I, V, M. This week we are going to talk about GDPR, the General Data Privacy Regulation which has been enacted in the European Union and is a sweeping law that gives customers a lot of protection over their own data. Of course we are talking about this now because Google recently got a massive find stock up their collective behinds and we will talk about the GDPR, what it consists of and if you are a company that does business in the European Union, you should be a little bit scared. See you on the other side of the brain.
Are you looking for finance products and services that can enhance your personal finance experience? Are you looking for a space to talk about your financial product or service? Are you looking for a crisp workshop where the conversation is all about money? Well, your search ends here.
Hi, my name is Arupak Gupta and I post other best of our podcast and I invite you for the conversation about your personal finance for each Monday on the IBM Varkas app or the website or at any podcast streaming platforms. See you folks. It feels like everyone is talking about two things right now, pickleball and podcast. So what happens when someone who's lived her whole life on the court decides to bring those two worlds together?
I'm Sanya Mirzam and I'm bringing you a brand new podcast, Serving It Up with Sanya. I've had some incredible conversations with friends, fellow athletes, artists and entrepreneurs. Each episode starts with a game of pickleball and once the rallies are done, the real topic is Serving It Up with Sanya, watch and listen on YouTube and wherever you get your favorite podcast. And welcome back to Simplified.
And as always, before we jump into the topic, du jour, we will introduce ourselves with the theme. Today's theme is what is the most valuable data that you have ever lost. So I am Chuck. I am your soul representative from Mumbai or indeed all of India today.
And yeah, the most amazing. Okay, but he's not on the show. That's all that matters. It's like shooting.
Yeah, yeah, yeah. So, it's loading girls, Narin. It's Narin in Maladar out of it. This is a question.
Yeah. Yeah. Somehow why am I thinking of Narin tied to a butter toast and rotating in the air? I think I mix my energies up.
That is different. That is the butter cat parrot out there. That is like the this thing. Oh yeah, butter cat parrot.
That is the butter cat parrot. Correct. But if any of you do bump into Narin in the street, just give him a butter toast. The most valuable data that I have ever lost were terabytes and terabytes of or other gigabytes and gigabytes of photos that I had to pay a guy a lot of money to restore.
Well, you can't restore photos. I mean, documents you can do something. I mean, you can do the work all over again. Music files show you can just download everything illegally all over again.
But photos, I mean, it's a bit of a pain to go to every place that you've been to and take all the photos again. So yeah, backup all the data kits. Yeah, man. Yeah.
And I'm speaking and most valuable data that I ever lost. In fact, I lost it initially. But then later, it also became what really hurt was that not only did I lose it, but it also became obsolete because what this data was that in so I got my first computer in 98 and there weren't like I don't know if they existed, but I did at least did not know of the existence of any lyrics sites. So what I did was for a lot of my favorite songs, I used to sit and actually write the lyrics on both notes and save them.
So like for Hotel California or Slim Shady or whatever. In fact, a lot of these songs, I did not know the lyrics. So I used to actually pause. I couldn't like decide for the lyrics.
So I just had to pause and repeat and all that stuff just to understand the lyrics and I hand out all of these lyrics and put them down. So when I was transferring from my first computer out and obviously in like a couple of years I discovered the lyrics sites and stuff. So I stopped using them. But they were still like very close to because I had like hand transcribed them in some cases, in most cases.
So actually then once I shifted computers, I lost that entire data dump. So I was like, it was a very dear loss. But I was like, okay, they were also quite obsolete. So who was the point?
But yeah, that was one of the most painful data losses I've ever had. I feel you should write a song about this. Yeah, and transcribe the lyrics. Yeah, and transcribe.
Moving on from that thought to the profundity of the day. Yeah, standard issue profundity of the day. Nothing extraordinary about this one. It's a good regular middle.
Like what do they say? Good line and length profundity. What is source? What is source?
It's also F.W.G. only. Family, what's that? Very nice.
Yeah. It's delivering again. Oh, oh, oh, oh, oh, oh, oh. Okay.
So again, nice simple one. Two simple tips to stand strong in every situation. Never take help of tears to show your emotion and never take help of words to show your anger. Good morning.
And I agree with this because if you are angry, you should not take the help of words. You should just take the help of your fists and just cough the bastard in the face. So if it's not words, what will you use? You're not recommending keeping the other anger contained inside yourself.
