Magazine menu Close Magazine menu

Data and privacy

Latest stories

paper dead shredder

Is paper dead?

  • min read
    • For retailers, predicting customers' future wants and needs is crucial – especially in this era of disrupted supply chains. I hope you won't recognize this story as something that might happen in your business, but it demonstrates how soon retailers of all sizes could find themselves in a new future. I bought a blouse recently from a traveling vintage clothes seller. Picture several racks of bright retro outfits set up under a caravan awning with a changing room crafted from tie-dyed blankets. Incense hangs in the air, as does the ringing of tiny bells attached to the seller's impossibly long hair, jingling as she wanders around after customers, straightening coat hangers. To pay, I offer cash, but she instead presents me with a beautifully calligraphed sign showing her bank account details. Given the riskiness of this practice, I offer a moment of security education. She tells me she's in the habit of giving out her bank details because it means more sales, and keeping enough change around is hard when you're always on the road. Even those on the fringes are moving towards electronic payment for its convenience and customer preference, albeit sometimes not in ideal ways. When it comes to meeting customer expectations in how your transactions happen, are you ready for a future where paper money, receipts, plastic cards are a thing of the past? Could your retail business work in a world where all money is changing hands by smartphone? Among Kaspersky researchers' privacy prediction for 2023 is that we'll keep seeing smartphones and other smart devices encroaching on activities once dominated by paper and plastic cards. A future where all we'll need is a smartphone seems close when we're paying by near-field communication (NFC) like Apple or Samsung Pay or QR code like Swish, or using apps to show COVID-19 testing and vaccination status. What does this mean for paper and plastic transactions? And what privacy and security issues should business consider when it comes to doing it all by smartphone? Environmental reasons to stop using paper and plastic Some might say the sustainability drive to eliminate paper and plastic in business transactions is overplayed. While both have significant environmental impacts, business transactions are not a major source. Meanwhile, electronic transactions can be responsible for much energy use and the equipment used will ultimately become resource-heavy and hard-to-recycle ewaste. Gen Z, Millennials and those younger will do much to avoid adding more plastic and paper to the world. Regardless of environmental impact, consumer demand for more convenient paperless and cardless transactions will only grow. Processes likely to move to smartphone apps Digitized identity documents look set to be the next big frontier for smartphones. It's already been a common approach to declaring COVID-19 testing and vaccination status worldwide, but soon passports, driver licenses, student IDs and more will be made available through apps. Germany started using app-based ID cards in 2021. Around the same time, Apple announced several US states would make digital identity cards and driver licenses available using Apple Wallet. ID stored on phones brings convenience and risk. A well-implemented system would let stores verify customers' age without seeing personal details they don't need, like home address – also known as 'zero trust' security. Digitized IDs could also speed up know-your-customer (KYC) procedures when applying for a loan with a smartphone. But using a smartphone to store growing amounts of personal data introduces 'single point of failure' security risk. Those who develop and commission smartphone software like apps must ensure top-notch device security and privacy-preserving data storage. Cardless cash withdrawal at ATMs is taking off around the world, especially where bankcard fraud is more common, like India. Smartphone apps enable cardless withdrawals, for example, scanning a QR code on the ATM screen with a payment app like Google Pay, or using near-field communication (NFC.) Again, these transactions aren't without risk. Speaking to price-comparison service Bankrate, Ricardo Pina, founder of personal finance blog The Modest Wallet, said, "Since bank cards are being replaced by phones, criminals will now be more enticed to target and hack your phone to mine your data, information and even change your phone and bank app settings." When will paper and card transactions become history? Those who run businesses that experience higher overheads thanks to processing cash, cards and printed receipts may dare to dream of a world where these go the way of the 'check.' Ubiquitous throughout most of the 20th century, many banks have stopped issuing and accepting these. Check payment is expected to be extinct by 2026. Those old enough to remember when checks were commonplace might think they'd disappeared years ago. But sometimes these methods strongly persist in parts of an economy that need them for specific reasons. A few years ago, a friend and I hiked the five-day South West Coastal Path in Cornwall, UK – and yes, it was glorious. This part of the UK is far from any major city. We were surprised to notice most bed-and-breakfasts  accepted only cash or check. Once we understood the area's geography, we paid by check wherever we could. Traveling on foot and far from towns, it seemed unwise to part with cash we might need. These businesses told us they didn't take card payments because they only had customers in summer, making point-of-sale machines uneconomic. Similarly, can smartphones – and reliable access to affordable data to operate apps – be all things to all people in all places? While access to mobile technologies has certainly enabled greater economic participation from marginalized people, we can easily overestimate how many can and will use these technologies if we use them or see them used around us often. Pew Research estimates around 85 percent of the US population owns a smartphone, but in China and India, it's lower at 70 percent. While China leads the world in mobile payment adoption, smartphone ownership numbers don't tell us how many people could use their smartphone for payments – for example, successfully download and register to use payment apps, and access data when needed. Cash transactions still account for far more business than many people think – in 2021, customers used cash for over 20 percent of point-of-sale transactions globally, according to the International Currency Association. Many businesses wouldn't survive losing 20 percent of their sales. There is also the inevitable backlash against smartphones because of negative mental health impacts, seeing some choose to quit or radically reduce how much they use them. It seems paper- and card-based identity and payment options will be with us much longer than we think, if the lifecycle of check payment is anything to go by. For small business, alternative point-of-sale card payment providers are fast making accepting cards more affordable, making paying by card even more ubiquitous without reducing security. When it comes to taking payment, it 'pays' to be flexible and listen to what your customers want, rather than focusing on what suits your business. Meanwhile, keep an eye on evolving technology making retail transactions simpler and more affordable.
data ethics interview

