How To Delete Your Data From ChatGPT

Important and becoming more important issue.   

ACM NEWS

How To Delete Your Data From ChatGPT,  By Wired, May 10, 2023

Sending data to the trash.

OpenAI has introduced tools and processes that allow people more control over at least some of their data.

There's a chance that ChatGPT knows personal details about you—and if it doesn't, it might just make something up. As OpenAI's generative text chatbot has boomed in popularity over the past six months, the risks of the system being trained on data vacuumed up from the web have become clearer.

Data regulators around the world are investigating issues with how OpenAI gathered the data it uses to train its large language models, the accuracy of answers it provides about people, and other legal concerns about the use of its generative text systems. Europe's data regulators have joined forces to look at OpenAI after Italy temporarily banned ChatGPT from the country. And Canada is also investigating the technology's potential privacy risks.

In Europe, GDPR laws require companies and organizations to demonstrate lawful reasons for handling people's personal information and to let people access information about them, be informed of how their information is used, and demand that errors be rectified. In some cases, they can ask that certain types of data be erased. The way people's personal information has been used in training data has been an early area of concern for EU regulators.

From Wired

View Full Article

GPT is Back in Italy

This block was reported some time ago and now has been resolved.  How this will long time connects with Euro GDPR is still unclear. 

ChatGPT accessible again in Italy, By Shiona McCallum,Technology reporter   in the BBC

Access to the ChatGPT chatbot has been restored in Italy.

It was banned by the Italian data-protection authority at the start of April over privacy concerns.

It maker, OpenAI, which is backed by Microsoft, said it had successfully "addressed or clarified" the issues raised.  It said its privacy policy was now accessible to people before they registered for ChatGPT and there was a new tool to verify the age of users.

The Italian data-protection authority, also known as Garante, had temporarily restricted the chatbot and launched a probe over the artificial intelligence application's suspected breach.   As Garante had accused OpenAI of failing to check the age of ChatGPT's users who are supposed to be aged 13 or above, OpenAI said it would offer a tool to verify users' ages in Italy upon sign-up.

OpenAI explained that it would also provide a new form for European Union users to exercise their right to object to its use of personal data to train its models.

The Italian regulator told the BBC it "welcomed the measures OpenAI implemented" but called for even more compliance.  In particular, the spokesperson said, around "implementing an age verification system and planning and conducting an information campaign to inform Italians of what happened as well as of their right to opt-out from the processing of their personal data for training algorithms."

Garante said it would carry on its "fact-finding activities regarding OpenAI also under the umbrella of the ad-hoc task force that was set up by the European Data Protection Board."   An OpenAI spokesperson said it appreciated the Garante for being collaborative, and that it would continue ongoing constructive discussions.

Millions of people have used ChatGPT since it launched in November 2022.   It can answer questions using natural, human like language and it can also mimic other writing styles. Microsoft has spent billions of dollars on it and it was added to Bing last month.   It has also said that it will embed a version of the technology in its Office apps, including Word, Excel, Powerpoint and Outlook.

Bard, Google's; rival artificial-intelligence chatbot, is now available, but only to specific users over the age of 18.

How Should Companies Prepare for Cybersecurity Regulations?

Very good, useful piece,  there are many links,  use the link just below to get a version that includes all links in the original  ...

A collection of observations, news and resources on the changing nature of innovation, technology, leadership, and other subjects.   By Irving Wladawsky-Berger

How Should Companies Prepare for the Coming Cybersecurity Regulations

“Cybersecurity has reached a tipping point,” wrote MIT professor Stuart Madnick in a recent Harvard Business Review article, New Cybersecurity Regulations Are Coming. Here’s How to Prepare. “After decades of private-sector organizations more or less being left to deal with cyber incidents on their own, the scale and impact of cyberattacks means that the fallout from these incidents can ripple across societies and borders.”

Given the growing threat of cyberattacks, there’s an urgent need to improve the security of IT systems. However, we still don’t know a lot about cyberattacks, including how many attacks have taken place and who’s been attacked. Until recently, cybersecurity regulation were mostly focused on data privacy, and the only attacks that had to be reported were those involving personal information, such as the theft of names and credit card numbers.

