Collecting and storing individuals’ personally identifiable information has become the typical way organizations and consumers try to establish trust for commerce, employment, social connections, etc. in our society. That’s why it’s not a surprise that so many high-profile data breaches occurred in 2022. Uber, News Corp., Cash App, and Crypto.com were just a few of the impacted companies.
Consumers are getting wary; they are waking up to the reality that businesses cannot protect their private data as well as they can. Now, not every data breach involves financial or credit card data because some cybercriminals don’t aim to target consumer information. However, data breaches that do target a company’s customers add another layer of risk and frustration: Customer trust gets shaken, leading to serious business consequences and massive lawsuits.
Many data breaches target consumers’ PII such as Social Security number, date of birth, address, etc. No amount of “free credit monitoring” that organizations routinely provide after they are forced to disclose a breach is going to put the “PII genie” back in the bottle. Businesses should fundamentally rethink their practice of collecting and storing consumers’ PII in the name of identity and trust verification.
Commerce, communication, and social networks have all gone digital, but trust verification and assurance are still stuck in the analog world. Companies should prepare for the rapid shift in consumer sentiment that puts the power of proof in their hands by shifting to consumer-owned, reusable verified identity now. And while that may be a bit daunting for some companies at the moment, there are other ways companies can take a consumer-first approach to identity verification, all of which come down to reducing the amount of information they collect from customers.
Exact methods aside, there are three main reasons why it’s imperative that companies in the United States and beyond pave the way for a consumer-first approach to identity verification.
Protect Consumers More Effectively
According to a 2021 IBM report, the consumers’ PII “was the most common type of record lost or stolen” in data breaches, with it being “included in 44% of all breaches in the study.” In contrast, the study found that customer data that had been anonymized, meaning “modified to remove PII,” was “compromised in 28% of the breaches studied.” PII is valuable to cybercriminals as opposed to anonymized customer data.
The only way for a consumer to be sure that their data is protected is not to have to share it repeatedly in the first place. As the first step, consumers should be able to establish trust with businesses without having to disclose personal data. Businesses should have a way to validate trust with their consumers without the liability of collecting and holding their private data.
When consumers have control over verifying their identities (such as via a digital wallet that they use to prove to organizations that they are who they say they are) or when companies simply collect less consumer PII to begin with, consumers will be better safeguarded in the event of data breaches. There will be a lower likelihood that sensitive details about their lives will get into the wrong hands.
Enhance Consumer Trust
It’s natural for consumers to feel like their personal privacy is being invaded when they have to hand over PII routinely. If you’ve ever had to send a photo of your passport or driver’s license, provide your SSN or even just give your phone number to a company, perhaps you felt a little uneasy, asking yourself questions such as, “Do they really need this information?” and “What will they do with my data?”
Consider this: In a 2021 report by KPMG, 70% of business leaders surveyed stated that “their company increased collection of consumer personal data over the last year.” But 86% of adults in the United States said that “data privacy is a growing concern for them,” with 68% “concerned about the level of data being collected by businesses.” In fact, “30% aren’t willing to share their personal data for any reason.”
By enabling consumers to use reusable smart credentials, so that they don’t have to hand over their PII—or by asking consumers for fewer personal details in the first place—companies can enhance consumer trust. Consumers will feel a greater sense of empowerment that their data is their own—and that their lives aren’t being intruded upon.
Stay On The Right Side Of Applicable Laws More Easily—And Potentially Curb Future Legislation
Not following consumer data privacy laws can have severe legal and financial consequences for companies.
For instance, a 2020 article from McKinsey & Company noted how falling on the wrong side of Europe’s General Data Protection Regulation law, which has shifted the manner in which companies “collect, store, share, and delete data,” can lead to costly repercussions. One company “incurred a fine of $180 million for a data breach that included log-in and payment information for nearly 400,000 people,” and another was “fined $57 million for failure to comply with GDPR.”
And GDPR isn’t the only regulation companies need to worry about. As that same article stated, governments “outside Europe have also begun to enact data-privacy regulations,” including Brazil and California. In the United States, many proposed consumer data privacy laws are currently pending.
If companies avoid over-collecting consumer PII, they could more easily comply with consumer privacy laws. If the data isn’t collected or stored by the company, the company doesn’t have to worry about landing in legal hot water over it.
Furthermore, if companies fundamentally change their attitude toward consumer PII, they could potentially play a role in curbing the need for future legislation in this area. As simplistic as it sounds, these data privacy laws exist because governments recognized that businesses were working with other businesses to obtain consumers’ PII, in many instances without the consumers’ knowledge and/or explicit consent.
I don’t predict that all existing consumer privacy laws will go away, but some of them could become obsolete. Perhaps there will be less legislation in the future if more companies take the lead and take greater ownership by encouraging consumer data privacy rights on their own. Companies need to show they are on consumers’ side without compromising the integrity of the trust relationship between both parties. Putting consumers first is good for business.