Hello and welcome back to the Once Upon a Trip podcast.
I am back with Marco.
Yay.
And today we're going to be diving into a topic
that I especially have been very interested
in talking about.
And that topic is online privacy and data protection,
culture shocks when it comes to Europe and the US.
I thought of this idea when I noticed
that there are some European content creators who hide
their face on social media, even if they're well known.
Also, there is a German rapper called Crow
that I am aware of.
He hides his face with a panda mask.
Of all people you mentioned, you mentioned this dude?
OK.
Yes, I had to.
So you get the point.
I have just become very curious about why Europeans appear
to be more private when it comes to showing their face
on social media and on the internet.
And I know that there's a counter to this,
which we'll get into.
If you happen to meet someone from another country
and you want to post something with their face
on social media, then there are really big precautions,
so to speak, that you need to be aware of.
And I think all of the things that we'll be diving into today
will be very helpful in being aware of when
it comes to social media presence and a number
of other little things.
So are you excited, Marco, to be diving into this?
I can barely sit down.
I see that excitement in your face.
And I can just feel it, right?
Just feel it.
I don't hide my emotions.
No, just kidding.
Yes, I'm very excited.
I am too.
We hope you enjoy the episode and that you take a little bit
of some nuggets away.
And before we get started, I do want to say and remind you
to please follow and subscribe to the podcast
if you really do love the new episodes.
We do appreciate the support and it really means a lot to us.
So here we go.
Let's start this off by having a little bit of an overview
on the European perspective and specifically in this case,
the German perspective of online privacy and data protection
and how Europeans feel about their personal data
and privacy online.
So Marco, what can you say about the European perspective
of hiding your face on social media
and these types of things?
Well, it's not just showing your face
or it's not just online in general,
the way we deal with our personal data,
so both information and also pictures,
is a little bit more cautious and more circumspect,
more on a need to know basis, you know, the whole history,
the way things are just set up.
I think it's just a cultural thing.
They tend to be more suspicious of anyone and anything
the time after on the Eastern side was much better.
With the Soviet Union.
Yeah, that may have been even,
at least on the Eastern side of Germany,
may have been even worse
because that was a total surveillance kind of setup
with, you know, the magnitude of which was almost unfathomable
because they basically had like a, yeah,
basically like a spy in every, you know, on every block,
in every like apartment building, basically.
So yeah, maybe that's where it comes from,
but still I would even think in the West of Germany,
people don't think much differently.
It's just a different mindset.
And in America, people don't think twice about it,
or at least most people,
and just accept, you know, that it's the way it is
and that's how the free market works here and yeah.
It is a little bit sad how commercial interests
are prioritized over personal protection.
Yeah, definitely.
In that case, that's really sad.
That is a fair observation, yes.
So like we were saying earlier, there is a counter to this,
and it's kind of sad and embarrassing to be honest,
because I think a lot of Americans don't think twice.
They think and like to believe that companies
use their consumer data in their best interest,
or they also believe that,
oh, well, if I can get something for free,
if I get a discount on this product,
if I can get access to this website for a lower price,
if that means selling my data,
essentially to big corporations and companies,
then sadly, there are so many people
who are willing to make that sacrifice and do that.
I think we also just have more of a hands-off approach
when it comes to our trustworthiness
and in terms of our comfort in sharing our data
on social media.
I mean, and also you live in a system here
where even when you are cautious
and even when you don't agree with those practices,
you can't really escape from it.
I always knew that America was much more lax
when it comes to data protection,
but it really hit me when I moved here.
Within two months, I had arrived to the US.
Prior to that, as far as the US was concerned,
I didn't exist, right?
And I was a new guy here, started out,
and within two months, my mailbox was packed.
Every week, I got ads upon ads upon ads,
not just general ads, personal ads.
With my name, my address,
and even in the ad, in the letters, it says,
hey, Marco, blah, blah, blah, blah.
And I just thought to myself, who the heck are you?
I mean, it's not, you know, in Europe,
they also, as best as they can, they try to sell your data,
but here, you have to really make an effort
and jump through hoops to keep somebody from doing that.
On an app, you have to go into menus and whatever,
and find the setting that specifically says,
don't allow the owner of the app or this company,
blah, blah, blah, to sell to third party.
