How the General Data Protection Regulation (GDPR) Will Impact U.S. Companies

http://ec.europa.eu/justice/data-protection/index_en.htm

The European Union’s 1995 Privacy Directive had strong protection for the privacy of personal data for EU residents and the movement of data across borders. The directive required all EU nations to establish their own laws under its framework. All companies with businesses that collect EU customer data, wherever they were headquartered, were covered by its provisions. The US and the EU established a Safe Harbor agreement to certify that US member companies were complying with EU regulations. The 1995 directive provided strong privacy regulation for many years but now that is changing.

What is the GDPR?

In 2016 the EU passed the GDPR with an effective date of May 2018. The regulation updates the existing procedures under the 1995 directive. Most important, it is a regulation with the force of law, not a directive that directs member companies to establish laws. Industry group Third Certainty (so named because observers believe that today’s third certainty after the traditional death and taxes is identity theft) describes the regulation as follows:

GDPR isn’t a suggestion that companies institute best practices for customer data privacy; it is a directive that could result in fines of €20 million or up to 4 percent of annual global turnover. Not only will all companies in the EU be required to meet the new regulations, but GDPR also is in effect for all organizations that hold or process the data of customers who live in the EU.

In addition, the GDPR site identifies major changes as:
•    The unambiguous inclusion of all companies that process the data of people residing in the EU no matter where the companies are located.
•    Consent to be obtained in a clear and accessible way, free of legalese, and the purpose for processing the data must be explained. It must be as easy to withdrawn consent as it is to give it.
•    Data breaches to be revealed within 72 hours of the company first being aware of the breach. Data processors are also required to notify of breaches without undue delay when they become aware of the breach.

According to the Information Commissioner’s Office in the UK the rights of individual data subjects are:
•    Right to be informed by means of privacy notices
•    Right of access to their data and information about how it is being processed
•    Right to rectification of inaccurate or incomplete data
•    Right to erasure of data where there is no compelling reason for continued processing
•    Right to restrict processing of personal data
•    Right to data portability, allowing subjects to move, copy or transfer personal data easily from one IT environment to another.
•    Right to object to certain types of processing
•    Rights related to automated decision making and profiling that protect against potentially damaging decisions made without human intervention.

Cookie Notice from https://ico.org.uk/

The ICO Guide has more detail on these provisions and a “What’s New” page that highlights ongoing analysis. Notice that this information is being provided for UK organizations post Brexit on a site that has one type of cookie notification. The home page of the Financial Times shows another type of notification that is being used under the provisions of the regulation. Notice that this is the U.S. version of the London-based publication that is showing the same notification that is shown on the U.K. and World editions.

 Cookies Notice from https://www.ft.com/world/us

The individual rights under GDPR are based on the Fair Information Practices Principles discussed in Chapter 17. These specific rights update the 1995 directive by being clearer and more specific.

How Should U.S. Companies Prepare for the GDPR?

It seems the question should really be, “Are U.S. companies preparing for the GDPR?” A study by NTT Security, quoted by Thompson Reuters, found that many decision makers around the world were unaware of the regulation and how it would affect them. Switzerland had the highest preparedness level at 58% of businesses. The U.S. had the lowest level of awareness of the regulation with only 25% of companies believing the regulation would affect them.

The Thompson Reuters post says that the regulation:

attaches to any data concerning an individual residing or present in the EU. Thus, if data is connected to an individual in the EU, the GDPR applies — regardless of where such data is processed. They add that it requires that, “organizations be able to justify their reasons for holding or processing every piece of data in their possession."

Those are sweeping statements, especially in view of the large fines that can result from non-compliance. Steps that U.S. firms should take to comply are outlined by Information Week:

•    Determine whether the firm is a controller, a processor or both. A controller is the entity that determines the purposes and conditions under which personal data will be processed. Since processing includes anything as basic as collecting and storing data, that means that any brand that collects personal data is a controller. That definition is the same as under the 1995 directive. The definition of a processor also does not change; a processor is an entity that processes personal data for a controller. Both controller and processor(s) are responsible for compliance with the GDPR but primary responsibility lies with the controller

•    Audit personal data to ensure that there is a single view of each data subject. This is necessary to be able to “forget” a data subject under the regulation.

This can be a huge task, but Steve Forde of Britain’s ITV advocates viewing it as an opportunity. He finds 3 principles of data collection—transparency, control and value exchange—to be essential in creating trust with customers. Preparing for GDPR is a way to instill this philosophy throughout the organization with the result that customer trust should increase.

