Is privacy worth the fuss if we regularly give government our personal info?

As a concept, privacy seems to be overrated but we seem to like it so much that we’ve turned it into an institution. Sure, data is valuable and some form of regulation is appropriate. It just strikes me as odd that we’ve developed an entire industry on POPI compliance – but what has it really achieved?

Perhaps it’s prevented some data breaches or leaks, but they still occur regularly. Dis-Chem is having a spat with the Information Regulator after being klapped with a notice and the Department of Justice got a sweet R5 million fine two months back. Your taxes will cover that but the more worrying thing is what good is a fine when the data is already out there?

ALSO READ: Dis-Chem facing R10 million fine after client data breach

We spend thousands on consultants to ensure that we are POPI compliant and then when we go to a government building, we don’t bat an eye when we fill in those forms at the front desk. You know the ones; you fill in your name, ID number, phone number, email address and company. It wouldn’t be a big deal were it not for your access to all the names above yours and their associated personal information.

Even worse, the names below yours will all have access to your personal information.

It seems strange that that seems to be okay. I doubt the security is paid enough to care about a how information is processed, even if there is a manual in place, and it’s not like any regulators have even issued a statement on the subject.

Beyond that, it doesn’t seem like anybody cares.

So, you walk out of the adult shop and somebody catches you on the camera with a big black bag full of goodies. Is that something we need legislation to prevent? Probably not. Say you input your bank details when shopping for goods but the website has no security in place. Is that something we need legislation to address? Certainly.

We know that there is some information that is best kept private but it’s not just for the sake of privacy. It’s to prevent harm to individuals and society. Protecting credit card details is one thing, but if we’re happy to put our names and numbers on a page anybody can have access to every time we walk into a municipal building, then is it really worth all the fuss?

ALSO READ: Information regulator slaps DoJ with R5m fine for contravening privacy act

If I were a whole Dis-Chem and got into trouble because I let slip 3.6 million names, surnames, email addresses and cell numbers, I’d know I’ve done wrong. Yet I’d still be angry that every department with a front desk gets away with doing the same thing (typically plus ID numbers) and it doesn’t seem to matter.

Dis-Chem is the low hanging fruit of information regulation. It’s nice and easy to go after the organisations that have informed you of the breach and have millions of data subjects on their books.

However, privacy isn’t protected if you only go after the low hanging fruit. What we need now is some grassroots education on the subject. If my personal information is so important, then it’s not only Dis-Chem that must keep it safe. It’s everybody else too.

That means protection of information we deem important enough to protect must have some active directives. One cannot simply act after a breach and one certainly can’t focus on only certain actors.

ALSO READ: Police apologise for leaking personal info of Krugersdorp gang rape victims

If privacy is really so important that we’ve created this whole industry, it would be pretty stupid to allow leaks in the most obvious of places. The Information Regulator has its work cut out for it but that work needs to be done if we really are going to take privacy seriously.

If we’re not serious about it then cool, let’s keep fining the big guys and in a few years, some entrepreneurs will have built a new industry of signing into buildings while wearing cameras in their specs.