By default, they just do, and it's just what it is here.
Based on research, there is this one general regulation
that covers all EU countries, not every country in Europe,
but all 27 EU countries,
not so much Eastern non-EU countries.
This is a federal law in the EU
that is something known as the GDPR,
the General Data Protection Regulation.
This is a federal law very stringent
on data protection and consumer protection.
If companies violate this law,
they can be fined up to 20 million euros,
or 4% of the company's annual global turnover rate.
Bargain.
Yeah, right?
The problem with that law is the kind of the enforceability,
because the companies that tend to violate that
are companies that are not headquartered in Europe anyway.
For example, Amazon has violated that.
Apple, Microsoft, all the companies that are,
especially the ones that are headquartered in the United States,
with jurisdiction and enforceability,
it's not as easy to really enforce that.
One of the most astounding facts of this entire situation
that I at least found is how much more heavily
you are fined in Europe for violating data protection laws.
So here in the US, and we are not experts,
so this is just going off of research,
from what we have found in the US,
if you violate a privacy law,
and usually these are very industry-specific,
sector-specific, and they vary state by state,
if you violate one of these usually,
the penalty is much lower.
So for example, the range of the fine
can be anywhere from 140 US dollars
to a little bit over 2.1 million dollars.
Whereas in Europe, you can be fined up to 20 million euros.
Like talk about a massive, massive difference.
Well, if a European company would violate that,
yeah, there's no chance.
But any offshore company, that makes it a little bit harder.
The reason the US doesn't have a law like this
is because of political interests
tending to cause gridlock in Congress,
and different interests clashing gets nothing passed.
So it's really almost impossible to make one big law,
data protection law, that is a one-size-fits-all,
that applies to all 50 states.
So that's kind of the problem that we have.
I don't like how there isn't one law
that covers all sectors and all interests,
but that's just how it is.
Only 20 out of 50 US states are covered
by some sort of comprehensive data protection law,
which is not even half.
So it is crazy.
Yeah, the thing with America in general
is that the United States is a federal republic,
like Germany is too.
But the difference is the 50 states here have so much more.
Power.
Individually.
Individually, and can regulate so many more things
than Germany could do.
The European Union is set up in a way
where they say European law will always supersede national law.
But there are many issues, not just on data protection,
where some countries are starting to push back and say,
no, this is none of your business.
This is a domestic policy concern.
It's not Brussels' place to mandate us what to do.
But that's a whole different discussion.
Let's talk more about social media.
From my personal experience as an American
and my own interaction with Europeans,
both from my travels and just on friendships,
I have noticed that many Europeans will tell me,
you should ask other Europeans for permission
before you post their face on anything on social media.
One time I was in Budapest
and I met this girl from the Netherlands.
And at the time I didn't think twice about it,
I was taking some pictures with her
and I noticed that every time I took a picture with her in it,
she would either turn her face
or she would literally cover it like this.
And I didn't think about why at the time, but yeah.
There are people that are more protective than others,
but yeah, generally the mindset is definitely different.
And many people also, which I understand,
I think I would do that too,
especially people that have small children,
sometimes on pictures they cover up the face of the children
or any other maybe person that they didn't ask
or they know, hey, you know, they're a little bit cautious.
I do understand why people will blur out baby faces
and children's faces.
That I do understand because that's also a tactic
to protect children from getting kidnapped
or subject to human trafficking.
I do understand that, but if you are an adult
and you are willingly an influencer
or you're a content creator, I just really, I don't know,
I guess I just wonder why would you not show your face
or why would you cover up your name?
I would say this way,
where Americans tend to care too little,
Europeans tend to be almost paranoid about it.
Give some examples of that.
Well, the thing is there are people,
like the people that make it a point to cover their faces
and do this and that and don't share anything
and delete their browser history or use VPN all the time
that are making it a point that,
hey, I don't wanna share any information.
I mean, they are enslaving themselves to that notion
that, hey, there are vultures out there
that wanna hurt me and that wanna take my information.
So there are people that, especially in Europe,
that are very, almost paranoid, I would say.
Where I'm like, okay, you know,
if you really wanted to live that life,
you would have to live off the grid in the woods somewhere.
