Speaker: Martin Kurze

1. Understanding Privacy…
… and data in personalized marketing: How to become a responsible data handler

2. ILLEGALBIG DATA
You should be scared
…. ore at least awake right now. Good Morning!

3. Understanding Privacy…
marketing: How to become a responsible data handler

4. EU Privacy Directive 95/46/EC
• It’s the law
• --- it must be boring 
EU Privacy Directive 2016/680
• It’s the law
• --- it must stay boring 

5. Relax …
• This is not my style
• I’m not a lawyer
• I’m an engineer.

6. Actually, I’m a researcher
• doing “real” research
• not “market” research
• (or do you deny that academia is “real”?)
• And: I’m a doctor
• but not a “real one”

7. I work for T-Labs
• Telekom Innovation Laboratories
(Deutsche Telekom’s R & D Unit)
• 300 Employees, DT-corporate and
Technical University researchers
• Our Slides look like this:

8. But not today
• Today I’m here to present some insights
we gained in our projects on data privacy

9. Privacy is NOT
• the preventer of innovative marketing
• an excuse for poor personalization
Innovative
Privacy,
Privacy
Protection
Privacy
© dilbert.com

10. Privacy is Rather
• your opportunity for an USP
• a technology that serves your customers
• a source of deep insights to customer
preferences and fears
• A means to make the world a better place.

11. This talk is about
• Privacy enhancing technologies
• “Privacy By Design”
• Monetizing privacy (features)
• some trends in privacy research
• and YOUR quesitions!

12. This talk is NOT
• a legal training (§§)
• aimed at security experts 
• a typical market research speech (sorry!)
• to be ignored

13. A few remarks impulses:
• Who owns user data?
• who controls them?
• who makes money with user data?
• Does privacy impact business?

14. YES! P.E.T. are here to
increase (your) profits!
• P.E.T. = Privacy Enhancing Technologies
• N.B.: P.E.T. also can increase your
customer’s profits/benefits (end customers)

15. Privacy Enhancing Technologies
• Cryptography
• Traceability
• Transparency
• Anonymization/Pseudonymization
• “artificial data”, “differential privacy” & more
• IT security

16. “Privacy By Design”
• by Ann Cavoukian
(Privacy Commissioner of Ontario, Canada, 1995)
(https://www.ipc.on.ca/wp-content/uploads/Resources/7foundationalprinciples.pdf )
• general adoption in many countries and
companies
• a good starting point

17. Ann Cavoukian, PhD
Information & Privacy
Commissioner,
Ontario, Canada
10.11.2
Concept, developed in the 1990s, still growing
Assumption:
Compliance and regulatory frameworks are not sufficient
Instead, privacy assurance must be “in the genes” of the
organization, so it will be its “default” mode of operation
and design/development.
PbD extends PETs (Privacy Extendig Technologies) to
PETplus  added value!
applies to:
• IT systems, business practices,
• physical design and
• (networked) infrastructure
• … market research and CRM? …

18. PBD: 7 foundational principles
1. Proactive not reactive; Preventative not remedial
2. Privacy as the default setting
3. Privacy embedded into design
4. Full functionality – positive-sum, not zero-sum
5. End-to-end security – full lifecycle protection
6. Visibility and transparency – keep it open
7. Respect for user privacy – keep it user-centric

19. 1. Proactive not Reactive; Preventative not
Remedial
• The Privacy by Design (PbD) approach is characterized
by proactive rather than reactive measures. It anticipates
and prevents privacy-invasive events before they
happen. PbD does not wait for privacy risks to
materialize, nor does it offer remedies for resolving
privacy infractions once they have occurred – it aims to
prevent them from occurring. In short, Privacy by
Design comes before-the-fact, not after.
 Have a privacy (by design) expert in your (design) team

20. 2. Privacy as the Default Setting
• We can all be certain of one thing – the default rules!
Privacy by Design seeks to deliver the maximum degree
of privacy by ensuring that personal data are
automatically protected in any given IT system or
business practice. If an individual does nothing, their
privacy still remains intact. No action is required on the
part of the individual to protect their privacy – it is built
into the system, by default.
 Let the user take over initiative (results in better quality insights)

21. 3. Privacy Embedded into Design
• Privacy is embedded into the design and architecture of
IT systems and business practices. It is not bolted on as
an add-on, after the fact. The result is that it becomes an
essential component of the core functionality being
delivered. Privacy is integral to the system, without
diminishing functionality.
 once done, this is easy to repeat later on in market research 

22. 4. Full Functionality – Positive-Sum, not Zero-
Sum
• Privacy by Design seeks to accommodate all legitimate
interests and objectives in a positive-sum “win-win”
manner, not through a dated, zero-sum approach, where
unnecessary trade-offs are made. Privacy by Design
avoids the pretense of false dichotomies, such as privacy
vs. security, demonstrating that it is possible to have
both.
 How can the “subject” of market research benefit? Think!

23. 5. End-to-End Security – Full Lifecycle Protection
• Privacy by Design, having been embedded into the
system prior to the first element of information being
collected, extends throughout the entire lifecycle of the
data involved, from start to finish. This ensures that at the
end of the process, all data are securely destroyed, in a
timely fashion. Thus, Privacy by Design ensures cradle to
grave, lifecycle management of information, end-to-end.
 security is a “must have” anyway. Why not use it for privacy too?

24. 6. Visibility and Transparency – Keep it Open
• Privacy by Design seeks to assure all stakeholders that
whatever the business practice or technology involved, it
is in fact, operating according to the stated promises and
objectives, subject to independent verification. Its
component parts and operations remain visible and
transparent, to users and providers alike. Remember,
trust but verify.
 Transparency guarantees insights (sic!)

25. 7. Respect for User Privacy – Keep it User-
Centric
• Above all, Privacy by Design requires architects and
operators to keep the interests of the individual
uppermost by offering such measures as strong privacy
defaults, appropriate notice, and empowering user-
friendly options. Keep it user-centric.
 the “subject “ (end-customer) is the eventual source of your revenue
 nice “side effect”: the user maintains his/her own data. So it stays
up-to-date with no extra effort (if done correctly ;-)

26. Example: Big Data & Privacy
New R&D project to start in Jan 2017:
• use “linked data”, a method of publishing structured
data so that it can be interlinked and become more useful
through semantic queries [Wikipedia]
• provide a “data dashboard” for tracking
• provide a “data cockpit” for control
 expected outcome: more “opt ins” for survey and data usage 

27. Benefits for the end user
reward the end user by
• money (simple but expensive and “vintage”)
• more accurate service offerings
• faster service delivery/operations
• gamification: let users compete and
compare their privacy settings/preferences

28. Be Open and Open Minded
• open your collection of personal data to the
end user (the source/owner of the data)
• open your derivates/conclusions of this
collection to the user. (no risk, no fun  )
• open yourself and your data/findings to the
general public! (might be a challenge by itself!)

29. Trends in Privacy Research
• Differential Privacy
• Artificial Data
• Location Blur
• Blockchains (not always a P.E.T. !!)
• Apply to non-IT driven products (are their any?)

30. Thank you!
• Questions?
I hope so!
• Use the app, use your brain, and use your mouth!
• Contact me “privately”:
martin.kurze@telekom.de +49 171b864 22 46
• https://www.linkedin.com/in/kurze