SlideShare a Scribd company logo
CREATIVE DESTRUCTION & PRIVACY
WHITEWASHING: WHERE DOES RISK
LIE?
Founder, Aurélie Pols & Associates
January 30th 2023
aurelie.pols@protonmail.com
1
aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates –
Data Governance & Privacy Engineer
Data is the New infrastructure – Privacy is the New Green – Trust is the New Currency
Dutch nationality, French mother tongue, works in English, lives in Spain (+kids!)
AURELIE POLS,
DATA GOVERNANCE
& PRIVACY ENGINEER
• DPO for mParticle (Customer Data platform) – contractor (USA, New York)
• Founder – Aurélie Pols & Associates
• Group expert member for the Observatory on the Online Platform Economy (E03607) – EU Commission
•Guest professor DPO certification courses Maastricht University, faculty of law (NL) & Solvay Business School
Brussels (B)
• Board Member European Center On Privacy and Security, Maastricht University (NL)
• Ethics Advisory Group (EAG) – European Data Protection Supervisor (EDPS) Towards a digital ethics
• Former Vice-chair P7002 – Data Privacy Process – IEEE
• Speaker/writer/consiglieri: Mobile World Congress, SWSX, Strata (+ Hadoop World), IAPP, Piwik, AT Internet,
industry associations, AdTech & MarTech vendors, …
2003:
OX2 Co-founder
Webanalytics.be
2008:
Sold to Digitas LBi
(Publicis)
2
Not former GAFAM
What I do for a living
In case you are (still) wondering ;-)
3
Interlocking liabilities & obligations
People
Company
(Telco,
Bank,
Insurance..)
Company
(Agency,
consultancy,
vendor, ...)
Cloud
provider
• Aligning contract obligations
• Risk
• (+ Mitigation measures?)
• Providing
• Security + Privacy
• Privacy engineering
• Design & Default(s)
B2C (+ B2B)
B2B
B2B
Privacy Notices
Lawful basis
Data Subject Rights
MSA
SOW
T&C
4
5
aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates –
IAB’s CEO at Annual Leadership Meeting
1. (Privacy) extremists are political opportunists
2. Attacks to ”our” industry also from within => Apple
3. Opportunity for healthy competition: positive ∑, not zero ∑?
6
Source:
https://www.dataprotection
authority.be/iab-europe-
held-responsible-for-a-
mechanism-that-infringes-
the-gdpr
aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates –
Rise up? For what? For who exactly?
7
aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates –
Is the IAB spamming now?
8
The gathering has begun? Surely this is spam…
And no opt-out link? tsssss
🇨🇦
aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates –
Let’s blame Canada!
Perro ladrador poco mordedor
(bark but no teeth)
Why?
9
Source: https://www.priv.gc.ca/en/opc-news/news-and-announcements/2023/nr-c_230126/
aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates –
Had this been .. other than PIPEDA
Let’s speculate
1. The GDPR,
• A fine?
• Deletion obligations?
• At HomeDepot
• For their processors?
• (Notifications to data subjects?)
2. The US like CCPA/CPRA, Colorado, Connecticut, Virginia, Utah
• Opt-out obligations?
• A potential class action?
10
11
12
aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates –
Let’s go back to the story
“Home Depot shared details from e-receipts with Meta without the
knowledge or consent of customers”
Geography: 🇨🇦
Purpose of data processing: delivering e-receipts to HomeDepot
customers who purchased in store
Data involved? Email Personal information? ✅
Applicable law: PIPEDA
Program: Meta Platform Inc. Offline Conversions
13
aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates –
Taking a closer look at the data flows
“Information sent to Meta was used to verify if a customer had a
Facebook account.
If they did, Meta compared the person’s in-store purchases to Home
Depot’s advertisements sent over the platform to measure and report
on the effectiveness of those ads.
Meta’s Offline Conversions contractual terms also allowed it to use the
customer information for its own business purposes, including user
profiling and targeted advertising, unrelated to Home Depot”
14
aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates –
In “privacy” obligations terms, the issues are:
i. sending PD/I to Meta beyond the purpose for the receipt (quid purpose
limitation principle?) requires some form of a lawful basis under GDPR
ii. Meta then engages in another data processing operation ie does the
user have a FB account? +
iii. FB compares to in-store purchases. isn't that data held by HomeDepot?
how does FB do that?
iv. to report on ad effectiveness ie another purpose in the interest of both
companies and
v. cross-mingle data between customer ie FB doesn't act as a data
processor or even service provider under CCPA/CPRA anymore!
15
aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates –
Justifications by HomeDepot
“Each email address Home Depot shared with Meta was encoded so
that it could not be read by individuals at Facebook. ”
“Home Depot said that it relied on implied consent and that its privacy
statement, accessible through its website and in print upon request at
retail locations, adequately explained that the company uses “de-
identified information for internal business purposes, such as
marketing, customer service, and business analytics” and that it “may
share information for business purposes,” including “with third parties.”
Home Depot also relied on Facebook’s privacy statement, which
explained the Offline Conversions program”
16
aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates –
On the magic of de-identification
This does NOT work under the GDPR or any opt-in laws which require:
1. A lawful basis
• Implied consent is not one of them
• GDPR has 6, LGPD has 10, Chinese PIPL 7
2. A defined purpose
Please share broadly
https://edps.europa.eu/system/files/2021-04/
21-04-27_aepd-edps_anonymisation_en_5.pdf
17
aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates –
10 misunderstandings related to anonymization
1. Pseudonimization is not anonymization
2. Encryption is not anonymization
3. Anonymization of data is always possible
4. Anonymization is forever
5. Anonymization always reduces the probability of re-identification to zero
6. Anonymization is a binary concept that can not be measured
7. Anonymization can be fully automated
8. Anonymization makes the data useless
9. Following an anonymization process used by others renders same results
10. There is no risk and no interest in finding out to whom this data refers to
18
The data is anonymous, privacy
law doesn’t apply
Privacy whitewashing #1
19
aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates –
Justifications by HomeDepot (II)
“... Meta employed an automated process that allowed it to match email
addresses attached to Facebook accounts.
Email addresses not already associated with a Facebook account could not
be linked to individuals.”
”The company said that it did not notify customers of its information sharing
agreement with Meta just prior to issuing e-receipts due to the risk of
“consent fatigue.””
Actually, under the GDPR, the initial data processing operation would NOT
require consent: the lawful basis would be contract.
For subsequent processes however, like ADM, art 22 would apply where a
data subject would have the Right NOT to be subject to it
20
The consumer consented
Privacy whitewashing #2
Follow up question is typically: to what exactly? PURPOSE
21
aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates –
Lessons learnt, now what?
The structure of how laws are built up really varies
Their consequences as well so what enforcement means
How enforcement is then accepted also
In the end this is all about change
“Home Depot was fully cooperative throughout the investigation and
has agreed to implement the OPC’s recommendations. The company
stopped sharing customer information with Meta in October 2022.”
22
The company will not do it
anymore/again
Privacy whitewashing #3
Follow up question is typically: how to make sure?
23
aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates –
High level: opt-in vs. opt-out laws
Comparing roles in 2 major privacy laws:
GDPR is a horizontal law, which took 5 years to mature, is enshrined
within EU law (Charter + TFEU), enforced by supervisory authorities
CCPA was originally proposed as a ballot proposition by a privacy group
known as Californians for Consumer Privacy.
24
CCPA/CPRA GDPR
Business Data controller
Service provider Data processor
3rd party/data broker Joint controller Accountability
Fundam
ental right
Lim
ited rights
Data to support growth
aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates –
US privacy law is sectoral
You’ve all heard of
COPPA, HIPAA, VPPA,
Fair Credit Act, …
And boy, is this
getting complicated!
P = right to opt-out of
processing for
profiling/targeted
advertising purposes
25
Source:
https://iapp.org/media/pdf/resource_ce
nter/State_Comp_Privacy_Law_Chart.pdf
aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates –
Purpose is taking center stage
Even in US state laws now: what is the data used for?
The scope of opt-outs vary by state:
1. VA, CO & CT enable consumers to opt-out of targeted advertising,
sale and profiling
2. UT enables consumers to opt-out of targeted advertising and sale of
data (but not profiling)
3. CA enables consumers to opt-out of sale & sharing + under CPRA,
when a business sees an opt-out preference signal (eg. GPC), it
must also opt the consumer out of from profiling
26
aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates –
Legislative evolutions: where is ePrivacy?
28
aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates –
And yes there is more coming
29
aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates –
But not just Europe and cookies: SDKs…
30
aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates –
Does section 230, DMA/DSA ring any bells?
31
aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates –
ADM, ML & AI
Start here
Keep in mind
1. Lawful basis
2. Purpose
(limitation)
If PD/I
32
aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates –
While AI brings back IP challenges
33
Source:
https://www.theverg
e.com/2023/1/17/23
558516/ai-art-
copyright-stable-
diffusion-getty-
images-lawsuit
Provenance of digital raw
material matters
Risks lie in lack of explainability for all actors involved in the data ecosystem
34
aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates –
Data governance, the sexiest job of 2023?
35
Thank you for coming to my
presentation
Aurelie.pols@protonmail.com
36
Life is like a plate of spaghetti, everthing is interconnected
Life is like a box of chocolates, you never know what to expect!