That's not the world we live in.
But yes, that is the thing
where people are just crazy about it.
Like, no, no, no, no, no, no, no, I cannot share this.
Somebody is watching me, I cannot have that.
And Facebook is a good example
because especially in the heyday of Facebook,
so around 2011, 2012, maybe,
depending on how elaborate somebody had created their profile
as far as information posted,
I think Mark Zuckerberg collected $500 per profile
in selling data, which at the time,
I don't know how many millions of accounts there were.
So crazy. I was not aware of that.
And I was very surprised when they first introduced that.
I don't know what they called it.
They changed, at some point, they changed the profile
where basically it was kind of a timeline
where you could also in hindsight post something and say,
you know, this happened in 2006, I don't know, graduation
or I got married.
Work experience.
Whatever.
And you could basically publicly
create a timeline of your life.
When they introduced this, I was thinking at the time,
like who would ever use it but come to find out Americans,
including older generation,
they would share their entire lives.
Pictures, pictures, pictures, pictures from decades,
their entire life documented.
And to me, that was crazy. Absolutely crazy.
Now people don't think twice about sharing
very personal experience.
And it's not just travel.
I mean, it's not just like the Instagram posts,
but your not just date of birth, anniversary, wedding,
the birth of their children,
anything you could possibly think of.
Chronologically in order and just,
I mean, it's cool for yourself,
but I wouldn't use a public platform like Facebook
to do that.
Well, then where else would you store that information?
You don't need a public platform for that.
Either you...
But it's convenient.
Yeah, and that's, you know, the American is talking.
Okay.
It's convenient.
No, I'm speaking in the perspective of many,
not just Americans, we can also include Canada
in this North America.
Okay, but yeah, because it's convenient.
Yeah, so what it's convenient.
It's still not worth just disclosing
this kind of information so easily,
because there will be people out there
that take advantage of it,
either marketers or even people that, you know,
even criminals.
In the school exchange that I participated in,
that was in 2011.
And I remember, you know, coming here,
it was a matter of days, one, two, three days in maybe,
I'm coming home to my host family
and I'm turning on the computer
and looking at Facebook.
And I was shocked at the time because,
so in 2011, I was 16 years old.
And so were you.
But...
Yeah, so was I.
So in Germany, that was really at that time,
a platform for young people, usually.
And here, there were so many parents of other students
were on Facebook and not only on Facebook,
but very, very, very active on Facebook.
So I came here, we met, we, maybe we went somewhere,
somewhere downtown Atlanta, some day trip, whatever.
And I come home and on the same day,
I have dozens of friend requests
from not just the other students, but also their parents.
They posted all the photos that they took on that day,
not only posted, but also tagged everybody.
While I was thinking at the time, for one thing, why,
and how do they have the time to even do that?
So that was a bit of a culture shock now,
but that was kind of the heyday of Facebook.
I think it's maybe not as bad anymore.
But that to me was, that was crazy.
Like the parents, I would have understood
if the people our age would have done that,
but the parents, like the mom of somebody, crazy.
And so German and European parents back in 2011
were not like that with Facebook?
At least the people that I knew,
Facebook was not a thing really to them.
Facebook conquered that cohort later.
What pieces of advice would you give to Americans
or to other people visiting Europe or people
who are interacting with Europeans?
What are some things that we should know
before we post any pictures with Europeans?
So you don't have to beat around the bush.
You can just say, hey, you know, I would like,
would you mind my posting this picture or video or whatever?
Or would you mind if I linked you and whatever?
So it's just a very straight up question.
Don't just do it.
You know, some people go with the flow and don't care.
Those people exist too.
But you never know.
I mean, do you find that your friends
and other people you know in Germany,
do you think that most of them are skeptical
of data protection laws and sharing stuff on social media?
I will say, I think in Germany,
it's much, at least the people I know,
I think it's a generational thing.
The older the people,
the more suspicious and protective they are.
Younger people, especially people
that are even younger than us,
they don't know any better because like young people
these days are basically being raised by their phones,
sadly enough.
I think Germany and Europe from time to time
will adopt more and more the American way,
especially now with this whole social media
and influencer kind of trend.
