might wonder how
Speaker 1: much is all your data worth? Well, that depends on
Speaker 1: the nature of the information and how much of it
Speaker 1: you're providing and who you are really. But there's a
Speaker 1: great post on medium titled quote how much is your
Speaker 1: data worth? And that uses some basic industry analysis to
Speaker 1: conclude that, on average, a person's data is worth about
Speaker 1: two forty dollars per year. But this calculation was done
Speaker 1: with a lot of assumptions, and that is something the
Speaker 1: author of the piece readily admits to. It's a tricky question,
Speaker 1: but still it could now be a question answered by
Speaker 1: individual citizens rather than data brokers. Related to this is
Speaker 1: the concept of data erasure, or better known as the
Speaker 1: right to be forgotten. A lot was written about this
Speaker 1: a couple of years ago when the EU first agreed
Speaker 1: to these rules, and I'll probably chat a little bit
Speaker 1: more about that later, but it is pretty tricky generally speaking.
Speaker 1: This policy says the data subject has the right to
Speaker 1: tell a data collection entity to cut it out, to
Speaker 1: delete all the collected data about that person, and potentially
Speaker 1: have third parties that partnered with that data collection entity
Speaker 1: to stop any data processing of the information. However, this
Speaker 1: has to be done with a consideration toward quote the
Speaker 1: public interest in the availability of the data end quote.
Speaker 1: So in other words, let's say you go and do
Speaker 1: something really really dumb, like colossally stupid, and news outlets
Speaker 1: pick it up and they cover your lostly stupid mistake,
Speaker 1: and now your name is associated with this terrible mistake
Speaker 1: you made, and you know you made it honestly, you
Speaker 1: didn't set out to make it. It just happened. But
Speaker 1: now it's attached to your name. Well, you wouldn't be
Speaker 1: able to just sweep that under the rug by asking
Speaker 1: all search engines to delete information about you, thus reducing
Speaker 1: the chance anyone would ever see that information about your
Speaker 1: dumb mistake, because it goes against the public interest of
Speaker 1: the availability of that data. This is one of the
Speaker 1: points that I was talking about just a second ago
Speaker 1: that a lot of news outlets were really focusing on.
Speaker 1: Because imagine you are, let's say, a political hopeful, and
Speaker 1: you decide you want to wipe out any references to
Speaker 1: your past that are online as best you can, and
Speaker 1: so you contact all of these different search engines to
Speaker 1: have all the information be quote unquote forgotten because you
Speaker 1: don't want people to dig up something you did, you know,
Speaker 1: fifteen years ago that would look really really bad while
Speaker 1: you're thing for office, that would be considered against this
Speaker 1: policy at this point. But there was a lot of
Speaker 1: discussion back when these rules were first being proposed that
Speaker 1: said this might end up causing some huge problems down
Speaker 1: the road. And it turns out and it needs to
Speaker 1: be a case by case basis. It's not like something
Speaker 1: that is clearly spelled out within the charter of g DPR. Well,
Speaker 1: we're going to take another quick break, but when we
Speaker 1: come back, I'll tell you a little bit more about
Speaker 1: this and how companies are doing as they try to
Speaker 1: measure up to g DPR. But first a quick word
Speaker 1: from our sponsor. So another change from the earlier Data
Speaker 1: Protection Directive is that the g d p R requires
Speaker 1: all system designers to incorporate privacy as part of the
Speaker 1: design from the start of their system, Like as soon
Speaker 1: as they start designing any kind of online system, data
Speaker 1: privacy protection has to be part of the design. Previously
Speaker 1: had been treated more as an addition to previously existing systems,
Speaker 1: but now system designers have to buy law incorporate privacy
Speaker 1: design into the actual development of their systems if they
Speaker 1: are to operate within the European Union. If a data
Speaker 1: collection or processing company detects a data breach, it is
Speaker 1: obligated under g DPR to notify affected parties within seventy
Speaker 1: two hours of detecting the breach, so three days afterwards
Speaker 1: they have to disclose this. That means that gone or
Speaker 1: the days when a company would sit on that information
Speaker 1: for maybe months or longer at a time. A data
Speaker 1: processor has to alert data collectors quote without undue delay
Speaker 1: in the quote upon detecting a breach. So let's say
Speaker 1: that Facebook is the data collector, and let's say there's
Speaker 1: an app out there are an add on, some form
Speaker 1: of enhancer for Facebook that is operating, and then the
Speaker 1: enhancer detects that air systems have been breached. They would
Speaker 1: be obligated to alert Facebook to that problem without undue
Speaker 1: delay in order for Facebook to take any measures it
Speaker 1: could under the g d p R, and then it
Speaker 1: would also have to alert all the people affected by
Speaker 1: this within three days. The g d p R also
Speaker 1: sets up the basis for a mandatory data protection officer
Speaker 1: for organizations that have core activities that quote consist of
Speaker 1: processing operations which require regular and systematic monitoring of data subjects.
