The modern consumer is keenly aware of businesses data collection habits. While the average person may not know too much, they are mostly aware that their details are being collected and analysed by businesses.<\/p>\n
There is a direct relationship between growth in the tech industry and the need for user data.<\/b> From consumer behavior to predictive analytics, businesses are able to convert the digital footprints of websters into a stream of revenue. This is done by capturing, unique patterns of behaviour, grouping them into consistent variables and analysing them for effective use.<\/p>\n
While this all spells cheer for marketeers, companies need to be wary of the risks involved. With an enormous bank of customer data comes the risk of hackers. Customer data is an asset, and data breaches can be costly and detrimental.<\/b><\/p>\n
With so much at stake, we will try to keep this article as informative as possible for your own understanding of data privacy; why you need to ensure that your data is secured and how you can do so.<\/b><\/p>\n
This article will be broken down into 6 chronological sections<\/b>. If you feel as if a certain section may be more relevant to you, feel free to skip ahead to it. If you would like a comprehensive overview of the topic at hand, here\u2019s the breakdown:<\/p>\n
i) What sort of personal data can businesses own?<\/i><\/a><\/span> Customer or user data is essentially the backbone of all internet businesses. SME\u2019s and larger corporations alike rely on their customer\u2019s data as a tonic for their marketing and sales strategies. The more they know about their customers, the better they can perform.<\/p>\n As a user, the moment you sign up to a website or service, you are asked for details that inform these companies of your personage. The sort of personal data that most businesses own are:<\/p>\n \u2022 Names<\/i> Additional data such as work salary, relationship status, general preferences, etc., are secondary and require a formal notice of consent as an ethical protocol. However, the personal data above helps businesses identify and segment their consumers on a basic level.<\/b><\/p>\n <\/a><\/p>\n Data Brokers specialise in the curation of personal data. They collect as much information as possible about individuals to eventually sell. The clients, usually large companies, use this information to accurately profile and segment individuals. This is the primary use of large user databases.<\/b> The profiles allow marketeers to push targeted ads towards the right consumers, therefore increasing overall sales and revenue.<\/p>\n Traditionally, data is collected through physical in-store contract forms or surveys. The data is then organised on an Excel sheet for estimations and predictions. Customer\u2019s are given a notice of their consent before collection.<\/p>\n In more modern times, data collection is much quicker through the use of social media platforms and Google.<\/b><\/p>\n Less people are willing to give their time to filling up forms these days. More deceptive parties tend to front their collection methods under the guise of apps and games. Fun little quizzes on Facebook pose themselves as \u2018free\u2019 but leverage consent for your personal data in exchange for your participation.<\/p>\n The recent data-mining scandal on Facebook<\/a> <\/span>saw the data of millions of people leaked. Cambridge Analytica, a political consulting firm affiliated with U.S. President Donald Trump, obtained the data inappropriately under the guise of a quiz. The firm is alleged to have created psychological profiles to influence voting behavior and political\/societal outlooks during the last election.<\/p>\n This goes to show that many accept the T&C\u2019s of these faux-services without understanding what is being given out in exchange.<\/b> Some simply don\u2019t care. Nevertheless, the scale of this scandal implies the influential perspective of user data. Firstly, given no circumstances of foul-play, organizations only have access to data which you have granted them. While you may not have knowingly given consent, most T&C\u2019s contain a formal notice of consent. Whether it is a computer program or a service form, if you have signed the T&C\u2019s, you have agreed to all written terms, including a consent notice.