PRIVACY NOTES

Privacy is the right of an individual to keep their personal information,

thoughts, beliefs, and activities safe from intrusion or unauthorized access. It
encompasses various aspects:

1- Information Privacy: Protecting personal data, such as name, address,

social security number, and online behavior.
2- Spatial Privacy: The right to be free from surveillance or intrusion in
one's physical space.
3- Communications Privacy: Ensuring the confidentiality of one's
communications, including emails, messages, and phone calls.
4- Decisional Privacy: The right to make choices without external
influence or judgment.

AFFECT OF PRIVACY

1- Autonomy and Individuality: Privacy empowers individuals to form their

own opinions, make personal decisions, and maintain their distinct
identity.
2- Security and Safety: Protecting personal information prevents identity
theft, fraud, and other cybercrimes.
3- Mental Health: The feeling of being constantly watched or exposed can
lead to stress, anxiety, and reduced well-being.
4- Trust: Privacy breaches erode trust in organizations and institutions,
affecting relationships between customers and businesses.

HOW DOES PRIVACY AFFECTS THE BUSINESSES

1- Trust and Reputation: Privacy violations can tarnish a company's

reputation, leading to loss of customers and revenue.
2- Legal Consequences: Non-compliance with privacy regulations (e.g.,
GDPR, CCPA) can result in hefty fines and legal actions.
3- Data Security: Protecting customer data is crucial to prevent data
breaches, which can be financially devastating.
4- Customer Loyalty: Respecting privacy enhances customer loyalty and
engagement.

PRIVACY DELIMMAS

1. Data Collection and Consent:

Dilemma: Should a company collect and analyze customer data

without explicit consent to improve its services?
Example: A mobile app collects location data to enhance user
experience but doesn't obtain clear consent, potentially violating
privacy expectations.

2. User Profiling:

Dilemma: Should an e-commerce platform use customer purchase

history to create personalized product recommendations?

Example: A website uses browsing history to recommend relevant

products, but users may feel their privacy is invaded.

3. Data Sharing and Third Parties:

Dilemma: Should an organization share customer data with third-party

partners to improve marketing strategies?

Example: A social media platform shares user data with advertisers,

leading to concerns about data misuse and breaches.

4. Data Retention and Deletion:

Dilemma: Should a company retain customer data indefinitely, even if

it's no longer needed for the original purpose?

Example: An online retailer stores customer data beyond the

transaction, raising concerns about data security and privacy

5. Data Security vs. Data Utility:

Dilemma: Should an organization prioritize strong data security

measures, potentially hindering data accessibility and usability?

Example: A healthcare provider faces challenges in sharing medical

records securely with authorized personnel due to stringent security
measures.

6. Location Tracking:

Dilemma: Should a ride-sharing company track and store customer

location data for better service and safety?

Example: A transportation app monitors users' real-time locations,

prompting debates about surveillance and privacy invasion.

7. Health Data and Research:

 Dilemma: Should medical research organizations use patient data for
scientific advancements, even if it's anonymized?

Example: A pharmaceutical company conducts research using patient

health records, leading to concerns about re-identification.

8. AI and Predictive Analytics:

Dilemma: Should an organization use predictive analytics to make

decisions about individuals, such as credit scoring or job applications?

Example: A financial institution uses AI to assess creditworthiness,

potentially perpetuating bias and discrimination.

9. Consent and Children's Data:

Dilemma: Should a social media platform allow children to create

accounts and share personal information with parental consent?

Example: A social network debates the age limit for users, balancing
educational benefits and potential risks.

10. Cross-Border Data Transfer:

Dilemma: Should a multinational company transfer customer data

across borders, potentially violating data protection laws?

Example: A global tech company faces challenges complying with

differing data protection regulations in various countries.

RIGHT TO PRIVACY AND BUSINESS NEEDS

 Legitimate purpose

 Consumer benefit

 Relevant

 Informing consumer

 Consent

 Accuracy

 Security

Ads that don’t overstep

• Privacy Paradox
 • Mitigating Backlash

• Trust

• More click through if trust is there and acceptable use is

disclosed

• Control

• More control over their privacy

• Justification

• Why it is needed

GUIDELINES

• Staying away from sensitive information

• Commitment to at least a little transparency

• Use data judiciously

• Justify data collection

• Trying traditional collection first, without digital surveillance

• Other notes

Customer centric

The case explains how targeted advertising can add value without crossing the line into
privacy invasion. Customers accept relevance but reject surveillance-like behavior.

Key Points (Same Concepts, Exam-Focused)

 Targeted advertising uses consumer data, browsing behavior, and preferences to

deliver relevant ads.
 Consumers like relevance but dislike feeling watched.
 The problem is not data use itself, but how transparent, predictable, and respectful it
is.
 When targeting feels too personal or unexpected, customers feel “creeped out.”
 Trust is fragile: once violated, consumers disengage or demand regulation.

Why Ads Feel “Creepy”

 Use of sensitive data (health, finances, personal relationships).

 Ads that reveal how much a company knows about an individual.
 Lack of clear consent or explanation.
  Data collected in one context used in another (context collapse).

