Sign in Subscribe
By Audrey Hingle —

You Have Data Rights: So Why Are They So Hard To Exercise?

You Have Data Rights: So Why Are They So Hard To Exercise?
Photo by Andrea De Santis / Unsplash

In our main article today, Public Interest Technologist and Senior Product Manager for Permission Slip at Consumer Reports, Sukhi Gulati-Gilbert, breaks down why data rights are so hard to use, how companies make opting out a nightmare, and what privacy tools can do to help consumers take back control.

But first...

The Importance of Women in Technology and Combating Digital Misogyny at UN's CSW69

The 69th session of the UN Commission on the Status of Women (CSW69) is underway, marking the 30th anniversary of the Beijing Declaration. This year, technology is at the forefront of discussions, with a strong focus on digital misogyny and the importance of women's participation in the digital economy.

At the start of the session, 193 UN member states adopted a Political Declaration addressing modern challenges to gender equality, including access to STEM education for women, equitable participation in the digital economy, and improved gender-specific data collection to inform policy. As part of these discussions, UN Secretary-General António Guterres highlighted the role of emerging technologies, including artificial intelligence, in perpetuating violence and abuse against women.

Events Highlighting Digital Rights and Gender Equity

CSW69 is hosting a range of official sessions and fringe events tackling these issues head-on, bringing together feminists, digital rights advocates, and policymakers. Upcoming events include:

💡
Sign up for Internet Exchange!

Internet Governance

Digital Rights

Technology and Society

Upcoming Events

Careers, Contribution and Funding Opportunities

What did we miss? Please send us a reply or write to editor@exchangepoint.tech.

💡
We want to hear from you! View this edition on the web to respond to our poll.

Realizing the Promise of Data Rights

By Sukhi Gulati-Gilbert, Public Interest Technologist and Senior Product Manager for Permission Slip at Consumer Reports. Views are her own and not indicative of Consumer Reports’ position.

Much of today’s internet is powered by a massive and opaque exchange of personal data. In the time it takes to load a web page, advertisers have likely already auctioned off your attention. Advertisers determine the value of ad space based on what they know about the viewer. Individual profiles for this purpose are aggregated from sources ranging from public property records to retail transactions and, of course, internet activity. This data is often collected without meaningful user consent and can be used in ways that are sensitive and invasive. Recently, the FTC took action against data brokers for using consumer location data to unlawfully sell inferences about medical conditions and religious beliefs. When every click contributes to an inscrutable sea of personal data, it can be overwhelming to take back control. 

State privacy laws in the United States have started to address dangers of the data economy by granting residents data rights. However, these rights are often difficult and frustrating to exercise. Improving digital privacy rights requires stronger legislation, new technical systems, and consumers making their voice heard. Until then, privacy tooling can help bridge the gap between data rights in law and protecting consumer privacy in practice.

The Current State of Data Rights Requests

Inconsistently Protected
In the United States, existing data rights are mostly enshrined in state-level legislation. Nineteen states so far have signed some form of digital privacy rights into law. The seminal piece of U.S. privacy legislation was the California Consumer Privacy Act (CCPA), which went into effect in 2020. The law grants residents an array of data rights. Perhaps most notably: the right to access what personal data companies are collecting, the right to request deletion of that data, and the right to opt out of the data being sold or shared. Though state laws vary in their protections, all nineteen contain some form of access, deletion and opt out rights. It is encouraging to see more states adopting privacy laws, although many Americans continue to lack any protected data rights. 

Onerous to Execute
Unfortunately, simply having privacy rights is not enough if consumers cannot execute those rights effectively and easily. Accounts of individuals sending out rights requests have revealed the process to be incredibly confusing. To start, individuals must identify how to submit a data rights request - a process which varies by company. A 2020 Consumer Reports study found that on 42.5% of sites tested, at least one in three testers were unable to find a “Do Not Sell” link. Once the link (or alternate submission method) has been located, it can still feel tedious or even deliberately difficult. An example is the common data broker practice of requiring users to find their information on the site in order to submit the opt-out request. Once the user begins searching for themselves, they are often asked follow up questions like: “Has this individual ever lived in New York?” “Are they under 30?” Going through a multi-step search significantly lengthens the time it takes to submit a data rights request and puts the burden of locating relevant information on the consumer instead of on the data broker. To make matters worse, consumers may answer the questions truthfully without realizing that doing so risks exposing even more personal data to the company. 