•    Redesign what consent looks like for your customers. They must explicitly consent to each use of their data and pre-checked boxes or opt-out requirements are not adequate. The range of data covered and special issues like collecting data from children have been make tighter and more explicit under the regulation.

•    Audit service providers to ensure they meet the requirements for processors. Otherwise the processing they do for a U.S. firm on its data for European subjects will be illegal.

•    There are other requirements like choosing a member state as the supervisory authority, appointing a data protection officer and locating data centers that are legal or technical in nature, but marketers need to be sure that all requirements are being met. Failure to do so could result in loss of access to data of European subjects—everything from contact information to CRM data. For many U.S. brands, that could result in a significant loss of business.

What is the Role of Privacy Shield?

Privacy Shield prototype

Under the 1995 directive, the Safe Harbor program certified that U.S. companies were compliant with its provisions. That compliance framework has been superseded by the Privacy Shield program. Developed by the Department of Commerce, the service is open to all organizations that are under the jurisdiction of the FTC or the DOT. The framework allows companies to self-certify that they have met the requirements of the GDPR for both the E.U. and the separate Swiss framework.

Companies that wish to certify must have a Privacy Policy that is compliant with the GDPR. Current privacy policies will not conform to the new requirements, which are essentially the rights of individual data subjects listed above. The company must provide an independent recourse mechanism from an approved list that includes agencies like the Better Business Bureau and TRUSTe. The company must provide for verification of its compliance and designate a contact for the Privacy Shield program. Companies that certify under the Privacy Shield program will automatically be removed from Safe Harbor and must remove all references to it from their privacy policy and website.

U.S. Companies Should Move Quickly to Comply with the GDPR.

If this all sounds like a great deal of work, it is. At the same time, remember the advice of Steve Forde from ITV. Trust is essential to ecommerce businesses and being transparent about the way a brand handles the personal data of its customers helps create that trust.

So the best advice to U.S. companies is to move quickly so they do not lose access to the data of their E.U. customers and to do so in a way that creates trust with their customers all over the world.

See the infographic here 

Related Updates

Post-cookie (also called zero data) advertising 
Privacy attitudes vary by country 
Businesses still not ready for GDPR with EU consumer data
Analysis from HBR
How the GDPR is affecting advertising 
Look-alike audiences under GDPR
ePrivacy regulation is a broader approach
Important French ruling on partners and data privacy

How Image Search is Changing Shopping

Since Google Image Search was introduced in 2001 many of us have found it useful in a variety of ways. According to Wikipedia image search results are based on the file name of the image, the link text pointing to the image, and the text adjacent to the image. If you use the Google Images search box, you can drag and drop an image to search and that is kind of fun. Other search engines also offer image search but this post will focus on the impact of image recognition on shopping and how we are getting there.

What is Deep Learning? How is it Affecting Marketing?

Talking about AI-driven advances in image search immediately brings us to the subject of deep learning. Its development is explained in the Nvidia blog as

                       Artificial Intelligence  >>  Machine Learning >>  Deep Learning

Deep Learning Layers

The post explains that what we can do at present falls into the  category of “narrow (specific) AI”. Examples include image classification on Pinterest and facial recognition on Facebook. Machine learning uses massive neural networks, running huge amounts of data through a network until it learns to recognize the item with near perfection. The “layers” shown in the dog recognition graphic are at the heart of deep learning. Speech recognition and image recognition are both products of deep learning technology. The impact of voice technology was discussed in my recent post on voice search. Image recognition is, of course, the enabler of image search.

Image search is interesting in a general sense, but the recent presentation I developed on Social Commerce opened my eyes to some of the ways image search—fueled by AI—could offer new shopping opportunities. That presentation focused on Pinterest, clearly a leader in the social shopping space, and on Facebook whose sheer size makes it impossible to overlook its initiatives in social commerce.

The clear leaders in the image search space are, not surprisingly, the leaders in voice technology—Amazon, Apple, Google and Microsoft. You could probably add Chinese web services firm Baidu to that list, but less is known about the current status of its AI.

Amazon has been in the space for a considerable time, using images as one input in its recommendation engine. Over time, it has added AI/deep learning to its use of images. Amazon recently made news when it opened its deep learning framework DSSTNY to other developers as an open source platform. There was speculation in the trade that Amazon was using this as one way to catch up with the technology of its more recent rivals, especially Google. Facebook also has made its facial recognition software open source. Facebook’s facial recognition services have been a special target for privacy advocates, a subject in itself. Apple is using facial recognition to unlock the iPhone X.

