A new set of stringent data privacy laws, in Europe, have come into effect on Friday. As a precursor to this, online service companies, had been sending e-mails to users and subscribers, all over the world including India, informing them about changes in their privacy policies. This has in a sense has raised the bar for Indian companies as well as users by giving them more control over the use of personal data.
The e-mails give information about the way businesses collect, process and store personal data. Some companies have changed the options — like a health portal now asking if users are willing to share their data for research – or informing users that their login data will be deleted as the account is not in use. Online companies are changing the ‘Membership Terms & Conditions, Privacy Policy and Cookie Policy’ to explain to members and users what control they have over data and how it is used.
Almost all global apps and browser-based online services including Twitter, LinkedIn, Amazon, Runkeeper, and Yahoo have sent out e-mails to the subscribers and users. An e-mail from Jet Airways says
“Your privacy and trust is important to us! At JetPrivilege, we strive to make our policies clear and our services easy to use.
As part of this ongoing commitment, and in preparation for new data protection laws, we are writing to let you know we will be updating our Membership Terms & Conditions, Privacy Policy and Cookie Policy.
The purpose of these changes is to update our policies and procedures, which include bringing them in line with the General Data Protection Regulation (“GDPR”), coming into force on May 25, 2018.”
What has changed?
The European General Data Protection Regulation (GDPR), which comes into force today in Europe but online companies are changing their privacy policies that will apply to users globally, irrespective of location.
GDPR restricts companies from putting personal data belonging to European citizens into the public domain without their explicit permission. Earlier, a 1995 regulation generally applied only if the business was itself physically located, or had processing equipment in Europe. The GDPR goes beyond as the physical location is increasingly becoming irrelevant. If the company targets EU residents today, it will be subject to and liable under the GDPR. The law walks a tightrope for what qualifies as targeting.
So, if a European comes to India and shops in an Indian clothes store, the store won’t automatically be subject to the GDPR, but if an online retailer in India displays European currency or language options, it probably will.
Similarly, entities that “monitor the behaviour” of EU residents, are also covered by GDPR. In other words, popular social networks, email providers, search engines, browsers, a majority of which do systematically monitor user behaviour, are indisputably subject to this law.
What type of information is collected from you?
Companies collect various data like personal information, activities on the site, membership status, buying activity, time spent on the portal, other personal information provided and collected by the companies partners and mobile apps.
How can you update Preference and Consent?
Most of the companies have an option in ‘settings’ or marketing and communication, where preferences can be reviewed and updated, consent can be given or revoked either wholly or partially.
It is understandable why companies are changing their data privacy laws globally instead of only in Europe. Developing different technologies with different privacy protections would place a costly burden on companies and developers.
Indian businesses will benefit as GDPR allows data transfers to only to those countries that have an ‘adequate’ level of data protection.
If countries in India follow a stringent data protection law the results will be positive. The data breach in Cambridge Analytica case has shown that the control over personal data is important to both commerce and politics.