Creative destruction & Privacy Whitewashing: where does risk lie?

CREATIVE DESTRUCTION & PRIVACY
WHITEWASHING: WHERE DOES RISK
LIE?
Founder, Aurélie Pols & Associates
January 30th 2023
aurelie.pols@protonmail.com
1

aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates –
Data Governance & Privacy Engineer
Data is the New infrastructure – Privacy is the New Green – Trust is the New Currency
Dutch nationality, French mother tongue, works in English, lives in Spain (+kids!)
AURELIE POLS,
DATA GOVERNANCE
& PRIVACY ENGINEER
• DPO for mParticle (Customer Data platform) – contractor (USA, New York)
• Founder – Aurélie Pols & Associates
• Group expert member for the Observatory on the Online Platform Economy (E03607) – EU Commission
•Guest professor DPO certification courses Maastricht University, faculty of law (NL) & Solvay Business School
Brussels (B)
• Board Member European Center On Privacy and Security, Maastricht University (NL)
• Ethics Advisory Group (EAG) – European Data Protection Supervisor (EDPS) Towards a digital ethics
• Former Vice-chair P7002 – Data Privacy Process – IEEE
• Speaker/writer/consiglieri: Mobile World Congress, SWSX, Strata (+ Hadoop World), IAPP, Piwik, AT Internet,
industry associations, AdTech & MarTech vendors, …
2003:
OX2 Co-founder
Webanalytics.be
2008:
Sold to Digitas LBi
(Publicis)
2
Not former GAFAM

What I do for a living
In case you are (still) wondering ;-)
3

Interlocking liabilities & obligations
People
Company
(Telco,
Bank,
Insurance..)
Company
(Agency,
consultancy,
vendor, ...)
Cloud
provider
• Aligning contract obligations
• Risk
• (+ Mitigation measures?)
• Providing
• Security + Privacy
• Privacy engineering
• Design & Default(s)
B2C (+ B2B)
B2B
B2B
Privacy Notices
Lawful basis
Data Subject Rights
MSA
SOW
T&C
4

IAB’s CEO at Annual Leadership Meeting
1. (Privacy) extremists are political opportunists
2. Attacks to ”our” industry also from within => Apple
3. Opportunity for healthy competition: positive ∑, not zero ∑?
6
Source:
https://www.dataprotection
authority.be/iab-europe-
held-responsible-for-a-
mechanism-that-infringes-
the-gdpr

Rise up? For what? For who exactly?
7

Is the IAB spamming now?
8
The gathering has begun? Surely this is spam…
And no opt-out link? tsssss
🇨🇦

Let’s blame Canada!
Perro ladrador poco mordedor
(bark but no teeth)
Why?
9
Source: https://www.priv.gc.ca/en/opc-news/news-and-announcements/2023/nr-c_230126/

Had this been .. other than PIPEDA
Let’s speculate
1. The GDPR,
• A fine?
• Deletion obligations?
• At HomeDepot
• For their processors?
• (Notifications to data subjects?)
2. The US like CCPA/CPRA, Colorado, Connecticut, Virginia, Utah
• Opt-out obligations?
• A potential class action?
10

Let’s go back to the story
“Home Depot shared details from e-receipts with Meta without the
knowledge or consent of customers”
Geography: 🇨🇦
Purpose of data processing: delivering e-receipts to HomeDepot
customers who purchased in store
Data involved? Email Personal information? ✅
Applicable law: PIPEDA
Program: Meta Platform Inc. Offline Conversions
13

Taking a closer look at the data flows
“Information sent to Meta was used to verify if a customer had a
Facebook account.
If they did, Meta compared the person’s in-store purchases to Home
Depot’s advertisements sent over the platform to measure and report
on the effectiveness of those ads.
Meta’s Offline Conversions contractual terms also allowed it to use the
customer information for its own business purposes, including user
profiling and targeted advertising, unrelated to Home Depot”
14

In “privacy” obligations terms, the issues are:
i. sending PD/I to Meta beyond the purpose for the receipt (quid purpose
limitation principle?) requires some form of a lawful basis under GDPR
ii. Meta then engages in another data processing operation ie does the
user have a FB account? +
iii. FB compares to in-store purchases. isn't that data held by HomeDepot?
how does FB do that?
iv. to report on ad effectiveness ie another purpose in the interest of both
companies and
v. cross-mingle data between customer ie FB doesn't act as a data
processor or even service provider under CCPA/CPRA anymore!
15

Justifications by HomeDepot
“Each email address Home Depot shared with Meta was encoded so
that it could not be read by individuals at Facebook. ”
“Home Depot said that it relied on implied consent and that its privacy
statement, accessible through its website and in print upon request at
retail locations, adequately explained that the company uses “de-
identified information for internal business purposes, such as
marketing, customer service, and business analytics” and that it “may
share information for business purposes,” including “with third parties.”
Home Depot also relied on Facebook’s privacy statement, which
explained the Offline Conversions program”
16

