COMMENTARY: Who’s Got Your Data? And What Are They Doing With It?

The right to be forgotten online isn’t enough: we need the right to know – and the right to go

Looking at a new medicine online? Handed over your supermarket loyalty card to get a discount? Somewhere a computer is taking note. Data consolidators know what we eat, drink and buy, our gender, our health, who we know, every Google search we ever ran, most downloads we ever did, every email we ever wrote – it all exists somewhere in the black hole of cyber space.

When you clicked “I agree” to those privacy terms and conditions, you may not have read them, thinking you had nothing to hide, and unknowingly agreed to limited use of your data. But even if you did read them, you probably won’t know how your information is being used.

Incomprehensibly large amounts of data are being created every day, and data protection laws are not keeping up. In the era of cloud computing, data cannot be held within national borders. Regulation and policy frameworks to protect consumers are insufficient.

Data consolidators take full advantage, controlling this data both individually and collectively and using it to sell products. It’s perfectly legal. But should businesses be allowed to use your data for something you didn’t intend? Something you don’t even know about?

The recent European Court of Justice decision granting the right to be forgotten online is a provocative step forward. But erasing data completely and permanently from a global Internet of more than 190 countries and territories is an enormous technical challenge and may, in fact, be nearly impossible.

Instead of the right to be forgotten, two other rights have the potential to achieve a similar goal in a more viable way: the right to know and the right to go.

The Right to Know
Knowing who has your information and what they are doing with it, who they have given or sold it to and for what purpose, should be a fundamental right. Just like an American’s right to receive an annual credit report, an individual’s right to a report on their online information could be made mandatory and is more easily achieved through existing platforms than complete data erasure. If users had the right to request a download of all data a company holds on them, they could then decide if they wished to continue having a relationship with that company. Companies should also disclose what data they have sold about an individual to other companies, so the individual can in turn contact those companies to exercise their right to know and go.

The Right to Go
The right to go is the right to terminate your relationship with any company, which would then be obligated to delete every shred of data they hold about you, notwithstanding any legal obligations.

Those two rights would change the behaviour of business overnight by changing the incentive structure of collecting and monetising online personal data. Instead of collecting every piece of data they can get their hands on, companies would tread carefully to avoid offending their customers. Many might try to gather as little data as they possibly can that still allows them to maximise their business value with watching customers. That means consumers would get what they deserve: a transparent and honest relationship with companies, and the right to walk away and have their private information deleted.