The European Union and Our Privacy

Historically, privacy was almost implicit, 

because it was hard to find 

and gather information. 

But in the digital world, 

whether it's digital cameras or satellites

 or just what you click on, 

we need to have more explicit rules - 

not just for governments 

but for private companies.

~Bill Gates

Have you noticed the recent barrage of privacy policy emails? Or maybe you've had to click to accept a website's privacy policy before you can login to your email or make an online purchase. Here's a copy of an email I received just last night:

What does the EU have to do with privacy regulations in the United States?

Simply put, not a lot. While some companies have announced that they will have one uniform privacy policy for the entire world, there is no requirement that data collection in the United States abide by the rules of the European Union (EU). In the US, we have laws protecting data privacy for health and financial records, and and for children. That, of course, leaves a lot of unprotected data. 

For more information on the GDPR, check these article: 3 Things You Should Know About Europe's Sweeping New Data Privacy Law, and Everything you need to know about a new EU data law that could shake up big US tech.

What is the GDPR?

The General Data Protection Regulation (GDPR) is a directive that was approved in April 2016. European authorities gave companies two years to comply and it came into force on May 25, 2018. It applies to residents of the EU, i.e., anyone living in an EU country, including Americans, is included in the new law. Moreover, all companies that have an Internet presence in the EU, including large American companies (Google, Facebook, Microsoft) are affected by the GDPR.

Under the GDPR, personal data includes what a person posts on social media, electronic medical records, mailing addresses, IP addresses, and GPS locations. The regulation requires permission from individuals to collect their personal data. The company clearly must ask for permission to collect personal data, and for the most personal data, the ask must be even clearer. If an individual does not want a company to keep personal data, then the company must delete the data without delay or face a penalty.

Under GDPR, consumers also has the following rights:

• the right to access the personal data being stored by companies and find out where and for what purpose it is used;
• the right to ask whoever is controlling their data to erase it and potentially stop third parties processing it; and 
• the right to take their data and transfer it to a different service provider.

The regulation addresses data breaches, too. Under the GDPR, companies must notify their data protection authority about a data breach within 72 hours of first becoming aware of the breach, and customers must be notified of the breach "without undue delay." For more about the requirements of the GDPR, click GDPR, The Checklist For Compliance.

Companies could face steep penalties for failure to comply--As much as 10 million euros ($12.4 million), or 2% of annual worldwide revenue, which ever is higher. In cases of negligence or violating the conditions of consent and infringing on data subject rights, the fines can go as high as 20 million euros ($24.8 million), or 4 percent of annual worldwide revenue, whichever is higher.

Too Soon to Tell

The law has been in effect for just over two weeks, so its affect on the people it aims to protect and the companies operating in the EU remains to be seen. How much it influences policies in countries not in the EU, such as the United States, is also an open question.

Another unknown is how Brexit will interact with the GDPR. Brexit, England's withdrawal from the EU, is complete on March 29, 2019. Until then, England is subject to the GDPR just as any other EU country. Afterwards, British companies will still have to observe the GDPR for EU residents.

Will the United States ever follow suit and strengthen our privacy laws? Probably not. In the meantime, check GDPR: Why Privacy Is Now Stronger in EU Than U.S. for a discussion on how privacy laws compare.

Beware of Wolves in Government Agents' Clothing

They headed down to, ooh, old El Paso

That's where they ran into a great big hassle

Billy Joe shot a man while robbing his castle

Bobbie Sue took the money and run

* * *

Bobbie Sue, whoa, whoa, she slipped away

Billy Joe caught up to her the very next day

They got the money, hey

You know they got away

They headed down south and they're still running today

Singin' go on take the money and run

~Take the Money and Run
The Steve Miller Band

Telemarketers have been a thorn in the side of the average person for years. They are known to interrupt dinner and won't take no for an answer. However, there are some callers who are beyond annoying, they are dangerous because they want to get you to give personal information they can use to steal from you.