More Related Content

What's hot

Security v. Privacy: the great debate
Security v. Privacy: the great debateSecurity v. Privacy: the great debate
Security v. Privacy: the great debate
David Strom
 
LGPD e Segurança da Informação
LGPD e Segurança da InformaçãoLGPD e Segurança da Informação
LGPD e Segurança da Informação
RicardoCrdobaBaptist
 
201711 abordagem rgpd
201711 abordagem rgpd201711 abordagem rgpd
201711 abordagem rgpd
Ricardo Marques
 
GDPR for Dummies
GDPR for DummiesGDPR for Dummies
GDPR for Dummies
Caroline Boscher
 
lgpd_curso_ufba.pdf
lgpd_curso_ufba.pdflgpd_curso_ufba.pdf
lgpd_curso_ufba.pdf
ZecaCarvalhoJnior
 
SABSA overview
SABSA overviewSABSA overview
SABSA overview
SABSAcourses
 
Steve Litras [Cribl] | The Power of Infinite Choice | InfluxDays Virtual Expe...
Steve Litras [Cribl] | The Power of Infinite Choice | InfluxDays Virtual Expe...Steve Litras [Cribl] | The Power of Infinite Choice | InfluxDays Virtual Expe...
Steve Litras [Cribl] | The Power of Infinite Choice | InfluxDays Virtual Expe...
InfluxData
 
General Data Protection Regulation (GDPR)
General Data Protection Regulation (GDPR)General Data Protection Regulation (GDPR)
General Data Protection Regulation (GDPR)
Extentia Information Technology
 
Accelerating the Path to GDPR Compliance
Accelerating the Path to GDPR ComplianceAccelerating the Path to GDPR Compliance
Accelerating the Path to GDPR Compliance
Hernan Huwyler, MBA CPA
 
LGPD Apostila
LGPD ApostilaLGPD Apostila
LGPD Apostila
AlbertoMonteiroNeto1
 
Data quality metrics infographic
Data quality metrics infographicData quality metrics infographic
Data quality metrics infographic
Intellspot
 
GDPR Basics - General Data Protection Regulation
GDPR Basics - General Data Protection RegulationGDPR Basics - General Data Protection Regulation
GDPR Basics - General Data Protection Regulation
Vicky Dallas
 
Critical success factors to develop and deliver a forward-looking BI strategy...
Critical success factors to develop and deliver a forward-looking BI strategy...Critical success factors to develop and deliver a forward-looking BI strategy...
Critical success factors to develop and deliver a forward-looking BI strategy...
SAP Analytics
 
Data Loss Prevention
Data Loss PreventionData Loss Prevention
Data Loss Prevention
Reza Kopaee
 
GDPR and Security.pdf
GDPR and Security.pdfGDPR and Security.pdf
Metrics, Risk Management & DLP
Metrics, Risk Management & DLPMetrics, Risk Management & DLP
Metrics, Risk Management & DLP
Robert Kloots
 
Data Catalog as the Platform for Data Intelligence
Data Catalog as the Platform for Data IntelligenceData Catalog as the Platform for Data Intelligence
Data Catalog as the Platform for Data Intelligence
Alation
 
Data Protection and Privacy
Data Protection and PrivacyData Protection and Privacy
Data Protection and Privacy
Vertex Holdings
 
Netflix Recommender System : Big Data Case Study
Netflix Recommender System : Big Data Case StudyNetflix Recommender System : Big Data Case Study
Netflix Recommender System : Big Data Case Study
Ketan Patil
 
Emerging Trends in Data Architecture – What’s the Next Big Thing?
Emerging Trends in Data Architecture – What’s the Next Big Thing?Emerging Trends in Data Architecture – What’s the Next Big Thing?
Emerging Trends in Data Architecture – What’s the Next Big Thing?
DATAVERSITY
 

What's hot (20)

Security v. Privacy: the great debate
Security v. Privacy: the great debateSecurity v. Privacy: the great debate
Security v. Privacy: the great debate
 
LGPD e Segurança da Informação
LGPD e Segurança da InformaçãoLGPD e Segurança da Informação
LGPD e Segurança da Informação
 
201711 abordagem rgpd
201711 abordagem rgpd201711 abordagem rgpd
201711 abordagem rgpd
 
GDPR for Dummies
GDPR for DummiesGDPR for Dummies
GDPR for Dummies
 
lgpd_curso_ufba.pdf
lgpd_curso_ufba.pdflgpd_curso_ufba.pdf
lgpd_curso_ufba.pdf
 
SABSA overview
SABSA overviewSABSA overview
SABSA overview
 
Steve Litras [Cribl] | The Power of Infinite Choice | InfluxDays Virtual Expe...
Steve Litras [Cribl] | The Power of Infinite Choice | InfluxDays Virtual Expe...Steve Litras [Cribl] | The Power of Infinite Choice | InfluxDays Virtual Expe...
Steve Litras [Cribl] | The Power of Infinite Choice | InfluxDays Virtual Expe...
 
