Balancing Profit and Privacy: How Can Businesses Use Data Ethically in the Digital Age

Much of our work today relies on and operates through enormous quantities of data sets.[1] Data is now considered a capital asset by businesses rather than merely a commodity.[2] These data enable businesses to make data-driven decisions using technologies that monitor client preferences, purchase patterns, and a range of habits to enhance customer experience and service delivery.[3]As with technological advancements, ethical challenges arise on how businesses use big data to their advantage.[4]

As data becomes central to business operations, legal and ethical challenges surrounding privacy and data protection emerge. Navigating these challenges is crucial, especially as businesses face increasing scrutiny from Regulators and customers alike.[5]

In Nigeria, businesses must align their data usage with both regulatory frameworks and ethical standards. The temptation to maximize profit by exploiting data without adequate privacy considerations can lead to severe legal consequences. This article will outline how businesses can ethically leverage big data, adhere to privacy regulations, and strike a balance between profit and privacy.

 Big Data in Business: Understanding Its Role in Achieving Business Productivity 

In today's world, businesses succeed by employing and deploying big data.[6] This cuts across targeted advertising to enhance customer experiences.[7] These opportunities bear inherent challenges. What intensifies this situation more is customer’s increasing awareness and attention to how businesses use their personal information.

The vital question plaguing the minds of many business owners and top-level executives is this:  How do we maximize profit from data processing without violating both the right of privacy and data protection for our clients? The answer lies in adherence to:

1. Constant monitoring and ensuring regulatory compliance:

The first step towards achieving a balance between privacy and profit is through adherence to applicable data protection and privacy legislation.[8] The question of what law applies in a particular business industry depends on a summation of some factors including; (i) the specific sector or industry the business functions, (ii) the country the business operates in, (iii) the geography and demography of the data subjects, and (iv) the risks associated with the processing of such data.[9] It is vital to note that most data protection laws have the European Union’s General Data Protection Regulation, 2018 (GDPR) as their foundation.[10] In Nigeria, some of the key regulations to consider are the Nigeria Data Protection Act, 2023, the Federal Competition and Consumer Protection Act, 2018, and other sector-specific laws.

The Nigeria Data Protection Act, (NDPA) 2023 ("the Act"), which regulates the processing of data, establishes certain criteria for data gathering, processing, and storage when dealing with data protection. The law establishes that businesses must seek explicit consent from individuals before using their data, establish strong security measures to secure information, and allow customers to access or erase their data upon request. Some specific compliance measures, such as Data Protection Impact Assessment (DPIA) audits, and registration with the Nigeria Data Protection Commission (NDPC), (“Commission”) as data controllers, are of fundamental relevance.

In the event of non-compliance, the regulatory authority established under the Act, the NDPC, imposes penalties. The Nigerian Federal Competition and Consumer Protection Commission (FCCPC) and the NDPC fined WhatsApp for failing to comply with privacy regulations, highlighting the importance of not only adhering to legal standards but also ensuring that ethical data practices are a core component of business strategy. Similarly, The Nigeria Data Protection Commission (NDPC) fined Fidelity Bank of Nigeria for non-compliance.[11] Compliance requirements are complex, and only registered experts can conduct certain requirements under the NDPA, such as mandatory data protection audits. As such, it is pertinent that your business seeks legal advice to navigate the complexities of compliance, mitigate risks, and prevent costly regulatory breaches.

1. Execution of Data-Sharing Agreements:

Organizations collaborating with partners for joint marketing efforts, data analytics, or other purposes involving the exchange of data must establish agreements detailing how data will be shared, processed, and protected. Data-sharing agreements ensure responsible data use between parties and minimize the risk of non-compliance with relevant data protection laws.

1. Review of Data Processing Activities of Third-Party Providers:

Businesses that rely on external data sources for customer insights, marketing strategies, or analytics should evaluate these providers’ data handling practices to ensure that they comply with applicable data protection laws and maintain robust security practices.

