Will 2021 be the year when respect for privacy becomes a competitive advantage?
We look at privacy policy as a selling point
Gartner is predicting that, by 2023, the personal data of 65 per cent of the world's population will be protected by new regulations. And, two years on from its introduction, the GDPR (General Data Protection Regulation) continued to have a major impact in 2020. Consumers are increasingly vocal in their demands for protection, and the world's legislators are responding. But are these developments bad news or good for online service providers? Could consumer pressure for privacy represent a hidden opportunity?
WhatsApp's new privacy policy
Not long ago, WhatsApp announced that users would have to agree to a new privacy policy in order to continue using the popular chat service. Although it's unclear what the practical implications of the new policy are, privacy advocates and users responded to the news en masse. Rival messaging app Signal was soon announcing that the influx of new users was so large that it was causing service performance issues.
Legal protections
Meanwhile, there is no short-term prospect of a new pact between the United States and the European Union to replace the troubled Privacy Shield with a view to protecting Europeans' personal data. However, in November 2020, Californian voters backed Proposition 24, which provides for legislation to impose stricter requirements on customer data processing. Under the proposed arrangements, consumers will be able to opt out of sharing their personal information, while companies will have to 'reasonably' minimise data storage in order to protect users' privacy. The new requirements could significantly restrict the activities of Apple, Facebook, Uber and Google, all with head offices in California. Privacy experts believe that the developments in the US were inspired by the GDPR, which – for all its imperfections – has proved highly influential. Two years on from the GDPR's introduction, EU states issued fines totalling more than 306 million euros in 2020. The most common offence being the processing of personal data without a legitimate basis.
At first sight, therefore, privacy legislation might appear to be a burden on the business community. That's not the case, however, for an operation like Signal. For Signal, the increasing desire for privacy protection is helping to drive growth.
Growing demand for privacy
Within the business community, there is growing recognition of the need to address consumers' concerns about the protection of their privacy-sensitive data. Repeatedly, companies whose approach has been wanting have found themselves the focus of damaging news stories. The Cambridge Analytica privacy scandal and major data breaches at companies such as Equifax have prompted consumers to wonder who they can trust and how they can protect themselves. The research evidence in this field is compelling:
Only 52 per cent of consumers feel they can trust companies, while globally just 41 per cent trust their governments (Edelman).
85 per cent of consumers believe that companies should do more to actively protect customers' data (IBM).
61 per cent of consumers say that they are more concerned about their personal data being compromised than two years ago (Salesforce).
While it's hard to pinpoint the precise implications of this crisis of trust, we do know that 75 per cent of consumers say that they prefer not to buy from firms that don't seem to take privacy protection seriously.
Your privacy policy as a selling point
With data protection in the spotlight, companies are increasingly recognising opportunities for using privacy to distinguish themselves from their rivals. More and more are putting customers back in control of their privacy-sensitive data. Apple is a good example. The tech giant recently introduced a series of privacy innovations, including the new Sign in with Apple service. The scheme enables users to log in to apps without sharing their personal information with the app developers. Apple has also updated its privacy page, and the opening sentences speak for themselves:
Privacy is a fundamental human right. At Apple, it’s also one of our core values. Your devices are important to so many parts of your life. What you share from those experiences, and who you share it with, should be up to you. We design Apple products to protect your privacy and give you control over your information. It’s not always easy. But that’s the kind of innovation we believe in.
In an interview with MSNBC, Apple’s CEO Tim Cook said, "The truth is, we could make a ton of money if we monetised our customer... if our customer was our product. We've elected not to do that." Cook's words represent a strong message to an industry that has traditionally profited from customer data, and an even stronger message to consumers: it's time to respect personal data.
By not merely satisfying privacy requirements, but going beyond them, companies can stand out from the competition.
From data greed to data ethics
Loyalty programmes, smart home devices, innovative insurance products, e-health solutions: all these products and services – and many more besides – are based on large-scale personal data collection. And, as we enter what is certain to be a data-driven decade, people are starting to recognise the cost of the big data arms race: consumers have lost their trust in the private and public sectors alike. That doesn't bode well for growth, which is supported by trust. Slowly but surely, therefore, the market is reorienting itself towards a future in which a customer-driven privacy policy is no longer a burden, but a competitive asset.
The same trend underpins the emergence of new technologies such as self-sovereign identity (SSI). SSI enables companies to transform their privacy policies, while also cutting costs, reducing fraud and improving customer experiences.
Self-self-sovereign identity (SSI): putting the consumer in control
Of all the technologies that facilitate both online service growth and privacy protection, SSI is the most far-reaching. In simple terms, SSI gives consumers more control over their personal data. The user manages their personal information in the form of verified digital 'attributes' saved in an 'SSI wallet’ on their smartphone. The attributes – items of information, such as date and place of birth, qualifications and so on – are provided and signed by trusted authorities (banks, universities, government agencies) so that they can never be changed or manipulated. The user can then share individual attributes as and when they choose.
SSI is a game-changer in two key respects:
SSI identification can be based on individual attributes. The user can demonstrate simply that they are over eighteen, hold a valid driving licence, have Dutch citizenship, or whatever else the situation may require. So, for example, they can show that they're old enough to buy alcohol, without disclosing their full date of birth. Only strictly necessary data is shared. For the consumer, such data minimisation represents a big step forwards in the drive for privacy. For the service providers it means shedding the cost of saving and securing privacy-sensitive data.
Correlation is increasingly hard. Online service providers can cryptographically verify the authenticity of customer data. There's no need to refer to ID providers, as government agencies and corporates such as Google, Facebook and Apple currently do. And information about the consumer's login activities isn't shared with the ID providers.
It's a win-win situation: consumers benefit from greater privacy and security, while service providers gain in several ways:
Faster onboarding of new customers due to easier, more precise and more secure personal verification
Cost savings based on smarter GDPR compliance and reduced security overheads
Improved customer experience, thanks to a personalised, omnichannel model with no data collection or trust loss
Various organisations in the Netherlands and other countries are now experimenting with SSI technology. And they clearly represent a movement that is gathering momentum. As the demand for privacy protection grows, it becomes increasingly attractive to develop business cases that address that demand. While Apple currently lead the way, 2021 may well prove to be the year when other strong runners join them at the head of the field.