Sharing things is a source of income for many people.
So I think it's, we're getting closer and closer
to kind of the American way of things, I think.
That's my observation and prediction.
Even here, older people are totally different about it.
They just, they share and it's okay to them.
People will tend to be more protective of their data.
But maybe we can touch on applying for a job
because that's where it becomes almost ironic.
Americans, when they apply for a job,
all of a sudden become very protective
of their personal data.
Whereas Europeans, I feel, do not as much.
Yeah, in America, when you apply for a job,
the resume that you hand in is very, very focused
on your work experience, of course.
But there isn't much to it other than the name
and maybe phone number and address.
Whereas in Germany, where we apply with a CV,
in a traditional application,
basically the head of that CV has your name,
usually a photograph of yourself,
a professionally taken photograph.
There are photographers.
It's like part of their business
to take job application pictures.
That is the biggest no-no in an American resume.
No.
And then it doesn't stop there.
Then date of birth, place of birth,
marital status, including how many children you have,
and citizenship.
So, and then Americans are like,
oh my God, that is so, that is so not okay.
You cannot do that.
Yeah, but you post every bit of that all day long
on social media, but applying for a job,
oh my God, no, a potential employer must not know that.
The reason why you should absolutely not include
a picture of yourself when applying for a job
is because it can be used in a discriminatory way
when employers are selecting a candidate for a position.
They can look at you and if you are very attractive,
you can have an unfair advantage.
That is why we don't do that.
The picture thing in Germany, it has become less,
it's still a thing, but also for that very reason,
yeah, some people are not doing it anymore,
and it's also accepted not to do it anymore,
but traditionally, yes.
But to your point, if you have your entire life
on social media, also not just the Facebooks
and Instagrams of the world, but also LinkedIn, for example,
the employer will Google your name anyway.
But that takes more effort on the employer's part.
It depends, okay.
So they might not wanna do that.
It depends also on your name.
If you have a very distinct name, then that's easy.
If your name is John Smith, which is not a name,
but more like a category, then yes,
it's gonna be hard to find.
But anybody who has somewhat of a distinct name
will have that information public anyway.
So you may as well just put it on your resume as well.
That's my German mind.
I was very surprised when I first saw kind of a sample
of an American resume.
I looked at it and I was like, I thought, oh, so that's it?
The employer will not even know how old you are.
You can infer based on looking, okay,
when somebody graduated from college or whatever,
but it never specifically says date of birth.
So basically somebody could apply
with being 20 years old or 40 years old,
in a weird case.
One thing I remember you had mentioned to me earlier
is how in Germany, if you take,
or I guess if reporters take videos of cars or of anything,
the license plates are covered.
Again, a little bit ironic.
So let's say you have a dash cam in your car.
If you were to publish that dash cam footage in Germany,
you will always have to blur out any faces
and any license plate numbers.
So is that officially a law?
Yeah, that is definitely a law.
Anybody who publishes dash cam footage
will have to blur out all of that.
So what happens if they don't?
Well, you could get fined,
or if you post something somewhere,
people could say, this has to be taken down.
And for example, a platform like YouTube would have
to take it down, especially if it's posted
by a German account,
because then they have jurisdiction, I think.
The whole thing, there's so many loopholes,
because if I did that from an American account,
that law wouldn't necessarily apply.
But anyway, journalists on the other hand,
if you go out and film a documentary
and it's a certain public space,
then all of a sudden it's okay, and it doesn't make sense.
It doesn't make sense.
I mean, maybe lawyers could speak to that better,
but it is kind of weird.
A journalist has more rights in that regard.
I don't know how else to describe it,
because also with a license plate,
I get the face thing, but a license plate number,
at least in Germany, unless you work for the government,
you will not be able to actually find out
whose car that is.
And it's public on the car.
That's what the license plate is for.
So it's odd.
So what you were saying about the GDPR, this law,
being kind of convoluted
and being in a different jurisdiction and it not applying.
The thing is, from what I read from the law,
this law must apply to any website
where a European is using it.
So even if it's outside of Europe,
it's supposed to apply to that case.
Yes. How do you enforce that?
I very much question the feasibility of that,
because the internet just works in a way
where the internet doesn't know country borders really.