The advent of the computer, and more recently iPads, tablets and smart phones, has brought these intruders into our houses in another way. They're lurking in the shadows waiting to get us to give up information online.

Telephone.  You come home from work after a rough  day and play the voice messages on your land line (yes, there are people who still have land lines). Your heart starts pounding when you hear a caller identify himself as an IRS agent. They inform you that you owe back taxes and demand that you pay it immediately. They tell you to make the payment on a prepaid debit card. Before you start transferring money, STOP!!

The IRS will never:

• Call to demand immediate payment, nor will the agency call about taxes owed without first having mailed you a bill.
• Demand that you pay taxes without giving you the opportunity to question or appeal the amount they say you owe.
• Require you to use a specific payment method for your taxes, such as a prepaid debit card.
• Ask for credit or debit card numbers over the phone.
• Threaten to bring in local police or other law-enforcement groups to have you arrested for not paying.

Every year, the IRS puts out a list of its Dirty Dozen scams to help taxpayers avoid being tricked.

Another common phone scam is solicitations for charity. There are several sites to check whether a charity is truly a charity. Two of the best known are Charity Navigator and GuideStar. Another common scam is solicitations for your local police and fire department (see Solicitations for Police and Firefighters).

Computer.  You're surfing the internet when a pop-up or a locked Internet browser alerts you that you have violated the law and/or are being monitored by the NSA. You have 24 hours to pay the fine or all your files, passwords, financial information, etc. The message even throws in a couple of official looking citations from the U.S. Code (the laws enacted by Congress) to convey the gravity of the situation. And, they know where you live. Your town is listed right there on the message.

The NSA

• gathers information America's adversaries wish to keep secret and protects America's vital national security information and systems from theft or damage by others; and
• does not take control of the computers of the average American and prevent the individual from accessing the internet until a ransom is paid.

For more on computer security (probably more than you ever wanted to know), check out Guide to Malware Incident Prevention and Handling. One helpful thing in this 101-page document is the Glossary of different computer security and scam terms.

I've just scratched the surface here. Scammers are becoming more sophisticated all the time, and you must remain vigilant to protect yourself. 

Caveat Emptor

Let the buyer beware. Here are a couple of common sense rules for avoiding being a victim. 

(1) Don't give out personal information to people who call you on the phone or email you without you first initiating contact. Be especially careful about credit card, social security and bank account numbers. Ask the caller if they will send you information in the mail about their organization or cause. If they won't, or if they say that you have to make a decision immediately, then end the call.

(2) Don't click on links in unsolicited emails. Scammers are good at making up websites that mimic legitimate websites. If I'm interested in something in an email that has a link, I will google the organization and go to the website that way. I can look for whatever I'm interested in once I get to the website.

(3) Don't allow someone on the phone (or on the computer) to push you into making a decision right away. If they can get you off-balance so you make a snap decision, they have a better chance of separating you from your money.

(4) Research the organization or the cause before you give them money. I can't think of any situation where a legitimate organization would not give you time to find out more about them.

(5) Government agencies will contact you via U.S. mail for routine matters. They won't call (at least for an initial contact) and they won't hold your computer for ransom.

(6) There's this pesky thing called the U.S. Constitution. Of course I'd find a way to work that in here, but it's relevant. Due process means that the government can't deny a citizen of his or her rights. Remember the idea of being innocent until proven guilty? If there's a dispute over you owing money to the government or criminal allegations against you, then you have a right to a trial. The government can't say you're guilty of a crime and require you to pay a penalty without a trial. That would be a denial of due process.

(7) Forget your manners! Most of us have had etiquette drilled into us for as long as we can remember. However, if you have a solicitor who is unwilling to end a phone conversation when you try to end it, then it's time to hang up the phone. Remember that their goal is to keep you on the phone until they make a sale or get you to make a "payment." 

Lastly, I found information on the FTC Consumer Information webpage regarding scams. You can even sign up for scam alerts. Click here to check it out.