Privacy in the post-GDPR world

March 14, 2018

A blog post by Val Srinivas, Banking & Capital Markets research leader, Deloitte Services LP.

I would hazard a guess that there is no single, universal answer to these questions. That is because privacy, like many things in life, is in the eye of the beholder.¹

And to complicate matters, one’s feelings about privacy may well depend on the situation—what information are we talking about, why does the other party have your information in the first place, where do these data reside, how are they protected, and, not least, who has your personal information?

As we collectively generate quintillions of bytes of data every day, much of them outside our control (think of the digital trails we leave), and as cyberattacks and information breaches become increasingly common occurrences, to say that concerns about privacy have only gone up could be an understatement.² This is particularly true of privacy in a financial context. Not only are consumers becoming more vigilant about privacy, but they are also demanding institutions do more to safeguard their private data.

Not to be left behind, regulators around the world are also establishing new rules for companies to follow. Consider the General Data Protection Regulation (GDPR) in the European Union, which is about to take effect on May 25, 2018.³ This sweeping regulation will affect every institution that handles personal data of EU citizens. And, unlike regulations in the United States, which tend to be narrower in scope and generally protect only specific types of data (such as Social Security numbers) GDPR is more encompassing in that it includes any and all information about EU residents. No doubt, many American companies, including financial institutions, have yet to fully come to grips with GDPR.⁴

But, to step back a bit, what does privacy really mean? A number of privacy scholars have noted that privacy is “a concept in disarray,” “embarrassingly difficult to define,” and “an essentially contested concept.”⁵

Without going too deep into these arguments, I tend to agree with the view that we need a clearer definition of privacy, especially one that will stand the test of time and remain appropriate for the technological innovations to come.⁶

Figure 1: Seven types of privacy

Source: Finn R.L., Wright D., Friedewald M. (2013) Seven Types of Privacy. In: Gutwirth S., Leenes R., de Hert P., Poullet Y. (eds) European Data Protection: Coming of Age. Springer, Dordrecht.

Forward looking framework

In the words of three academics—Rachel L. Flinn, David Wright, and Michael Friedewald—who studied this topic, what we as a society need is a “forward looking framework” that takes into account the impact of new and emerging technologies. They further argue that there are seven different types of privacy—ranging from privacy of the person to privacy of association (figure 1).

Now, how could this typology apply to privacy in financial services? For one thing, it highlights the multidimensionality of the privacy concept, and suggests that as service providers who may have access to information about the different types of privacy outlined in figure 1, financial institutions need to think differently about how to collect, store, process, share, and protect each type of privacy.

Take, for example, the use of biometric data for identification in financial services. It is clear that these technologies will become more commonplace as the years go by. However, the application of biometrics may go beyond identification to include other analyses, where such data are combined with other personal information, such as location or social media behavior, to decipher an individual’s needs or preferences for financial services. So, in the privacy context, what are the expectations regarding the use of such biometric information? Do consumers need to be informed that such merging of private information is happening, and how such combined information may be used to serve customers?

I can imagine a number of similar questions that may be relevant to privacy as new technologies are used to target and serve financial services customers. But such examination would not be possible without a deeper and richer understanding of privacy in all its facets in today’s digital world.

My hope is that financial institutions think of privacy in a more nuanced, holistic, and meaningful way, rather than merely trying to satisfy existing compliance requirements. I would also hope financial institutions become more proactive and deliberate in envisioning how privacy might evolve over time, and in ensuring that privacy becomes an institutionwide mantra.

Lastly, I believe privacy management when practiced in the way I describe above can also be a differentiator in the customers’ eyes. Who knows what premium superior privacy management can engender? In other words, it is entirely possible that sound privacy practices by financial institutions could ultimately lead to better financial outcomes for the service providers.