* Problem: Spammers automate creation of accounts. Solution: Reuse the MFA infrastructure as some kind of "CAPTCHA". The phone number is not stored.
* Problem: Spammers use a single phone number to unlock 1000's of accounts. Solution: Store the phone number - so those kinds of misuse can be detected.
* Problem: Ads-Team wants to sell more targeted ads. Solution: There is possibly a phone number stored in the user profile, use that.
Who is to blame here? The Ads team that didn't check if the number can be used?
> Solution: Store A HASH OF the phone number - so those kinds of misuse can be detected.
If you don't need to store PII verbatim, don't store it verbatim.
> Who is to blame here? The Ads team that didn't check if the number can be used?
Yes. 100% yes. It's insane that we've normalized the idea that if you can physically get your hands on some data then that means you're allowed to do whatever you want with it. Anyone even remotely responsible working in advertising should be tracking provenance of the data they're using. I've heard all sorts of excuses about why this isn't practical, but with each year that passes I find them less convincing, and I've finally reached the point where I reject those excuses outright. If you don't _know_ you're allowed to use some PII for marketing, then you _can not_ use it for marketing. It's that simple.
If a system to provide such protections didn't exist, then that system should have been implemented before agreeing on collecting phone numbers. Again, whoever didn't have that insight, should be the one to blame.
(all this is just wishful thinking on my part, of course)
Do banks run like that? No. Do banks sell your details, your address, sign you up for random subscribtiona without your permission? No. Why should twitter get away with this
Something new for them: """ CEOs are required to personally attest that they are responsible for changes to privacy practices and written policies. """
It isn't really a "personal liability" until there's a good amount of jail term involved.
Has any CxO been to jail inviolation of SOX? If "no", then there's your answer how useful it is.
