GDPR talk from Vilnius Big Data Meetup of the 26 February, 2016

Some points from GDPR regulation

Transcript

1. GDPR vs (AI,ML,Big Data environment) Juliana Vorono https://www.linkedin.com/in/vorono/ 2018 February 22
2. Outline of the talk 1.Why GDPR was required 2.Practical implications of GDPR in AI, ML and data driven environoment 3.Sources of further information
3. How it all started • Data ownership • Data privacy
4. Joke “Google's pizza” • - Hello! Gordon's pizza? - No sir it's Google's pizza. - So it's a wrong number?" Sorry - No sir, Google bought it. - OK. Take my order please - Well sir, you want the usual?" - The usual? You know me? - According to our caller ID data sheet, in the last 12 times, you ordered pizzawith cheeses, sausage, thick crust. - OK! This is it ... - May I suggest to you this time ricotta, arugula with dry tomato.? - What? I hate vegetables. - Your cholesterol is not good, sir." - How do you know? - We crossed the number of your fixed line ☎with your name, through the subscribers guide. We have the result of your blood tests for the last 7 years. - Okay, but I do not want this pizza!,I already take medicine ... -"Excuse me, but you have not taken the medicine regularly, from our commercial database, 4 months ago, you only purchased a box with 30 cholesterol tablets at Drugsale Network. - I bought more from another drugstore. - It's not showing on your credit card statement - I paid in cash - But you did not withdraw that much cash according to your bank statement - I have have other source of cash - This is not showing as per you last Tax form unless you bought them from undeclared income source. -WHAT THE HELL? "I'm sorry, sir, we use such information only with the intention of helping you.❤❤❤ - Enough! I'm sick of google, facebook, twitter, WhatsApp. I'm going to an Island without internet, cable TV, where there is no cell phone line and no one to watch me or spy on me "I understand sir but you need to renew your passport first as it has expired 5 weeks ago
9. Point to consider GDPR is not only about third party or customers data, but rather all the person identifiable data, hence data on your past, current and future employees should be included in the scope.
10. Practical implications It is allowed to collect and process personal data, however, one has to make sure, that this is compliant at all stages from collection to processing and that once processed or data subject’s note received, the appropriate data is destroyed. Moreover, if a company obtains customer consent to use their personal data, that data cannot be processed or used for any other purpose other than that for which consent was given
11. Things to consider 1. Personal Data 2. Principles 3. Lawful processing 4. Data subject’s rights 5. Data protection officer 6. Data breach notification 7. Controller and processor 8. Sensitive data 9. Subject matter 10. Material scope 11. Enforcement 12. PIA 13. Territorial scope 14. Codes of conduct and certification 15. Supervisoty authority 16. International transfer
15. Practical example from HR
16. Profilingin Article 22 of the GDPR "profiling" addresses automated decision-making and profiling, and in related provisions. "the data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.”
18. Why no profiling? Quoting from the 2014 White House Big Data Report, the EDPS identified risks of big data as lack of transparency, informational imbalance, erosion of data protection principles, spurious correlations and unfair discriminatory outcomes, as well as social, cultural, and creative stultification. Some of the privacy risks particularly pronounced in the context of big data profiling therefore include: • Processing of personal data outside of the purpose for which it was collected; • Use of incorrect and/or outdated information; • Discrimination or bias against certain individuals or groups resulting from the application of certain profiling algorithms; • Processing of personal data in excess of what is needed in order to process it. Because automatic processing involves such high risks to privacy, it is prohibited in principle under the GDPR, except where: • It is performed based on (explicit) consent; or • It is required to enter into or perform a contract, provided the data subjects concerned can contest an automatic decision and obtain human intervention.
19. Data ownership Data subject has rights to his personal private data: • Consent needed for collection • Can always check, what data has been collected • Can ask data to be destroyed
20. Analytics in UK The ICO report considers the types of personal data used for big data analytics. It may involve the use of ‘new types of data’ for the analysis, such as ‘observed data’, ‘derived data’ and ‘inferred data’. These data are additional to personal data consciously provided by the individual. The new types of data are collected through various sensors, cookies, or produced by using machine learning algorithms and analytics methods. The ICO provides six key recommendations for compliance with the GDPR: 1. anonymise personal data, where personal data is not necessary for the analysis; 2. be transparent about the use of personal data for big data analytics and provide privacy notices at appropriate stages throughout a big data project; 3. embed a privacy impact assessment process into big data projects to help identify privacy risks and address them; 4. adopt a privacy by design approach in the development and application of big data analytics; 5. develop ethical principles to help reinforce key data protection principles; and 6. implement internal and external audits of machine learning algorithms to check for bias, discrimination and errors.
21. Do you see the difference?
24. More sources of information - EU level • GDPR http://eur-lex.europa.eu/legal- content/en/TXT/?uri=CELEX%3A32016R0679 • European Parliament resolution of 14 March 2017 on fundamental rights implications of big data: privacy, data protection, non- discrimination, security and law-enforcement (2016/2225(INI)) http://www.europarl.europa.eu/sides/getDoc.do?pubRef=- //EP//NONSGML+TA+P8-TA-2017-0076+0+DOC+PDF+V0//EN
25. More sources of information - country level • Information Commissioner’s Office (UK) https://ico.org.uk/for-organisations/guide-to-the-general-data- protection-regulation-gdpr/ • Valstybinė duomenų apsaugos inspekcija (Lithuania) https://www.ada.lt/ • Other EU national bodies http://ec.europa.eu/newsroom/just/document.cfm?doc_id=48619
26. Industry level best pracises and info • The International Associatin of Privacy Professionals (IAPP) https://iapp.org/news/ • GDPR Awareness Coalition http://gdprcoalition.ie/ • Your industry level association, best practices journal etc. Once this GDPR thing is clear and implemented, the best practises will start forming that will lead to GDPR complience.
27. GDPR compliance is a constant journey!!!