For example, when Colonial Pipeline suffered a serious ransomware attack in May of 2021 that shut down nearly 50% of fuel deliveries to the US East Coast, neither the company nor the pipeline operators were required to report the attack because personal information wasn’t stolen. “As a result, it’s almost impossible to know how many cyberattacks there really are, and what form they take,” said Madnick. “Some have suggested that only 25% of cybersecurity incidents are reported, others say only about 18%, others say that 10% or less are reported.” We need detailed information on who is being attacked, how are they getting attacked, what are the attackers after, and what have they’ve actually stolen.

Governments around the world are now proposing or enacting new laws and regulations. The General Data Protection Regulation (GDPR) requires that the EU’s 27 member states must report serious data breaches withing 72 hours. In the US, new regulations and enforcements are likely to come from the White House, Congress, the Cybersecurity & Infrastructure Security Agency (CISA), the Securities and Exchange Commission, the Federal Trade Commission, and a number of other agencies. Thirty six states have already enacted new cybersecurity legislation.

These new rules would require companies to report cyber incidents, like the Colonial Pipeline attack, especially when critical infrastructure industries are involved, such as energy, health care, communications and financial services. ....'   (click through above for all links) 

Think of Ransomware as a Data Management Problem

As most things can be thought of.   Just reading work of Turing, Von Neumann et al, and their early work was all about how you effectively stored things and used them,  though its safety had not yet come up. 

Ransomware: Why It’s Time to Think of it as a Data Management Problem

Enrico Signoretti. Mar 23, 2022 -- Blog in  GigaOm

Over the last couple of years, ransomware has taken center stage in data protection, but very few people realize it is only the tip of the iceberg. Everybody wants to protect their data against this new threat, but most solutions available in the market focus just on relatively quick recovery (RTO) instead of detection, protection, and recovery. In fact, recovery should be your last resort.

Protection and detection are much more difficult measures to implement than air gaps, immutable backup snapshots, and rapid restore procedures. But when well-executed these two stages of ransomware defense open up a world of new opportunities. Over time, they will help defend your data against cybersecurity threats that now are less common, or better said, less visible in the news—such as data exfiltration or manipulation. And again, when I say less visible, it is not only because the incidents are not reported, it is because often nobody knows they happened until it’s too late!

Security and Data Silos

Now that data growth is taken for granted, one of the biggest challenges most organizations face is the proliferation of data silos. Unfortunately, new hybrid, multi-cloud, and edge infrastructures are not helping this. We are seeing what we might call a “data silo sprawl”–a multitude of hard-to-manage data infrastructure repositories that proliferate in different locations and with different access and security rules. And across these silos there are often rules that don’t always follow the company’s policies because the environments are different and we don’t have complete control over them.

As I have written many times in my reports, the user must find a way to consolidate all their data in a single domain. It could be physical—backup is the easiest way in this case—or logical, and it is also possible to use a combination of physical and logical. But in the end, the goal is to get a single view of all the data.

Why is it important? First of all, once you have complete visibility, you know how much data you really have. Secondly, you can start to understand what the data is, who is creating and using it, when they use it, and so on. Of course, this is only the first step, but, among other things, you start to see usage patterns as well. This is why you need consolidation: to gain full visibility.

China Passes Strict New Data Privacy Law

Intriguing in the details.  But data privacy for who?  How is it applied legally?   How will it be interpreted? 

China Passes Strict New Data Privacy Law    By Alex Woodie  in Datanami

The Chinese government today announced that it will institute a strict new data privacy law on November 1. Dubbed the Personal Information Protection Law (PIPL), it is said to be among the most stringent data privacy laws in the world.

Passed by the National People’s Congress earlier today, PIPL requires organizations to obtain the consent of Chinese citizens before collecting their personal information. Companies must also give citizens the option not to be targeted for marketing purposes or to have marketing based on personal characteristics.

The law also requires that there must also be a “clear and reasonable purpose” for handling personal information, and organizations must aim for the “minimum scope necessary to achieve the goals of handling” data, according to a Reuters story.

PIPL, which was first proposed in 2020, applies to all companies that work with Chinese citizens, including foreign and domestic entities. Chinese citizens in recent years have begun to complain about the mismanagement and abuse of their personal information at the hands of Chinese companies.