Are you? I mean, like Obama says don't move vote. I'm moving on from that. Fairly.
But like getting people to vote has been fairly dangerous in recent times. So probably just maybe stick to tears of his. Moving right along to GDPR or to give it its full Christian name, the general data protection regulation. What a mey name.
It should be something more spectacular. General directed. Now again. Terrible.
Absolutely terrible. Okay. The GDPR is the actual regulation is 88 pages and 55,000 words. She can then I have read all of it and we are bringing you now 30 minutes.
That's what I spent my entire flight to variation and subsequent months. So when the GDPR came out, there was a quite a bit of mystique around what it actually is. To the extent that if you search for GDPR right now, you will find an explainer website ranking above the official website of the GDPR on Google. That was quite hilarious.
All right. Before we get into the word GDPR for people who have done MBR, it just means completely different. Which is? I mean, just one bit of GDPR just sounds like GDPR.
So yeah, I mean for me, whenever I got GDPR, I was like, how? We have a GDPR. Surely there was a GDPR on the GDPR. Okay.
GDPR. What GDPR is, it's basically how all EU citizens, European Union citizens, personal data must be handled and what companies can do with the people's data. It's a regulation on that. That's basically it.
Why this has gained so much prominence of late is because a whole bunch of things are happening around the world if you have been noticing, like Russia's interfering in elections and Russia's interfering in elections. Facebook is growing up left, right and center. Mostly to right. Right.
Right. And generally a lot of people are wondering, okay, why are so many companies asking us for so much data? Do I really need to give Facebook my political affiliation and do I want to do was to order a shower? Why do I need to tell them which football club I support?
Because fuck about said so. Okay. Okay. When we say all EU citizens, we must clarify because those terms are becoming a little hazy as days go by, all individuals within the European Union and the European Economic Area, in an ideal world, both of these would be the same thing, but they are two different things.
The EU is 28 member states with a total population of 513 million. It's one state. It has a last count. Yeah.
It's two hundred and four million. Yeah. 28 has a last count. And the European Economic Area is basically 28 member states with the addition of Iceland, Norway, the GDPR adopted on 14 April 2016 and became enforceable beginning 25th May 2018.
And still a lot of countries are a lot of companies rather are flat footed as to what to do. Just like Brexit actually, a severe amount of heads up was given and not too much has been done by people who needed to do something. The GDPR is a regulation and not a directive. So it's directly binding and applicable.
And it applies to anyone who offers products and services to the European Union. Right. Yeah. And it sells anything in the European Union to EU customer to EU residence has to comply with GDPR and why it does largely apply to online companies because, hey, those are the guys who take your data.
It also applies to offline retailers and stuff as well. There are a few major sort of like points about the GDPR, which we'll talk about over here. The first is a very nice word, which I think everybody should be indoctrinated in in LKG itself and it's consent. Yeah.
Yeah. Consents generally are very nice word. And over here, the application for it over here is take data only with person knowing. Like data only with permission and general, you know, handshaking on both sides.
Just as an aside and a great video to watch. There is this amazing video on consent and tea. I think that everyone should watch and show to all your children and everyone you care about. Yeah.
Who was that by? You remember? Not really sure. But it seems pretty American.
Yeah. All right. So there was tea. So first one was consent.
The second thing is collect only the data that you need. All right. A lot of companies go overboard collecting a lot of things. And anytime if you download a new app, you will see that the app asks you for permission for all sorts of things.
And you really have to stop and wonder, hey, why does Ola need access to my camera, for instance? Yeah. But if then Ola justifies that by saying, hey, we need to scan your KYC documents for instance. Okay.
Then you provide the reason for it. So companies can collect whatever they want as long as they are able to provide, you know, sort of like a reason for collecting the data. Is there then a body that is also questioning that reason? Yeah.
It's called the people of the EU. They can question companies at any point of time. So basically what the GDPR does is it empowers individuals as well as regulatory bodies to actually ask these questions to tech companies. Like just taking this example ahead, for instance, if Ola, okay, Ola is probably not a relevant example, the user suppose Uber is asking for access to your camera and somebody raises the stinking and ask, why do you want access to the camera?
