Privacy didn\u2019t feature in any aspect of law until the latter half of the twentieth century.\u00a0 From the original census called by Herod, the idea that the powers that be were entitled to the maximum amount of data was ingrained in the general population.\u00a0 If asked, people would provide any amount of information that was requested in order to prove who they were or where they lived or what their income was.<\/p>\n
This largess was extended to large corporations too.\u00a0 Hardly anyone queried the long forms that came as part of buying or hiring anything, whether it was in order to purchase an insurance policy, get a bank loan or even just to hire a car.\u00a0 It was as if those who were selling things or providing services were doing you a favour, so one had to go along with whatever conditions those businesses decided were right and proper.<\/p>\n
<\/p>\n
Then the concept of personal privacy came along.\u00a0 It\u2019s not one that would be immediately apparent to someone who lived between the war years.\u00a0 Then, privacy was about ensuring that your secrets were kept safe from neighbours or work colleagues.\u00a0 The assumption was that public bodies and businesses had a right to know huge amounts about you, if you had consented to deal with them.<\/p>\n
Perhaps the reason no one really worried about it before, was because the effort involved in keeping tabs on the minutiae of every person\u2019s life and opinions was far more effort than it was worth. Knowing peoples\u2019 movements for example meant appointing someone to follow them around, as was sometimes done for big insurance claims, in order to catch photographs of those who claimed to be almost crippled by an accident, out running or bouncing on a trampoline.\u00a0 This was a very expensive approach, and so was only used where the company was relatively sure there would be a big payback.<\/p>\n
Now, technology has changed that equation.\u00a0 Gathering information about people has become so much easier over the last few decades and powerful computers have given the ability to search for information on a specific individual \u2013 the traditional needle in a haystack \u2013 or to crunch the numbers to derive behavioural insights from the mass of data that is available. \u00a0Combined with the fact that so many people are putting the information out there themselves via social media and the job has become so much easier; the information doesn\u2019t have to be gathered, it just has to be filtered out from the mass of information that already exists.<\/p>\n
Cameras on streets can decide to change traffic light at different rates in order to optimise the flow of cars, based on the volumes they can see coming to a junction from different directions.\u00a0 Or they can identify an individual driving too fast and trigger an automatic fine with photographic evidence to back it up.\u00a0 All without human intervention.\u00a0 But it does mean that the cameras are gathering information on us and our whereabouts can thus be identified without us having any say in the matter.\u00a0 If people get access to this data, then they can plot our movements throughout the day.<\/p>\n
It\u2019s even worse with the smartphones we all carry.\u00a0 Of course, from the standard phone signals, triangulation between masts ensures that we can be positioned roughly.\u00a0 But our constant use of Wi-Fi in public places and businesses such as cafes, restaurants, and train stations mean that our actual position can be found out quite easily.\u00a0 We are constantly giving this information out to machines which, like elephants, never forget.<\/p>\n
<\/p>\n
If people are so willingly giving away so much information about their own life and the choices they are making, why is there so much drama going on about data privacy?\u00a0 Why are we ending up with ludicrous situations such as when my wife tried to open an account in a bank recently for a charity, she was compelled to fill out completely new forms and provide ID again, even though, she already had an account with the bank.\u00a0 They claimed that under GDPR they couldn\u2019t share her own information with herself.<\/p>\n
There are many incidents like this e.g. the Irish Office of Public Works (like the National Trust) has withdrawn all visitors books from their historic sites in case anyone photographs the names and addresses some visitors write into it.\u00a0 The fact that the visitors wrote their address and comments in deliberately to be seen doesn\u2019t seem to matter.<\/p>\n
The point is that when people decide to put information into the public domain, it is their decision.\u00a0 If they send information to a company, they are knowingly supplying that information.\u00a0 They do not expect it to be abused, by being leaked out or sold to another company.\u00a0 But they are engaging with the company and will expect quite several people to have access to it.\u00a0 So, why are so many companies and institutions so worked up about the extremely unlikely possibility that they will be held responsible for simply using the data when the customer has voluntarily submitted it?<\/p>\n
The reason is that the scale of the fines imposed for GDPR breaches is at such a level \u2013 a maximum of 4% of global turnover \u2013 that it has firms very afraid indeed.\u00a0 Indeed, it would not be an understatement to call it paranoia.\u00a0 As a result, people are making life much more difficult for themselves.\u00a0 Every piece of data that might fall into the \u2018personal\u2019 data category is being treated as if it is radioactive.\u00a0 And yet, all this data is willingly being submitted by customers because they are looking for the organisation to provide them with services that must be related to the individual \u2013 an approach which is impossible if all information about the individual held is to be private, and therefore unusable.<\/p>\n