Chinese citizens succumb to scams and fraud at rates similar to people in other countries. A 2015 survey by the Internet Society of China found that 76% of Chinese users had received fraudulent information from sources purporting to be banks, Internet companies, or television stations offering prizes, according to a 2016 story in the Wall Street Journal. Over half have received scam calls, while one-third said they have lost money after receiving fraudulent calls, text messages, or emails, the story said.

PIPL is the third of three new laws that Chinese lawmakers have passed in recent years. The Chinese Data Security Law, which is set to go into effect on September 1, sets a framework for companies to classify data based on its importance, including “national core data,” “important data,” and “general data.” The country’s Cybersecurity Law, which went into effect in 2017, requires network operator to store select data within the country, and allows the government to conduct spot-checks of data and network operations.

PIPL resembles the European Union’s General Data Protection Regulation (GDPR) in some respects. However, it differs in one major way, which is that Chinese authorities are expected to maintain access to people’s personal information. Multi-national companies that want to sell their products and services to Chinese citizens, however, would do well to pay attention to the new law, says Charles Farina, head of innovation at Adswerve.  ... ' 

Big Fines for Amazon Under GDPR

Good to know the implications of the EU GDPR.  Note how Amazon sees the gathering of customer data. On to the EU court.

EU Fines Amazon Record $888 Million Over Data Violations   By Bloomberg, August 2, 2021

Luxembourg's CNPD data protection authority fined Amazon a record $888 million for breaching the EU's General Data Protection Regulation (GDPR).

The EU regulator charged the online retailer with processing personal data in violation of GDPR rules, which Amazon denies. The ruling closes an investigation triggered by a 2018 complaint from French privacy rights group La Quadrature du Net.

Amazon says it gathers data to augment the customer experience, and its guidelines restrict what employees can do with it; some lawmakers and regulators allege the company exploits this data to gain an unfair competitive advantage.

Amazon also is under EU scrutiny concerning its use of data from sellers on its platform, and whether it unfairly champions its own products.

From Bloomberg  

GDPR Compliance

Examining this topic

Is there such a thing as “GDPR compliant”?  in Gartner

By Nader Henein | May 27, 2021 

Recent approvals for two codes of conduct by the European Data Protection Board – the body who oversees the GDPR – has reinvigorated this question. The short answer is “No”, the longer answer is “Not yet, but it should be coming soon”,  and you should be preparing. In this 5 minute read, I’ll take you through the story so far and what IT leaders and vendors can do to demonstrate compliance and prepare for formal certification.

Vendor marketing claims aside, as of the writing of this post, there is no formal certification for GDPR compliance. BUT the GDPR does set out a process in Article 42 so that certification bodies can submit their schemes for formal approval. Even though the GDPR came into effect in May of 2018, a process to operationalize Art. 42 did not exist till early 2020 with the publication of the approval procedures.  ... " 

Anti-Patterns in Regulation

 Thoughtful piece in ACM where the notion of 'anti-pattern' is discussed, where regulation (or norms or practice)  run contrary in purpose to their original intent in design.   An specifically how the GDPR,  the European privacy law, can run contrary to modern cloud scale systems. An element of the goals of practice vs regulation or other forms of compliance.  Considerable look at the idea, largely non technical.  Anyone dealing with GDPR and other regulation  should understand the idea and implications.

GDPR Anti-Patterns  By Supreeth Shastri, Melissa Wasserman, Vijay Chidambaram

Communications of the ACM, February 2021, Vol. 64 No. 2, Pages 59-65  10.1145/3378061

The General Data Protection Regulation (GDPR)26 is a European privacy law introduced to offer new rights and protections to people concerning their personal data. While at-scale monetization of personal data has existed since the dot-com era, a systemic disregard for privacy and protection of personal data is a recent phenomenon. For example, in 2017, we learned about Equifax's negligence17 in following the security protocols, which exposed the financial records of 145 million people; Yahoo!'s delayed confession21 that three years ago, a theft had exposed all three billion of its user records; Facebook's admission33 that their APIs allowed illegal harvesting of user data, which in turn influenced the U.S. and U.K. democratic processes.