And Uber says, I need a camera for ADC purpose. And if the guy who is, you know, sort of like filing the complies, okay, that seems like a good enough reason, then everything's okay. But if the guy says, no, that's actually a stupid reason. You should not be asking me for my camera for this.
Then the company is liable to pay whatever whatever whatever. Okay. So then they can be fine. Yeah.
So then they can be fine. And how? I will get to the fines. They are very fine fines.
Okay. So yeah, if you are a company, collect only the data that you need and you will be asked for it at some point of time. Lastly, sorry, not lastly, actually. Thirdly, allow people an exit route, you know, like make unsubscribe terms and conditions.
These all should be visible. They should not be any pre-ticked boxes, you know, like this is always a habit of willingly sign up for this newsletter, which has already been pre-ticked for you. Oh, yeah. Yeah, that's not a good thing.
I think one of our one of very famous mutual friends that we have, the architecture was in, yeah, the architecture was in, you raised this entire, we had an entire crusade against it. Yeah. For having, uh, pre-signed him to some priority banking service or something without which he did not consent to at all. And I mean, I had to, I had to unsubscribe from it after having been charged for it like several times.
Yeah. And he liked it this 100 day campaign. Yeah. Yeah.
Which was, I mean, in India, pre-consent is like everything. And everything they are just assuming consent. Yeah. Yeah.
Yeah. Insosiety itself. Why is the vice-de-company consent? What's the collect only that you need?
So, so, uh, yeah, the GDPR goes against the cultural fabric of, uh, of modern India. Anyway, yeah. It's against Indian culture. So, uh, anyway, so make your unsubscribe TNC visible, et cetera, et cetera.
Reason, uh, so basically this is the reason if you remember when, uh, GDPR went into effect, you would have got several hundreds of males from all the companies that, you know, you might have looked at their ad once and you would have got like males from them. All of them now have to explicitly get your consent to be able to send you newsletters. So, yeah, that deluge of males happened. And I think that is the time a lot of people actually realized that they were actually signed up for a lot of things and ended up subscribing.
Yeah. And we know sometimes finding the unsubscribe button on some emails can be more challenging than your average men's sub problem. So, uh, the, especially for the bank emails. The cutest, the smartest thing that I've seen is just like white font on white background.
Yeah. Yeah. So, all these shady practices have gone out of the window now. Yeah.
And all right. So, that's the third thing. The fourth thing, if you screw up with respect to your data, like let's face it, technology companies as secure as they try to make them, there is a Russian hacker somewhere who is probably smarter than you are. So, chances are your data might get leaked out.
If it does, you need to tell all your customers within 72 hours that there's been a data breach. Yeah. There is also a clause of data portability, which means that a person should be able to access his own data. He should be able to erase his data with special conditions at any point of time.
And so, there are a lot, there are a lot more smaller clauses like this. But yeah, overall, if you look at just what you've collected, what you've said so far, ask for data, you need to ask consent for data to be used, collect only the data that you need and justify why you are asking for each and everything, make all your unsubscribed terms and conditions, et cetera, et cetera, visible, no shady tactics there. And if you screw up, you need to tell your customers within three days that there's been a data breach and all that. So, all of this put together, I am gathering the conclusion that EU citizens care quite a bit about data privacy.
Shriqit. So, this is as comprehensive as any military doctrine that you might put out. But it's interesting again, when we think of it in context of India, because it is very actually, the first point that you made, it's very similar to the concept of consent. The concept of consent goes from saying that if someone has given consent at some point in time, you have to ask for consent again.
You have to ensure that you have continuous consent. So, you have to say that you need to be in a particular system, and you need to be in a place where you are like, I don't know what the marketer means to understand. But just because I have the approach that I have, I personally have a marketer. The approach that we use when we try to put consumers is always that, okay, what is the easiest way to pull the data and how many times can I hammer with my message.
This particular thing actually throws us pattern in the works of marketers. But actually it does a great deal to realign the entire market. I mean, it cleans things up a little bit, right? Yeah, it cleans significantly.
Yeah. Significantly, because then you're no longer, the customer is no longer just like a subject who's being like thrown shit at, right? The customer has rights. Yeah.
And the customer is like someone who has to be like, asked every time that you need to target them. So then it makes the ground fairer for the customer and then will be more informed. It is a win for marketing, but a fail for the brand manager's monthly metrics presentation. It's a little bit.