General Data Protection Regulation (GDPR)
General Data Protection Regulation (GDPR)General Data Protection Regulation (GDPR)
General Data Protection Regulation (GDPR)
 
Accelerating the Path to GDPR Compliance
Accelerating the Path to GDPR ComplianceAccelerating the Path to GDPR Compliance
Accelerating the Path to GDPR Compliance
 
LGPD Apostila
LGPD ApostilaLGPD Apostila
LGPD Apostila
 
Data quality metrics infographic
Data quality metrics infographicData quality metrics infographic
Data quality metrics infographic
 
GDPR Basics - General Data Protection Regulation
GDPR Basics - General Data Protection RegulationGDPR Basics - General Data Protection Regulation
GDPR Basics - General Data Protection Regulation
 
Critical success factors to develop and deliver a forward-looking BI strategy...
Critical success factors to develop and deliver a forward-looking BI strategy...Critical success factors to develop and deliver a forward-looking BI strategy...
Critical success factors to develop and deliver a forward-looking BI strategy...
 
Data Loss Prevention
Data Loss PreventionData Loss Prevention
Data Loss Prevention
 
GDPR and Security.pdf
GDPR and Security.pdfGDPR and Security.pdf
GDPR and Security.pdf
 
Metrics, Risk Management & DLP
Metrics, Risk Management & DLPMetrics, Risk Management & DLP
Metrics, Risk Management & DLP
 
Data Catalog as the Platform for Data Intelligence
Data Catalog as the Platform for Data IntelligenceData Catalog as the Platform for Data Intelligence
Data Catalog as the Platform for Data Intelligence
 
Data Protection and Privacy
Data Protection and PrivacyData Protection and Privacy
Data Protection and Privacy
 
Netflix Recommender System : Big Data Case Study
Netflix Recommender System : Big Data Case StudyNetflix Recommender System : Big Data Case Study
Netflix Recommender System : Big Data Case Study
 
Emerging Trends in Data Architecture – What’s the Next Big Thing?
Emerging Trends in Data Architecture – What’s the Next Big Thing?Emerging Trends in Data Architecture – What’s the Next Big Thing?
Emerging Trends in Data Architecture – What’s the Next Big Thing?
 

Similar to Creative destruction & Privacy Whitewashing: where does risk lie?

AI Roles and Risk for election year 2024
AI Roles and Risk for election year 2024AI Roles and Risk for election year 2024
AI Roles and Risk for election year 2024
Aurélie Pols
 
ePrivacy Directive, a 10 steps framework to be as compliant as possible for m...
ePrivacy Directive, a 10 steps framework to be as compliant as possible for m...ePrivacy Directive, a 10 steps framework to be as compliant as possible for m...
ePrivacy Directive, a 10 steps framework to be as compliant as possible for m...
Aurélie Pols
 
eMetrics Summit Boston 2014 - Big Data for Marketing - Privacy Principles & P...
eMetrics Summit Boston 2014 - Big Data for Marketing - Privacy Principles & P...eMetrics Summit Boston 2014 - Big Data for Marketing - Privacy Principles & P...
eMetrics Summit Boston 2014 - Big Data for Marketing - Privacy Principles & P...
Aurélie Pols
 
Preparing for the AI Act - 5 years into GDPR enforcement
Preparing for the AI Act - 5 years into GDPR enforcementPreparing for the AI Act - 5 years into GDPR enforcement
Preparing for the AI Act - 5 years into GDPR enforcement
Aurélie Pols
 
eMetrics Summit Boston 2014 - Big Data Marketing - From Über Creepy to Over ...
 eMetrics Summit Boston 2014 - Big Data Marketing - From Über Creepy to Over ... eMetrics Summit Boston 2014 - Big Data Marketing - From Über Creepy to Over ...
eMetrics Summit Boston 2014 - Big Data Marketing - From Über Creepy to Over ...
Aurélie Pols
 
Data Accountability & Consumer Trust
Data Accountability & Consumer TrustData Accountability & Consumer Trust
Data Accountability & Consumer Trust
Aurélie Pols
 
Storm on the Horizon: Data Governance & Security vs. Employee Privacy
Storm on the Horizon: Data Governance & Security vs. Employee PrivacyStorm on the Horizon: Data Governance & Security vs. Employee Privacy
Storm on the Horizon: Data Governance & Security vs. Employee Privacy
Aurélie Pols
 
Women in STEM for IE Girl Up Club
Women in STEM for IE Girl Up Club Women in STEM for IE Girl Up Club
Women in STEM for IE Girl Up Club
Aurélie Pols
 
Privacy Regulations and Your Digital Setup
Privacy Regulations and Your Digital SetupPrivacy Regulations and Your Digital Setup
Privacy Regulations and Your Digital Setup
Piwik PRO
 
GDPR - Applift firstscreen june 2016
GDPR - Applift firstscreen june 2016GDPR - Applift firstscreen june 2016
GDPR - Applift firstscreen june 2016
Saira Nayak, JD, CIPP/US/E
 
Data protection & security breakfast briefing master slides 28 june-final
Data protection & security breakfast briefing   master slides 28 june-finalData protection & security breakfast briefing   master slides 28 june-final
Data protection & security breakfast briefing master slides 28 june-final
Dr. Donald Macfarlane
 
Data Protection & Security Breakfast Briefing - Master Slides_28 June_final
Data Protection & Security Breakfast Briefing - Master Slides_28 June_finalData Protection & Security Breakfast Briefing - Master Slides_28 June_final
Data Protection & Security Breakfast Briefing - Master Slides_28 June_final
Dr. Donald Macfarlane
 
Privacy & Analytics: Yeti or Snow Fairy?
Privacy & Analytics: Yeti or Snow Fairy?Privacy & Analytics: Yeti or Snow Fairy?
Privacy & Analytics: Yeti or Snow Fairy?
FLUZO
 
Who ownes the customer? Privacy in the connected age.
Who ownes the customer? Privacy in the connected age.Who ownes the customer? Privacy in the connected age.
Who ownes the customer? Privacy in the connected age.
jatharrison
 
Linking Data: The Legal Implications - SemTech2010
Linking Data: The Legal Implications - SemTech2010Linking Data: The Legal Implications - SemTech2010
Linking Data: The Legal Implications - SemTech2010
mleyden
 
Cognizant business consulting the impacts of gdpr
Cognizant business consulting   the impacts of gdprCognizant business consulting   the impacts of gdpr
Cognizant business consulting the impacts of gdpr
audrey miguel
 
Companies, digital transformation and information privacy: the next steps
Companies, digital transformation and information privacy: the next stepsCompanies, digital transformation and information privacy: the next steps
Companies, digital transformation and information privacy: the next steps
The Economist Media Businesses
 
How the EU-GDPR May Affect Your Website
How the EU-GDPR May Affect Your WebsiteHow the EU-GDPR May Affect Your Website
How the EU-GDPR May Affect Your Website
SilverTech
 
Piwik PRO The Real Cost of Data Privacy
Piwik PRO The Real Cost of Data Privacy Piwik PRO The Real Cost of Data Privacy
Piwik PRO The Real Cost of Data Privacy
Piwik PRO
 
How to Protect Your Data
How to Protect Your DataHow to Protect Your Data

Similar to Creative destruction & Privacy Whitewashing: where does risk lie? (20)

AI Roles and Risk for election year 2024
AI Roles and Risk for election year 2024AI Roles and Risk for election year 2024
AI Roles and Risk for election year 2024
 
ePrivacy Directive, a 10 steps framework to be as compliant as possible for m...
ePrivacy Directive, a 10 steps framework to be as compliant as possible for m...ePrivacy Directive, a 10 steps framework to be as compliant as possible for m...
ePrivacy Directive, a 10 steps framework to be as compliant as possible for m...
 
eMetrics Summit Boston 2014 - Big Data for Marketing - Privacy Principles & P...
eMetrics Summit Boston 2014 - Big Data for Marketing - Privacy Principles & P...eMetrics Summit Boston 2014 - Big Data for Marketing - Privacy Principles & P...
eMetrics Summit Boston 2014 - Big Data for Marketing - Privacy Principles & P...
 