1. Use of Data Anonymization and Minimization Techniques for Ethical Profitability

To balance privacy with profitability, businesses should adopt data anonymization and minimization techniques. These methods allow businesses to extract valuable insights from data without compromising individual privacy. However, applying these techniques correctly requires a deep understanding of regulatory requirements. Legal counsel can ensure that your data practices, such as anonymization, meet the standards set by relevant regulations, reducing the risk of breaches or violations.

1. Ensuring Informed Consent and Adequate Data Rights Management:

Another critical component of balancing privacy and profit is getting proper informed consent from customers. This involves giving individuals clear, accessible information about how businesses intend to use their data and getting their explicit approval before processing it. Managing data rights, such as fulfilling customer requests to access or delete their information, is equally important. In 2023, Spotify was slammed with a €5 million fine by the Swedish Data Protection Authority for inadequate data rights Management.[12] Adequate data rights management in compliance with the relevant law helps businesses minimize exposure to hefty fines whilst granting businesses access to necessary data.

1. Use of Transparent Data Policies:

Adopting transparent data policies is essential for balancing profit and privacy. By clearly outlining how businesses collect, use and share personal data. businesses can foster trust among clients while ensuring compliance with data protection laws. Privacy and data protection legislations emphasize informed consent, which is express, unequivocal, and directly given. An inventory of how customers or personal data subjects’ interface with privacy policies published on companies’ websites shows customers do not comprehend what is happening around their data. Hence, regulations mandate that businesses ensure transparency by clearly and expressly communicating with the data subjects on how they use their data and giving consumers genuine control over their personal information. A well-crafted privacy policy should clearly state what personal data the company collects, the specific purposes for which the company uses the data, disclose any third parties participating in data sharing and inform clients of their rights regarding access, correction, and deletion of their data.

1.   Compliance with Platform Policies:

Companies that use platforms like Twitter, Instagram, Facebook, or other social media platforms for marketing and customer engagement must ensure their data practices align with the platforms’ policies. Each platform has its own set of guidelines for data handling and privacy; businesses must ensure that they understand these policies before utilizing personal data obtained through the platform, as these can result in penalties from the platform and relevant authorities.

 Conclusion

Balancing profit and privacy is crucial for businesses operating in today’s data-centric landscape. Companies must prioritize compliance with relevant regulations and implement certain protective mechanisms to remain compliant and competitive.

For more information, please feel free to contact us at enquiries@laperitum.com or click here to reach us directly.

[1]Terence Craig Mary E. Ludloff, Privacy and Big Data: The Players, Regulators and Stakeholders (O’Reilly, 2011).

[2]Andy Petrell, What is Data Governance? Understanding the Business Impact ( O’Reily Media, Inc, 2021).

[3]Harsha Patil, Vikas Muhandule, Juber Fakir, Omprasad Ajgaonkar, “Balancing Data Privacy and Ethics in the Age of Big Data: Challenges and Solutions” (2024) vol. 3 (1) Journal of Innovations in Business and Industry 1<Journal of Innovations in Business and Industry (aspur.rs)> accessed 16 September, 2024.

[4]ibid.

[5]Ibid.

[6]David Hoffman, ‘Privacy is a Business Opportunity’ (2014) Harvard Business Review <Privacy Is a Business Opportunity (hbr.org)> accessed 16 September, 2024.

[7]ibid

[8]Ibid

[9]Tom Petrocelli, Data Protection and Information Management Lifecycle (O'Reilly Media, 2006).

[10]Orla Lynskey, The Foundations of EU Data Protection Law, (Oxford University Press, 2019).

[11]Ibid (n.11).

[12] Boris Otterbach, “Spotify’s €5 million penalty: The importance of problem DSR management” https://www.dataguard.co.uk/blog/spotify-fined-for-inadequate-dsr  Accessed on September 26, 2024