The iPhone knows its location and stores that information in a file. Apple denied this claim, called users confused and the problem a bug.
Sony admitted last week that hackers had obtained Play Station Network user names, addresses, email addresses, birth dates, passwords and IDs.
Oh, and a few days later, Sony admitted to a second security breach that may have resulted in the theft of personal information of 24.6 million Sony Online Entertainment (SOE) customers. This includes 12,700 non-U.S. credit or debit card numbers and 10,700 direct debt records.
This is not about bashing Sony and/or Apple. There are bigger issues at hand here.
The core issue is informed consent, which is a by-product of basic respect and empathy for customers. Most companies are lacking these important principles. 30 free days added to their subscription by Sony is just not good enough. Customers should be offered free credit reports and subscriptions to identity theft protection services. A few friends of mine had to deal with identity theft, and I can assure you 30 days of free service wouldn’t make up for the time they had to waste cleaning up their record.
Consumers will put up with a lot from brands they like and do business with so long as they are told what the brands wants to do (in non-marketing and non-technical speak) and they are given the opportunity to choose.
Apple didn’t provide any opportunity to opt-in for storage of location data, no choice was ever given. Sony didn’t do enough to ensure the anonymity and privacy of their users, they didn’t even encrypt personal data.
Lawyers will point to the end-user license agreement and TOS but the relationship between a brand and a person is much more than a legal contract. Nobody reads these documents, we just scroll down to mark the checkbox and get on with it. They protect the legal structure of an enterprise but they don’t do anything for customers. Sony and Apple, just like other enterprises that collect data, don’t put clear verbiage in front of people and give them real options. And, yes, the option to selectively enable and disable data collection and sharing should be included.
Sony had good reasons to collect customer data: It provides them the opportunity to sell more products by delivering relevant messages at an opportune time. That’s fine as long as the customer can make a risk assessment: Is a $5 coupon worth the risk of identity theft?
Trust in data security is eroding.
This is only the beginning of the end of personal data collection by enterprises. Almost every day we read about examples of companies abusing the ownership of our personal data. This massive crisis might force Sony into opening their data systems to independent external auditors, letting them access the source code of the implementation and validating that data is secured and used in a way consistent with the privacy criteria both parties agreed on. They will have to change their communication with customers to make it more human, less legal and transparent.
Will it be enough?
In the short-term, those measures should help the gain the trust of their most avid customers. In the long-term, more breaches in different verticals will become public and customers will finally see that their data is being treated recklessly and without any respect.
Ultimately, enterprises have to deal with this reality:
People will understand their personal data has more value than a “$1 off” coupon. They will refuse to give enterprises long-term access to their data. Instead, they will allow them to access their data for a limited amount of time in exchange for a real value proposition. People have given the key to brands too many times, just to get a wrecked car in return. It’s about time, they demand the key back.
uwehook 