Preparing for the AI Act - 5 years into GDPR enforcement
Preparing for the AI Act - 5 years into GDPR enforcementPreparing for the AI Act - 5 years into GDPR enforcement
Preparing for the AI Act - 5 years into GDPR enforcement
 
eMetrics Summit Boston 2014 - Big Data Marketing - From Über Creepy to Over ...
 eMetrics Summit Boston 2014 - Big Data Marketing - From Über Creepy to Over ... eMetrics Summit Boston 2014 - Big Data Marketing - From Über Creepy to Over ...
eMetrics Summit Boston 2014 - Big Data Marketing - From Über Creepy to Over ...
 
Data Accountability & Consumer Trust
Data Accountability & Consumer TrustData Accountability & Consumer Trust
Data Accountability & Consumer Trust
 
Storm on the Horizon: Data Governance & Security vs. Employee Privacy
Storm on the Horizon: Data Governance & Security vs. Employee PrivacyStorm on the Horizon: Data Governance & Security vs. Employee Privacy
Storm on the Horizon: Data Governance & Security vs. Employee Privacy
 
Women in STEM for IE Girl Up Club
Women in STEM for IE Girl Up Club Women in STEM for IE Girl Up Club
Women in STEM for IE Girl Up Club
 
Privacy Regulations and Your Digital Setup
Privacy Regulations and Your Digital SetupPrivacy Regulations and Your Digital Setup
Privacy Regulations and Your Digital Setup
 
GDPR - Applift firstscreen june 2016
GDPR - Applift firstscreen june 2016GDPR - Applift firstscreen june 2016
GDPR - Applift firstscreen june 2016
 
Data protection & security breakfast briefing master slides 28 june-final
Data protection & security breakfast briefing   master slides 28 june-finalData protection & security breakfast briefing   master slides 28 june-final
Data protection & security breakfast briefing master slides 28 june-final
 
Data Protection & Security Breakfast Briefing - Master Slides_28 June_final
Data Protection & Security Breakfast Briefing - Master Slides_28 June_finalData Protection & Security Breakfast Briefing - Master Slides_28 June_final
Data Protection & Security Breakfast Briefing - Master Slides_28 June_final
 
Privacy & Analytics: Yeti or Snow Fairy?
Privacy & Analytics: Yeti or Snow Fairy?Privacy & Analytics: Yeti or Snow Fairy?
Privacy & Analytics: Yeti or Snow Fairy?
 
Who ownes the customer? Privacy in the connected age.
Who ownes the customer? Privacy in the connected age.Who ownes the customer? Privacy in the connected age.
Who ownes the customer? Privacy in the connected age.
 
Linking Data: The Legal Implications - SemTech2010
Linking Data: The Legal Implications - SemTech2010Linking Data: The Legal Implications - SemTech2010
Linking Data: The Legal Implications - SemTech2010
 
Cognizant business consulting the impacts of gdpr
Cognizant business consulting   the impacts of gdprCognizant business consulting   the impacts of gdpr
Cognizant business consulting the impacts of gdpr
 
Companies, digital transformation and information privacy: the next steps
Companies, digital transformation and information privacy: the next stepsCompanies, digital transformation and information privacy: the next steps
Companies, digital transformation and information privacy: the next steps
 
How the EU-GDPR May Affect Your Website
How the EU-GDPR May Affect Your WebsiteHow the EU-GDPR May Affect Your Website
How the EU-GDPR May Affect Your Website
 
Piwik PRO The Real Cost of Data Privacy
Piwik PRO The Real Cost of Data Privacy Piwik PRO The Real Cost of Data Privacy
Piwik PRO The Real Cost of Data Privacy
 
How to Protect Your Data
How to Protect Your DataHow to Protect Your Data
How to Protect Your Data
 

More from Aurélie Pols

IAPP - Skills For Minimizing Privacy Risk in Data Science Product and Service...
IAPP - Skills For Minimizing Privacy Risk in Data Science Product and Service...IAPP - Skills For Minimizing Privacy Risk in Data Science Product and Service...
IAPP - Skills For Minimizing Privacy Risk in Data Science Product and Service...
Aurélie Pols
 
Interoperability in Digital will take a Global Village
Interoperability in Digital will take a Global VillageInteroperability in Digital will take a Global Village
Interoperability in Digital will take a Global Village
Aurélie Pols
 
The GDPR is here. So do you know what the courts are saying?
The GDPR is here. So do you know what the courts are saying?The GDPR is here. So do you know what the courts are saying?
The GDPR is here. So do you know what the courts are saying?
Aurélie Pols
 
CPDP: Data ownership, Innovation and Privacy: looking for an approach on both...
CPDP: Data ownership, Innovation and Privacy: looking for an approach on both...CPDP: Data ownership, Innovation and Privacy: looking for an approach on both...
CPDP: Data ownership, Innovation and Privacy: looking for an approach on both...
Aurélie Pols
 
GDPR and the aftermath: what are we building towards?
GDPR and the aftermath: what are we building towards?GDPR and the aftermath: what are we building towards?
GDPR and the aftermath: what are we building towards?
Aurélie Pols
 
Who Goes There? Demystifying Digital Identity for All (1/2)
Who Goes There? Demystifying Digital Identity for All (1/2)Who Goes There? Demystifying Digital Identity for All (1/2)
Who Goes There? Demystifying Digital Identity for All (1/2)
Aurélie Pols
 
Data is the new infrastructure, Privacy is the new green, Trust is the new cu...
Data is the new infrastructure, Privacy is the new green, Trust is the new cu...Data is the new infrastructure, Privacy is the new green, Trust is the new cu...
Data is the new infrastructure, Privacy is the new green, Trust is the new cu...
Aurélie Pols
 
How digitization challenges our values as citizens
How digitization challenges our values as citizens How digitization challenges our values as citizens
How digitization challenges our values as citizens
Aurélie Pols
 
Technical Consequences of the Data Subject's Rights
Technical Consequences of the Data Subject's RightsTechnical Consequences of the Data Subject's Rights
Technical Consequences of the Data Subject's Rights
Aurélie Pols
 
