Users of online services have an expectation of how their personal data will be used. Still, with the internet linking users with services around the world, the reality is that the rules and regulations depend on where in the world you are. A US citizen accessing a service based in the European Union can expect significantly different personal data protection than if they accessed a similar service located in China. This article will look at how data privacy varies worldwide and provides our own assessment of which countries offer the best protection and which, in our opinion, the worst.

Contents

Introduction
What do we mean by Data Privacy?
So, what is Personal Data?
Data Privacy Core Principles
Good Data Privacy Practices
What are the threats to Data Privacy?
undefinedundefinedundefined
How do we rank countries?
Who have we excluded?
Who are the top 5?
undefinedundefinedundefinedundefinedundefined
Who are the bottom 5?
undefinedundefinedundefinedundefinedundefined
Where is the US and Canada in the rankings?
Conclusions
Resources

What do we mean by Data Privacy?

Privacy as a concept in the US was defined as the right to be left alone. It became a fundamental human right in the 1940s. With the growth of the internet, technology has been developed to collect personal information by tracking and monitoring users' actions as they use online services and browse websites. This led to the need for data privacy.

Data privacy is basically how an individual's personal information is collected, handled, shared, and stored. In some countries, robust legislation and regulations provide individuals with safeguards for their personal data. These rules cover how individuals, organizations, and the government themselves can deal with an individual's personal data. There are other countries where robust legislation and regulations do not exist, and individuals need to actively protect their personal data from misuse. Then there are those countries where the government and its state-controlled bodies deny individuals the fundamental privacy rights that most of us would expect.

Those countries with data protection regulations have done so to give individuals rights over how and why their personal data is used. It also gives rights over who can use it. More importantly, they also give individuals the right to prevent their personal data from being used unless there is a good reason. For example, law enforcement bodies acting on a court-issued warrant needing access to information. So, what is Personal Data? Data Privacy Rankings - Top 5 and Bottom 5 Countries

At a fundamental level, it is merely information that relates to a living and identifiable individual. This can cover identifying information such as names, addresses, email addresses, phone numbers, IP addresses, and social security numbers. It may also include personal information about that individual, such as gender, race, political affiliations, and medical conditions. The exact legal definition of what is covered by the term personal data will vary from country to country due to the differences in each country's data privacy regulations. Where countries have no data privacy regulations, there will be no legal definition of personal data.

In practice, even in countries with robust data privacy regulations, the definition of personal data is not straightforward. For example, a list of names and addresses will meet the criteria for personal data. Suppose the names are replaced with numeric identifiers to break the link between the address information and an identified individual. Under the EU's General Data Protection Regulation (GDPR), this still counts as personal data. The pseudo-anonymization process is not sufficient to prevent the address information from being linked back to an individual. If the data set is genuinely anonymized, only then does it cease to be defined as personal data under GDPR. Data Privacy Core Principles

Data privacy is having robust data protection regulations and the measures to ensure personal data is managed in compliance with those regulations. The problem is that the internet is a global service, but each country has its own data privacy approach. Data privacy can be encapsulated as a set of core principles. These are:

The right of an individual to be left alone
The right of an individual to have control over their personal data
Regulations for collecting, handling, processing, and sharing personal data
Enforcement of data protection regulations

Undemocratic countries with oppressive state control typically fail the first two core principles, making having regulations in place irrelevant to data privacy for individuals. Democratic nations that abide by the first two core principles but have no formal rules in place provide no mechanisms for individuals to control who collects and processes their personal information. Similarly, having regulations in place but no means or appetite for enforcement with meaningful penalties for non-compliance offer individuals little protection. The lack of governmental enforcement may, worst case, leave individuals having to use the courts to seek redress for misuse of personal data. This can result in a two-tier state where only those with the resources to take legal action are afforded data privacy protection. Good Data Privacy Practices

Every time you go online to use a service or purchase a product, you hand over personal information. This may be information you knowingly share, like your name and address, to arrange delivery. Or it may be information like your computer's IP address and browsing history that you do not know has been collected. Without rules to govern what can and cannot be collected, with and without consent, individuals may have no idea what information they have shared and where it will end up.