Business Lessons

 Transparency reduces discomfort.

 Customers want control and choice, not secrecy.
 Responsible targeting improves engagement without harming brand trust.

Exam Takeaway

Effective advertising balances personalization with privacy expectations.

WHAT IS PRIVACY

 Privacy vs info exploitation

 Confident that it would be treated with care, no longer
 First version
 Form of self expression
 Facts about oneself
 No one’s business but our own unless we decide otherwise
 Second version
 Social contract
 Ignore what we learn about others private lives in public setting
 Technology complicates this
 Dog poop girl
 Norms

WHO SPEAKS FOR IT

 Don’t just pick solutions that best protect privacy

 Privacy protection should be built into every process and tech
 Someone has to speak for it
 Does not rise naturally
 Bell curve
 Fundamentalists
 Pragmatists (worry about threats but reasonable safeguards
 Unconcerned
 Attitudes to privacy are shifting
 Generation gap

PRIVACY CHECKLIST

 Align privacy with strategy

 Rules to values
  Culture
 Bottom up
 Anticipate issues
 Create accountability
 Don’t conflate security and privacy
 Privacy as social responsibility
 Manage your data supply chain
 Rely on tech when appropriate
 Plan for disaster recovery
 Privacy thinking must span a range of generational norms and
expectations

CASE 2
“Can Facebook Scale?”
Can facebook scale

Core Idea

The case analyzes whether Facebook’s business model based on user data, social sharing, and
advertising can scale without triggering privacy backlash and regulatory pressure.

Key Points

 Facebook’s growth depends on collecting, analyzing, and monetizing personal data.

 Users freely share information socially but object to commercial exploitation.
 Privacy issues arise from:
o Default public settings
o Automatic data sharing
o Behavioral tracking

Facebook’s Privacy Challenge

 Social sharing ≠ consent for advertising.

 Users feel betrayed when friend activity becomes marketing data.
 Changing defaults from “opt-out” to “opt-in” became necessary after backlash.

Strategic Tension

 More data = more revenue.

 More data = more risk.
  Scaling requires trust, governance, and compliance, not just technology.

Exam Takeaway

Platforms can scale only when privacy expectations evolve alongside business models.

CASE 3
“What Was Privacy?” – Lew McCreary (HBR)
What Was Privacy_

Core Idea

The article argues that privacy is no longer just about control of information, but about social
norms, trust, and dignity in a digital world.

Key Concepts (Same Language Retained)

 Privacy is the freedom to selectively reveal one’s self.

 Digital life produces continuous behavioral data exhaust.
 The internet is a “cruel historian”—nothing disappears.
 Once, people trusted that information would be treated with care and discretion; today
they cannot.

Two Views of Privacy

1. Individual Control
o Personal data, identity, preferences
o Health and financial information
2. Social Contract
o Shared norms about what should be noticed or ignored
o Civility and dignity in public spaces

Examples Used

 “Dog Poop Girl” shows how public shaming destroys reputations.

 Google search results flatten context (merit award + arrest).
 Surveillance cameras normalize observation.

Role of Business
  Companies underestimate how much privacy matters.
 Failure leads to:
o Regulation
o Reputation damage
o Loss of trust
 Best solution: negotiate directly with customers.

Exam Takeaway

Privacy matters because social trust depends on it.

GDPR (General Data Protection Regulation)

DETAILED EXAM NOTES
What is GDPR?

GDPR is a European Union data protection law designed to protect personal data and
privacy rights of individuals.

Who Must Comply

 Any organization that:

o Processes EU residents’ data
o Collects, stores, analyzes, or shares personal data

GDPR CORE PRINCIPLES (Very Important for Exams)

1. Lawfulness, Fairness, Transparency
o Data must be processed legally and openly.
2. Purpose Limitation
o Collect data for specific, explicit purposes only.
3. Data Minimization
o Collect only what is necessary, nothing extra.
4. Accuracy
o Data must be correct and up to date.
5. Storage Limitation
o Do not keep data longer than needed.
6. Integrity and Confidentiality
o Protect data from breaches and unauthorized access.
 7. Accountability
o Organizations must prove compliance.

RIGHTS OF DATA SUBJECTS

 Right to be informed
 Right of access
 Right to rectification
 Right to erasure (Right to be Forgotten)
 Right to restrict processing
 Right to data portability
 Right to object
 Rights related to automated decision-making

GDPR EXAM CHECKLIST

Before Collecting Data

✔ Clear privacy notice

✔ Lawful basis identified (consent, contract, legal obligation)
✔ Purpose clearly defined

During Data Processing

✔ Collect minimum data

✔ Secure storage (encryption, access control)
✔ Limit internal access

User Control

✔ Easy opt-in / opt-out

✔ Consent can be withdrawn
✔ Clear explanation of data usage

Data Retention

✔ Defined retention period

✔ Old data deleted or anonymized

Third Parties
✔ Data sharing agreements
✔ Vendor compliance checks

In Case of Data Breach

✔ Detect breach quickly

✔ Notify authority within 72 hours
✔ Inform affected users if risk is high