From GDPR to ePrivacy: what does it mean to the advertising sector?
From GDPR to ePrivacy: what does it mean to the advertising sector?From GDPR to ePrivacy: what does it mean to the advertising sector?
From GDPR to ePrivacy: what does it mean to the advertising sector?
Aurélie Pols
 
State of EU legislation: GDPR & ePrivacy for Superweek
State of EU legislation: GDPR & ePrivacy for SuperweekState of EU legislation: GDPR & ePrivacy for Superweek
State of EU legislation: GDPR & ePrivacy for Superweek
Aurélie Pols
 
The Great GDPR MyData Debate - Aurelie Pols - Keynote
The Great GDPR MyData Debate - Aurelie Pols - KeynoteThe Great GDPR MyData Debate - Aurelie Pols - Keynote
The Great GDPR MyData Debate - Aurelie Pols - Keynote
Aurélie Pols
 
The Data Subject First? Decoding the GDPR at StrataData
The Data Subject First? Decoding the GDPR at StrataDataThe Data Subject First? Decoding the GDPR at StrataData
The Data Subject First? Decoding the GDPR at StrataData
Aurélie Pols
 
Brussels data science - Privacy Engineering for Big Data & Data Science
Brussels data science - Privacy Engineering for Big Data & Data ScienceBrussels data science - Privacy Engineering for Big Data & Data Science
Brussels data science - Privacy Engineering for Big Data & Data Science
Aurélie Pols
 
Sibos INNOTRIBE Digital Ethics
Sibos INNOTRIBE Digital EthicsSibos INNOTRIBE Digital Ethics
Sibos INNOTRIBE Digital Ethics
Aurélie Pols
 
Superweek 2016 Would You Lie to Your Physician?
Superweek 2016 Would You Lie to Your Physician?Superweek 2016 Would You Lie to Your Physician?
Superweek 2016 Would You Lie to Your Physician?
Aurélie Pols
 
Multi-tasking teams within cyber security departments
Multi-tasking teams within cyber security departmentsMulti-tasking teams within cyber security departments
Multi-tasking teams within cyber security departments
Aurélie Pols
 
BIG DATA IN BUSINESS Implement and use Big Data to your organization’s advantage
BIG DATA IN BUSINESS Implement and use Big Data to your organization’s advantageBIG DATA IN BUSINESS Implement and use Big Data to your organization’s advantage
BIG DATA IN BUSINESS Implement and use Big Data to your organization’s advantage
Aurélie Pols
 
Get data without the creepiness factor, the privacy by design concept
Get data without the creepiness factor, the privacy by design conceptGet data without the creepiness factor, the privacy by design concept
Get data without the creepiness factor, the privacy by design concept
Aurélie Pols
 
Big Data Big Ideas: Data is the New Oil, Privacy is the New Green
Big Data Big Ideas: Data is the New Oil, Privacy is the New GreenBig Data Big Ideas: Data is the New Oil, Privacy is the New Green
Big Data Big Ideas: Data is the New Oil, Privacy is the New Green
Aurélie Pols
 

More from Aurélie Pols (20)

IAPP - Skills For Minimizing Privacy Risk in Data Science Product and Service...
IAPP - Skills For Minimizing Privacy Risk in Data Science Product and Service...IAPP - Skills For Minimizing Privacy Risk in Data Science Product and Service...
IAPP - Skills For Minimizing Privacy Risk in Data Science Product and Service...
 
Interoperability in Digital will take a Global Village
Interoperability in Digital will take a Global VillageInteroperability in Digital will take a Global Village
Interoperability in Digital will take a Global Village
 
The GDPR is here. So do you know what the courts are saying?
The GDPR is here. So do you know what the courts are saying?The GDPR is here. So do you know what the courts are saying?
The GDPR is here. So do you know what the courts are saying?
 
CPDP: Data ownership, Innovation and Privacy: looking for an approach on both...
CPDP: Data ownership, Innovation and Privacy: looking for an approach on both...CPDP: Data ownership, Innovation and Privacy: looking for an approach on both...
CPDP: Data ownership, Innovation and Privacy: looking for an approach on both...
 
GDPR and the aftermath: what are we building towards?
GDPR and the aftermath: what are we building towards?GDPR and the aftermath: what are we building towards?
GDPR and the aftermath: what are we building towards?
 
Who Goes There? Demystifying Digital Identity for All (1/2)
Who Goes There? Demystifying Digital Identity for All (1/2)Who Goes There? Demystifying Digital Identity for All (1/2)
Who Goes There? Demystifying Digital Identity for All (1/2)
 
Data is the new infrastructure, Privacy is the new green, Trust is the new cu...
Data is the new infrastructure, Privacy is the new green, Trust is the new cu...Data is the new infrastructure, Privacy is the new green, Trust is the new cu...
Data is the new infrastructure, Privacy is the new green, Trust is the new cu...
 
How digitization challenges our values as citizens
How digitization challenges our values as citizens How digitization challenges our values as citizens
How digitization challenges our values as citizens
 
Technical Consequences of the Data Subject's Rights
Technical Consequences of the Data Subject's RightsTechnical Consequences of the Data Subject's Rights
Technical Consequences of the Data Subject's Rights
 
From GDPR to ePrivacy: what does it mean to the advertising sector?
From GDPR to ePrivacy: what does it mean to the advertising sector?From GDPR to ePrivacy: what does it mean to the advertising sector?
From GDPR to ePrivacy: what does it mean to the advertising sector?
 
State of EU legislation: GDPR & ePrivacy for Superweek
State of EU legislation: GDPR & ePrivacy for SuperweekState of EU legislation: GDPR & ePrivacy for Superweek
State of EU legislation: GDPR & ePrivacy for Superweek
 
The Great GDPR MyData Debate - Aurelie Pols - Keynote
The Great GDPR MyData Debate - Aurelie Pols - KeynoteThe Great GDPR MyData Debate - Aurelie Pols - Keynote
The Great GDPR MyData Debate - Aurelie Pols - Keynote
 
The Data Subject First? Decoding the GDPR at StrataData
The Data Subject First? Decoding the GDPR at StrataDataThe Data Subject First? Decoding the GDPR at StrataData
The Data Subject First? Decoding the GDPR at StrataData
 
Brussels data science - Privacy Engineering for Big Data & Data Science
Brussels data science - Privacy Engineering for Big Data & Data ScienceBrussels data science - Privacy Engineering for Big Data & Data Science
Brussels data science - Privacy Engineering for Big Data & Data Science
 
Sibos INNOTRIBE Digital Ethics
Sibos INNOTRIBE Digital EthicsSibos INNOTRIBE Digital Ethics
Sibos INNOTRIBE Digital Ethics
 
Superweek 2016 Would You Lie to Your Physician?
Superweek 2016 Would You Lie to Your Physician?Superweek 2016 Would You Lie to Your Physician?
Superweek 2016 Would You Lie to Your Physician?
 
