HIX Bypass

Digital Privacy Laws Are Lagging Behind The Data-Hungry Technology

Researchers and advocates warn the new logjam laws are like panting tires trying to bear the heavy load of data crime as leaders from Paris to San Francisco celebrate landmark privacy regulations.

Individuals have rights of access, deletion and data restriction thanks to the European General Data Protection Regulation (GDPR), California's Consumer Privacy Act (and many others) and an increasing patchwork of state and national laws across Auditor Confident regions. Still, critics say those protections amount to little more than window-dressing.

One central problem is consent. Until now, most privacy frameworks have depended upon the principle that users consent to data practices by reading disclosures. The truth is, hardly anyone reads long privacy policies and even less actually understands them. One oft-cited study said that it would take weeks worth of labor to read all the policies an average person encounters in a year. Consent banners, on the other hand, are made to make people hit "accept."

Enforcement presents another obstacle. Moreover, regulators are always behind the curve with so few folks compared to the thousands of companies they regulate. While fines for big tech companies may seem large in absolute terms, so often they are a fraction of their revenue and investigations can take years. Businesses treat fines as a cost of business.

Things are further complicated by the fact that the world-wide web has no borders. Data may go between jurisdictions in milliseconds, but legal authority ends at the national border. Repeated invalidations of agreements covering the US transfer of European data have problematised businesses and users.

Legal definitions themselves are unable to keep pace with technology. Generally, privacy laws contain exemptions for "personal information," but advances in data analysis allow companies to re-identify supposedly anonymous records when datasets are cross-referenced. Algorithmically derived inferences, such as those predicting health, financial status and political leanings, exist somewhere in the legal grey area since they are generated rather than offered up by the user.

At the same time, many sectors of data collection slip through gaps in existing regulations. Bringing together those records will usually only create profiles, linked to little more than snippets of public record, app activity and information purchased from other brokers on the perfunctory buyers and sellers of private lives. Even more so, the government having access to commercially held data calls into further question, given that agencies can purchase details which they otherwise would need a warrant for.

Privacy advocates counter with an approach called data minimization, which means having limits on what companies can even collect and do—instead of relying on individual consent. In some cases, proposals would outright ban practices like selling sensitive location data.

But industry groups argue that excessively strict rules could inhibit innovation and burden small businesses. As artificial intelligence broadens the appetite for training data, so the battle is likely to heat up.

For now, experts say, individuals bear most of the responsibility for protecting themselves — a task few are truly suited to handle.