S1: Welcome in San Diego. It's Jade Hindman on. Today's show will tell you about a new tool to get your information off the internet. This is KPBS Midday Edition. Connecting our communities through conversation. Like it or not , most of us rely on technology and the internet to do a lot in our daily lives. We shop online , we chat online , we are entertained online. And that activity creates information about us that gets tracked and often monetized. This year , the state released a web tool for Californians to better protect their digital privacy. It's called drop and stands for delete , request and Opt out platform. We wanted to dig into the details of how it works here. To help us do that is Hailey Sugiyama. She is the director of state affairs for the Electronic Frontier Foundation. Hailey , welcome to Midday edition.
S2: Thanks for having me.
S1: So glad to have you here. This is one of those topics I know a lot of people are curious to hear about. This platform came out of a state law called the California Delete Act , and that was something your organization , the Electronic Frontier Foundation , pushed for. So why do you feel this tool is important? Yeah.
S3: Yeah. So I think , you know , we as I said , we were as you said , we were one of a member of a coalition that really pushed for this bill , sponsored by a friends at the Privacy Rights Clearinghouse , because we pushed for strong California privacy law to make sure that people had a right to know , sort of , you know , what companies were collecting about them and had some control over what to do with it. But as the law went into effect , we realized , actually , these these rights are really hard to use. And so the idea behind the Delete act was to have a tool that anyone could use. So you could submit a bunch of requests at once , rather than having to go from company to company , and the drop platform will submit to to all data brokers that are registered in California , which right now is about 600 companies all at once. So that saves you a lot of time. Interesting.
S1: Interesting. So I a lot of time. What exactly are data brokers and what kinds of information do they track about us? Yeah.
S3: Yeah. So data brokers are basically businesses that gather and sell consumer information that consumers didn't give them directly. So , you know , you may have a relationship with a retailer and say , here's my address. Send me , you know , send me the product that I ordered. But data brokers are really companies that you don't have a have a relationship with , and they collect and sell personal information. Some of it's sensitive. So that can include like social security number , geolocation information , browsing history , shopping habits and then email addresses and phone numbers. So those are some of the types of information that data brokers collect.
S1: How do they get this data in the first place?
S3: Yeah they get it from a number of sources , you know. Often they're buying it from from other companies. So , you know , a retailer may say , yeah , I have Hayley's shopping habits. Like if you want to buy that information and put it in a profile that you're building about her or about people like her , you know , we're happy to do that. And then , you know , sometimes they're scraping information. There are a lot of ways that data brokers get information , but a lot of times they just buy it from people.
S1: Are there laws against this at all?
S3: Um , I mean , we are working on data broker regulation. I think when people find out about data brokers , it's often , you know , just like not a business model that people are super comfortable with. But , um , so we're working on that. But right now , right now , what we have is this is this registry , which I think is useful so that , you know , at least the state is aware of sort of who you know , who is operating as a data broker , and then it brings them under obligations like this one firm drop so that they there are some checks on what they're doing.
S1: All right , well , can you describe how this drop tool works? Yeah.
S3: Yeah. So you provide some information to to the state of California so you can get sort of as granular or non granular as you want them. You know your name addresses email addresses so that they have the information to put in a request that they can ask the data brokers then to say like is there a person matching this description who's in your databases. And then you can say , okay , I want to delete that information , or I want to opt out of the sale of that information. Um , and so you are just kind of following , filing this paperwork with the state , and then they are sending it on to data brokers to ask them to make those changes.
S1: And the tool can be found at privacy drop. Of course. We'll have a link on our website at pbs.org. Um , you mentioned you do need to share private information for it to work. A little ironic , but what kind of of information will you have to share?
S3: Yeah , I mean , I definitely see the irony in it. I , you know , it is , um , things like your name and your address sorts of the pieces of information about you that would identify you individually in a data broker , um , like in a data broker's files. Right. So if you have a common name , for example , they might say , well , I can't prove that this is this John Smith. Right? I need more information than that. So , uh , like when I did my request , I did my name , I did my maiden name. I did my last couple of addresses. Um , I didn't put in , like , my vehicle identification number , which is an option that you can put in. Um , you know , I just decided that wasn't for me. So you can sort of dial it up and down. And the state does have a pretty good privacy policy that says , you know , we're not going to use this for other information just to just to file this request. So I definitely understand the hesitation there and the feeling of like , I can't believe I'm giving up information to get my information deleted. But I think , you know , my hope is that people will find the benefits worth.
S1: It and must justify the means. Absolutely. So listen , what types of private information are not covered by this tool? Yeah.
S3: Yeah. So , um , information that , you know , companies have to retain , um , to comply with other laws. So there are like public records laws. I think one one type of information that can be surprising to people is , is address. Often , you know , if you own property and your address is on , you know , a property record somewhere , then they can't delete that information. You know , if you're a renter , then , you know , that might be a different question. If you have a phone number that's associated with a business record , for example , that's with the state. They can't delete that information. So there are some intersections with other laws that prevent them from deleting information. And then there's also some information that's covered by other privacy laws. So health information financial information those are protected under a different regime. So you won't necessarily have them delete that information from this request. But it is protected in other ways. And they should be there should be higher bars to keep them from sharing that information.
S1: And how do we.
S2: Know they have it? Yeah.