Multi-tasking teams within cyber security departments
Multi-tasking teams within cyber security departmentsMulti-tasking teams within cyber security departments
Multi-tasking teams within cyber security departments
 
BIG DATA IN BUSINESS Implement and use Big Data to your organization’s advantage
BIG DATA IN BUSINESS Implement and use Big Data to your organization’s advantageBIG DATA IN BUSINESS Implement and use Big Data to your organization’s advantage
BIG DATA IN BUSINESS Implement and use Big Data to your organization’s advantage
 
Get data without the creepiness factor, the privacy by design concept
Get data without the creepiness factor, the privacy by design conceptGet data without the creepiness factor, the privacy by design concept
Get data without the creepiness factor, the privacy by design concept
 
Big Data Big Ideas: Data is the New Oil, Privacy is the New Green
Big Data Big Ideas: Data is the New Oil, Privacy is the New GreenBig Data Big Ideas: Data is the New Oil, Privacy is the New Green
Big Data Big Ideas: Data is the New Oil, Privacy is the New Green
 

Recently uploaded

Receivership and liquidation Accounts Prof. Oyedokun.pptx
Receivership and liquidation Accounts Prof. Oyedokun.pptxReceivership and liquidation Accounts Prof. Oyedokun.pptx
Receivership and liquidation Accounts Prof. Oyedokun.pptx
Godwin Emmanuel Oyedokun MBA MSc PhD FCA FCTI FCNA CFE FFAR
 
What are the common challenges faced by women lawyers working in the legal pr...
What are the common challenges faced by women lawyers working in the legal pr...What are the common challenges faced by women lawyers working in the legal pr...
What are the common challenges faced by women lawyers working in the legal pr...
lawyersonia
 
原版制作(PSU毕业证书)宾州州立大学公园分校毕业证学历证书一模一样
原版制作(PSU毕业证书)宾州州立大学公园分校毕业证学历证书一模一样原版制作(PSU毕业证书)宾州州立大学公园分校毕业证学历证书一模一样
原版制作(PSU毕业证书)宾州州立大学公园分校毕业证学历证书一模一样
osenwakm
 
在线办理(SU毕业证书)美国雪城大学毕业证成绩单一模一样
在线办理(SU毕业证书)美国雪城大学毕业证成绩单一模一样在线办理(SU毕业证书)美国雪城大学毕业证成绩单一模一样
在线办理(SU毕业证书)美国雪城大学毕业证成绩单一模一样
osenwakm
 
Business Laws Sunita saha
Business Laws Sunita sahaBusiness Laws Sunita saha
Business Laws Sunita saha
sunitasaha5
 
Incometax Compliance_PF_ ESI- June 2024
Incometax  Compliance_PF_ ESI- June 2024Incometax  Compliance_PF_ ESI- June 2024
Incometax Compliance_PF_ ESI- June 2024
EbizfilingIndia
 
San Remo Manual on International Law Applicable to Armed Conflict at Sea
San Remo Manual on International Law Applicable to Armed Conflict at SeaSan Remo Manual on International Law Applicable to Armed Conflict at Sea
San Remo Manual on International Law Applicable to Armed Conflict at Sea
Justin Ordoyo
 
Sangyun Lee, 'Why Korea's Merger Control Occasionally Fails: A Public Choice ...
Sangyun Lee, 'Why Korea's Merger Control Occasionally Fails: A Public Choice ...Sangyun Lee, 'Why Korea's Merger Control Occasionally Fails: A Public Choice ...
Sangyun Lee, 'Why Korea's Merger Control Occasionally Fails: A Public Choice ...
Sangyun Lee
 
Ease of Paying Tax Law Republic Act 11976
Ease of Paying Tax Law Republic Act 11976Ease of Paying Tax Law Republic Act 11976
Ease of Paying Tax Law Republic Act 11976
PelayoGilbert
 
Lifting the Corporate Veil. Power Point Presentation
Lifting the Corporate Veil. Power Point PresentationLifting the Corporate Veil. Power Point Presentation
Lifting the Corporate Veil. Power Point Presentation
seri bangash
 
fnaf lore.pptx ...................................
fnaf lore.pptx ...................................fnaf lore.pptx ...................................
fnaf lore.pptx ...................................
20jcoello
 
Matthew Professional CV experienced Government Liaison
Matthew Professional CV experienced Government LiaisonMatthew Professional CV experienced Government Liaison
Matthew Professional CV experienced Government Liaison
MattGardner52
 
V.-SENTHIL-BALAJI-SLP-C-8939-8940-2023-SC-Judgment-07-August-2023.pdf
V.-SENTHIL-BALAJI-SLP-C-8939-8940-2023-SC-Judgment-07-August-2023.pdfV.-SENTHIL-BALAJI-SLP-C-8939-8940-2023-SC-Judgment-07-August-2023.pdf
V.-SENTHIL-BALAJI-SLP-C-8939-8940-2023-SC-Judgment-07-August-2023.pdf
bhavenpr
 
Search Warrants for NH Law Enforcement Officers
Search Warrants for NH Law Enforcement OfficersSearch Warrants for NH Law Enforcement Officers
Search Warrants for NH Law Enforcement Officers
RichardTheberge
 
Defending Weapons Offence Charges: Role of Mississauga Criminal Defence Lawyers
Defending Weapons Offence Charges: Role of Mississauga Criminal Defence LawyersDefending Weapons Offence Charges: Role of Mississauga Criminal Defence Lawyers
Defending Weapons Offence Charges: Role of Mississauga Criminal Defence Lawyers
HarpreetSaini48
 
The Art and Science of Cryptoforensic Investigation: Best Practices and Tools
The Art and Science of Cryptoforensic Investigation: Best Practices and ToolsThe Art and Science of Cryptoforensic Investigation: Best Practices and Tools
The Art and Science of Cryptoforensic Investigation: Best Practices and Tools
Milind Agarwal
 
2015pmkemenhub163.pdf. 2015pmkemenhub163.pdf
2015pmkemenhub163.pdf. 2015pmkemenhub163.pdf2015pmkemenhub163.pdf. 2015pmkemenhub163.pdf
2015pmkemenhub163.pdf. 2015pmkemenhub163.pdf
CIkumparan
 
Genocide in International Criminal Law.pptx
Genocide in International Criminal Law.pptxGenocide in International Criminal Law.pptx
Genocide in International Criminal Law.pptx
MasoudZamani13
 
Presentation (1).pptx Human rights of LGBTQ people in India, constitutional a...
Presentation (1).pptx Human rights of LGBTQ people in India, constitutional a...Presentation (1).pptx Human rights of LGBTQ people in India, constitutional a...
Presentation (1).pptx Human rights of LGBTQ people in India, constitutional a...
SKshi
 
The Future of Criminal Defense Lawyer in India.pdf
The Future of Criminal Defense Lawyer in India.pdfThe Future of Criminal Defense Lawyer in India.pdf
The Future of Criminal Defense Lawyer in India.pdf
veteranlegal
 

Recently uploaded (20)

Receivership and liquidation Accounts Prof. Oyedokun.pptx
Receivership and liquidation Accounts Prof. Oyedokun.pptxReceivership and liquidation Accounts Prof. Oyedokun.pptx
Receivership and liquidation Accounts Prof. Oyedokun.pptx
 
What are the common challenges faced by women lawyers working in the legal pr...
What are the common challenges faced by women lawyers working in the legal pr...What are the common challenges faced by women lawyers working in the legal pr...
What are the common challenges faced by women lawyers working in the legal pr...
 
