Privacy Laws Are Only as Effective as the Companies Implementing Them

Before he dropped out of the race, John Delaney proposed the U.S. adopt a law similar to the California Consumer Privacy Act, which gives greater agency to consumers when it comes to limiting companies collecting of their data.

The law empowers California consumers to know when private companies collect, share or sell their data and to stop that sale if necessary.

Sometimes the very laws meant to enforce privacy can result in companies nevertheless sharing it.

GDPR opens up a way of crooks to impersonate people and get their data from companies.

A year after GDPR went into effect, researchers in the EU showed how it's easy to access personal data from companies.

"This isn't a problem with the law itself, but instead with the companies and organizations implementing it," Mariano Di Martino, one of the researchers, who is a PhD student as Hasselt University in Belgium, told CoinDesk in an interview.

One group used publicly available information, such as names, emails, and phone numbers, in addition to more complicated methods to request information on their research partners from 55 companies under GDPR. One of these complex methods for obtaining the data included replacing the name, birth date and photo on the image of an ID to reflect the person whose information the researchers wanted.

Four companies never responded to their data requests, in clear violation of GDPR. This isn't a problem with the law itself, but instead with the companies and organizations implementing it.

The information they gathered included financial companies giving up details such as ID card numbers, a list of timestamped financial transactions, customer IDs, telephone numbers and place of birth, and transportation and logistic companies releasing locations people visited in the past as well as routes they'd saved.

The GDPR research illustrates that privacy laws may only be as good as the companies affected by them.