<\/p>\n Now here\u2019s where things get fascinating (or unnerving, depending on you). Google, the mega-behemoth-king-of-search, provides us with what sort of data is collected, and how it is used. Here are a few things they track:<\/p>\n \u2022 Photos<\/i> The list could go on, but these are some of the main things that Google tracks and provides for you when asked.<\/b> Using all of these factors, Google is able to customize an advertisement profile that is specifically tailored to you. Overall, Google is pretty transparent with the data that they keep.<\/b> If you click the link below, you\u2019ll be able to see the ad profile that Google has made of you: google.com\/settings\/ads\/<\/a><\/span><\/p>\n Given the list above, most companies will be able to track at least a few of those categories when you use their services. An online retail website like Amazon, for example, would prioritize tracking your browsing habits, searched items and locations in order to direct relevant items to you. This feature is an example of how user data benefits both the service provider and consumer. A data breach is a security incident where sensitive, protected or confidential data is copied, transmitted, viewed stolen, or used by unauthorised individuals. There are a few ways in which this can happen, including cyber attacks and unintentional disclosure.<\/p>\n For the party that lets the data slip, the repercussions are seldom kind. The Ashley Madison breach<\/a> <\/span>(2015) is one of the biggest examples of data breach consequences, where hackers had both the business and its\u2019 customers at their mercy. More than 25-gigabytes of user data was leaked,<\/b> tainting the reputation of the website and prominent individuals who were anonymous users of the site\u2019s hookup services.<\/p>\n Target\u2019s breach<\/a> <\/span>(2013) was another incident where the credit\/debit card information of roughly 110 million people were compromised. The breach cost Target $162 million, along with the resignation of their CIO and CEO in months following the breach.<\/b> They were given 180 days to update their security software systems.<\/p>\n <\/p>\n Most countries have adopted some form of Data Protection Laws to assist in cases of data breaches. The framework for these laws are generally similair, but there are some differences in penalties. Let\u2019s take a look at the laws of some countries in South East Asia:<\/p>\n Under section 51(3)(b) and (c) of the Personal Data Protection Act (2012)<\/a> <\/span>an organisation or person that commits an offence is liable to:<\/p>\n \u2022 In the case of an individual, a fine not exceeding SGD$10,000 or to imprisonment for a term not exceeding 12 months Under section 130 of Personal Data Protection Act (2010)<\/a>,<\/span> the unlawful collection, disclosure or sale of personal data is punishable with a fine of RM500,000 or imprisonment of up to three years or both.<\/b><\/p>\n Under section 131, a person who abets or attempts the commission of such an offence is liable to the same punishment.<\/p>\n Section 25 of the Data Privacy Act (2012)<\/a> <\/span>carries a fine of:<\/p>\n \u2022 up to Php 2 million<\/b> and imprisonment of up to 1 to 3 years<\/b> for unauthorized processing of personal information.<\/p>\n \u2022 up to Php 4 million<\/b> and imprisonment of up to 3 to 6 years<\/b> for processing sensitive personal information without the consent of the data subject.<\/p>\n Indonesia is unique in that there is no general law on data protection. However, there are regulations concerning electronic data usage. The EIT Law (2008) and EIT Law Amendment<\/a>\u00a0<\/span>(2016) provides criminal penalties for:<\/p>\n \u2022 up to R.p. 800 million and\/or up to 8 years of imprisonment for unauthorized access<\/p>\n \u2022 up to R.P. 800 million and\/or up to 10 years of imprisonment for interception\/wiretapping of transmission<\/p>\n \u2022 up to R.p. 5 billion and\/or up to 10 years of imprisonment for alteration, addition, reduction, transmission, tampering, deletion, moving, hiding, Electronic Information and\/or Electronic records.<\/p>\n India has also yet to enact specific legislations on data protection. However, their Information Technology Act (2000)<\/a> has been amended to include:<\/p>\n \u2022 Section 43A: parties that misuse sensitive personal data or computer-resourced data are liable to pay damages as compensation to victims.