S1: Yeah. Well , how do we know these data broker companies will actually delete the data? I mean , what penalties do they do they face if they don't? Yeah.
S3: Yeah. So they have 45 days to comply with the request. After that they have a it's it's all monetary right. They have they have fines that um that they will have to pay. So if they fail to delete consumer personal information , it costs them $200 per day per consumer. So every person who files and that every day that they don't comply , um , they , they get charged $200. That can add up pretty quickly. Um , and so that was a really important part of the law , was to make sure that there actually was some penalty in this case , a financial penalty for them to be facing. Um , they also face a , you know , if there are companies that aren't registered , but should be they also face a penalty for not registering. So we are trying to build in some , you know , teeth into some of these laws so that companies actually will comply with with these requests. Mhm.
S1: Mhm. You mentioned that putting in a request in this tool won't remove all information about you. So for those looking for more privacy protections online , say what options do they have? Yeah.
S3: Yeah. Um , so I think it's important to remember that when it comes to data and the information that people are collecting , the more recent the data , the more valuable it is. And so anything you can do now to cut off some of the stream of that information can be helpful. So , you know , for most people , I recommend taking a good look at the location settings on your cell phone and seeing like what apps have access to your location information. Location information can be really revealing. And so even just flipping off , you know , like , oh , I'm not I don't want to share it with this app anymore. And auditing apps on a regular basis as well can be a good tool to cut off , um , the flow of data into some of these companies because , you know , if their app isn't on your phone , then they can't be collecting information from your phone. So that's a couple of practical tips. And um , if you're ever interested in looking at more privacy tips. We've got a bunch of them.
S1: It sounds like there's this entire ecosystem for information. Um , on a bad day at worst. Tell me , what is the consequence of having that information just floating around out there about you? Yeah.
S3: Yeah. Um , so there are a couple a couple of things. I mean , geolocation information , as we've talked about is , you know , highly sensitive and in the wrong hands. You know , if somebody's looking at location information , they could pretty easily figure out , like what my commute is right between my office and my home so they can figure out who I'm going to see. Maybe they can figure out who I'm associating with , what my religion is , that sort of thing. Um , and in the wrong hands , that information can be , you know , abused pretty badly. Um , and , you know , we have seen companies share geolocation information with , with , you know , with people who are trying to find people who don't want to be found. So that's that's one thing. Um , there's also just inferences that they can draw from this information. So right or wrong. You know , if I'm looking up information about a disease , you know , my browsing history might indicate that I have that disease , say diabetes or something. And , you know , I could be looking it up for a friend. I could be looking it up for a family member. But if I get tagged as being at risk or I'm being a person with diabetes , like that can affect , you know , rates that I might see for other products or that might affect , you know , just all sorts of things that they use this information for.
S1: It's so interesting. What what further changes would you like to see customers have when it comes to their digital rights and privacy?
S3: Well , ideally I'd love to see more of control. I mean , right now you have to opt out of the sale of information , out of the sale of the collection of information. I'd love to see companies have to come to me first and ask before they can collect that information. That would be a very big change in American privacy law , but that's sort of one that I would that I would love to see. Um , you know , in general , I would also like to see more enforcement mechanisms for , you know , as you say , we can we can ask companies to do a lot of stuff. But , um , if we don't put some teeth behind it , who knows how they're why they're going to change their behavior. So I would love to see more enforcement in privacy law , too.
S1: What's your cell phone situation like? Do you have apps on your cell phone? Have you gone through them to do that that audit? What information do you allow and what information do you not allow? Yeah.
S3: Yeah. Um , I mean , I am a person who lives in the modern world , so I do have a smartphone with apps on it. Um , I'm very careful about who gets my location information , you know , and I flip it off , like , if I , you know , if I'm traveling , then I'll let the airline app have my information. But when I'm not traveling , I'll either delete that airline app or I'll turn off , you know , sharing. Um , I'm also really careful about contacts , like access to the address book , because , um , frankly , that's not my information to share. I often feel like. And so I very , very rarely allow apps to , to access my address book.
S1: That's that's very interesting too. I know some apps do ask that all the time , consistently , and I have to consistently deny that. Do you have any other tips you can give us before to to better protect our digital privacy online , whether it's with our cell phone or or the web browser on our laptop? Yeah.
S2: Yeah.
S3: I mean , I think , uh , you know , in general just sort of being it's hard. You know , the system is designed to take as much information from you as possible. So for anybody who feels this is overwhelming , please remember that it's not your fault. It is designed to do this and you're trying to fight a fight against it. I mean , uh , you know , I do recommend being really careful about if you have a work device or a school device , you know , making sure that if you're doing personal stuff that you do that on a personal device rather than on a , you know , a company computer or a school computer , for example , um , that just sort of limits your , um , your risk. Uh , and then , you know , just sort of , again , like checking the permissions and , you know , before you download an app , even just being like , is this going to ask for a lot of stuff? Can I turn that off? Um , that can be that can be really helpful and can go a long way.
S1: All right. I've been speaking with Hayley Sugiyama. She is the director of state affairs for the Electronic Frontier Foundation. Hayley , thank you so very much for breaking this down for us.
S3: Thanks for having. Me.
S2: Me.
S1: That's our show for today. I'm your host , Jade Hindman. Thanks for tuning in to Midday Edition. Be sure to have a great day on purpose , everyone.
