love the guillotine


——————-
Radio link

https://www.npr.org/sections/money/2018/11/07/665392227/your-lifetime-value-score

How long do you spend on hold? What kind of discounts do you get? These things could be determined by something called a Customer Lifetime Value score. This score is being used by companies across the economy and the results of those scores can be powerful.

————————

https://www.wsj.com/articles/on-hold-for-45-minutes-it-might-be-your-secret-customer-score-1541084656

It would be behind a paywall.

On Hold for 45 Minutes? It Might Be Your Secret Customer Score
Retailers, wireless carriers and others crunch data to determine what shoppers are worth for the long term—and how well to treat them

Khadeeja Safdar
Nov. 1, 2018 11:04 a.m. ET
By
Khadeeja Safdar
Two people call customer service at the same time to complain about the same thing. One waits a few seconds before a representative gets on the line. The other stays on hold. Why the difference?

There’s a good chance it has something to do with a rating known as a customer lifetime value, or CLV. That secret number is used by all manner of companies to measure the potential financial value of their customers.

Your score can determine the prices you pay, the products and ads you see and the perks you receive.

What’s Your Secret Shopper Score?

On Hold for 45 Minutes? It Might Be Your Secret Customer Score
See how a retailer develops your customer lifetime value. Click here.

Credit-card companies use the scoring systems to decide what to offer customers who want to cancel their cards. Wireless carriers route high-value callers immediately to their most skilled agents. At some airlines, a high score increases the odds of a seat upgrade.

“There’s no free lunch,” says Sunil Gupta, a marketing professor at Harvard Business School who has researched models for calculating lifetime value. “The more profitable you are, the better service you will get.”

These days, companies are resorting to all sorts of data and scores to size up consumers and predict their behavior. Retailers use risk scores to try to limit merchandise returns and prevent e-commerce fraud. There are scores to measure the likelihood a person will become sick, cancel a subscription or bad-mouth a company.

Everyone with a bank account, cellphone or online shopping habit has at least one CLV score, more likely several. And most people have no inkling they even exist, let alone how they are used, what goes into them or how accurate they are. Unlike credit scores, CLVs aren’t available to consumers and aren’t monitored by any government agency.

“There needs to be a public conversation around the accuracy of the scores being used,” says Pam Dixon, executive director of the World Privacy Forum, a nonprofit digital-privacy research group. “You can essentially be accused of being cheap or a fraudster, and it may not even be true.”

To determine how the scores are compiled and how they are used, The Wall Street Journal interviewed data scientists who develop the models and employees of the software and analytics firms that help companies put them to use.

Most CLV score users contacted for this article declined to comment on how they score customers, citing competitive reasons. Many say the scores make them more comfortable offering costly services and products in the short term because they are confident they will pick up more business in the long term. Some say they aim to increase each customer’s lifetime value by encouraging repeat business.

In some respects, the scores are just a high-tech version of what shopkeepers have done for generations—make judgments on a customer’s value based on how they look or behave. As far back as 20 years ago, academics were publishing models to calculate the future value of customers.

Now there are hundreds of analytics firms that calculate customer lifetime value, each with its own approach. Some of them put a value on shoppers based simply on what they spend, while others use hundreds of data inputs, adding and deducting points for demographic information such as ZIP Codes or behavioral details such as the number of returns they make or when they shop.

“Not all customers deserve a company’s best efforts,” says Peter Fader, a marketing professor at the University of Pennsylvania’s Wharton School who helped popularize lifetime value scores. His scoring method is based on transaction history, which he says is all companies need to determine how customers will behave in the future. This year, he sold the firm he co-founded, Zodiac Inc., which performs such analysis, to Nike Inc.

The data that goes into a score can come from transaction records, website interactions, customer-service conversations, social-media profiles and third-party brokers such as Acxiom LLC and Alliance Data Systems Corp.’s Epsilon, which sell information on such things as the number of bedrooms in a house and the type of credit card someone carries. Each piece of data is weighted based on past patterns and perceived level of predictability.

Marital status is often factored in, with some companies assuming that singles are better customers, and others, the opposite. Age also is a common input, potentially penalizing older people because of their shorter projected lifespans.

Some retailers deduct points from shoppers who exhibit costly behaviors, such as buying things only when they are deeply discounted.
Some retailers deduct points from shoppers who exhibit costly behaviors, such as buying things only when they are deeply discounted. Photo: Jeenah Moon/Bloomberg News
Some companies deduct points from shoppers who exhibit costly behaviors. Banks sometimes take into account the calls people make to customer-service agents or the number of times they visit branches. Online retailers track shoppers who buy things only when they are deeply discounted. People expected to cost more than they spend can have a negative score.

Computer systems sometimes tag customers as high-value or low-value. Marketing staffers or service agents gauge interactions based on the status. Vendors such as Zeta Global and Salesforce Inc. can automatically offer discounts and other incentives based on the scores.

Phone service

At wireless carriers such as Verizon Communications Inc. and Sprint Corp. , lifetime value can determine marketing offers and other perks. At some carriers, high-value customers who are at risk of switching to another carrier are prioritized and get routed to a top-rated call center.

Verizon and Sprint declined to provide specifics about how they assess customer value. “The predominant way we route calls is based on the reason for the call,” says a Sprint spokeswoman. She says customer lifetime value is “one of many ways we guide customer interactions.”

Zeta Global, whose clients include wireless carriers, generates scores using data points such as the number of times a customer has dialed a call center and whether that person has browsed a competitor’s website or searched certain keywords in the past few days. The firm says it has a database of more than 700 million people, with an average of over 2,500 pieces of data per person.

When a person’s “churn” score, which predicts his or her chances of switching to another carrier, exceeds a certain threshold, Zeta’s system flags that customer to a customer-service agent. The higher the customer’s lifetime value, the more likely that Zeta will recommend responding to the customer more quickly and offering free phones and other perks, says David Steinberg, Zeta’s chief executive. “Most of this comes down to how you’re marketed to and how you’re treated,” he says.

Apparel

Apparel retailers often compare a shopper’s lifetime value with the cost of marketing to that person before deciding whether to woo him or her and how much money to spend doing so.

“What CLV does is allows us to see beyond the day-to-day to ensure we’re focused on the quality of the new customers we’re acquiring, not just the quantity,” says Ed Boyle, senior director of performance marketing at Bonobos, an apparel retailer acquired by Walmart Inc.

Apparel retailers such as Bonobos use customer lifetime values to assess the quality of new customers.
Apparel retailers such as Bonobos use customer lifetime values to assess the quality of new customers. Photo: Victor J. Blue/Bloomberg News
In a research paper last year, ASOS, an online retailer, said it scores shoppers on over 100 data inputs, including a customer’s age and location. Since ASOS doesn’t recoup delivery costs for returned items, “customers can easily have negative lifetime value,” the paper said. The company declined to comment on the paper.

Brad Birnbaum, chief executive of customer-service platform Kustomer Inc., says some of his e-commerce clients use scores, including CLV, to respond to email inquiries. “If you’ve got an angry shopper with a high lifetime value, you might want to bump up the priority,” he says.

Shoppers with higher scores, however, won’t necessarily get the best deals all the time, says Jerry Jao, chief executive of Retention Science, which has worked for companies such as Target Corp. and Procter & Gamble Co. Retailers sometimes withhold discounts to high-value customers until they are at risk of losing them. “Why waste a 25% offer when the person is going to buy anyway?” Mr. Jao says.

Cars

At auto dealerships, a high score can mean access to loaner cars, preferential service slots and special events, says Scot Eisenfelder, chief executive of Affinitiv Inc., which uses lifetime value to create marketing campaigns for dealerships. The scoring helps dealerships weed out costly customers. “This is what you call grinders—people who visit 16 stores to get the absolute lowest price,” he explains.

Mr. Eisenfelder says his firm develops scores by crunching data on things such as previous car purchases, whether a household has a teenager, where else a person has shopped and ZIP Codes, which can be used as a proxy for income. Someone who has a Neiman Marcus credit card is going to be more valuable for a car dealership than someone with a credit card from a discount chain, he says.

At auto dealerships, a high score can mean access to loaner cars, preferential service slots and special events.
At auto dealerships, a high score can mean access to loaner cars, preferential service slots and special events. Photo: David Paul Morris/Bloomberg News
Air travel

At airlines, CLV scores incorporate frequent-flier information and other data. A high score can increase a person’s chances of getting seat upgrades or better service, says Laks Srinivasan, co-chief operating officer of Opera Solutions LLC, which works with airlines, retailers, banks and other companies.

The firm’s scores can draw from more than 5,000 data “signals” per customer, Mr. Srinivasan says, translating them into recommendations for flight attendants, gate agents and other personnel. The company tracks, for example, the number of times a person calls to complain over the prior 90 days, which can affect the CLV.

An airline can compare how often a shopper complains with his or her lifetime value and customer experience score, which measures inconveniences such as number of times in the middle seat, flight delays and lost bags.

“A high-value customer who had a real service disruption and never calls to complain should be compensated more quickly than someone who is complaining and costing time and money,” Mr. Srinivasan says.

Credit cards

To calculate lifetime value, credit-card companies analyze spending behavior, payment history and credit scores, among other things. “Banks know what you buy, and where and when you buy it,” says Arpan Dasgupta, head of financial services and telecom practices at Fractal Analytics, which helps companies analyze customer data. “It’s powerful data that can be useful for CLV.”

The score can determine which customers receive credit-card offers and other incentives. When customers call to cancel at a card company such as American Express Co. , their relationship with the issuer and past spending behavior are some of the criteria used to determine what perks will be offered to retain them.

------
“There is no fate that cannot be surmounted by scorn.” -Albert Camus

=======================================
Coolin...

------
“There is no fate that cannot be surmounted by scorn.” -Albert Camus

the level of service/benefits that are applied...

this is my line of work

but their phrasing it as though bad/broke customer (in their view) = bad service and that's not necessarily the case


example...in healthcare...I've seen one highly known insurance company prioritize the service of Congressional members(and family) over literally ANY and EVERYONE while their base customer is everyday government/private industry employees


basically if your state college's football coach, let's say...Urban Meyer who makes @ 5 mill a year vs. Idk....Orin Hatch's son... the latter gets the gold star treatment

=======================================
Coolin...

Like it’s really easy to write an equation that “fits” the assumptions

Age, income, zip code

But what do they use for control and if you rank the people highly that have a lot of money anyways but fall outside of that equation then it’s a shit equation.

I’m willing to bet dollars to donuts that the equations reinforce assymmetry rather than helo make quicker or better decisions AND that there are nearly universally zero plans to evaluate effectiveness of these programs internally.

------
“There is no fate that cannot be surmounted by scorn.” -Albert Camus

like there's a bazillion factors that go in but in the end

it's just like everything else... leadership normally 'sticks to their guns' when it comes time to make decisions despite the data...


it's slowly moving toward consumers having more of a voice (it's a growing industry) but it all boils down to leadership


in the example that I provided...that org operates almost like a government entity...they don't necessarily have the 'competition' in their marketplace so they can and do bully customers into whatever they decide....like the absolute bottom of their priority list is you and me...it's odd and I don't think most people are aware of how they get down but yeah...they would rather prioritize congressmen and place your everyday joe who literally contributes the most to their capital at the absolute bottom ....even over the medical providers that are calling to collect $ from em

competitive companies(telecom, retail, etc.) are more receptive to strategies based around customers

=======================================
Coolin...

what industry specifically do you work in?

currently -- with the state government
formally -- with the fed government


while with the former, worked in/with the technology and companies who come up with all the cool toys

=======================================
Coolin...

see what they offer if I cancel. I wonder how much my interest
rate is affected by these scores. 

2 things I find pretty interesting. one statement about all
customers don't deserve the companies best effort. that's
counter to pretty much all the stuff we're told about how
companies operate.

the other was tracking where you spend your money to get a
gauge of your income. just makes me curious how the math on
that. 

Y'all buy those labels, I was born supreme

"Get ready....for your blessing....."

Y'all buy those labels, I was born supreme

Sometimes I get the “Can we call you back” option

I want the lowest price possible using the easiest method possible.

Don’t have the time to worry about what these people do with my transaction history.

****************
TBH the fact that you're even a mod here fits squarely within Jag's narrative of OK-sanctioned aggression, bullying, and toxicity. *shrug*

Or when you’re trying to get your kids into school
Or when you apply for that next loan
Or when you want to move neighborhoods to get your kids into better public school
Or when you’re old and need to get into a home
Or when there’s only a few beds left in the hospital
Or when you need medical assistance on a plane but have been deemed unruly
Or when you get shot by the police and they’re trying to work out your life insurance policy for lifetime lost income in settlement?

------
“There is no fate that cannot be surmounted by scorn.” -Albert Camus

****************
TBH the fact that you're even a mod here fits squarely within Jag's narrative of OK-sanctioned aggression, bullying, and toxicity. *shrug*

Stop them?
It’s a leap.

------
“There is no fate that cannot be surmounted by scorn.” -Albert Camus

****************
TBH the fact that you're even a mod here fits squarely within Jag's narrative of OK-sanctioned aggression, bullying, and toxicity. *shrug*

But it first starts with a will of the people.

------
“There is no fate that cannot be surmounted by scorn.” -Albert Camus

The most direct things are duty to notify and simplified agreements
It’s why nearly EVERY site you access now asks you if you consent to cookies
Also actual fines and enforcement mechanisms
Which allowed them to seize a trove of Facebook paperwork last week.

https://www.zdnet.com/article/gdpr-an-executive-guide-to-what-you-need-to-know/

What does GDPR stand for?

General Data Protection Regulation.

How did it come about?

In January 2012, the European Commission set out plans for data protection reform across the European Union in order to make Europe 'fit for the digital age'. Almost four years later, agreement was reached on what that involved and how it will be enforced.

One of the key components of the reforms is the introduction of the General Data Protection Regulation (GDPR). This new EU framework applies to organisations in all member-states and has implications for businesses and individuals across Europe, and beyond.

"The digital future of Europe can only be built on trust. With solid common standards for data protection, people can be sure they are in control of their personal information," said Andrus Ansip, vice-president for the Digital Single Market, speaking when the reforms were agreed in December 2015.

What is GDPR?

WhatsApp, Facebook to face EU data protection taskforce
WhatsApp, Facebook to face EU data protection taskforce

WhatsApp and its parent company Facebook have been invited to meet a data protection taskforce after alleged non-compliance with European data laws.

Read More

At its core, GDPR is a new set of rules designed to give EU citizens more control over their personal data. It aims to simplify the regulatory environment for business so both citizens and businesses in the European Union can fully benefit from the digital economy.

The reforms are designed to reflect the world we're living in now, and brings laws and obligations - including those around personal data, privacy and consent - across Europe up to speed for the internet-connected age.

Fundamentally, almost every aspect of our lives revolves around data. From social media companies, to banks, retailers, and governments -- almost every service we use involves the collection and analysis of our personal data. Your name, address, credit card number and more all collected, analysed and, perhaps most importantly, stored by organisations.

What is GDPR compliance?

Data breaches inevitably happen. Information gets lost, stolen or otherwise released into the hands of people who were never intended to see it -- and those people often have malicious intent.

Under the terms of GDPR, not only will organisations have to ensure that personal data is gathered legally and under strict conditions, but those who collect and manage it will be obliged to protect it from misuse and exploitation, as well as to respect the rights of data owners - or face penalties for not doing so.

Who does GDPR apply to?

GDPR applies to any organisation operating within the EU, as well as any organisations outside of the EU which offer goods or services to customers or businesses in the EU. That ultimately means that almost every major corporation in the world will need to be ready when GDPR comes into effect, and must start working on their GDPR compliance strategy.

There are two different types of data-handlers the legislation applies to: 'processors' and 'controllers'. The definitions of each are laid out in Article 4 of the General Data Protection Regulation.

Also: GDPR compliant? Here's a handy five-step preparation checklist

A controller is "person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of processing of personal data", while the processor is "person, public authority, agency or other body which processes personal data on behalf of the controller". If you are currently subject to the UK's Data Protection Act, for example, it's likely you will have to look at GDPR compliance too.

"You will have significantly more legal liability if you are responsible for a breach. These obligations for processors are a new requirement under the GDPR," says the UK's Information Commissioners Office, the authority responsible for registering data controllers, taking action on data protection and handling concerns and mishandling data.

GDPR ultimately places legal obligations on a processor to maintain records of personal data and how it is processed, providing a much higher level of legal liability should the organisation be breached.

Controllers will also be forced to ensure that all contracts with processors are in compliance with GDPR.

istock-gdpr-concept-image.jpg
General Data Protection Regulation: What does it mean for you?

Image: iStock
What is personal data under the GDPR?

The types of data considered personal under the existing legislation include name, address, and photos. GDPR extends the definition of personal data so that something like an IP address can be personal data. It also includes sensitive personal data such as genetic data, and biometric data which could be processed to uniquely identify an individual.

When does GDPR come into force?

GDPR will apply across the European Union from 25 May 2018, and all member nations are expected to have transferred it into their own national law by 6 May 2018.

Following four years of preparation and debate, GDPR was approved by the European Parliament in April 2016 and the official texts and regulation of the directive were published in all of the official languages of the EU on May 2016.

gdpr-date-on-a-keyboard.jpg
GDPR comes into force on 25 May 2018.

Image: iStock
What's the GDPR compliance deadline?

As of 25 May 2018, all organisations are expected to be compliant with GDPR.

How does Brexit impact on GDPR?

The UK is set to leave the EU on 29 March 2019, a little over ten months after GDPR comes into force. The UK government has said this won't impact on GDPR being enforced in the country, and that GDPR will work for the benefit of the UK despite the country ceasing to be an EU member. So Brexit is unlikely to have any impact on an organisation's GDPR compliance requirements.

What does GDPR mean for businesses?

GDPR establishes one law across the continent and a single set of rules which apply to companies doing business within EU member states.. This means the reach of the legislation extends further than the borders of Europe itself, as international organisations based outside the region but with activity on 'European soil' will still need to comply.

It's hoped that by slim-lining data legislation with GDPR, it can bring benefits to businesses. The European Commission claims that by having a single supervisor authority for the entire EU, it will make it simpler and cheaper for businesses to operate within the region. Indeed, the Commission claims GDPR will save €2.3 billion per year across Europe

"By unifying Europe's rules on data protection, lawmakers are creating a business opportunity and encouraging innovation," the Commission says.

TechRepublic: EU General Data Protection Regulation (GDPR): A cheat sheet

What that means, they say, is regulation will guarantee data protection safeguards are built into products and services from the earliest stage of development, providing 'data protection by design' in new products and technologies.

Organisations will also be encouraged to adopt techniques like 'pseudonymization' in order to benefit from collecting and analysing personal data, while the privacy of their customers is protected at the same time. (Although some groups have argued that this already comes too late, given the number of connected devices in the world.)

What does GDPR mean for consumers/citizens?

Because of the sheer number of data breaches and hacks which have occurred over the years, the unfortunate reality for many is that some of their data -- be it an email address, password, social security number, or confidential health records -- has been exposed on the internet.

One of the major changes GDPR will bring is providing consumers with a right to know when their data has been hacked. Organisations will be required to notify the appropriate national bodies as soon as possible in order to ensure EU citizens can take appropriate measures to prevent their data from being abused.

Consumers are also promised easier access to their own personal data in terms of how it is processed, with organisations told that they need to detail how they use customer information in a clear and understandable way.

Some organisations have already moved to ensure this is the case, even if it is as basic as sending customers emails with information on how their data is used and providing them with an opt-out if they don't issue their consent to be a part of it. Many organisations, such as those in the retail and marketing sectors, have contacted customers to ask if they want to be a part of their database.

In these circumstances, the customer should have an easy way of opting out of their details being on a mailing list. Meanwhile, some other sectors have been warned that they have a lot more to do in order to ensure GDPR compliance - especially when consent is involved.

GDPR is also set to bring a clarified 'right to be forgotten' process, which provides additional rights and freedoms to people who no longer want their personal data processed to have it deleted, providing there's no grounds for retaining it.

Organisations will need to keep these consumer rights in mind once GDPR comes into force.

Is this privacy email really from an actual company? Could it be a scam?

Organisations of all sizes in all sectors are sending customers emails, asking them to opt-in in order to keep receiving messages and other marketing material. For the most part, if the customer does want to remain on the list, they just need to click the part of the email that tells the company they wish to remain in touch.

However, with so many organisations sending out emails on GDPR, criminals and scammers have taken it up as a prime opportunity to send out phishing emails in order to catch people unware - especially given how people might be receiving more emails from organisations than usual right now.

Researchers at Redscan uncovered one of these schemes, which sees criminals posing as Airbnb and claiming that the user won't be able to accept new bookings or send messages to prospective guests until a new privacy policy is accepted. The attackers specifically mention new EY privacy policy as the reason for the message being sent.

However, those behind this scheme are very much leveraging GDPR in order to steal information, because while the real Airbnb message doens't ask for any information, those who receive the fake message are asked for their personal information, including account credentials and payment card information.

It's unlikely to be the only attempt by criminals to piggyback on GDPR for their own gain.

What is a GDPR breach notification?

Once GDPR comes into force, it'll introduce a duty for all organisations to report certain types of data breaches which involve unauthorised access to or loss of personal data to the relevant supervisory authority. In some cases, organisations must also inform individuals affected by the breach.

Organisations will be obliged to report any breaches which are likely to result in a risk to the rights and freedoms of individuals and lead to discrimination, damage to reputation, financial loss, loss of confidentiality, or any other economic or social disadvantage.

istock-hacker-hoody.jpg
If customer data is breached by hackers, the organisation will be obliged to disclose this.

Image: iStock
In other words, if the name, address, data of birth, health records, bank details, or any private or personal data about customers is breached, the organisation is obliged to tell those affected as well as the relevant regulatory body so everything possible can be done to restrict the damage.

This will need to be done via a breach notification, which must be delivered directly to the victims. This information may not be communicated only in a press release, on social media, or on company website. It must be a one-to-one correspondence with those affected.

Under GDPR, when does an organisation need to make a notification about a breach?

The breach must be reported to the relevant supervisory body within 72 hours of the organisation first becoming aware of it. Meanwhile, if the breach is serious enough to mean customers or the public must be notified, GDPR legislation says customers must be made responsible without 'undue delay.'

What are the GDPR fines and penalties for non-compliance?

Failure to comply with GDPR can result in a fine ranging from 10 million euros to four per cent of the company's annual global turnover, a figure which for some could mean billions.

Fines will depend on the severity of the breach and on whether the company is deemed to have taken compliance and regulations around security in a serious enough manner.

The maximum fine of 20 million euros or four percent of worldwide turnover -- whichever is greater -- is for infringements of the rights of the data subjects, unauthorised international transfer of personal data, and failure to put procedures in place for or ignoring subject access requests for their data.

A lower fine of 10 million euros or two percent of worldwide turnover will be applied to companies which mishandle data in other ways. They include, but aren't limited to, failure to report a data breach, failure to build in privacy by design and ensure data protection is applied in the first stage of a project and be compliant by appointing a data protection officer -- should the organisation be one of those required to by GDPR.

What's in a GDPR-compliant breach notification?

TECH PRO RESEARCH

IT leader’s guide to the threat of fileless malware
Incident response policy
IT leader’s guide to cyberattack recovery
Auditing and logging policy
Cybersecurity in 2018: A roundup of predictions
In the event of a company losing data, be it as a result of a cyberattack, human error or anything else, the company will be obliged to deliver a breach notification.

This must include approximate data about the breach, including the categories of information and number of individuals compromised as a result of the incident and the categories and approximate numbers of personal data records concerned. The latter takes into account how there can be multiple sets of data relating to just a single individual.

Organisations will also need to provide a description of the potential consequences of the data breach, such as theft of money, or identity fraud, and a description of the measures which are being taken to deal with the data breach and to counter any negative impacts which might be faced by individuals.

The contact details of the data protection officer, or main point of contact dealing with the breach, will also need to be provided.

When do we need to appoint a Data Protection Officer?

Under the terms of GDPR, an organisation must appoint a Data Protection Officer (DPO) if it carries out large-scale processing of special categories of data, carries out large scale monitoring of individuals such as behaviour tracking or is a public authority.

In the case of public authorities, a single DPO can be appointed across a group of organisations.While it isn't mandatory for organisations outside of those above to appoint a DPO, all organisations will need to ensure they have the skills and staff necessary to be compliant with GDPR legislation.

Also: GDPR proves that tech giants can be tamed

There's no set criteria on who should be a DPO or what qualifications they should have, but according to the Information Commissioner's Office, they should have professional experience and data protection law proportionate to what the organisation carries out.

Failure to appoint a data protection officer, if required to so by GDPR, could count as non-compliance and result in a fine.

What does GDPR compliance look like?

GDPR might seem complex, but the truth of the matter is that for the most part, the legislation is consolidating principles which currently form part of the UK's Data Protection Act.

However, there are elements of GDPR such as breach notification and ensuring that someone is responsible for data protection which organisations need to address, or run the risk of a fine.

There's no 'one size fits all' approach to preparing for GDPR. Rather, each business will need to examine what exactly needs to be achieved to comply and who is the data controller who has taken responsibility for ensuring it happens.

"You are expected to put into place comprehensive but proportionate governance measures," says the UK's ICO. "Ultimately, these measures should minimise the risk of breaches and uphold the protection of personal data. Practically, this is likely to mean more policies and procedures for organisations, although many organisations will already have good governance measures in place."

TechRepublic: Will GDPR actually protect EU citizens? 61% of infosec pros say yes

That could be the responsibility of an individual in a small business, or even a whole department in a multinational corporation. Either way, budget, systems and personnel will all need to be considered to make it work.

Under the GDPR provisions that promote accountability and governance, companies need to implement appropriate technical and organisational measures. These could include data protection provisions (staff training, internal audits of processing activities, and reviews of HR policies), as well as keeping documentation on processing activities. Other tactics that organisations can look at include data minimisation and pseudonymisation, or allowing individuals to monitor processing, the ICO said.

In preparing for GDPR, bodies such as the ICO offer general guidance on what should be considered. All organisations will need to ensure they've carried out all the necessary impact assessments are and GDPR compliant come 25 May 2018 or risk falling foul of the new directives.

GDPR is here, so what now?

As of May 25th, GDPR has now come into force, with the days and weeks prior to it seeing a surge in companies sending emails to customers asking them to opt-in to new privacy and consent policies. Emails came so thick and fast in the last 24 hours, that many web users felt overwhelmed.

In the run up to the date, some organisations and platforms, including social media site scoring site Klout simply shut down operations - Klout didn't explicitly point to GDPR, but the date of May 25th probably isn't a coincidence. It isn't the only service to shut down operations or restrict access to European users.

European users who visited high profile US news websites such as The LA Times, The Chicago Times and The Baltimore Sun on the morning of May 25th found that they weren't able to access the websites, with the publishers pointing to GDPR as the reason.

"Unfortunately, our website is currently unavailable in most European countries. We are engaged on the issue and are commited to looking at options that support our full range of digital offerings in the EU market," said a statement on the Los Angles Times website.

Similar statements were posted across news publications operated by the Lee Enterprises and Tronc groups.

Denying users access to products - at least for the time being - is viewed by many as a price worth paying to avoid potential fines. Although some would ask the the question, what were they doing with user data and what consent did they have?

What has GDPR changed since it was introduced?

As of August, those issues with US publishers still haven't been resolved, with the likes of Tronc still displaying the same apology to users in Europe.

Publishers aren't the only organisations which are having to come to terms with the new reality as some of the largest technology companies including Facebook say they've started to feel the bite of GDPR. The social network has blamed GDPR for a decline of about a million monthly users during the second quarter of the year, as well as a dip in advertising revenue growth within Europe.

Organisations of all sizes have found themselves it to some extent, by users who didn't provide consent for their data to be used when offered the chance to opt in.

Analysts at Forrester say many companies have reported a decrease of between 25 percent and 40 percent of their addressable market for emails and other forms of contact.

As a result, many companies find themselves having to think about new methods of attracting consumers and generating revenue. Analyst Gartner has suggested that some companies may have to rethink their data center strategy as a result of legislation such as GDPR.

PREVIOUS AND RELATED COVERAGE
IT leader's guide to the threat of cyberwarfare

From security and mobiles to Windows and shadow IT.

Vendor Security Alliance tweaks auditing system to be GDPR compliant

The non-profit alliance has added GDPR compliance to its yearly vendor auditing system and announced it will be taking on new members for the first time.

How Europe's GDPR will affect Australian organisations

Failure to comply with the data protection regulations could result in a €20 million fine, and Australian organisations with links to Europe will not be exempt.

------
“There is no fate that cannot be surmounted by scorn.” -Albert Camus

------

12 play and 12 planets are enlighten for all the Aliens to Party and free those on the Sex Planet-maxxx

XBL: trkc21
Twitter: @tyrcasey

all customers need to have a baseline level of service. perks can be offered to their "ideal" customers based on the customers history with them.

getting social media data or third part data? no good.

<--- Big Baller World Order

Nm

------
“There is no fate that cannot be surmounted by scorn.” -Albert Camus

https://www.nytimes.com/2019/11/04/business/secret-consumer-score-access.html

As consumers, we all have “secret scores”: hidden ratings that determine how long each of us waits on hold when calling a business, whether we can return items at a store, and what type of service we receive. A low score sends you to the back of the queue; high scores get you elite treatment.

Every so often, journalists lament these systems’ inaccessibility. They’re “largely invisible to the public,” The New York Times wrote in 2012. “Most people have no inkling they even exist,” The Wall Street Journal said in 2018. Most recently, in April, The Journal’s Christopher Mims looked at a company called Sift, whose proprietary scoring system tracks 16,000 factors for companies like Airbnb and OkCupid. “Sift judges whether or not you can be trusted,” he wrote, “yet there’s no file with your name that it can produce upon request.”

As of this summer, though, Sift does have a file on you, which it can produce upon request. I got mine, and I found it shocking: More than 400 pages long, it contained all the messages I’d ever sent to hosts on Airbnb; years of Yelp delivery orders; a log of every time I’d opened the Coinbase app on my iPhone. Many entries included detailed information about the device I used to do these things, including my IP address at the time.

Sift knew, for example, that I’d used my iPhone to order chicken tikka masala, vegetable samosas and garlic naan on a Saturday night in April three years ago. It knew I used my Apple laptop to sign into Coinbase in January 2017 to change my password. Sift knew about a nightmare Thanksgiving I had in California’s wine country, as captured in my messages to the Airbnb host of a rental called “Cloud 9.”

“The heater in the room with the big couch has been running since we got here and we’re not sure how to turn it off,” I wrote on Wednesday afternoon.

“The air in the main house is really musty, like maybe there’s a mildew or mold issue,” I wrote on Thursday, then added apologetically, “Sorry to be bothering you on Thanksgiving!”

“The bathroom flooded during the rainstorm. The carpet outside the bathroom is very wet,” I wrote on Friday. “Ants are coming in from the interior wall of the house.”

This may sound somewhat comical, but the companies gathering and paying for this data find it extremely valuable for rooting out fraud and increasing the revenue they can collect from big spenders. Sift has this data because the company has been hired by Airbnb, Yelp, and Coinbase to identify stolen credit cards and help spot identity thieves and abusive behavior. Still, the fact that obscure companies are accumulating information about years of our online and offline behavior is unsettling, and at a minimum it creates the potential for abuse or discrimination — particularly when those companies decide we don’t stack up.
How to get your data

There are many companies in the business of scoring consumers. The challenge is to identify them. Once you do, the instructions on getting your data will probably be buried in their privacy policies. Ctrl-F “request” is a good way to find it. Most of these companies will also require you to send a photo of your driver’s license to verify your identity. Here are five that say they’ll share the data they have on you.

Sift, which determines consumer trustworthiness, asks you to email privacy@sift.com. (An earlier version of this article contained a link to an online form; the company disabled the page after receiving thousands of submissions.)

Zeta Global, which identifies people with a lot of money to spend, lets you request your data via an online form.

Retail Equation, which helps companies such as Best Buy and Sephora decide whether to accept or reject a product return, will send you a report if you email returnactivityreport@theretailequation.com.

Riskified, which develops fraud scores, will tell you what data it has gathered on your possible crookedness if you contact privacy@riskified.com.

Kustomer, a database company that provides what it calls “unprecedented insight into a customer’s past experiences and current sentiment,” tells people to email privacy@kustomer.com.

Just because the companies say they’ll provide your data doesn’t mean they actually will.

Kustomer, for example, gave me the runaround. When I first contacted the company from my personal email address, a representative wrote back that I would have the report by the end of the week. After a couple of weeks passed, I emailed again and was told the company was “instituting a new process” and had “hit a few snags.” I never got the report. When I contacted a company spokeswoman, I was told that I would need to get my data instead from the companies that used Kustomer to analyze me.
Thanks, California

Most of the companies only recently started honoring these requests in response to the California Consumer Privacy Act. Set to go into effect in 2020, the law will grant Californians the right to see what data a company holds on them. It follows a 2018 European privacy law, called General Data Protection Regulation, that lets Europeans gain access to and delete their online data. Some companies have decided to honor the laws’ transparency requirements even for those of us who are not lucky enough to live in Europe or the Golden State.

“We expect these are the first of many laws,” said Jason Tan, the chief executive of Sift. The company, founded in 2011, started making files available to “all end users” this June, even where not legally required to do so — such as in New York, where I live. “We’re trying to be more privacy conscious. We want to be good citizens and stewards of the internet. That includes transparency.”

I was inspired to chase down my data files by a June report from the Consumer Education Foundation, which wants the Federal Trade Commission to investigate secret surveillance scores “generated by a shadowy group of privacy-busting firms that operate in the dark recesses of the American marketplace.” The report named 11 firms that rate shoppers, potential renters and prospective employees. I pursued data from the firms most likely to have information on me.

One of the co-authors of the report was Laura Antonini, the policy director at the Consumer Education Foundation. At my suggestion, she sought out her own data. She got a voluminous report from Sift, and like me, had several companies come up empty-handed despite their claims to have information on hundreds of millions of people. Retail Equation, the company that helps decide whether customers should be allowed to make a return, had nothing on me and one entry for Ms. Antonini: a return of three items worth $78 to Victoria’s Secret in 2009.

“I don’t really care that these data analytics companies know I made a return to Victoria’s Secret in 2009, or that I had chicken kebabs delivered to my apartment, but how is this information being used against me when you generate scores for your clients?” Ms. Antonini said. “That is what consumers deserve to know. The lack of the information I received back is the most alarming part of this.”

In other words, most of these companies are just showing you the data they used to make decisions about you, not how they analyzed that data or what their decision was.
‘It’s incredible what machines can do when they can look under every stone’

My Sift file didn’t come with a credit-score-type number at the top, but many of the entries included a percentage rating as to whether the behavior was “abuse” or “not abuse,” “normal” or “fraud” or “account takeover” versus “not account takeover.”

When I told Mr. Tan that I was alarmed to see my Airbnb messages and Yelp orders in the hands of a company I’d never heard of before, he responded by saying that Sift doesn’t sell or share any of the data it has with third parties.

“We are in the business of predicting risks for particular events at particular times, for particular fraud,” he said. Sift is looking at all my online activity to make sure it’s me, and not someone trying to impersonate or hack me.

“Behind the scenes, we’re trying to create connections between fraudulent accounts,” Mr. Tan said. To score risk, the more data Sift has, the better. It’s able to use what it knows across the accounts of all its clients, so if a certain device has been used to make an order on Yelp with a stolen credit card, Sift can flag that device when it shows up on Airbnb.

“We’re not looking at the data. It’s just machines and algorithms doing this work,” said Mr. Tan. “But it’s incredible what machines can do when they can look under every stone.”

I asked Mr. Tan how many people had requested their data from Sift since the company introduced the option to get it.

“Honestly, we haven’t seen much of a response,” he said.

A spokeswoman from Zeta Global, which created a portal for data requests in August, told me that 10 people have requested their data so far. “There was only data on two people,” she said. (I was one of them; the company had a record of all the comments I had made on a blog a decade ago.)

This may be because most people have no idea Sift, Zeta and the other secret scorers exist. But now you do, and you know how you can get your files.

If you submit a request to any of these companies and get back something weird, please share your experience with me at kashmir.hill@nytimes.com.

------
“There is no fate that cannot be surmounted by scorn.” -Albert Camus

_______________________________________

------
“There is no fate that cannot be surmounted by scorn.” -Albert Camus

You could easily find out by requesting your data, waiting a bit, then requesting it again.

---
Love,
Nopayne

Basically the data is there to prevent credit card fraud for a couple of apps. So it logged a lot of GPS info.

------
“There is no fate that cannot be surmounted by scorn.” -Albert Camus