Where an individual provides their personal data, then the following rights should be afforded to individuals. These rights form the basis for the more robust data protection regulations, though not all countries with such laws afford all these rights.

The right of the individual to know how their personal data will be processed
The right of the individual to know their personal data will only be processed when they have knowing consented
The right of the individual to know that the processing of their personal data is lawful
The right of the individual to expect that only the personal data necessary for processing is collected
The right of the individual to expect their personal data to be correct and up to date
The right of the individual to expect their personal data to be kept safe
The right of the individual to expect their personal data to be only kept for as long as it is needed

What are the threats to Data Privacy? Surveillance Government Threats

The collection of biometric data and the use of technologies such as facial recognition is increasing across the world, both for law enforcement and state monitoring purposes. Many countries seek to balance individual privacy with national security needs. However, some countries actively use technology to remove the right to privacy and enact state-wide control of their population through behavioral monitoring and analysis techniques. Commercial Threats

Personal data is precious for commercial organizations seeking to gain a competitive advantage. Targeted advertising is significantly more effective than more general advertising techniques. Adverts destined to be shown on television channels are tuned to appeal to the typical audience's demographics for the television programs being broadcast when the advert is scheduled to be transmitted. Online collection and processing of personal data on a mass scale using multiple diverse sources allow advertising companies to build up detailed knowledge on a vast section of the population's lifestyle and purchasing habits. They can do this with a granularity that allows adverts to be directed at individuals rather than a specific demographic. While this may sound great in theory, receiving adverts for products you are likely to be interested in does have its downsides. Criminal Threats

The internet is awash with criminal elements, be that an opportunist individual or organized crime syndicate. Personal data has value for activities such as identity theft or fraud. Impersonating any individual will allow a criminal to either steal from them or use their identity to trick a person or business into performing some action to the criminals' benefit. Stolen personal data is collected and aggregated until there is sufficient information to commit a crime. Stolen personal data is also made available for sale on the dark web. The chances are that once an individual has been targeted once, they can expect multiple follow-on attacks. How do we rank countries?

The assessment of how much protection an individual is afforded in any one country depends on the different threat actors seeking to exploit personal information. These can be the country's own government agencies looking to monitor and control its citizens, be that for national security and law enforcement purposes to implementing behavioral monitoring, racial profiling, and oppressive control. These can be commercial companies looking to gain a marketplace advantage with target advertising. The final group is criminals looking to steal personal data for use in the execution of a crime.

The countries with the best data privacy ratings will be those that exercise reasonable and proportional government. They offer individuals control over how commercial companies their personal data and provide the laws to minimize data theft risks.

There are many sources of data available that rank countries for data privacy, data protection, and personal freedoms. Each has different rankings for the top and bottom countries that reflect how the data is biased towards a particular aim. Here, we look at whether the country has robust data privacy legislation. Does it enforce that legislation? Does that legislation afford protection from the government itself and controls over commercial use and security against criminal misuse? While there are currently 194 countries globally, the UN report that only 128 have any form of data privacy legislation or regulations. This leaves 66 countries that offer their citizens no legal data privacy protection. These include some of the larger countries where internet use is rapidly expanding and established centers for commerce. The list includes:

Afghanistan
Bangladesh
Belize
Botswana
Burundi
Cambodia
Cameroon
Central African Republic
Congo
Cuba
Dominica
Egypt
El Salvador
Eswatini
Ethiopia
Fiji
Guatemala
Guinea-Bissau
Guyana
Haiti
Iraq
Jordan
Liberia
Libya
Malawi
Maldives
Mozambique
Myanmar
Namibia
North Korea
Pakistan
Papua New Guinea
Rwanda
Saudi Arabia
Seychelles
Sierra Leone
Somalia
South Sudan
Sri Lanka
Sudan
Syria
Timor-Leste
Uganda
Tanzania
Venezuela
Zimbabwe