How data ethicists are helping tech business be better

  • min read
    • Using data responsibly is a hot topic. Tech companies must ensure they don't cause harm, for example, by breaching consumer privacy or reinforcing bias through automated decisions. It's a moral and legal question, but it may be unclear how businesses and governments should approach their data responsibilities despite increased regulation. We still see egregious data use practice. Alice Thwaite is technology ethicist and responsible owner for ethics at OmniGOV, MG OMD, working with the UK government on communications and advertising. We chat about what data ethics means in practice. Gemma: What does it mean to be a data ethicist today? Alice: Ethics is the study of how to live. An ethicist takes a theory of how humans want to be treated and how we should interact with the wider world, and thinks about how an action or technology could contribute to that goal. We use ethical methodologies and knowledge about the consequences of a technology or business model to transform the business into one that prioritizes ethics. Businesses have always operated in the realm of ethics, but usually without a systematic approach. Ethicists co-create frameworks with stakeholders like customers, colleagues and wider society so that an organization's values become critical in business decisions. What does that look like in practice? First, we help organizations understand where they're making ethical decisions and show how they'll need a more systematic process to reach their ethical goals. Second, we educate organizations on ethical methodology and issues. Third, we assess practice to understand what the company wants to prioritize and how current practice meets ethical goals, making suggestions like 'ethical pilots.' Finally, we implement and measure ethical pilots so they can become policy. We don't work in a vacuum – we must be in constant contact with various communities. For example, before establishing diversity, equity and inclusion (DEI) initiatives, a company might think racial equality is important but have no roadmap to get there. With an influence campaign, education, auditing and an implementation program, they may still have a way to go. But they're now measuring ethnicity pay gap and thinking about inclusive work environments for different people. They can keep following the 'influence, educate, assess, implement' process to fruition. Where do organizations start? What tips do you have for those keen to start doing ethics? Hire someone to build an ethical program and link them with a sponsor who can ensure the organization implements their recommendations. They may have a degree in philosophy, international relations, social science or community work experience. Ensure they can learn as much as possible about business ethics and support their attempts to transform the culture. Those in data security or compliance should recognize an ethicist has different processes. The goals may be similar, but the process aligns more with social science and humanities methods. What questions should organizations wanting a data ethicist ask? Are we committed to change? Do we want a world prioritizing human values like democracy, dignity and freedom? Are we prepared for the discomfort that comes with changing procedures? If you're prepared to change, write a job description incorporating things I've mentioned and encourage your team members to apply. Opinions reflect those of the expert. Interview edited for clarity.
personalisation customer data

