Data privacy and GDPR: Regulation impacts platform usage

[Anna-Simpson]

On July 25^th, 2018 Facebook saw the largest one-day stock drop in history. Consumer concerns over data security and privacy have driven platform usage numbers down. In the EU alone, Facebook reported a drop in over 1 million active users. The Cambridge Analytica scandal, amongst others, have forced Facebook to invest in security. Translation - expenses are up and revenue is down.

Let’s take a moment to reflect on a year of data privacy debacles for Facebook:

• May 2017: Fined €150,000 by French regulators
• September 2017: Fined €1.2 million by Spanish regulators
• March 2018: Cambridge Analytica scandal, a history altering revelation. Application user acceptance by roughly 300,0000 downloads, exponentially exposed personal data of 87 million users. The behavioral patterns learnt leveraged to influence the outcome of multiple elections, changing the global political climate for years to come.

If these breaches had occurred post GDPR D-day, the outcome would have been very different; fines exponentially higher, the door to punitive damages swung wide open, and reputational damage more quantifiable. Arguably GDPR is already having a tangible effect on platform usage.

Last week’s stock plummet is a reminder that GDPR is far reaching. Subsequently it is quickly becoming a blueprint for regulations closer to home. The California Consumer Privacy Act was passed June 28^th, 2018 and comes into effect January 1^st, 2020. The Act protects the rights of Californian residents, around 1 in 10 consumers, meaning the regulatory changes will be pervasive across the US. Although it doesn’t replicate GDPR verbatim, individual rights are to be recognized at the state level - right to access, right to portability, right to be forgotten, and the list goes on. With other states (New York, Florida, Texas, Maryland) taking steps in a similar direction, Federal regulatory reform seems inevitable, and somewhat overdue.

The number and frequency of data breaches is staggering. Organizations should be held accountable. They are responsible for protecting the data they collect, store and process. They should value each consumer as an individual. And, as individuals we all hold ‘the right to privacy’, even in this digital age, as defined by the United Nations. GDPR and an ever-evolving data privacy regulatory landscape is simply a vehicle for those protected by it, to exercise this right.