My Data Journey
When I decided to take a break from work, I knew I needed something to keep my mind sharp. I decided to use this time to take on a project to clean up my personal data. The first step was to identify who had my personal data. I started the identification process by using my personal password manager to create an inventory. Using a password manager is a good security practice, and I have been using one for many years. In addition to using it for security reasons, this also allowed me to get a good start on an inventory of who had my personal data. Currently, I have around 250 items in my password manager. Some were items I added since I moved to Spain. I was able to eliminate quite a few items after moving to Spain. I also used items I received via physical mail as a second way to identify who had my personal information. From there, the next step was to identify which organizations I would request to delete my personal information. I identified many websites that I wanted to remove my personal data from for various reasons. Some were just websites I was no longer using. Some were e-commerce sites that I would have no use for, living outside the United States. I then started contacting these various companies to request that my personal data be deleted. I found such a broad range of experiences. The first category would be the sites where I could click a button in either the app or website and the deletion of my personal data was instantaneous. The second would be sites that required going through a third party to request the deletion of data. This is the group where I encountered the most inconsistencies. This inconsistency is partly due to the differences in state privacy laws in the United States. Privacy laws in the United States at the federal level are minimal at best. Some companies set their policy based on the strictest privacy laws that exist in any state. Some would only do the bare minimum required based on state privacy laws and would only allow for users to delete their personal data in the states that required it. The third scenario would be websites that required you to send an email or make a phone call.
Get Nick Marsh’s stories in your inbox
Join Medium for free to get updates from this writer.
My experience around data privacy laws is quite different living in Spain. Since Spain is part of the EU, GDPR applies here and part of GDPR regulation is the right to the erasure of personal data. I have noticed that this regulation has given me greater control over how my personal data is used. I have found it easier to request the deletion of my personal data. Most are automated processes that a user can manage themselves. I also have noticed that companies here completely shut off your online access when you terminate a service. An example of this would be my private health insurance. I changed private health insurance providers after the end of my first year in Spain. As soon as my policy ended, my access to their website was terminated. In comparison, I can still access the site for my private insurance that I terminated over a year ago when I left the United States.
After experiencing the differences firsthand, the EU way of handling data privacy is much more consumer-friendly, whereas the US way of handling data privacy is much more business-friendly. As a user, I prefer the EU way of handling this. One thing I do wonder is how GDPR applies to someone in my position, a US citizen residing in an EU member country. Also, how does it apply to any data I provided while I was a US resident. I do know that some US companies do block access to their websites to IP addresses either located outside the US or located in an EU member country. I am also curious to know if this practice actually complies with GDPR, since you can bypass these restrictions by using a VPN.
In conclusion, I hope that this short bit about my data privacy experiences from the perspective of an American tech professional living in Europe gives other tech professionals something to think about. I also hope this provides some useful knowledge and experience. Until next time, ciao.