How to be clever – not creepy – with customer data

  • min read
    • Businesses are collecting ever-increasing customer data and marketers targeting consumers with more personalized ads. But when does hyper-targeted marketing cross the line from clever into creepy? In 2012, an angry customer approached a manager of a Target store in Minneapolis, US, demanding to know why his teenage daughter was receiving coupons for baby clothes and cribs. The manager, who had no idea why, apologized. Days later, the customer called to apologize, having found out his teenage daughter was, in fact, pregnant. Target's customer-tracking technology showed people ads based on what they bought. It had identified that purchasing vitamins, cotton balls and fragrance-free skincare products suggested future purchases of a crib and baby clothes, or in other words, that the customer was expecting a baby. Businesses can collect huge amounts of data about customers, and when combined with shopping or browsing patterns, it can tell marketers much about someone, sometimes more than we know ourselves. They can correlate data from different sources into a 'buyer persona' that may be surprisingly accurate. But ads based on this deep data collection and correlation can come across as creepy, leaving consumers wondering how brands know so much about them. Tracking people across the internet "Most websites and emails contain some form of tracking," Karen Gullo of EFF (Electronic Frontier Foundation) told me. "Cookies let advertisers follow your web searching. Tracking pixels in emails tell the sender if you opened the message. Tracking links let websites know what you clicked on. If you've ever filled out an online form, the data may have been collected even if you didn't submit the form." But with great data comes great responsibility. 'The more targeted the ad, the higher the response' has been a standard in advertising for decades. But as ads grow more focused, they begin to cross lines. Marketers must think about how their campaigns might come across to customers. What makes ads creepy? Research shows that personalization tends to increase response, but it can also have the opposite effect. When personalization and targeting are 'too much,' it puts people off by seeming intrusive. CEO of Email Optimization Shop Jeanne Jennings told me, "I got an email from a department store where I shop, with my first and maiden name in the subject line." She had not used her maiden name for 20 years and could not figure out how they knew it. She eventually worked out they got her maiden name through her social security card, which she had shared when setting up her debit card. While perceptions vary between customers and age groups, people tend to base judgments of creepiness on four things. 1.   Consent: Was the data collected voluntarily? Using data voluntarily provided by the customer means great targeting, but using third-party data or data obtained without consent can be an invasion of privacy. "You want the customer to be pleased the content is relevant. You don't want them to wonder how you got that information," said Jennings. 2.   Explainability: How does a brand know this about me? "Some of the best recommendations… suggest why you are seeing that recommendation," said Emad Hassan, former Head of Data Analytics at Facebook and Paypal, on CMSWire. Using targeted data in a way that makes it easy for the customer to know why you have the data reduces intrusiveness. For example, a donut shop might say, "From your purchase data, we know you're a huge fan of our donuts, so here's a special discount for being one of our top customers." 3.   Third-party data: When information given to one company shows up in an ad for another Using demographic or preference data from a third-party source to target consumers often comes across as intrusive. Someone buying books for a niece or nephew from a children's book shop may not appreciate a children's clothing brand urging them to get "their" children new clothes for school. There's presumptuousness alongside exchange of personal data between brands. "If you learned that a friend had revealed something about you to another friend, you'd probably be upset, even if you have no problem with both parties knowing the information," wrote Harvard Business Review. 4.   Security and privacy: Will this brand keep my data safe? Consumers want to know they can trust brands to store and process their data ethically and securely against hacks and breaches. Poor data storage or weak privacy policies can turn consumers off. Seeing personal information pop up in an ad or communication from another brand can be distressing and feels like a breach in trust between consumer and brand. The same principles that apply to social interactions apply here – don't use information gained without consent or from a third party, keep customers' data secure and avoid using sensitive information like sexual orientation, health information or financial status. "It's about privacy, safety, and security, and being able to control your data and internet experience," said Gullo. Future advertising: Hyper-targeted… or not targeted at all? Third-party cookies are put on a website by someone other than the website's owner and collect data for that external entity. Many search engines have already, or plan to, phase these out soon. The third-party cookie ban means marketers must rely more on data from their own company's customer interactions. This may mean more transparent, direct and explainable ads that improve trust between the consumer and the brand. Jennings thinks marketing's future should be more responsible and smarter personalization. "As the industry is more responsible with how they use data, personalization is going to stay around but be better," she said. Advertising must respond to evolving consumer attitudes to privacy, but data-based targeting is likely here to stay. How companies obtain and use data will change, focusing more on consent and privacy. Make sure your business gets ahead and leaves the (sometimes creepy) old ways behind forever.
data transparency center