I mean, yes, there are IP addresses
and there is a certain way of tracking things,
but at the end of the day, especially a big tech company
that has state of the art knowledge
will always be ahead of the law.
And AI will be the biggest challenge of our time,
especially for anybody in this kind of field,
in this kind of data protection field.
It will not be feasible to enforce certain laws,
not even in Europe with European companies,
but much less with American or Chinese companies.
Yeah, I mean, the only huge concern would be identity theft,
but that's more so with credit cards
and financial and medical health data,
which under our law called HIPAA,
medical and health information are protected.
And yeah, people are very skeptical
in terms of sharing financial information.
That is a good point.
That's different.
That is, yeah, but still that is a good point,
because I tend to mock this country's kind of banking system.
When it comes to banking here,
there's always like a middleman,
like there's PayPal and Cell and all those service providers.
For some reason, banking is very cumbersome here
because of people being afraid of data breaches and stuff.
With credit cards, like credit card numbers online
and storing that information,
I would argue that most Americans and myself included,
I do not store my credit card information anywhere.
Like that, no.
Because credit, the whole credit card concept here is insane.
On the one hand, Americans don't wanna share
any bank account information,
but then you can go with your credit card
and no matter the amount of money
that you will have a transaction in,
you don't even need a PIN.
I can give you my credit card
and whatever the money that my credit card is good for,
you can just go shopping with it
and nobody will even think about it.
Well, no, now there are fraud alerts
and companies that pay attention to that.
On a general note, yeah, but still,
the chance of somebody abusing your credit card
and stealing money from you
is so much greater here than it is in Germany
because in Germany, you go
and you always have to punch in your PIN.
So are PINs required for credit cards?
Yes. Yes.
Okay. Yes.
In fact, recently I just went to Germany
and I have a, not only personal credit cards,
but also company credit card
and at the hotel and also gas station and stuff.
More than one time, the cashier behind the counter
was like, wait a second, what just happened?
He put in the card and it was like,
I don't know, 80 euros or something.
And nothing.
I said, yeah, okay, transaction approved.
And then a receipt.
Yeah, and receipt comes out.
And more than one time, the guys were like,
wait a second, that can't be.
There was no PIN, there was no nothing,
not even a signature required.
And I said, yeah, this is an American credit card.
And what was that person's response?
And they were like, what are you, it's like, yeah.
So it's, oh my God, that's crazy.
That has happened to me more than one time.
That actually is a good point
because I've completely forgotten about that aspect
of financial security.
It's just interesting that the priorities
that both sides of the pond have.
You would think, okay, so Europe is all about it
and America is like, hmm.
About finance, like a credit card?
Not a protection general.
It's not just information, but also financial information.
If so, if you come here and you get a credit card
or get an American bank account, yeah,
watch your credit card.
Here, if I lost my credit card
and I wouldn't notice it for some reason,
somebody could cause a lot of damage.
Whereas in Germany, yes, they can find the credit card,
but without a pin, there's only so much you can do.
Even now, online shopping,
most German credit cards, when you go online shopping,
you go, like, let's say you order something off of Amazon
or something or some other online store,
at least for the first time to activate the card.
I think sometimes it goes directly to a setup
where you have to, I think you have to put in
your online banking password or your something.
It's not just like, okay, credit card
and you're good to go.
Oftentimes they make it a point that
even the transaction online,
there's like a barrier in between to double check.
And here it's just like, oh, $100 here, oh, here you go.
No, that's not true.
Yes, it is.
The thing is even,
because I've had this happen to me before.
So if your credit card number gets compromised
and charges have already been charged,
then your credit card company will basically
undo those charges once you report, okay, this person,
like this, that I didn't, one of these things.
They have a very elaborate surveillance in place, yes.
But they wouldn't need it to that extent
if the credit card would have other safety measures,
i.e. a pin in place.
Yeah, but if it's online on an account.
Still though, I know a story of somebody
where data protection works, I give you that,
where people surveil it and that's even years ago.
So I know a story of a guy who was in New York City
during 9-11 and the guy, he was from here, from Georgia.
And the guy couldn't fly back because there were no planes
and he took a rental car and he drove down towards Georgia
and like three states in, at some, gassing up the car,
the card was declined and he called the credit card
and then they said, yeah, your card must've been stolen.
