In Data Regulation We Trust?
Coming in the wake of the Cambridge Analytica data breach affecting 87 million Facebook users, this congressional exchange underlines how the use of personal information on social media platforms remains a question of corporate ethics and regulation as much as faith in technological defences against cyberattack. Given the unprecedented amount of personal information amassed in the last decade not just by social media platforms but also by other online sites and search engines, even Zuckerberg has acknowledged that regulation may be on its way for the internet giants.
For the financial services sector, tough data protection laws have long governed it. The Gramm-Leach-Bliley Act of 1999 requires providers of financial products and services not only to safeguard sensitive data but to explain their information-sharing practices to their customers. Phishing techniques to access private information under false pretences are prohibited.
Social platforms may choose to explain their information-sharing practices. Following Zuckerberg's congressional testimony, Facebook has updated its data policy to better outline how users' data is collected, stored and deleted. Yet can they be truly effective without legislation granting legal recourse? And what would be the resulting consequences for social media? This is the question now facing the lawmakers on Capitol Hill.
he severe financial penalties facing financial institutions that fail to comply with the 1999 legislation extends to fines and imprisonment for its officers and directors. But before the same sanctions apply to the world's leading digital C-suites, it needs to be acknowledged why the data collecting activities of financial services and social media platforms are fundamentally different.
Banks' and payment providers gather data for primarily transactional purposes: verifying identities and tracking transactions necessarily requires collecting copious amounts of personal data in order to safeguard against fraud, tax evasion, money laundering and the funding of terrorism. Beyond such concerns, customers can opt out of having their non-public personal information disclosed to a non-affiliated third party.
With search engine enquiries and social media activity, users share far more personal information than they would naturally entrust to a bank. The internet giants have built a business model that relies on monetizing this very data. Restrict their ability to do this, and at what price would one buy, or pay for, Facebook or Google?
The severe financial penalties facing financial institutions that fail to comply with the 1999 legislation extends to fines and imprisonment for its officers and directors. But before the same sanctions apply to the world's leading digital C-suites, it needs to be acknowledged why the data collecting activities of financial services and social media platforms are fundamentally different.
There is also the risk that regulation is a threat not only to the internet giants but to their potentially disruptive innovators. We have seen this with FinTech start-ups who do not have the resources struggling to cope with a slew of compliance requirements behind which the established players can entrench their advantage. The industry has found a way to help some of these promising startups, by bringing them into the fold of incumbents. Banks run their own incubator or accelerator programmes. In some markets, such as Singapore, where the regulators are taking a proactive lead in driving FinTech innovations, the emerging players have the option of operating within a regulatory sandbox. The question that we need to ask ourselves is if an equivalent of a regulatory sandbox for emerging social media players would be necessary to balance innovation with safeguarding consumers' data and privacy?
One response focuses on accountability rather than restriction. Coming into force this month, the European Union's General Data Protection Regulation (GDPR) requires organisations (financial and non-financial) to ensure that their contracts and notices communicate clearly and concisely the rights of an individual, giving them greater control over the organisations that can use their personal data. Financial institutions are among the entities that must respond in a timely and adequate manner to a customer requesting their data's deletion.
If there is a purpose to new regulation it is instilling trust through ensuring accountability and transparency. Building trust in the brave new world of digital exchanges is more critical than ever. Whether you are making a payment or posting a selfie, you want to know that information that you've just shared remain in safe hands.