How transparency centers and open data processing practices help your business

  • min read
    • Data processing centers are already a crucial part of digital business, and transparency centers – although less widespread – are becoming part of that picture too. But the two can be confused or poorly understood. Enterprises wanting to make sure they're protecting their security in the best way possible will want to get to the bottom of this. Here, we'll take an in-depth look at both, examining their different purposes and what your business should consider when using each as part of its security practice. What data processing centers do Data processing centers hold servers and computers that process your business's information. Increasingly, data processing centers are separate from the data-owning business's premises for safety, security and cost-effectiveness. According to Market Prospects Insights, "Data center operations include installing and maintaining network resources, ensuring data center security, and monitoring systems responsible for power and cooling." Speaking of power and cooling, more businesses are now thinking about the environmental impact of data processing. Thankfully, data processing needn't cost the earth. You can seek out data processing centers powered by renewable electricity, either in a country where grid power comes mostly from renewable energy, like Norway, Brazil or New Zealand. Or, process your data with a company that powers their data center by buying electricity only from renewable sources. Why data center location matters Regulation can also impact where businesses choose to process their data. You'll need to know how laws in the territory you and your customers are in could affect your data security. A third factor influencing where you process your data may be company values. At Kaspersky, we use two data centers in Zürich, Switzerland to store all threat-related data from our product users in Europe, North and Latin America, the Middle East and several Asia-Pacific countries. We chose Switzerland because of its long history of neutrality, as part of our Global Transparency Initiative (GTI.) What transparency centers do Wondering what next-level trust between businesses looks like? You may soon have the opportunity to examine your software supply chain in a new level of detail. Outside the open-source software movement, software source code is usually a closely guarded trade secret. But increasingly, front-runners realize that finding ways to safely and securely let partners and clients inspect their code helps build the trusting relationships businesses need to thrive. Communications giant Huawei established its first transparency center in Brussels in 2019. Huawei explains what they hope to achieve with their center: "Through the Cyber Security Transparency Centre, we plan to increase communication and collaboration with security professionals, governmental agencies, customers and other industry stakeholders, in order to develop a secure and trusted digital environment." Microsoft opened transparency centers in Brussels and Redmond, Washington in 2014 to 2015 as part of its Government Security Program (GSP.)  Matt Thomlinson, Vice President of Microsoft Security highlighted how transparency centers can contribute to better economic outcomes for all: "Only by increasing confidence in digital solutions […] can Europe ensure that every citizen, business and government feels the benefits of the digital revolution." Kaspersky started creating transparency centers in 2017 and now has seven, in Zürich (Switzerland,) Madrid (Spain,) São Paulo (Brazil,) Woburn (USA,) Tokyo (Japan,) Singapore and Kuala Lumpur (Malaysia.) We welcome customers and partners, including authorities responsible for cybersecurity, from anywhere in the world to visit these centers. How Kaspersky customers can use our transparency centers We suggest clients visit a transparency center if they want to know more about our data security, privacy and management practices, encryption methods or supply chain risk management. When customers visit our centers, we have experts on hand to give any technical information about our source code and technologies. We have three levels of access, like the beginner, intermediate and advanced slopes on a ski field – designed to allow a broader range of client visitors to get something out of the experience. They could rebuild our source code to ensure it matches publicly available modules, and read what independent auditors – including a Big Four accounting firm – have said about us in recent security reports. While few businesses have transparency centers today, others are adopting similar ideas. Showcase centers, for example, let customers try out the firm's latest tech and in some cases, securely review code. UK-based telecommunications multinational BT established a showcase center for its financial services products, where their customers learn more about their products – especially security features. Today, businesses must understand where and how their data is processed and ensure processing conforms with regulation and their organization's values. Find out what opportunities you have to better understand what's happening with your data. If you have an opportunity to visit a transparency center or other facility that lets you get up close and personal with the code of organizations in your supply chain, take up the offer – regardless of which ski slope you're on.
trust customer privacy