Yeah. There are lots more small ramifications and points. And we will also look at the reason why we have brought up GDPR, which is Google got, but recently. You all got the side of this break.
It feels like everyone's talking about two things right now, pickleball and podcast. So what happens when someone who's lived her whole life on the court decides to bring those two worlds together? I'm Sanya Mirzam, and I'm bringing you a brand new podcast, Serving It Up with Sanya. I've had some incredible conversations with friends, fellow athletes, artists, and entrepreneurs.
Each episode starts with a game of pickleball, and once the rallies are done, the real talk begins. Serving it up with Sanya, watch and listen on YouTube, and wherever you get your favorite podcasts. Are you looking for finance products and services that can enhance your personal finance experience? Are you looking for a space to talk about your financial product or service?
And are you looking for a crisp talk show where the conversation is all about money? Well, your search ends here. Hi, my name is Arubak Gupta, and I post all the best of us at the podcast, and I invite you for the conversation about your personal product for each Monday on the IVF podcast app or the website, or at any podcast streaming platforms. See you folks.
Welcome back, and we are sorry for not asking for your consent for taking a break. For now, we are actually going to ask for a referendum. Every time you want to take a break, we will wait for your entries to come in, and then only we will take a break. It's gonna be the last episode of 75 from now.
Please enjoy it while you're there. Okay, all right. So GDPR went into effect. What happened?
A lot of things actually happened. Firstly, the European Commission itself noted that they got more than 95,000 complaints from citizens since May of 2017, against various companies saying that, hey, he's so in response to your questions, we get like if Uber is asking for access to camera, yeah, that and 94,999 other complaints are waiting to be heard. And there are also several raising awareness campaigns that the Commission and the regulatory authorities of each country are doing. So each country has their own sort of like data protection authority, DPA's as they've called.
Francis DPA is what has sued Google basically. So individual can sue the data protection authority can sue the, it's a Gala time to be a sewer right now. Yeah, companies are very much on the back foot, but nobody has any sympathy for these companies because all of that, most of them tend to be plush Silicon Valley companies. Like the fine that Google got was some 50 million euros and what is 50 million euros to Google?
It probably wasn't even worth their time to fight it. They're just paying the damn thing of because wasting time on the cases probably going to cost them more. Oh, yeah. Anyway, what this is ending up acting as now that GDPR is now that Europe has put so much trouble and effort into creating the GDPR.
Is that it's acting as a template for the rest of the world, not just to formulate their own data protection laws, but also just to just generally start thinking about data. They're realizing, okay, shit, this is important. Yeah, it's like the GDPR is now, it's not just the first, but it's also gold standard of what internet protection laws need to be like. So I mean, it's a template, I mean, that's a positive sign that such a strong and well articulated law is the first data protection law out there.
That, I mean, whether you want it or not, whether you like it or not, like most of the data protection laws will on some way, at least be modeled on this. So there is hope for the data protection. And other thing is it looks severely shady if a huge company like say Facebook complies with GDPR in one continent, which is Europe and in one market. And it's a regular thing in the other market.
So obviously those customers also be like, even what they're getting. Yeah, exactly. Yeah, so thankfully Facebook has preempted this and said that they're going to keep the thing sort of like default around the world. The GDPR was applying for around the world.
Yeah, for around the world. I'm guessing a lot more people will do that. At least people who are currently perceived slightly negatively in the public eye, which is Facebook. And oh yeah, that's it.
Anyway, for some smaller companies, the deadline was too soon. And sometimes it was blocking the EU. As in they are not making their website accessible to customers in the EU. And a simple way of doing this is just change your VPN to any of these countries that are in the EU.
And you will get an error message or something saying that, you know, we need to block or whatever. And I guess for them, that's what makes sense because the EU isn't as valuable to them. Like I've often had my VPN set to say something like Sweden when I'm indulging in, yeah, you never mind. And I've opened up new sites like whatever.
I don't remember the exact new sites. But some of them aren't accessible. You can sort of make sense, right? Like why would a person, the average person in Stockholm, why would he be worried about, say an Indian news website?
Or maybe it's an e-commerce company which doesn't really need Europe. In travel like the company where I used to work for instance. We could either comply with GDPR or we sold tickets only in India. So we just put up a block message in Europe and that's not going to affect too much because less than 1% of our traffic comes from Europe.