Thus, GDPR was enacted to prevent a widespread and systemic abuse of personal data. At its core, GDPR declares the privacy and protection of personal data as a fundamental right. Accordingly, it grants new rights to people, and assigns companies that collect their personal data, new responsibilities. Any company dealing with the personal data of European people is legally bound to comply with all the regulations of GDPR, or risk facing hefty financial penalties. For example, in January 2019, Google was fined6 €50M for lacking a customer's consent in personalizing advertisements across their different services.  ... " 

Emergence of the AI Risk Manager

In our day this was integrated with other kinds of analysis and management.   It may well make sense to focus this more generally. 

The emergence of the professional AI risk manager

By Kenn So  in Venturebeat

When the 1970s and 1980s were colored by banking crises, regulators from around the world banded together to set international standards on how to manage financial risk. Those standards, now known as the Basel standards, define a common framework and taxonomy on how risk should be measured and managed. This led to the rise of professional financial risk managers, which was my first job. The largest professional risk associations, GARP and PRMIA, now have over 250,000 certified members combined, and there are many more professional risk managers out there who haven’t gone through those particular certifications.

We are now beset by data breaches and data privacy scandals, and regulators around the world have responded with data regulations. GDPR is the current role model, but I expect a global group of regulators to expand the rules to cover AI more broadly and set the standard on how to manage it. The UK ICO just released a draft but detailed guide on auditing AI.  https://ico.org.uk/about-the-ico/ico-and-stakeholder-consultations/ico-consultation-on-the-draft-ai-auditing-framework-guidance-for-organisations/   The EU is developing one as well. Interestingly, their approach is very similar to that of the Basel standards: specific AI risks should be explicitly managed. This will lead to the emergence of professional AI risk managers.  ... "

AI Powered Contract Management

Another example in the legal space, here specifically looking at contracts,  and the management of related data.  Much more at the link.  Note machine learning training by lawyers.  Check out the tabs to find much more in the connection of analytics, contracts and decision process.  Also how regulations like CDPR relate to legal contracts.

Exigent launches AI-powered contract management system for speed to smart data in DSS Resources

With a machine learning engine trained by lawyers, Exigent's end-to-end CMS now auto-extracts contract data in milliseconds and runs contextual search with improved accuracy

CHICAGO, March 11, 2020 /PRNewswire/ -- Legal technology provider, Exigent, has released the latest update to its Contract Management Solution to include AI-based auto-extraction and contextual search for increased speed to data, accuracy and business impact. Exigent's AI auto-extraction tool, Scarlett, is powered by a machine learning engine set up and trained by legal professionals, financial experts, and data scientists, creating faster and more accurate outcomes.

Using Exigent's new CMS automates the once costly, slow and error-ridden manual extraction and input of contract data. The solution extracts smartly selected business and legal terms quickly, automatically placing them into a data lake and making key data accessible at all times in a universal format. All extracted information is then aggregated on dashboards or included in easily buildable reports in seconds. Scarlett has unlimited applications across many industries and departments: the tool can be used by legal, procurement, and other departments across an organization to auto-extract and structure data for powerful, customized analysis. Information is aggregated and used to review and enhance performance, as well as predict business outcomes. Scarlett's power is already being used by Exigent's clients for more efficient contract review, to tackle LIBOR transition and for compliance in general (GDPR, POPI, CCPA and any other clauses that need attention in a contract). ... "

See also, Exigent.

Your Data is Shared and Sold

Further look at personal data and its use and regulations.

Your Data Is Shared and Sold…What’s Being Done About It?
Oct 28, 2019 Europe, North America

Earlier this month, California Gov. Gavin Newsom signed into law amendments to the California Consumer Privacy Act (CCPA), the most sweeping state data privacy regulations in the country. The law, which takes effect on Jan. 1, regulates how data is collected, managed, shared and sold by companies and entities doing business with or compiling information about California residents. Some observers contend that because no business would want to exclude selling to Californians, the CCPA is de facto a national law on data privacy, absent an overarching federal regulation protecting consumer information.

