Data privacy: What will 2021 bring?

By Eve Maler, CTO, ForgeRock

Each year, when Data Privacy Day comes around, I like to take stock and ask myself: how will privacy change in the year ahead? And how, in a world where data is increasingly central to everything we do, can consumer privacy be truly protected?

This year, these questions seem more pertinent than ever. As the pandemic condensed a decade of digital transformation into just one (long) year, the role data plays in our lives has become more prominent than ever. From 2010 to 2020 alone, the volume of data consumed worldwide exploded from two zettabytes (two trillion gigabytes) to 59 zettabytes, and this growth is only going to continue.

As we see yet more changes to the way data is used, collected and processed, here are my three predictions for the year ahead.

Governments everywhere will adopt national digital identities

The public sector hasn’t been immune to the digital transformation wrought by the pandemic. Test and Trace, remote access to services and, most importantly, measures which may provide a way out of current restrictions have shown us just how crucial digital innovation is for public sector services too.

For governments, this will drive the adoption of ‘national’ digital identities for their citizens. In the UK, for example, the government announced in September 2020 that it was considering the roll-out of ‘unique digital identities to revolutionise the use of data across government’ and increase service delivery efficiency including for public health. This has been followed by talk of other digital identity projects such as a ‘vaccine passports’ pilot.

Aside from questioning their efficacy, many commentators have raised concerns about privacy within these systems, with some fearing that these and future measures could lead to more tracking and storing of people’s personal data in the long-term. After all, in the face of COVID-19, the point of some of these measures to control movement. This requires the government to process location, contact, and health (for example temperature, recent illnesses, and vaccine history) data, at the very least.

A source of optimism may be the 10-week pilot of the Scottish Government’s Digital Identity Scotland which found that it was able to better communicate the service’s benefits, including stringent privacy controls, after completing the pilot and understanding user needs.

However, few proposals have materialised into large successes; for example, Gov.UK Verify hasn’t lived up to its original vision at scale.

The clock is ticking on post-Brexit UK-EU data transfers

Following the Trade and Cooperation Agreement signed by the UK and EU at the eleventh hour last year, post-Brexit data transfers still hang in the balance – and it’s a precarious one.

The UK has now entered a six-months bridging period in which it’s not yet considered a “third country” in terms of data transfers, so for now things are continuing as normal. By the end of this period the EU should grant the UK data adequacy – otherwise businesses will have to resort to alternative mechanisms.

However, experts warn that there is some risk this may not happen: while both parties have broadly parallel data regulation regimes, the UK also has an Investigative Powers Act (IPA) which is similar to the US surveillance laws that resulted in the Privacy Shield – which legitimated US-EU data transfers – being struck down last year.

As with the situation between the EU and US – which is still ongoing – the UK’s mass surveillance program doesn’t meet either the conditions laid out in the Court of Justice of the EU’s decision in Schrems II or the EU Data Protection Board’s guidance on surveillance safeguards.

If the right legal pathways can be found, everything will work out just fine. But the government is telling businesses to err on the side of caution and prepare for the worst, just in case. My view is that an agreement will be found soon, because there is just too much business riding on the outcome for it to fail.

Data subjects are doin’ it for themselves

Data consent has been broken for some time. How many people clicking ‘accept’ truly understand what they are agreeing to when it comes to their data? This long-standing issue became a full-blown problem in 2020 as millions of people started using online channels to do the many tasks which were no longer possible in person.

In recent research undertaken by ForgeRock, we found that accompanying this online shift has been a growing sensitivity to how users’ data is handled. For example, two-thirds of consumers ranked not having their data sold by a company whose services they use as a top priority. That attitude has been borne out in how consumers have behaved in recent months: when WhatsApp changed its data-sharing terms and conditions, users left the app enmasse to avoid their data being shared with parent company Facebook. Reports suggest the winners have been privacy-sensitive apps such as Telegram and Signal.

Looking ahead to the rest of this year, this shift is surely only going to continue. Building on the success of past regulatory developments including GDPR and Open Banking, I believe we’ll see individuals take on new roles as empowered data agents, rather than mere data subjects. They’ll have the regulatory wind behind their sails, pushed along by the UK’s Pensions Dashboard, the US healthcare sector’s CMS rule, and Australia’s Consumer Data Right.

In 2021 – as every year – I hope that we will enter a new era for how personal data is captured, handled and shared. This year the seismic societal and commercial shifts precipitated by the pandemic will act as the catalyst once and for all.

More about Irish Tech News and Business Showcase here.
FYI the ROI for you is => Irish Tech News now gets over 1.5 million monthly views, and up to 900k monthly unique visitors, from over 160 countries. We have over 860,000 relevant followers on Twitter on our various accounts & were recently described as Ireland’s leading online tech news site and Ireland’s answer to TechCrunch, so we can offer you a good audience!

Since introducing desktop notifications a short time ago, which notify readers directly in their browser of new articles being published, over 50,000 people have now signed up to receive them ensuring they are instantly kept up to date on all our latest content. Desktop notifications offer a unique method of serving content directly to verified readers and bypass the issue of content getting lost in people’s crowded news feeds.

Drop us a line if you want to be featured, guest post, suggest a possible interview or just let us know what you would like to see more of in our future articles. We’re always open to new and interesting suggestions for informative and different articles.

Contact us, by email, twitter or whatever social media works for you and hopefully, we can share your story too and reach our global audience. We are agile, responsive, quick and talented, we look forward to working with you!

If you would like to have your company featured in the Irish Tech News Business Showcase, get in contact with us at Simon@IrishTechNews.ie or on Twitter: @SimonCocking