GDPR And The Question Of Who Owns Personal Data

The European Union’s General Data Protection Regulation, usually called GDPR, will begin applying in May 2018. Even companies outside Europe are paying attention because websites and services often have users in many countries.

The regulation is large, but the basic questions are understandable. What personal data does a company collect? Why does it collect it? How long does it keep the data? Can the user access, correct, or delete some of it? Has the company explained the process clearly?

For years, websites have collected information because storage became cheap and data seemed potentially useful. “We may need it later” became an easy reason to keep almost everything. GDPR pushes organizations to justify that habit more carefully.

Consent is another important area. A long privacy policy that nobody reads is not the same as meaningful understanding. Users should have clearer information about how their data is used, especially when the processing goes beyond what is necessary to provide the service.

For developers, privacy becomes a design problem rather than only a legal document. Databases, logs, analytics, backups, and third-party services can all contain personal information. Deleting one account may be much harder than removing one row from one table.

I think this is healthy even when compliance work is inconvenient. Software has become capable of remembering almost everything. Human beings need some ability to say that not everything should be remembered forever.

Privacy is often discussed as if people either care about it or do not. In reality, most of us make complicated trade-offs for convenience. Good systems should not take advantage of that complexity more than necessary.