“The new privacy law is a big win for data privacy,” says Joseph Turow, a privacy scholar and professor of communication at the Annenberg School for Communication at the University of Pennsylvania. “Though it could be even stronger, the California law is stronger than anything that exists at the federal level.” Among other stipulations, the CCPA requires businesses to inform consumers regarding the types of personal data they’ll collect at the time they collect it and also how the information will be used. Consumers have the right to ask firms to disclose with whom they share the data and also opt out of their data being sold.

The CCPA comes on the heels of the EU’s General Data Protection Regulation (GDPR), which took effect in May 2018. According to the United Nations Conference on Trade and Development, 107 countries have data privacy rules in place including 66 developing nations. In the U.S., there was a “significant” increase in data privacy bills being introduced this year, with at least 25 states and Puerto Rico starting such legislation, according to the National Conference of State Legislatures. Notably, this bill count doesn’t include related legislation on topics such as cybersecurity.  .... "

Managing Data with Brexit

Useful thoughts, How will the flow of data change in new regulatory environments.

How to Manage Your Data When Expecting Brexit
By Ralph O'Brien in Datanami

The implications of a possible Brexit on privacy and compliance-related statutes, such as the General Data Protection Regulation (GDPR), Privacy Shield, and the Data Protection Act of 2018 (DPA) are vast. These regulations govern the handling and transfer of consumers’ private data between entities in the EU, UK, and the rest of the world. If the landscape of the European Union changes, so, too, do the jurisdictions of these regulations.

In the wake of Brexit, data transfer relationships will require mending. Taking data that belongs to people in the UK and transferring it to the EU will still be an acceptable transfer. If the UK leaves the EU and loses its stature as a member state, the country will cease to be a trusted party and deemed inadequate for data transfers from the EU to the UK.

In order to reopen the flow of data westward across the English Channel, the EU and UK will have to establish a new data transfer agreement, with the European Commission reviewing the privacy laws of the UK and deem them adequate for data transfers. Similarly, Privacy Shield, which currently regulates data transfers between the EU and U.S., will no longer cover instances when companies transfer data from the UK to the U.S. (as it is an EU/U.S. arrangement!) though it is understood the UK and U.S. will be making amendments to enable this in the near future.   .... " 

Useful View of one year Old GDPR

Useful piece about what they believe GDPR regulations has resulted in.

What the Evidence Shows About the Impact of the GDPR After One Year
by Eline Chivot and Daniel Castro in DataInnovaion

The General Data Protection Regulation (GDPR), the new privacy law for the European Union (EU), went into effect on May 25, 2018. One year later, there is mounting evidence that the law has not produced its intended outcomes; moreover, the unintended consequences are severe and widespread. This article documents the challenges associated with the GDPR, including the various ways in which the law has impacted businesses, digital innovation, the labor market, and consumers.

Specifically, the evidence shows that the GDPR:

Negatively affects the EU economy and businesses
Drains company resources
Hurts European tech startups
Reduces competition in digital advertising
Is too complicated for businesses to implement
Fails to increase trust among users
Negatively impacts users’ online access
Is too complicated for consumers to understand
Is not consistently implemented across member states
Strains resources of regulators .... ' 

(more detail)

(Update) GDPR Impact a Year Later

Its made browsing and gathering technical information harder, but for the corporation? (Update) in Fastcompany:  " ..... One year in, GDPR seems to have helped Google & Facebook ...  New projections from eMarketer show that Google and Facebook are both continuing to grow their share of the digital advertising market in the United Kingdom  ...".   I assume by making it more difficult for competitors.

GDPR’s Impact One Year Later   Alex Woodie in Datanami

The General Data Protection Regulation (GDPR) granted Europeans unprecedented rights to control their own data, including the controversial “right to be forgotten.” The GDPR has been in effect for a year now, but what’s been the overall impact?

One thing is certain: There’s been no shortage of complaints around GDPR. According to a February survey by DLA Piper, there have been 59,000 complaints of data breaches in violation of GDPR since the law went into effect in May 2018. However the same report found only 91 fines have been handed out.

The biggest fines have been handed out to social media giants, like Google and Facebook. In January, Google was fined $56.8 million (€50 million) by the French data regulator CNIL for failing to sufficiently inform consumers about collecting data used in online ads, citing a “lack of transparency, inadequate information and lack of valid consent to personalize advertising.

