It is critical to mandate the default privacy settings that apps have

Today some way or the other, each and every business and individuals are touched by cybersecurity. The level of risk is so high that in 2019, almost $2 trillion were incurred by businesses as costs related to cybercrimes and the number is growing day by day. And in order to understand the risk even better, we certainly need some guidance that only experts can offer. DeviceNext caught up with Ms. Pooja Haldea, Senior Advisor, CSBC to know more about track of the ongoing events in the security horizon and also make us aware of the underlying trends.

What should users look for before using any apps 

 Reading the privacy policy and understanding how the companies plan to use the data that they are sharing, is the bare minimum act that the user can control. Alongside this, following public debates on apps which default on user privacy, reading up on the privacy record of a particular company whose service you wish to purchase, can also be an indicator of how they are placed in terms of their practices and their standing over a given country’s privacy policies. If companies offer the choice to change the privacy settings at a later stage, that signals good privacy practices and ethics on their part. Users should also look out for auto changing privacy settings. Social media platforms often send privacy policy update notifications, which should not be ignored. Other good practices that users can adopt is using strong and secure passwords and changing passwords every few months. Users can also begin using apps and programs that are widely accepted as user-privacy friendly, open-sourced and those that put the onus of sharing data right with the user, allowing him/her to opt for the type of information they wish to share.

What policies should the Govt. adopt for better security and a better environment for developers?

The government must work with all the stakeholders to build a robust regulatory framework with clear directions with respect to compliance for companies. Compliance rules should ideally be well-defined with clear cut directions, and simplified procedures must be laid out, instead of convoluted bureaucratic clauses which we are familiar with. Furthermore, insisting on policy changes in line with user expectations on privacy can standardize the ecosystem. Along with the insistence on ‘Make in India’ it must incentivize start-ups with tax breaks while investing on creating a value-based ecosystem that encourages privacy practices of the highest order. Our research has shown that good privacy practices like ‘cool down period’ on the privacy policy page before a user can hit ‘I agree’, or star ratings that indicate the effectiveness of the privacy features on an app can nudge users to become more privacy conscious and cognizant of the kind of data being shared. Additionally, it is critical to mandate the default privacy settings that apps have, because most users don’t change the default settings. Moreover, the government can take a lead in initiating wider conversations with the civil society, industry leaders and about adapting to the fast paced changes in terms of cyber security, AI and industry 4.0 and their impact on its people.  

IntAct is a pioneering research initiative focused on the behavioural aspects of data privacy. They are the outcome of a shared vision between behavioural science specialists, the Busara Center for Behavioral Economics, and the Centre for Social and Behaviour Change (CSBC) with support from Omidyar Network India as part of its work on digital identity.