原版制作(PSU毕业证书)宾州州立大学公园分校毕业证学历证书一模一样
原版制作(PSU毕业证书)宾州州立大学公园分校毕业证学历证书一模一样原版制作(PSU毕业证书)宾州州立大学公园分校毕业证学历证书一模一样
原版制作(PSU毕业证书)宾州州立大学公园分校毕业证学历证书一模一样
 
在线办理(SU毕业证书)美国雪城大学毕业证成绩单一模一样
在线办理(SU毕业证书)美国雪城大学毕业证成绩单一模一样在线办理(SU毕业证书)美国雪城大学毕业证成绩单一模一样
在线办理(SU毕业证书)美国雪城大学毕业证成绩单一模一样
 
Business Laws Sunita saha
Business Laws Sunita sahaBusiness Laws Sunita saha
Business Laws Sunita saha
 
Incometax Compliance_PF_ ESI- June 2024
Incometax  Compliance_PF_ ESI- June 2024Incometax  Compliance_PF_ ESI- June 2024
Incometax Compliance_PF_ ESI- June 2024
 
San Remo Manual on International Law Applicable to Armed Conflict at Sea
San Remo Manual on International Law Applicable to Armed Conflict at SeaSan Remo Manual on International Law Applicable to Armed Conflict at Sea
San Remo Manual on International Law Applicable to Armed Conflict at Sea
 
Sangyun Lee, 'Why Korea's Merger Control Occasionally Fails: A Public Choice ...
Sangyun Lee, 'Why Korea's Merger Control Occasionally Fails: A Public Choice ...Sangyun Lee, 'Why Korea's Merger Control Occasionally Fails: A Public Choice ...
Sangyun Lee, 'Why Korea's Merger Control Occasionally Fails: A Public Choice ...
 
Ease of Paying Tax Law Republic Act 11976
Ease of Paying Tax Law Republic Act 11976Ease of Paying Tax Law Republic Act 11976
Ease of Paying Tax Law Republic Act 11976
 
Lifting the Corporate Veil. Power Point Presentation
Lifting the Corporate Veil. Power Point PresentationLifting the Corporate Veil. Power Point Presentation
Lifting the Corporate Veil. Power Point Presentation
 
fnaf lore.pptx ...................................
fnaf lore.pptx ...................................fnaf lore.pptx ...................................
fnaf lore.pptx ...................................
 
Matthew Professional CV experienced Government Liaison
Matthew Professional CV experienced Government LiaisonMatthew Professional CV experienced Government Liaison
Matthew Professional CV experienced Government Liaison
 
V.-SENTHIL-BALAJI-SLP-C-8939-8940-2023-SC-Judgment-07-August-2023.pdf
V.-SENTHIL-BALAJI-SLP-C-8939-8940-2023-SC-Judgment-07-August-2023.pdfV.-SENTHIL-BALAJI-SLP-C-8939-8940-2023-SC-Judgment-07-August-2023.pdf
V.-SENTHIL-BALAJI-SLP-C-8939-8940-2023-SC-Judgment-07-August-2023.pdf
 
Search Warrants for NH Law Enforcement Officers
Search Warrants for NH Law Enforcement OfficersSearch Warrants for NH Law Enforcement Officers
Search Warrants for NH Law Enforcement Officers
 
Defending Weapons Offence Charges: Role of Mississauga Criminal Defence Lawyers
Defending Weapons Offence Charges: Role of Mississauga Criminal Defence LawyersDefending Weapons Offence Charges: Role of Mississauga Criminal Defence Lawyers
Defending Weapons Offence Charges: Role of Mississauga Criminal Defence Lawyers
 
The Art and Science of Cryptoforensic Investigation: Best Practices and Tools
The Art and Science of Cryptoforensic Investigation: Best Practices and ToolsThe Art and Science of Cryptoforensic Investigation: Best Practices and Tools
The Art and Science of Cryptoforensic Investigation: Best Practices and Tools
 
2015pmkemenhub163.pdf. 2015pmkemenhub163.pdf
2015pmkemenhub163.pdf. 2015pmkemenhub163.pdf2015pmkemenhub163.pdf. 2015pmkemenhub163.pdf
2015pmkemenhub163.pdf. 2015pmkemenhub163.pdf
 
Genocide in International Criminal Law.pptx
Genocide in International Criminal Law.pptxGenocide in International Criminal Law.pptx
Genocide in International Criminal Law.pptx
 
Presentation (1).pptx Human rights of LGBTQ people in India, constitutional a...
Presentation (1).pptx Human rights of LGBTQ people in India, constitutional a...Presentation (1).pptx Human rights of LGBTQ people in India, constitutional a...
Presentation (1).pptx Human rights of LGBTQ people in India, constitutional a...
 
The Future of Criminal Defense Lawyer in India.pdf
The Future of Criminal Defense Lawyer in India.pdfThe Future of Criminal Defense Lawyer in India.pdf
The Future of Criminal Defense Lawyer in India.pdf
 

Creative destruction & Privacy Whitewashing: where does risk lie?