Facebook is also bracing for possible GDPR fines as a result of a 2018 data breach, among other potential problems. The social media giant has stockpiled a reported $3 billion to pay Federal Trade Commission (FTC) fines that are expected as a result of its handling of the Cambridge Analytica scandal in 2016.

But overall thus far, the GDPR hammer hasn’t come down to the extent that many expect it eventually will, so the jury is still out on that aspect of the regulation.

Compliance a multi-part affair when it comes to GDPR, and many companies around the world are at various stages of their GDPR journey .... "

Knowledge Graphs, Governance, Learning and Much More

Have now been involved in a number of efforts in this area, worth understanding since Google has made an impressive run at this.  The article tells a historical journey I have traveled as well, we might finally be getting to real enterprise value.  And regulations like GDPR are forcing us to take notice of the need to really understand our data. The article is long, but has good points to make.

The Semantic Zoo - Smart Data Hubs, Knowledge Graphs and Data Catalogs   By Kurt Cagle Contributor in Forbes

COGNITIVE WORLDContributor Group
Sometimes, you can enter into a technology too early. The groundwork for semantics was laid down in the late 1990s and early 2000s, with Tim Berners-Lee’s stellar Semantic Web article, debuting in Scientific American in 2004, seen by many as the movement’s birth. Yet many early participants in the field of semantics discovered a harsh reality: computer systems were too slow to handle the intense indexing requirements the technology needed, the original specifications and APIs failed to handle important edge cases, and, perhaps most importantly, the number of real world use cases where semantics made sense were simply not at a large enough scope; they could easily be met by existing approaches and technology.


Semantics faded around 2008, echoing the pattern of the Artificial Intelligence Winter of the 1970s. JSON was all the rage, then mobile apps, big data came on the scene even as Javascript underwent a radical transformation, and all of a sudden everyone wanted to be a data scientist (until they discovered the fact that data science was mostly math). Meanwhile, from the dim recesses of the troughs of despair, semantics was readying itself for its own metamorphosis. Several semantic standards, including the SPARQL query language along with a new update language began seeing implementations by 2015.  Servers became faster and cheaper, and a rise of graphics processor units (GPUs) fueled by the gaming and entertainment industry provided tools for a new class of graph databases.

Meanwhile, the Big Data initiatives that had marked the early part of the 2010s was facing some real problems. The original promise of Hadoop as a map / reduce framework had ended up creating large numbers of data lakes that aggregated content but that sat under-utilized. Data scientists struggled to deal with dirty data that was really no cleaner for having been put in data lakes. JSON databases had grown in popularity, but they were proving hard to query in a consistent fashion, and all too many Hadoop projects ended up becoming large, slow, but cheap data graveyards for regulatory data (the kind of data that must be retained for five years). ..... "

AI Needs Explaining

All analytics needs explaining.  But primarily, why is what we have discovered as a pattern here trustable as a pattern in the future?  And will that discovered pattern be useful in some business process today or in the future?  Will some regulatory condition in the future prevent us from using this discovery?

AI, You’ve Got Some Explaining To Do   By Alex Woodie in Datanami

Artificial intelligence has the potential to dramatically re-arrange our relationship with technology, hearkening a new era of human productivity, leisure, and wealth. But none of that good stuff is likely to happen unless AI practitioners can deliver on one simple request: Explain to us how the algorithms got their answers.

Businesses have never relied more heavily on machine learning algorithms to guide decision-making than they do right now. Buoyed by the rise of deep learning models that can act upon huge masses of data, the benefits of using machine learning algorithms to automate a host of decisions is simply too great to pass up. Indeed, some executives see it as a matter of business survival.

But the rush to capitalize on big data doesn’t come without risks, both to the machine learning practitioners and the people whom are being practiced upon. The risk posed to consumers by poorly implemented machine learning automation is fairly well-documented, and stories of algorithmic abuse are not hard to find.

And now, as a result of the European Union’s General Data Protection Regulation (GDPR), the risks are being pushed back to the companies practicing the machine learning arts, which can now be fined if they fail to adequately explain to a European citizen how a given machine learning model got its answer.

“In addition to all the rights around your personal data, the right to be removed and so forth, there’s a passage in GDPR talking about the right to an explanation,” says Jari Koister, FICO Vice President of Product and Technology. “The consumer actually has the right to ask, Why did you make that decision?”