Speaker 1: On a large scale, or of special categories of data
Speaker 1: or data relating to criminal convictions and offenses end quote.
Speaker 1: Other organizations can have a data protection officer, but it's
Speaker 1: not mandatory if they are outside of that definition. However,
Speaker 1: all the really big companies out there kind of fall
Speaker 1: into this, So I expect we're going to have data
Speaker 1: protection officer as a new type of UH employee at
Speaker 1: most of those large companies, either employed directly by the company,
Speaker 1: or they will be offering their services as a data
Speaker 1: protection officer and it will be a contract issue with,
Speaker 1: you know, some sort of provider that specializes in this.
Speaker 1: Because the person who is the data protection officer is
Speaker 1: supposed to have a specialty in that field. It's not
Speaker 1: just supposed to be Hey, Bob, do you want to
Speaker 1: be data protection officer this week? It's not supposed to
Speaker 1: be like that. In addition, this data protection officer becomes
Speaker 1: a liaison with data protection authorities or d p a s.
Speaker 1: The data protection authorities are kind of like the overseers
Speaker 1: of this system. They're the ones who are making certain
Speaker 1: that everyone is is complying with the rules. If anyone's
Speaker 1: not complying with the rules, they can take action uh,
Speaker 1: And they have a lot of power. So for example,
Speaker 1: they can impose corrective actions such as a temporary or
Speaker 1: definitive limitation on data processing activities, including a complete ban
Speaker 1: on data processing, or or to order the suspension of
Speaker 1: data flows to a recipient in a third country. So
Speaker 1: in other words, they could say, hey, Facebook, you are
Speaker 1: not allowed to process any data from any citizen in
Speaker 1: the European Union ever again, because you broke this rule.
Speaker 1: They technically have the power to do that. Uh. In addition,
Speaker 1: if a controller is found to be in breach of
Speaker 1: g d p R, it can be hit with a
Speaker 1: fine of up to four percent of its annual global
Speaker 1: turnover or twenty million euro whichever is greater. Well, global
Speaker 1: turnover is a European phrase. It's a way of saying
Speaker 1: total revenues. That's what we would call it in the
Speaker 1: United States. So if you want to look at global
Speaker 1: total revenues, that can be a truly mind numbingly huge
Speaker 1: sum of money depending on the company. Let's go with
Speaker 1: a big one. Let's think about Apple. So Apple made
Speaker 1: two nine point two billion US dollars in revenue in
Speaker 1: If we convert that to your oh, that's one billion
Speaker 1: eight hundred ninety three million, eight hundred two thousand euro.
Speaker 1: So let's take four percent of that. That would be
Speaker 1: a fine. Let's say Apple has committed this, this breach
Speaker 1: of g d PR, this this worst case scenario, and
Speaker 1: the data protection authorities levy this four percent fine. That
Speaker 1: four percent fine would amount to seven billion, eight hundred
Speaker 1: thirty five million, seven hundred fifty two thousand eighty euro,
Speaker 1: almost eight billion euro in a in one fine. That's
Speaker 1: it's it's crazy, and that's why a lot of companies
Speaker 1: have really been taking a lot of effort to try
Speaker 1: and at least appear to comply with g d p
Speaker 1: R because the consequences are truly scary. And that's if, obviously,
Speaker 1: if your company is operating at a level where more
Speaker 1: than four percent of your your or your four percent
Speaker 1: rather of your total revenue is greater than twenty million euro.
Speaker 1: If it's less, then you still have to hey twenty
Speaker 1: million euro. Now the penalties are tiered, so it's not
Speaker 1: like it's that fine for any infraction. The example I
Speaker 1: just cited was for the absolute worst case scenario, But
Speaker 1: if it were for a smaller infraction, Let's say that
Speaker 1: it's like you didn't conduct a proper impact assessment for
Speaker 1: something like a potential data breach, and the d p
Speaker 1: A S found that out. They said, oh, well, you
Speaker 1: didn't take the necessary steps. According to the g d
Speaker 1: p R, you could be hit by a smaller fine,
Speaker 1: but by smaller fine, it could still be two percent
Speaker 1: of your total revenues. I mean, half of seven billion
Speaker 1: euros is still a huge amount of money, right Anyway.