Even in the case where companies have created an easy or intuitive data rights request process, the volume of requests for an individual to send is high. There are hundreds of data brokers in California's data broker registry and many companies in addition to data brokers that consumers may have shared data with. An individual could end up managing requests with hundreds of entities to effectively reduce their digital footprint. 

Lacking Assurance
A now infamous leaked Facebook memo explained, “We do not have an adequate level of control and explainability over how our systems use data, and thus we can’t confidently make controlled policy changes or external commitments such as ‘we will not use X data for Y purpose.” For years before privacy regulation came into effect, systems were designed to maximize data collection, not to protect user privacy. Retrofitting them for privacy compliance is difficult and expensive, making it entirely possible that companies claiming to fulfill data rights requests have not truly deleted or protected user data. Currently, those exercising their data rights do not receive any verifiable proof that their request has been fulfilled or that the data they submitted with the requests was not used for purposes other than fulfilling their request. The process requires taking on good faith that a company has complied when they say they have, even though we know that the problem can often be technically intractable. 

An Interim Solution: Privacy Tooling

Given how onerous it can be to send out data rights requests manually, privacy automation tools have emerged to help consumers. Many state laws include a provision that allows individuals to delegate a third party - referred to as an “authorized agent” -  to submit requests on their behalf. An authorized agent could be an individual, an organization, or an automated tool. Agents can be a powerful force to simplify the user experience by allowing consumers to interface with one agent rather than dealing with multiple companies individually. Permission Slip by Consumer Reports is one of a few applications leveraging this concept to make it easier for consumers to exercise their data rights. Authorized agents in the market vary in their approach but the value proposition is similar: they take on the tedious task of sending out data rights requests and tracking their progress so users don’t have to. These tools also enable collective action. At Consumer Reports, for example, we follow up with companies that fail to respond to requests at scale and may even file complaints with enforcement agencies. 

Authorized agents are one set of tools working to make privacy more accessible, but they aren’t the only ones. Global Privacy Control is a browser tool users can configure to proactively signal to websites that they do not want their data sold or shared. There are also state-led efforts to simplify user interfaces. Recently, California’s DELETE Act went into effect, requiring the state to create a system that lets residents delete their data from all registered data brokers with a single request. 

Moving Forward: Making Data Rights More Effective

Reducing the consumer burden of exercising data rights is important, but we should also continue to iterate on data rights by making them more consistent, standard and effective. Everyone has a part to play:

For Policymakers: 

  • Standardize Data Rights Requests: Data rights requests should be standardized so that they can be submitted via an API. This will enable both the public and private sectors to create one-stop tools for consumers to submit data rights requests that are more intuitive and usable than what companies have incentive to create. 

For Technologists: 

  • Invest in Data Traceability: Decades of innovation have gone into creating systems that are optimized for extracting value from user data. To catch up, we’ll have to create usable, open source systems that make it easy for companies to incorporate data traceability. Without reliable and transparent understanding of data flows, we cannot achieve verifiable assurance that rights have been effectively exercised.

For Consumers:

  • Send Out Data Rights Requests: However imperfect, submitting requests can dramatically reduce your digital footprint and exert real demands on companies with potential to spur increased investment in privacy programs. Given how long the process can take, you may consider employing an authorized agent to help or prioritizing requests to the worst offenders. 
  • File Complaints: If your state has a privacy law and a company is not replying to your data rights requests, file a complaint with your state’s attorney general.

Of course, we should also not lose sight of a world beyond data privacy rights. While they can help us mitigate the harm when surveillance is the default, we should continue to advocate for reimagined systems and business models where privacy is the default instead. In the meantime, the emergence of data rights for Americans is a step in the right direction. Let’s make the most of them.

💡
Please forward and share!

Subscribe to Internet Exchange

Don’t miss out on the latest issues. Sign up now to get access to the library of members-only issues.
jamie@example.com
Subscribe