You need these two ways to win customers’ data privacy trust

  • min read
    • Business sees trust in data privacy as a panacea. Companies that foster customer trust see more customer engagement and willingness to share valuable personal information. But what do we mean when we talk about trust in data privacy? What are privacy experts advising companies to do when they recommend building trust? It's one of the driving questions behind my book, The Intelligent Marketer's Guide to Data Privacy: The Impact of Big Data on Customer Trust. Most guidance around instilling trust doesn't adequately explain what trust is, or how to develop it. In researching companies that use privacy as a competitive advantage, I found two types of trust are key. First, customers must trust the company is competent and skilled in protecting their data. Second, they must trust the company's reasons for protecting their data are customer-centered. Although each type of trust is valuable alone, developing both is optimal for customer and business outcomes. Be capable of delivering what you promise The Oxford English Dictionary says trust is "belief in the reliability, truth, ability or strength of someone or something." This definition links trust with data privacy capabilities. For a company to position itself as strong on data privacy, it must have the skills and competencies to be effective in security and protection. For enterprises, this means having resources like data security teams or systems in place, and a talented chief privacy officer (CPO.) You should find it relatively easy to implement (and exceed) privacy regulations. For smaller firms, demonstrating responsible data handling across all interfaces and processes strengthens customer trust in your privacy capabilities. Trust in your company's data privacy abilities also involves your history with data protection. Strong claims about protecting customer data privacy seem suspicious if you've had a well-publicized data breach in the past. But my research found organizations that have suffered a data breach can recover trust by giving customers transparency and control. Ensure you're honest about past lapses when encouraging customers to trust your data protection capabilities following a breach. Be privacy-conscious for the right reasons Customers must also trust your data privacy position is for the right reasons. If trust in your ability to uphold privacy is the cold, rational side of trust, trust in your intentions is the warm, fuzzy side. Ways to build trust in your company's data privacy motivations are less clear and may take longer. This kind of trust is linked to reputation, so just one negative event can deteriorate it, with a long, hard road to redemption. My research found many prominent technology companies suffer from this deficiency in trust. Large firms with ample resources for strong data protections may not necessarily find customers like their privacy stance. For example, even before the Cambridge Analytica scandal, Facebook (now Meta) wasn't well regarded for its privacy practices. When companies like this talk about privacy, customers tend to distrust their reasons. This trust deficit around big tech may present opportunities for small or new tech companies to make a mark, differentiating themselves through customer-centered privacy values. Building customer trust is key to creating value through smooth exchange of personal information and building long-term, mutually beneficial relationships. Businesses of all sizes should pursue customer trust. But, before devoting resources to building trust in data privacy, your business must understand what trust involves. Trust implies distinct company behaviors and practices. Carefully managing trust and not taking for granted what trust you already have, is key to leading on privacy.

Could this voluntary charter fix data ethics in big tech?