Google is making advances in deep learning AI research on several fronts. In 2011 it introduced Rank Brain (discussed in Chapter 10) as part of its search process. At present, it also uses deep learning in a number of ways:

•    To help categorize images on the web to improve search results. It also allows image enhancement, essentially filling in the blank, when images are missing detail.
•    Google Cloud Video Intelligence allows videos to be segmented and analyzed for content and context with automated summaries provided. It can be used to search for various types of meaning including suspicious content. See a video demo on YouTube.
•    Language recognition technology is essential to Google’s growing line of home assistant devices.
•    Google also uses deep learning to improve recommendations on YouTube, thereby keeping users on the site longer.
•    It is enhancing Google Image Search with Pinterest-like suggestions about related content. For instance, it will highlight when a recipe is available for a particular food image.

Remember—it’s still early days for these technologies. Nevertheless, there are already useful commercial applications. The fashion industry with all its visual content provides some good examples.

How Image Search is Changing Fashion Shopping

Tech CEO Ron Palmeri says the smart phone camera is on its way to becoming “the keyboard” because it can capture so much more information than words alone. Palmeri said he imagines a time when a shopper takes a picture of a desired item and rather than typing in a keyword to find it, they upload the image to a search engine that spits back a number of similar items at a range of price points or even items customized to a specific price point, if the user has integrated financial data into the model.

Palmeri’s firm, Layer, supplies the search technology for Nordstrom’s Trunk Club. The Twitter box describes the service and a posting shows one offer. The postings tend to show accessorized outfits, but a customized tux was the most recent post when I visited. Note that a personal fashion advisor is available on the mobile apps. Trunk Club actually started in 2009 as a service for men who didn’t like to shop but its expansion to women’s fashion and the importance of the smart phone camera is putting the emphasis on mobile.

Trunk Club Twitter Offer

 Trunk Club Twitter Page

It’s about more than just selling; the importance of the images is influencing design at Nordstrom. “We are trying to understand how one pair of jeans plays out against another pair that was released in another season,” explained Justin Hughes, vp of product development and design at Trunk Club. “We want to get really granular and understand what really works.”

In a related development, Nordstrom is rolling out a line of stores with no inventory. The first store in Los Angeles has no merchandise, but it offers a fascinating array of services. See this post for a picture gallery that would stimulate a lively discussion about the future of retailing in the digital age.

British fashion supplier Apsos finds 80% of its UK traffic coming from mobile and 70% of its orders. Customers average 80 minutes each month on their mobile apps. No wonder Apsos is adding image search to its mobile apps! A customer takes a picture of an item or pulls one in from, say, Instagram for the search. The app returns similar items with reasonable accuracy, according to one reviewer. The results that don’t match so well may actually give customers more shopping ideas she says. There is plenty of room for ideation; Apsos currently has about 85,000 items in its image database.

  Play the demo   https://vimeo.com/226972601

We've all probably spent time searching for an item among the multitude available on eBay. Well, eBay will soon have an app for that! The app will allow the user to search not only for products but also for specific features of the product. The user can also choose the color. Play the description from the link in the caption.

Target has taken another route. The retailer is adding Pinterest’s Lens search technology discussed in the Social Commerce presentation) to its mobile app. Users take a picture with their smart phone and the search will find similar items for sale at Target. “The Pinterest partnership quite literally helps us shorten the distance from when our guests have an idea to when they’re ready to make a purchase,” said Rick Gomez, Chief Marketing Officer for Target. He adds that this technology will help understand what customers are looking for and therefore improve their merchandise planning.

What is the Future of Image Search?

There are a number of implications to be drawn from this discussion. As far shopping is concerned, many other visually-oriented categories like food should quickly be active in the space. The technology will continue to grow more powerful because of the players discussed here and other powerful ones, IBM for example, whose activities in deep learning were not discussed.

Brands have choices in terms of how to become a player in image-based shopping. Some will make a quick entry by partnering with a technology firm—Target and Pinterest, for example. Others will carefully build their own back-end processes, Apsos and eBay for example. Burberry is said to have engaged in massive image creation for a trial on Pinterest when it introduced its new Cat Lashes mascara. These activities are already beginning to impact the physical retail space as Nordstrom's new store illustrates.

Finally, search marketers will be pardoned if they emit another long sigh. Image search looks to be another disruptive development in the search space.

Look for all sorts of fascinating developments in the months and years to come!

Related Links

 AI that trains itself
Asos new image search tool
Google ups its visual game
Retailers are experimenting with visual search
Visual search a top tool in 2019