So that was that. A few things are going to have a bit of problems. Like you said, in marketing, programmatic advertising is going to face an issue. Yeah, for those of you who don't know what programmatic advertising is, it's basically a simplified automated version of those annoying display ads that you see, like banner ads along the website.
So basically if you're a person who somehow Google has realized that you're the person who has the propensity to spend a lot of money because you have browsed from this phone and you have bought on this website before say purchase of over $5,000 or something, they will probably follow you and target you with ads for high end goods. So that is going to become a lot more difficult. Here's another thing that's going to have problems thanks to GDPR if it didn't have problems already, Brexit. Oh God, yeah.
If a no deal happens, it's going to create massive headaches since Britain is now going to be considered an outside country from the EU and that opens up a different can of worms altogether. There's a small and sticking to media, another media agency that's got affected not in the way that you might think. It's an agency in Wooster called GD that had to rebrand itself because the company's name was GDPR and Media. So they had to go on the campaign of renaming themselves.
Now here is a scary thing. When you hear the words, China has got inspired by Dash. Does that inspire in your sense of confidence, happiness or like, mortal dread? Right, largely dread, largely dread, yeah.
So when you say that China is... Chinese, Chinese inspirations are usually like have a body count or like something. Yeah, I mean, they either have a body count or like they will have like some kind of like broken firewall or some sinister deal being stuck somewhere with like some hundreds of people suing like footballs with their teeth or something like that. So China has got inspired by the GDPR and is working on a law that's even more stringent than GDPR, which now, so you know, here's the thing.
While that seems like a positive step, I am a little skeptical, especially given that the government itself is surveilling people so much. Yeah, it's basically like their new regulation is going to be like one big E-force machine in which all your data are belong to them. Yeah, yeah. So yeah, apart, so there are obviously several problems that companies have for this.
They have to comply which means that they have to fix a lot of their processes. They need to make sure that they're asking for data only if they actually need it. They have to check the data that they have. They have to write to their customers which is why you're getting so many emails saying, hey, do you still want to sign up for this newsletter which you accidentally signed up for or we signed you up for a few years ago?
And companies might actually have to hire talent. So another ruling in the GDPR is if you have an employee strength of over 250, you need to hire a data protection officer, which yeah, which could actually end up meaning higher prices for consumers. So let's go back, let's take a step back and ask why did the GDPR actually come about? That's because a lot of the early cybersecurity laws happened in a pre-smart phone era where data gathering and all that didn't exactly happen.
Right now we live in the Senator rerun ads era where there are a lot of things have changed. We live in an era where everything is digitized. Things we read, our health trackers, the podcast we listen to, who we check out on Tinder, what we say to people on Tinder. And I think it's a good reason that some people might not want all this information to get out or be targeted as a result of it.
I am reminded of the example in, I think it was Amazon in the US. They had tracked a girl's purchasing behavior and they said it's very predictive that she is going to become pregnant in other few months and started sending her baby stuff. I think a pregnancy kit or something, the dad was outraged but true to form she ended up being pregnant because she and her boyfriend had an interesting idea. Yeah, slightly more depressing and terrifying incident.
There was a woman who suffered a miscarriage and she actually posted, this is an entire emotional post about how Amazon and the rest of the guys wouldn't stop targeting her with stuff about babies because well she had a miscarriage and there is no baby but she kept getting started as strollers and all that stuff. So yeah, I mean, that's the part about GDPR. That's the part about GDPR that I particularly like and there is this entire section which, my favorite section of the GDPR that came about was that this part about single token usage of data where it very clearly ruled and I feel it's one of the simplest and most important parts of GDPR which says that as a customer you want to interact with a store or a database once. You effectively want to consent to give your data to them for use of a single job.
So I'm giving my address of my phone number so that I can get that particularly if I'm ordering a tennis ball on Amazon. I'm giving it so that tennis ball can deliver to my house and after that I don't need that data to be there but what marketers have exploited for the longest time pre-entry GDPR days is the fact that they've been able to use that data till infinity and they're able to build on any of the other, they keep building your profile by offering information from all your other online footprints and make a composite profile of you and continue to target you stuff without your consent and you can do nothing you can do about it. But with single token access, I am required to, if I'm getting consent for your data for one single use that token of data expires with that single use. And the next time you want to talk to me, you will have to ask for my consent for that data again and then you will be able to get the data again and you will have to use it.