  • 1. CREATIVE DESTRUCTION & PRIVACY WHITEWASHING: WHERE DOES RISK LIE? Founder, Aurélie Pols & Associates January 30th 2023 aurelie.pols@protonmail.com 1
  • 2. aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates – Data Governance & Privacy Engineer Data is the New infrastructure – Privacy is the New Green – Trust is the New Currency Dutch nationality, French mother tongue, works in English, lives in Spain (+kids!) AURELIE POLS, DATA GOVERNANCE & PRIVACY ENGINEER • DPO for mParticle (Customer Data platform) – contractor (USA, New York) • Founder – Aurélie Pols & Associates • Group expert member for the Observatory on the Online Platform Economy (E03607) – EU Commission •Guest professor DPO certification courses Maastricht University, faculty of law (NL) & Solvay Business School Brussels (B) • Board Member European Center On Privacy and Security, Maastricht University (NL) • Ethics Advisory Group (EAG) – European Data Protection Supervisor (EDPS) Towards a digital ethics • Former Vice-chair P7002 – Data Privacy Process – IEEE • Speaker/writer/consiglieri: Mobile World Congress, SWSX, Strata (+ Hadoop World), IAPP, Piwik, AT Internet, industry associations, AdTech & MarTech vendors, … 2003: OX2 Co-founder Webanalytics.be 2008: Sold to Digitas LBi (Publicis) 2 Not former GAFAM
  • 3. What I do for a living In case you are (still) wondering ;-) 3
  • 4. Interlocking liabilities & obligations People Company (Telco, Bank, Insurance..) Company (Agency, consultancy, vendor, ...) Cloud provider • Aligning contract obligations • Risk • (+ Mitigation measures?) • Providing • Security + Privacy • Privacy engineering • Design & Default(s) B2C (+ B2B) B2B B2B Privacy Notices Lawful basis Data Subject Rights MSA SOW T&C 4
  • 5. 5
  • 6. aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates – IAB’s CEO at Annual Leadership Meeting 1. (Privacy) extremists are political opportunists 2. Attacks to ”our” industry also from within => Apple 3. Opportunity for healthy competition: positive ∑, not zero ∑? 6 Source: https://www.dataprotection authority.be/iab-europe- held-responsible-for-a- mechanism-that-infringes- the-gdpr
  • 7. aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates – Rise up? For what? For who exactly? 7
  • 8. aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates – Is the IAB spamming now? 8 The gathering has begun? Surely this is spam… And no opt-out link? tsssss 🇨🇦
  • 9. aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates – Let’s blame Canada! Perro ladrador poco mordedor (bark but no teeth) Why? 9 Source: https://www.priv.gc.ca/en/opc-news/news-and-announcements/2023/nr-c_230126/
  • 10. aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates – Had this been .. other than PIPEDA Let’s speculate 1. The GDPR, • A fine? • Deletion obligations? • At HomeDepot • For their processors? • (Notifications to data subjects?) 2. The US like CCPA/CPRA, Colorado, Connecticut, Virginia, Utah • Opt-out obligations? • A potential class action? 10
  • 11. 11
  • 12. 12
  • 13. aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates – Let’s go back to the story “Home Depot shared details from e-receipts with Meta without the knowledge or consent of customers” Geography: 🇨🇦 Purpose of data processing: delivering e-receipts to HomeDepot customers who purchased in store Data involved? Email Personal information? ✅ Applicable law: PIPEDA Program: Meta Platform Inc. Offline Conversions 13
  • 14. aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates – Taking a closer look at the data flows “Information sent to Meta was used to verify if a customer had a Facebook account. If they did, Meta compared the person’s in-store purchases to Home Depot’s advertisements sent over the platform to measure and report on the effectiveness of those ads. Meta’s Offline Conversions contractual terms also allowed it to use the customer information for its own business purposes, including user profiling and targeted advertising, unrelated to Home Depot” 14
  • 15. aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates – In “privacy” obligations terms, the issues are: i. sending PD/I to Meta beyond the purpose for the receipt (quid purpose limitation principle?) requires some form of a lawful basis under GDPR ii. Meta then engages in another data processing operation ie does the user have a FB account? + iii. FB compares to in-store purchases. isn't that data held by HomeDepot? how does FB do that? iv. to report on ad effectiveness ie another purpose in the interest of both companies and v. cross-mingle data between customer ie FB doesn't act as a data processor or even service provider under CCPA/CPRA anymore! 15
  • 16. aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates – Justifications by HomeDepot “Each email address Home Depot shared with Meta was encoded so that it could not be read by individuals at Facebook. ” “Home Depot said that it relied on implied consent and that its privacy statement, accessible through its website and in print upon request at retail locations, adequately explained that the company uses “de- identified information for internal business purposes, such as marketing, customer service, and business analytics” and that it “may share information for business purposes,” including “with third parties.” Home Depot also relied on Facebook’s privacy statement, which explained the Offline Conversions program” 16
  • 17. aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates – On the magic of de-identification This does NOT work under the GDPR or any opt-in laws which require: 1. A lawful basis • Implied consent is not one of them • GDPR has 6, LGPD has 10, Chinese PIPL 7 2. A defined purpose Please share broadly https://edps.europa.eu/system/files/2021-04/ 21-04-27_aepd-edps_anonymisation_en_5.pdf 17
  • 18. aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates – 10 misunderstandings related to anonymization 1. Pseudonimization is not anonymization 2. Encryption is not anonymization 3. Anonymization of data is always possible 4. Anonymization is forever 5. Anonymization always reduces the probability of re-identification to zero 6. Anonymization is a binary concept that can not be measured 7. Anonymization can be fully automated 8. Anonymization makes the data useless 9. Following an anonymization process used by others renders same results 10. There is no risk and no interest in finding out to whom this data refers to 18
  • 19. The data is anonymous, privacy law doesn’t apply Privacy whitewashing #1 19
  • 20. aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates – Justifications by HomeDepot (II) “... Meta employed an automated process that allowed it to match email addresses attached to Facebook accounts. Email addresses not already associated with a Facebook account could not be linked to individuals.” ”The company said that it did not notify customers of its information sharing agreement with Meta just prior to issuing e-receipts due to the risk of “consent fatigue.”” Actually, under the GDPR, the initial data processing operation would NOT require consent: the lawful basis would be contract. For subsequent processes however, like ADM, art 22 would apply where a data subject would have the Right NOT to be subject to it 20
  • 21. The consumer consented Privacy whitewashing #2 Follow up question is typically: to what exactly? PURPOSE 21
  • 22. aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates – Lessons learnt, now what? The structure of how laws are built up really varies Their consequences as well so what enforcement means How enforcement is then accepted also In the end this is all about change “Home Depot was fully cooperative throughout the investigation and has agreed to implement the OPC’s recommendations. The company stopped sharing customer information with Meta in October 2022.” 22
  • 23. The company will not do it anymore/again Privacy whitewashing #3 Follow up question is typically: how to make sure? 23
  • 24. aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates – High level: opt-in vs. opt-out laws Comparing roles in 2 major privacy laws: GDPR is a horizontal law, which took 5 years to mature, is enshrined within EU law (Charter + TFEU), enforced by supervisory authorities CCPA was originally proposed as a ballot proposition by a privacy group known as Californians for Consumer Privacy. 24 CCPA/CPRA GDPR Business Data controller Service provider Data processor 3rd party/data broker Joint controller Accountability Fundam ental right Lim ited rights Data to support growth
  • 25. aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates – US privacy law is sectoral You’ve all heard of COPPA, HIPAA, VPPA, Fair Credit Act, … And boy, is this getting complicated! P = right to opt-out of processing for profiling/targeted advertising purposes 25 Source: https://iapp.org/media/pdf/resource_ce nter/State_Comp_Privacy_Law_Chart.pdf
  • 26. aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates – Purpose is taking center stage Even in US state laws now: what is the data used for? The scope of opt-outs vary by state: 1. VA, CO & CT enable consumers to opt-out of targeted advertising, sale and profiling 2. UT enables consumers to opt-out of targeted advertising and sale of data (but not profiling) 3. CA enables consumers to opt-out of sale & sharing + under CPRA, when a business sees an opt-out preference signal (eg. GPC), it must also opt the consumer out of from profiling 26
  • 27. aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates – Legislative evolutions: where is ePrivacy? 28
  • 28. aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates – And yes there is more coming 29
  • 29. aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates – But not just Europe and cookies: SDKs… 30
  • 30. aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates – Does section 230, DMA/DSA ring any bells? 31
  • 31. aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates – ADM, ML & AI Start here Keep in mind 1. Lawful basis 2. Purpose (limitation) If PD/I 32
  • 32. aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates – While AI brings back IP challenges 33 Source: https://www.theverg e.com/2023/1/17/23 558516/ai-art- copyright-stable- diffusion-getty- images-lawsuit
  • 33. Provenance of digital raw material matters Risks lie in lack of explainability for all actors involved in the data ecosystem 34
  • 34. aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates – Data governance, the sexiest job of 2023? 35
  • 35. Thank you for coming to my presentation Aurelie.pols@protonmail.com 36 Life is like a plate of spaghetti, everthing is interconnected Life is like a box of chocolates, you never know what to expect!