On the magic of de-identification
This does NOT work under the GDPR or any opt-in laws which require:
1. A lawful basis
• Implied consent is not one of them
• GDPR has 6, LGPD has 10, Chinese PIPL 7
2. A defined purpose
Please share broadly
https://edps.europa.eu/system/files/2021-04/
21-04-27_aepd-edps_anonymisation_en_5.pdf
17

10 misunderstandings related to anonymization
1. Pseudonimization is not anonymization
2. Encryption is not anonymization
3. Anonymization of data is always possible
4. Anonymization is forever
5. Anonymization always reduces the probability of re-identification to zero
6. Anonymization is a binary concept that can not be measured
7. Anonymization can be fully automated
8. Anonymization makes the data useless
9. Following an anonymization process used by others renders same results
10. There is no risk and no interest in finding out to whom this data refers to
18

The data is anonymous, privacy
law doesn’t apply
Privacy whitewashing #1
19

Justifications by HomeDepot (II)
“... Meta employed an automated process that allowed it to match email
addresses attached to Facebook accounts.
Email addresses not already associated with a Facebook account could not
be linked to individuals.”
”The company said that it did not notify customers of its information sharing
agreement with Meta just prior to issuing e-receipts due to the risk of
“consent fatigue.””
Actually, under the GDPR, the initial data processing operation would NOT
require consent: the lawful basis would be contract.
For subsequent processes however, like ADM, art 22 would apply where a
data subject would have the Right NOT to be subject to it
20

The consumer consented
Follow up question is typically: to what exactly? PURPOSE
21

Lessons learnt, now what?
The structure of how laws are built up really varies
Their consequences as well so what enforcement means
How enforcement is then accepted also
In the end this is all about change
“Home Depot was fully cooperative throughout the investigation and
has agreed to implement the OPC’s recommendations. The company
stopped sharing customer information with Meta in October 2022.”
22

The company will not do it
anymore/again
Follow up question is typically: how to make sure?
23

High level: opt-in vs. opt-out laws
Comparing roles in 2 major privacy laws:
GDPR is a horizontal law, which took 5 years to mature, is enshrined
within EU law (Charter + TFEU), enforced by supervisory authorities
CCPA was originally proposed as a ballot proposition by a privacy group
known as Californians for Consumer Privacy.
24
CCPA/CPRA GDPR
Business Data controller
Service provider Data processor
3rd party/data broker Joint controller Accountability
Fundam
ental right
Lim
ited rights
Data to support growth

US privacy law is sectoral
You’ve all heard of
COPPA, HIPAA, VPPA,
Fair Credit Act, …
And boy, is this
getting complicated!
P = right to opt-out of
processing for
profiling/targeted
advertising purposes
25
Source:
https://iapp.org/media/pdf/resource_ce
nter/State_Comp_Privacy_Law_Chart.pdf

Purpose is taking center stage
Even in US state laws now: what is the data used for?
The scope of opt-outs vary by state:
1. VA, CO & CT enable consumers to opt-out of targeted advertising,
sale and profiling
2. UT enables consumers to opt-out of targeted advertising and sale of
data (but not profiling)
3. CA enables consumers to opt-out of sale & sharing + under CPRA,
when a business sees an opt-out preference signal (eg. GPC), it
must also opt the consumer out of from profiling
26

Legislative evolutions: where is ePrivacy?
28

And yes there is more coming
29

But not just Europe and cookies: SDKs…
30

Does section 230, DMA/DSA ring any bells?
31

ADM, ML & AI
Start here
Keep in mind
1. Lawful basis
2. Purpose
(limitation)
If PD/I
32

While AI brings back IP challenges
33
Source:
https://www.theverg
e.com/2023/1/17/23
558516/ai-art-
copyright-stable-
diffusion-getty-
images-lawsuit

Provenance of digital raw
material matters
Risks lie in lack of explainability for all actors involved in the data ecosystem
34

Data governance, the sexiest job of 2023?
35

Thank you for coming to my
presentation
Aurelie.pols@protonmail.com
36
Life is like a plate of spaghetti, everthing is interconnected
Life is like a box of chocolates, you never know what to expect!

Creative destruction & Privacy Whitewashing: where does risk lie?

Recommandé

Recommandé

Contenu connexe

Tendances

Tendances (20)

Similaire à Creative destruction & Privacy Whitewashing: where does risk lie?

Similaire à Creative destruction & Privacy Whitewashing: where does risk lie? (20)

Plus de Aurélie Pols

Plus de Aurélie Pols (20)

Dernier

Dernier (20)

Creative destruction & Privacy Whitewashing: where does risk lie?