So I found that to be an incredibly empowering piece of legislation that actually helps the consumer in such a single way. Although when you did say that you were purchasing a tennis ball from Amazon, I was actually thinking somebody from the Amazon warehouse actually backing a tennis ball across the streets of Kuala Lumpur and finally bounces into your window. Oh, and yeah, the day. So I mean, oh, God, yeah, a friend of mine was actually she's actually interviewing delivery people for her dissertation and stuff.
And she was actually talking about how there are delivery people who actually are like complaining about the fact that Kissikko, Kissikko, iskriim, Kani Kissikko, iskriim, kani kusili, wita, miro, pachis, kile mittan, jalana, bartai. Wow. Yeah, it's just stuff like that. But anyway, thank you.
Okay, so a quick look at what happened to Google actually. Textbook example, again, right down the middle good line and length example of GDPR violation. Quite simple, CNIL, which is the French Data Protection Agency, National Commission on Informatics and Liberty. They held that Google wasn't violation of the obligation of transparency.
So basically they didn't tell their customers what they were using the data for. And yeah, the current processing operations do not allow a user to be aware of the plurality of websites and applications, meaning that you might have submitted your data to Google for search, but the same data was being used for other services like YouTube, Google Maps, Play Store, et cetera. And they got hit with a massive fine purely because of the, so one, your fine is directly proportional to your turnover. So the because you are the harder you will fall.
And yeah, and the fact that it was so over each, when you think about Google's universe, they can get in your data from, say, Google search, and just think about where all it can be applicable. And while convenient, it's also important that customers are aware that their data is being used in this way. So 50 million euros was a fine. Congratulations, Google.
It's unlikely to be broken for a while, even with Zuckerberg's best efforts. It was based on the number of violations in the French market, given Google's tremendous user base also. And the fact that the violations are continuous and they just remain unaddressed. Also, it means that here's the other thing, which should scare a lot of other smaller companies, actually.
If you're a company that use tools by GDPR non-compliant companies and you're saying, yeah, you could be liable. See, these are all like questions. There are no exact answers to things like this. So if you use, say, Google, which is, say, non-GDPR for whatever, like it could be just using a Google Maps API for your delivery product or something, you might actually be fine.
Again, it varies from case to case, obviously. But yeah, again, these are throwing up more questions and answers and lawsuits, clearly. Yeah, anyway, the takeaways from GDPR. European data protection authorities have teeth now, and they are not afraid to bite.
Oh, yeah. Forget bearing them. They are biting. And the DPA's, they have their eye on targeted advertisements, especially.
And watch out. There are agitators in the data protection space. There are activists. There are people who are running education campaigns.
And at the end of the day, transparency is just key. If you're a company, there are chances that you will need to get in data at some point of time. So don't be a dick about it. Just ask people nicely, and it should be all OK.
Which, right now, brings us to a very, very important question. Is simplified GDPR compliant? I mean, I don't know of any kind of data collection devices that we have over here. That is a question that we need to ask Abhaz and Amit.
But otherwise, I'm proud to, at least from R.P.L.T. to announce that we are 100% GDPR compliant, as far as we know. But should we ask how you can do it? The only way to forecast it is 100% or from my lord west anyway.
Yes, India is not a my lord west macrocosm. I mean, macrocosm. All right. All right.
That's all we have for you from GDPR. If any of you have questions, type in GDPR in Google and click on the first link, because the second link is the official page with the 88 pages of software nobody will be able to understand. And one final thing on GDPR is that, I mean, among all the episodes that we do about 80 to 90% of them are about things that are going to shoot. It's so nice to do once in a while, that 10% while episode where someone is actually doing something right and like the consumers are winning versus the evil corporation for once.
So for every Brexit and Russian interference, there is GDPR. I just feel, the other part is I just feel that I'm sorry for the British people. They were among all the other miseries they will get. They'll be like, yeah, GDPR, try to be like, oh, oh.
Oh, yeah. Then after they're like, OK, now all the waiters and all these guys are standing, they're clapping their fingers together like Mr. Burns. Oh, amazing.
Anyway, that's it from us. And as Narin would say, stay safe, stay compliant. Yeah, stay simplified. Bye-bye.