The financial services sector is, by its very nature, extremely prone to this.\u00a0 Banks, insurers and other financial institutions can be rendered paralysed by the scale of the amount of personal financial information they are already holding and the fear that they could be accused of doing things with it that they shouldn\u2019t. Internal controls can become excessive \u2013 I was recently informed of an insurance firm where marketing individuals were being stopped from seeing lists of data coming in that they were to respond to because of the personal email addresses involved.\u00a0 Yet, the customer submitting the information didn\u2019t imagine they were submitting it to just one person in the organisation, the employee had a valid business reason for seeing the data and all employees should be bound to keep all information confidential anyway by virtue of the employment contract they signed.<\/p>\n
<\/p>\n
Some of this is also patronising to the customers.\u00a0 They do not expect that they can get highly personalised services without putting in a lot of information. They are not so gullible to believe that the company can simultaneously both know enough about them to provide the correct recommendations and products to suit them, and yet not have a lot of personal data about them.<\/p>\n
This is the true irony of the current situation; people are said to be demanding huge levels of data privacy, and yet at the same time demanding highly personalised services.<\/p>\n
The biggest fines to date have not been to financial institutions; they have been to the airline, British Airways, hotel group Marriott\u2019s and the social networking site Facebook.\u00a0 Although all three fines were for data protection failures, British Airways fine (\u00a3183M) and Marriott\u2019s fine (\u00a399M) were for cyber security breaches \u2013 where the data was hacked. \u00a0This was down to their failure to protect the data from external attack and, while it calls for far more rigorous approaches to the technical security of their data, it had nothing to do with the amount of data they were gathering nor with whom was carrying out the processing within the organisation.<\/p>\n
All companies need to regard their data storage like they would regard a bank vault \u2013 something to be protected at all costs against the fact that the contents are extremely valuable, and therefore attractive to hackers and thieves.\u00a0 These failures would have been huge problems for them even if GDPR had not existed, although it is probable that the fines would have been lower.<\/p>\n
Only Facebook (\u00a344M) was fined for a purely \u2018GDPR\u2019 based situation \u2013 the failure to provide users with transparent and understandable information on its data use policies.\u00a0 This is undoubtedly something that wouldn\u2019t have happened before, although it is questionable whether the scale of the fine would have been the same with any other firm.<\/p>\n
<\/p>\n
The key point is that data protection is primarily common sense.\u00a0 If the customer is seeking a product or service, then clearly, they must give the company some personal data.\u00a0 In the case of life and pension companies, this is likely to be quite a lot of highly sensitive data, given the nature of life and pension products. It is not wrong to have it, but it must be clearly secured against unauthorised use.<\/p>\n
This however does not mean that one needs to be incredibly paranoid within the organisation \u2013 all employees will be bound to keep the company\u2019s information private by virtue of their contract with the company.\u00a0 It means most of all focusing on how to keep the data secure from outsiders and to ensure that the correct processes and policies are implemented internally to prevent the data leaking from the inside.<\/p>\n
Cyber security is where the big focus should be.\u00a0 The most pressure should be on those who manage the IT infrastructure in order to prevent outsiders being able to gain unauthorised access.\u00a0 Secondly, staff must be fully data aware to co-operate with this.\u00a0 This means regular training and testing of employees\u2019 ability to recognise these threats, as one of the more common ways hackers will attempt to effect this is to try to get a member of staff to be an innocent accomplice by phishing them or using some type of email scam in order to implant trojan software onto the system, which can help the external hacker to gain access.<\/p>\n
While huge care is needed, and no one can say that data protection shouldn\u2019t be a top priority, the paranoia that is affecting many companies should stop.\u00a0 The client has willingly given the data, and therefore the key is to use it as the client would expect i.e. to provide the products or services that the client is looking for.<\/p>\n
<\/p>\n
Data protection should be seen as a positive by life and pension companies.\u00a0 The way you protect the data of your customers can be a key part of one\u2019s strategy, given that the basis on which people entrust their money or protection to a life and pension companies is one of trust\u2026 that the company will deliver when the unforeseen happens.<\/p>\n
Instead of panicking over the possibility of an internal process going wrong, the company is better off focusing on how to ensure that the data is protected from outside attack and that internally a full audit trail is in place in order to spot any issues with rogue employees who would be in breach of their contract if they started to leak information that they were not entitled to. Once these protections are in place and constantly monitored, the data should be used as the asset it is, in order to inform the company of customer behaviour and to hone their products and services.\u00a0 Use the asset, don\u2019t fear it.<\/p>\n","protected":false},"excerpt":{"rendered":"
Privacy didn\u2019t feature in any aspect of law until the latter half of the twentieth century.\u00a0 From the original census called by Herod, the idea that the powers that be were entitled to the maximum amount of data was ingrained in the general population.\u00a0 If asked, people would provide any amount of information that was…<\/p>\n