  • min read
    • We know some people and businesses will, given the chance, use personal location data in unethical ways. When automotive cybersecurity experts Karamba Security posted a fake vehicle control unit online, they saw 25,000 attempted breaches in three days. Stalkers have used AirTag, Apple's coin-sized device for finding lost keys or other property, to track victims. Regulations like the EU's General Data Protection Regulation (GDPR) define minimum standards of data ethics, but the case for going further is strong. To that end, what can help those tech businesses who want to stay ahead of the data exploitation curve by upholding the highest data ethics standards? Learning to foresee the unforeseen International non-profit the Locus Charter promotes a higher standard of responsibility for professionals and businesses when it comes to location data. They want to avoid unforeseen privacy breaches by working out what can go wrong and pinpoint big problems before they're exploited. They champion public interest by showing businesses how to prevent unintentional harm. The charter is based on ten principles that balance moral behavior with economic benefit, like realizing opportunities and understanding impacts. Location data is one of many frontiers. As veterans of data policy in and out of government, the charter's founders want to be part of all kinds of data discussions. Automation challenging data ethics "The most important focus in data ethics is exploring the power granted by the accumulation of data so everyone can recognize how that power can be used and misused," Ben Hawes, Technology Policy Consultant and co-author of the Locus Charter, told me. He continues, "There's an assumption automated systems and digital technologies are always better. Economic pressures mean companies prefer the promise of greater productivity at all costs, which can be alarming when people are unaware of many potential data misuses, accidental or deliberate." "Some risks in business going digital crop up in all sectors," said Hawes. "We often see 'designer biases,' where developers center their own experiences, leading to alienating people who don't fit the same racial, economic or physical profile. Another issue is automation making back-end processes more complex until they're opaque. There are also sector-specific issues." With the digital world's size and potential, regulating the space is an uphill battle. New ways to exploit data are appearing faster than lawmakers can address them. Is self-regulation enough? Hawes doesn't support a relaxed approach to data ethics. "It's unwise to avoid oversight and critical regulation in the hope self-regulation may be enough, as it rarely is." A 'wild west' model is attractive for short-term gains by freeing emerging markets from red tape, but loose protections don't create conditions for long-term growth or stable markets, especially in an age of social pressure on brands to be ethical. Can whitewashing be cleaned up? With limited regulative authority, a non-profit trade initiative likely isn't eager to bicker with companies they're working with. Organizations like Locus may be better placed, approaching economic ethics from a collaborative angle. Of course, some companies are only interested in the PR boost of appearing ethical by whitewashing their marketing because they don't want to be the only ones following the rules in a competitive arena. They end up paying lip service alone, without taking the issues seriously. Hawes thinks despite this, there's still benefit in working in good faith. "To get ethically reluctant companies to behave well with data, is it better to give them the benefit of the doubt or be critical and accusing? I think, better to have a company aspire to a good standard, even if it's empty promises, because they can at least be held to those standards in some way." Less direct ways of influencing A cooperative strategy may create the best conditions in a self-regulating atmosphere. When ethics groups collaborate with business, they influence thousands of staff members, creating internal pressure for higher standards in the boardroom. It's also worth championing an ethical company for consumers looking to do the right thing with their money. Though strategies like these can't do it all, they have worked, motivating large companies to produce net-carbon zero plans and banks to create green investment options. But data misuse is not the same as pollution. "It's harder to see and analyze compared with other high-profile scandals, so it's hard to translate into a common grievance that can unite people," says Hawes. Will something have to go badly wrong for the world to take it seriously? Hawes considers, "If authorities avoid developing solutions until a problem causes substantial harm, they'll still need about a decade to develop tools that would be effective in this complex market. Governments should be working on this yesterday." In other words, have a fire extinguisher ready when playing with matches, rather than trying to invent one as your house burns down. Reforming data use culture The task of reforming fast-evolving data industries is daunting. Hawes' recommended method involves slowly, steadily establishing ethical practice as the norm. "The UK has the Digital Regulation Cooperation Forum for sharing information and approaches. It lets regulators gain knowledge of the risks data and digitalized business generate, so they can manage them sector by sector. We need a forum like that on an international scale," says Hawes. "Understanding risks like explainability, transparency and bias creates a foundation for building standards that address the problem and brings stability to the data economy." This pressure can also come from outside industry, and often flavors the expectations that filter into business. "More public debate on how we can avoid driving digital inequalities would go a long way," says Hawes. "This is particularly important in social media, which is the frontline of data ethics in many ways." While data privacy issues haven't seen the emphasis Hawes and his peers would like, they're eager to change the culture. Business can choose to be part of the solution and be heralded as ethical data use champions for their efforts.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries