I recently collaborated on a playlist with my co-workers and found that pop songs had more to teach me about privacy, consent, and empowerment than I expected.
Like all "legends," the General Data Protection Regulation (GDPR) team playlist comes from humble origins. It was the product of a need to escape the noise of a nearby Journey-soundtracked office ping-pong game and a desire to make my work more entertaining. I gathered songs that felt relevant to the GDPR-friendly tools we were building, including tongue-in-cheek hits like “Somebody’s Watching Me,” “‘C’ is for Cookie,” and “The Final Countdown,” along with my favorite deeper cuts on the topic of privacy.
Seeking more ways to be inclusive, I sent the playlist to our team via Slack and was pleasantly surprised at its popularity. I would have been satisfied with a few :joy: emoji reactions, but the reception was unexpectedly grand: the playlist suddenly grew from 13 tracks to 41, and I even got a shout-out on Twitter! Sharing this playlist enabled our project team of engineers, account managers, and legal specialists to connect from different locations—adding songs from London, Nashville, Los Angeles, and Sacramento—while we chipped away at our work.
Needless to say, my ego grew 3 sizes that day.
As a career software engineer, I want to make sure that I’m improving the experience of the people who touch the software I create—or at least making that experience less of a hassle. Working at NationBuilder for the past couple of years has ingrained in me the belief that we all have the ability to impact the world. From witnessing a customer, Mike Connolly, raise $47K and win his election, to hearing how the charts I worked to implement helped customers take action by highlighting which supporters’ memberships were about to expire—understanding how our software positively impacts people’s experience moves me to do my best work. At first, making our system compliant with new privacy regulations just seemed like a thing the business needed to do, a matter of checking boxes to appease an authority I didn’t fully understand.
While sifting through songs, I kept coming back to Meghan Trainor’s “NO,” a track that expresses the work of gaining consent in such an explicit manner that it’s almost comical. It’s a single that I remember wafting frequently from my 17-year-old cousin’s too-loud earbuds as she tuned out our adult dinner-table quibbles. With its catchy dance beat, snappy chorus and memorable melody, “NO” is the kind of glittery pop that might be dismissed for being only relatable for “adolescent girls.” But it’s not.
Watching a preteen grow to a young adult is truly bizarre. My 17-year-old cousin still seems seven to me. (Unsplash)
One of the main tenets of GDPR is digital data consent—a timely concept, with data-related scandals dominating the news. Stories from the past year have also highlighted what consent looks like in the context of interpersonal conduct, whether at work, with a significant other, or just out in the world. GDPR goes further to protect the right to be forgotten in the EU, establishing that once an EU resident revokes consent for a company to use or process their data, that data must be erased.
In Trainor’s hit, it’s easy to identify her clear denial to a request for personally identifying data (she repeats it four times or so): My name is no, my sign is no, my number is no / You need to let it go. It tells the story of someone exercising their agency over their personal data and personal space, even when their right to protect both are not respected by a persistent suitor.
As a female-presenting, internet-connected human of the world, I’ve had many experiences where the right to my own personal space has not been respected, and I know I’m not alone. I often think about my cousin, now a junior in high school, and the decade that separates us. There were no denial of consent anthems like this when I was growing up—how nice it must feel to be supported by a more accepting culture, in a moment of greater accessibility. My “Independent Women” were defined by their financial success and self-reliance. (Throw your hands up at me.) Meghan Trainor reminds a younger generation of their power to deny and not give consent, regardless of their prosperity or social status.
Of course, a song (or tracklist) demanding respect will not move everyone to embrace the idea of affirmative consent. Nor will all of the fines in the world motivate every business to act scrupulously with our personal data. But, in big and small ways, both help to push societal expectations around personal data and ownership forward. That’s where my work comes in. Through designing and programming the functionality that asks if you give your consent for your anonymized data to be sent to third-party analytics engines, I, too, can help advance awareness about the use of personal data and help anyone with internet access experience what it means to expect affirmative consent.
Better get that consent. (Unsplash)
The GDPR states that a lack of positive consent to contact EU residents via email is a denial of consent—period. If, by May 25th, companies and organizations haven’t explicitly gotten that consent to keep emailing people in the EU, they could incur a fine of up to 20 million Euros or 4% of global turnover for the year, just for trying. Already, companies are receiving backlash for sending out re-permissioning emails to customers who have previously revoked email consent by unsubscribing from mailing lists.
When I think of GDPR as the consent-denial anthem of the internet, giving people the tools to say “no” to any communications they’re not explicitly interested in, preparing for it feels more like something exhilarating. The internet brings us, the world and all that is contained within it, closer together. In such close quarters, we cannot be blind to the experiences of others—no longer hidden by the brick and steel obstructions of the physical world. GDPR is a step towards ensuring our own safety in this crowded, digital metropolis, and showing better consideration for the people we hope to serve.