GDPR and Better Marketing

Intriguing point,  if we fully understood the GDPR fully in its application as yet. 

How GDPR Can Lead to Better Personalized Marketing

By Michelle Chiantera in the Cisco Blog

As marketers, we’ve come a long way in becoming data-driven experts when it comes to creating more engaging personalized marketing experiences. The GDPR is making us think more critically about how we leverage that data to be in compliance, while still being able to effectively market and reach customers in relevant ways.

According to Forbes Insights, when it comes to GDPR compliance, 60% of organizations indicated they are challenged with shifting marketing and sales tactics in accordance with GDPR guidelines.

This shows that the GDPR’s impact has been a wake-up call for companies across the board and how they leverage data, but I feel it’s a refreshing and much needed one. Data has been foundational to everything we do for the past few years, but the GDPR is a good reminder that customers are more than targets and data sets, they are people who value trust and partnership.

So how can GDPR make us better at personalized marketing?  ... " 

California Signs Data Privacy act for 2020

Yet another regulatory insertion to be interpreted and inserted:

Companies Confront Calififornia's Version of GDPR
By George Slefo in AdAge

California Gov. Jerry Brown signed the Consumer Privacy Act on Thursday, giving residents of the state significantly more control over how their data is collected, used and handled.

Call it "GDPR Lite." 

Although the law will not go into effect until January 2020, it will without question have massive implications for every brand, agency and tech company both here and abroad. ... 

In short, California just passed its own digital privacy law, allowing consumers to know what information companies are collecting about them, why they are collecting that data and who they are sharing it with. It also arms residents of the Golden State with the ability to tell tech behemoths such as Google and Facebook to delete their data, not to share their data or not to sell it. People can also opt out from a company's terms of service without losing access to its offerings. And companies are barred from selling data on anyone under the age of 16 without explicit consent. .... " 

Targeted Ads and Data Privacy

Surprising comments that there is still not clear understanding of what is required to comply. Thus the hundreds of checkboxes saying I understood that cookies where being used.  But not the details of how.

How Will Targeted Ads Fare in an Era of Data Protection?  in K@W

If targeted advertising needed indicators of both enormous growth and potential threats ahead, several recent events have been only too happy to oblige. On the one hand, this is the year mobile will edge out TV as the dominant advertising medium in the U.S., according to a forecast from eMarketer, just as Google continues to roll out products and services that make life and its logistics more seamless. On the other hand, the Cambridge Analytica episode has provided a cautionary tale in what can go wrong when a trusted tech giant like Facebook loses control over its users’ private data.

Another wild card has just begun to reveal itself. The General Data Protection Regulation (GDPR) went into effect last month, granting individuals a greater degree of control over how firms gather, store and use their personal data. The GDPR was crafted by and for members of the European Union, but because commerce and data move freely across international borders, many firms in the U.S. and across the globe have decided to conform to its guidelines.

What exactly will it mean in the U.S.? Even the federal government appears to be unsure. “GDPR’s implementation could significantly interrupt transatlantic cooperation and create unnecessary barriers to trade, not only for the U.S. but for everyone outside the E.U.,” wrote U.S. commerce secretary Wilbur Ross in the Financial Times. “We do not have a clear understanding of what is required to comply.” .... " 

“[GDPR] will force companies to take a closer look at their data infrastructure, much more so than they would otherwise — and we know it’s a big mess out there.”–Peter Fader ... "

How to Read a Privacy Policy

Thoughtful piece worth reading ...

How to read a privacy policy   By Ashley Carman    @ashleyrcarman  in TheVerge

We haven’t been able to avoid privacy policies in our post-GDPR world, but figuring out what these legal documents are trying to tell us isn’t easy. They’re typically filled with legalese and boring chatter about data and how it’s handled. I get why no one wants to spend time reading them.

So to save us all some effort, I called a couple lawyers — Nate Cardozo from the Electronic Frontier Foundation and Joseph Jerome from the Center for Democracy and Technology — to learn how they read and process tons of policies. They’ve given me a few tips on how we can essentially skim through a privacy policy while still learning something about how our data is handled. ..... "