Speaker 1: The full GDPR document is available online and in many
Speaker 1: different languages. The English language version is eighty eight pages long,
Speaker 1: so there's a lot more in there that I kind
Speaker 1: of skimmed over for the purposes of this episode. I
Speaker 1: wanted to take a bit of time, however, to talk
Speaker 1: about the effect this has had on the world already.
Speaker 1: I'm recording this at the beginning of July two, team,
Speaker 1: and already we're starting to see the effects of GDPR.
Speaker 1: And first you probably received some of those emails or
Speaker 1: messages from different organizations about their efforts to comply with
Speaker 1: g d p R. A lot of companies have been
Speaker 1: working toward compliance ever since the policy was approved in
Speaker 1: twenty sixteen. That's exactly what they were supposed to do.
Speaker 1: They were supposed to get their acts and gear within
Speaker 1: those two years, but according to analyst firm Gartner, more
Speaker 1: than half of all companies affected by g DPR will
Speaker 1: not be in full compliance with his regulations even by
Speaker 1: the end of ten. On a related note, there's a
Speaker 1: consumer advocacy group called the European Consumer Organization. Its initialism
Speaker 1: is b e u C because it comes from the
Speaker 1: French name for the group, which I am not going
Speaker 1: to attempt to pronounce because I love you French speakers
Speaker 1: and I don't want to hurt you with my terrible pronunciation.
Speaker 1: But anyway, the b e u C conducted a study
Speaker 1: of big tech companies and how they hold up to
Speaker 1: g DPR policies. And they analyzed a bunch of privacy
Speaker 1: policy sees by fourteen major companies, including Facebook, Apple, and Google,
Speaker 1: and they said that most of them had privacy policies
Speaker 1: that might not meet the g d PR standard at all.
Speaker 1: They said a lot of them included vague and insufficient language.
Speaker 1: One big reason for that comes down to the era
Speaker 1: of big data. So big data or big data if
Speaker 1: you prefer, refers to enormous data sets that can include
Speaker 1: all sorts of information, including stuff that upon first glance
Speaker 1: might be useless or completely unrelated to whatever you want
Speaker 1: to analyze. But data analysts have found that you can
Speaker 1: discover really interesting patterns and associations and trends. If you
Speaker 1: have really large sets of data, sometimes you can find
Speaker 1: new ways to make use of that data that are
Speaker 1: really transformative. But you might not have that idea before
Speaker 1: you actually get hold of all the information, and therein
Speaker 1: lies a huge problem. G d PR requires companies to
Speaker 1: spell out in clear terms why they want a person's information.
Speaker 1: They're only soupposed to collect the data relevant to whatever
Speaker 1: process they wish to perform, and they have to get
Speaker 1: the users consent to do it. So I have a
Speaker 1: feeling that if you were to ask a data collection
Speaker 1: company why do you need all this information about me
Speaker 1: and my behavior? You might get a responsive oh no,
Speaker 1: and that won't cut it. There are companies right now
Speaker 1: that have so much information about us that they don't
Speaker 1: even know what they have. It's kind of like going
Speaker 1: to an auction and buying a locked storage unit and
Speaker 1: you don't get to look inside it. You have to
Speaker 1: buy it site unseen. You have no idea what you're
Speaker 1: going to get once you open that storage unit stores.
Speaker 1: It might be a gold mine of antiques, or it
Speaker 1: could just be a bunch of worthless junk, or might
Speaker 1: even be empty. Well, some companies have enormous repositories of
Speaker 1: information that effectively amounts to the same thing. They don't
Speaker 1: know what they have yet. Having these companies comply with
Speaker 1: g d PR requires them to sift through all that
Speaker 1: information and to determine which bits are identifiable as defined
Speaker 1: by g d p R, and then be able to
Speaker 1: produce it or destroy it upon request, which is a
Speaker 1: pretty tall order, all right. So what does this mean
Speaker 1: to the average person. Well, if you live in the EU,
Speaker 1: you now have some pretty darn powerful legislation looking after
Speaker 1: your data protection, and if you so choose, you can
Speaker 1: exert your rights to request data or even have it deleted,
Speaker 1: assuming doing so does not go against the public interest
Speaker 1: in general, and you should be able to expect that
Speaker 1: to be delivered upon. Although I've listened to some podcasts,
Speaker 1: my buddy Nate Lankson did one for Bloomberg where he
Speaker 1: talked about how difficult it was to get his information
Speaker 1: from certain organizations h even going through the g d
Speaker 1: p R process. So companies aren't really necessarily prepared to
Speaker 1: do this, but they are supposed to comply with it.