<\/p>\n \u2022 Section 72A: Parties may be fined up to INR 500,000 when personal information is breached, disclosed or processed without authorization. For a small business, the most sought-after data that hackers want is your customer\u2019s credit card information. <\/b><\/p>\n The first step to preventing this and any sort of attack is by educating your employees<\/b>. Ensure that they are up to date with the latest methods being used by cyber criminals.<\/p>\n One of the best ways to test your businesses\u2019 protection is to simulate a cyber attack<\/b>. By doing this, you will gain a firm understanding of how secure your data is. Also, you and your employees will be better equipped to handle a crisis if it occurs.<\/p>\n Next, you should be aware of what data you have and where it is stored.<\/b> It can be hard to keep track of all your data, so creating a simple spreadsheet that documents various types of sensitive data and their locations can be beneficial.<\/b><\/p>\n Besides that, also ensure that your data is securely encrypted. Most operating systems already come with inbuilt encryption tools. However, if you are transferring data such as through email, make sure that it\u2019s encrypted. This will prevent other people from stealing or intercepting your data easily. Also, never transmit data over public WI-FI networks, as anyone can access and intercept your data.<\/p>\n Now, it is easy to believe that larger enterprises are the real targets in the game of cyber hacking. In reality, small businesses are just as profitable for these hackers. There have been cases where small businesses have lost tens of thousands in an attack.<\/p>\n Furthermore, it is not just you or your business at stake, it is your customers<\/b>. By collecting their information, you are subject to laws and regulations regarding data collection. The blame for misuse can ultimately fall upon you if customers are dissatisfied. Taking a page from Google, try and be upfront with your customers about what data you collect and how it is being used.<\/b><\/p>\n With all that has been said in this article, there is a dire need for businesses to look after the data that they have stored. Data breaches are costly and embarrassing when mishandled.<\/b> Drawing from past examples, we can see just how impactful a breach can be towards parties involved.<\/p>\n Despite regulations and laws, hackers are becoming increasingly crafty at stealing data. Many go by unnoticed and leave very little on their trails. The recent SingHealth data breach<\/a><\/em><\/span><\/i> is an example of how hard it can be to resolve an incident.<\/p>\n Actionable Takeaway:<\/p>\n Hopefully this article has provided you with information that can help you keep your data safe and secure. If you have any information concerning your country\u2019s laws or data breaches in general, feel free to share them in the discussion below.<\/p><\/blockquote>\n [\/restrict]<\/p>\n","protected":false},"excerpt":{"rendered":"
\nii) What methods are employed in obtaining this data?<\/i><\/a><\/span>
\niii) What data can be accessed or owned by businesses?<\/i><\/a><\/span>
\niv) How does a data breach impact a business?<\/i><\/a><\/span>
\nv) Data Privacy Laws around the region<\/i><\/a><\/span>
\nvi) How can small business owners implement these data privacy laws into their business?<\/i><\/a><\/span>
\n<\/a><\/p>\n1. What sort of personal data can businesses own? [restrict]<\/h2>\n
\n\u2022 Gender<\/i>
\n\u2022 Email Addresses<\/i>
\n\u2022 Phone Numbers<\/i>
\n\u2022 Home Addresses<\/i>
\n\u2022 Identification Details<\/i>
\n\u2022 Passport Numbers<\/i><\/p>\n2. What methods are employed in obtaining this data?<\/h2>\n
\n<\/a><\/p>\n3. What data can be accessed or owned by businesses?<\/h2>\n
\n\u2022 E-mails<\/i>
\n\u2022 Locations<\/i>
\n\u2022 Searched Items<\/i>
\n\u2022 Deleted Items<\/i>
\n\u2022 Browsing Habits<\/i>
\n\u2022 Application Usage<\/i>
\n\u2022 YouTube History<\/i>
\n\u2022 Events Attended<\/i>
\n\u2022 Workout Routines<\/i><\/p>\n
\n<\/a><\/p>\n4. How does a data breach impact a business?<\/h2>\n
While the cost of a data breach does scale with the company\u2019s size, the diminished reputation will not be easily restored. Companies tend to lose up to a third of their former clients after a data breach.<\/h3>\n
5. Data Privacy Laws<\/h2>\n
Singapore<\/h3>\n
\n\u2022 In any other case, a fine not exceeding SGD$100,000<\/p>\nMalaysia<\/h3>\n
Philippines<\/h3>\n
Indonesia<\/h3>\n
India<\/h3>\n
\n<\/a><\/p>\n6. Small Business Owners<\/h2>\n
Conclusion<\/h1>\n