How to Protect Your Data and Privacy

Imagine if someone pointed a surveillance camera through your bedroom window or published sensitive information about you in the newspaper. It’s clear that they’ve crossed a line. Privacy has always been important.

However, older laws haven’t kept up with the rapid digital transformation of the last decade. What about your online activity and your smartphone use? Shouldn’t your privacy be respected there as well?

This is where the lines get blurry, but that’s changing. Entities that exploit people’s data, compromising their privacy and security, are facing pushback from both lawmakers and individuals.

One key change happened in 2018, when the General Data Protection Regulation (GDPR) was enacted in the EU and EEA.

This law has granted us robust rights that can be exercised to protect ourselves and our interests online. There are also other ways you can take to stay safe online and hide some of your digital tracks. In the following section we go through both the rights you have and some basic techniques for digital self-defence.

Privacy has a direct impact on a democratic society. Without the protection of our privacy, we simply cannot have a democracy, as lack of privacy can make us susceptible to manipulation. We need a private space where we can think freely, form our own opinions, and educate ourselves.

In the physical world, those with wealth often secure their privacy with large properties, security personnel, and surveillance cameras. This concept of privacy needs to be renegotiated in the digital world.

There are questions to be answered—for example, who should own the data and the infrastructure? How can we prevent too much information, data, and power from ending up in a few hands? These are political issues, and that’s why bodies like the EU have taken a proactive stance in this field.

You leave many digital traces that various organisations and businesses can access. A lot of this is considered personal data since it’s linked to you as a specific or identifiable person.

Misuse of personal data can be intrusive and unpleasant for the individual, and in the worst case, lead to things like blackmail or identity theft. Even small breaches are not just possible, they’re quite common. For example, misuse of consent, which must be specific, given actively, and meet several other requirements to be valid.

Sometimes these breaches happen even when there’s no bad intention. For example, the ones asking for consent might not fully understand what valid consent involves.

Businesses that process personal data—collecting, viewing, storing, deleting or doing anything else with it—have several obligations. One of these obligations is to precisely understand the rules of consent and to have a legal basis for the processing (more on this in chapter 3). Businesses cannot do whatever they please.

You, as an individual, have many rights.

It is important to note that privacy isn’t an absolute right. It has to be balanced with other freedoms, such as freedom of speech, and public interests such as public health. We also have to take into account other rights, such as the right to conduct economic and commercial activities.

For example, an insurance company will obviously need their customer’s name and address to sell home insurance. There are other situations where someone’s need to process personal data might outweigh an individual’s right to privacy. There are always exceptions to rules, and judgement calls are sometimes necessary.

It is still both legal and fully possible to process personal data, but it must occur within certain parameters, and on a defined basis, where the processing is proportionally weighed against the purpose.

One can feel powerless when it comes to privacy. The fact that there is a risk that you as a private individual can be re-identified even from “anonymised” data is just one example.

Laws such as the GDPR are there to help. They ensure data is only collected as necessary for a given purpose and that it isn’t used for anything else. It is challenging, however, to make laws that keep up with technological advancements while not hindering innovation.

Therefore, each of us must take steps to protect ourselves. The following principles can be helpful:

The most important thing is that you are aware of your personal data and privacy concerns, and act accordingly. Simple actions such as installing browser extensions that delete cookies and limit tracking, using a password manager for unique, strong passwords, or using a VPN to partly hide your online activity can go a long way. We’ll look more into this in the next Chapter, on security.

Furthermore, you can avoid sharing more data than necessary with the big platforms by choosing alternative services. You could, for instance, choose other services for email and messaging than those owned by Google or Meta. If you choose services with so-called end-to-end encryption, the actual content will not be visible to others, other than yourself and the recipient.

Similarly, you can choose alternative services—preferably so-called “open-source"—for your browser, search engine, and so on. A good rule of thumb is that if you’re paying for the service, it’s less likely that you are the product.

Finally, it’s important to know the difference between human and algorithmically selected information. We increasingly inform ourselves through digital platforms. It’s not just social media that selects content for each user using algorithms. When you search for something, you may get different results than someone else, based on your previous searches. Over time it might mean that your view of the world could start looking very different compared to your neighbour’s.

We don’t have access to the criteria algorithms use to decide which search results we see on, for example, Google, what we’re recommended to watch or listen to on services such as YouTube or Spotify, or what content we see on platforms such as Instagram and TikTok—other than it being the content the algorithm believes will engage us the most. The digital profiles they create are used for targeted advertising.

Therefore, it’s important to inform oneself broadly, seek alternative sources, and take steps such as using privacy-oriented search engines and browsers to find the most neutral content possible.