Number was compromised.
Your card was used in so and so many states
in that amount of time, that's not possible.
And then he said, yeah, no, actually I'm driving
and I'm really making strides here to go back home.
And then, oh, okay.
So then they, somebody was like, hey, wait a second.
So I don't know, New York and I don't know, Pennsylvania
and many states and they said, hey, something is off here.
Yeah, so we're not completely-
Yes, but-
Like careless about it.
But again, you need, you have to have a system
that is much more elaborate than it needs to be
if there were other measures in place, but okay.
What about for medical information and health information?
So like I had said earlier,
so health information is very well protected here,
medical information that you don't want companies
to know about necessarily.
What about in Germany and about in Europe?
Yes, very, very protected.
So, I mean, and I think we've talked about it before.
So once, when you call in sick
and your doctor issues you that note,
the copy that the employer get will not even disclose
the condition, the diagnosis.
Before I started working,
I did an internship at the health insurance company
and it was interesting, my job,
the stuff I had to do as an intern,
which was very superficial kind of stuff.
Whenever I had to go into somebody's file
for some piece of information, it was monitored.
Like, and then people would have scrutinized and said,
hey, what was the reason for you to look into that?
This is sensible information.
So even on that public level, if you work at a company
that has access to sensitive information, it is monitored.
And even employees are being monitored that, hey,
they only look up on an absolute need to know basis.
There are safety measures even in the organization in place
that not everybody can just open up a file
and look things up.
Yeah, and there were even a couple of celebrities,
for example, that had even an additional safeguard
where you could not, where somebody authorized
a very high manager would have even had access to that file.
But yeah, medical information is extremely protected
to the point where if there was a criminal case
or something, a doctor, I think they need a court warrant
to enable a doctor to speak about a certain
medical condition of somebody.
Or you need to be married, or there needs to be
a letter of authority in place for a third party
to get and manage certain information.
Yeah, it's extremely protected.
That is at least one area that I can see North America
and specifically the United States and Europe
and Germany specifically in Marco's case,
where we do have some common understanding.
I think so too.
So that is good.
That is, yeah.
So yeah, and then the biggest thing here,
and that's also just the system,
the core of anybody's personal information
is one's social security number.
Yes, yes.
Which is crazy because the social security number
and we have something like that too,
should only be for your public retirement money later on,
but the social security number is used to monitor
each and every one, including their credit worthiness
and their spending behavior and everything.
And if somebody gets your social security number,
you're screwed because then people,
they can go out and just pretend that they're you
and order something online or any kind of contract
and if they have your social security number,
then they will just, it will be very credible to anybody
saying, oh yeah, that's really that person
because that social security number checks out,
that's well, that's used the name John Smith again, XYZ.
So your social security number is a nine digit number,
typically three digits, two digits, then four digits.
And typically we only ever tell people or institutions
the last four digits of that number.
The other numbers we absolutely should not share.
So for anybody coming to the US to live and work,
you will get a social security number
because otherwise you cannot be legally employed anywhere
and otherwise you can also not, you can't do anything.
You cannot go out and buy a car.
Sometimes you can't even get like a phone plan.
Usually any contract,
it will involve your social security number.
So if somebody ever sends you an email or calls you
and asks for your social security number,
that is a hundred percent a scam.
You must never disclose your social security number.
Ever. Big no, no.
Americans are fine with publishing anything else,
but social security number, that's where they draw the line.
That is absolutely critical.
Yeah, you absolutely need to protect that number.
You can go out and take pictures of anybody
and publish them, it's fine, all good,
but social security number and also banking information,
that's where people are like, oh no, no, no, no, no, no.
Yeah, it's a big no.
Neither system I think is perfect.
Both of them need improvement.
Maybe in years to come, there will be some strides
in making those improvements happen,
but for the time being, we think it's just important
to be aware of these things when traveling
or moving to either place.
Anything that's manmade is not perfect.
We wanna thank you so much
for tuning into today's episode.
As always, we look forward to being back here
with you very soon.
Happy data protecting everybody.
Happy data protecting.
See you soon.
See you soon, bye.
Bye everybody.