Speaker 1: But if you're outside the EU, like me, you're probably
Speaker 1: just getting a ton of emails about this, and for
Speaker 1: the most part you can ignore them. Some of them
Speaker 1: are likely asking you if you consent to being included
Speaker 1: on mailing lists as kind of a protective measu. You're
Speaker 1: there people who aren't certain if this is absolutely necessary yet,
Speaker 1: But a lot of companies are like, we'd better, We'd
Speaker 1: rather we'd rather send an unnecessary email out now and
Speaker 1: cover our bases, then find out later on that we
Speaker 1: should have done that. So if you want to keep
Speaker 1: getting email from those companies, you might need to skim
Speaker 1: the message. There might be a link you have to
Speaker 1: click in to indicate you've opted in to receive that mail.
Speaker 1: But if you're like me, you're probably just deleting the
Speaker 1: emails and then relishing in the thought that you're not
Speaker 1: gonna have to deal with as much spam on a
Speaker 1: regular basis now. I noticed on zd net that there
Speaker 1: is a theory going around about clout. That's the company
Speaker 1: that assigned people a social media score based off the
Speaker 1: reach and impact of their various social media accounts like
Speaker 1: Twitter and Facebook. Cloud closed up shop right around the
Speaker 1: time the gdp R compliance was to go into effect,
Speaker 1: which was May two thousand eighteen. And the theory is
Speaker 1: that's that it's possible Cloud went and closed up partly
Speaker 1: because it was so hard to comply with g d
Speaker 1: p R. I mean, they're an organization that's dependent upon
Speaker 1: many other entities that are collecting and processing data. So
Speaker 1: the owners of Cloud may have opted just to walk
Speaker 1: away rather than try and work that out. But again
Speaker 1: that's just a theory. It may have nothing to do
Speaker 1: with the g d p R, but it is interesting
Speaker 1: the timing. And also there's some sites like news organizations
Speaker 1: such as the l A Times or the Baltimore Sun
Speaker 1: that have restricted the access to their sites within the
Speaker 1: European Unions. So if you're in the EU and you
Speaker 1: try to visit one of those sites, you might get
Speaker 1: a message stating that due to g d p R,
Speaker 1: the users would be unable to access the site at
Speaker 1: that time. Now that's not necessarily permanent. These sites are
Speaker 1: more more likely just trying to find ways that they
Speaker 1: can comply with g DPR that might even require them
Speaker 1: to set up a different web portal for their various
Speaker 1: articles and services that operates on a different set of
Speaker 1: rules than the ones than the rest of the world do,
Speaker 1: which creates sort of a fragmented experience, But it might
Speaker 1: be the only way they're able to comply with gdp
Speaker 1: R without overhauling their entire system. But the penalties for
Speaker 1: failing to comply are so high some companies would rather
Speaker 1: step back in the short term and lose all that
Speaker 1: traffic from the EU while they're trying to work on
Speaker 1: a more compliant implementation, rather than risk and enormous fine.
Speaker 1: And that brings us up to speed on what g
Speaker 1: d p R is and why it's causing so much
Speaker 1: ruckis in the text sphere right now. I'm sure we'll
Speaker 1: have plenty of stories relating to g d p R
Speaker 1: unfold over the next few years, and I'm I'm certain
Speaker 1: that in the future I'll cover some of them. But
Speaker 1: I wanted to do this episode just in case some
Speaker 1: people out there were like me, wondering what this was
Speaker 1: all about. And you don't have time to read all
Speaker 1: eighty eight pages of that legislation. It's a real page turner.
Speaker 1: It's actually not that bad to read, um, but it's
Speaker 1: a lot, so hopefully this was helpful. If you have
Speaker 1: any suggestions for future episodes of tech Stuff, whether it
Speaker 1: is a technology, a person, a company. Maybe there's a
Speaker 1: particular story in tech that you think really deserves deep treatment,
Speaker 1: send me a message asked me to cover it. I
Speaker 1: would love to hear from you. The email address for
Speaker 1: the show is tech Stuff at how stuff works dot com.
Speaker 1: Or draw me a line on Facebook or Twitter. The
Speaker 1: handle of both of those is tech Stuff H s W.
Speaker 1: Don't forget to follow us on Instagram and I'll talk
Speaker 1: to you again really soon for more on this and
Speaker 1: thousands of other topics. Because it how stuff works dot
Speaker 1: com