Webmardi - GDPR

GDPR is everyone's responsibility Jérémie Fontana | Designer & Privacy
Advocate @ Liip 2018-05-01//19:00 Webmardi — @skynebula

Webmardi : GDPR — 2018-05-01//19:00 @ Liip — Jérémie Fontana
— @skynebula — Good evening y’all!!

— @skynebula — Thanks

— @skynebula Thank you… webmardi.ch

— @skynebula Thank you… liip.ch

— @skynebula — Who are you?

— @skynebula — Technology

— @skynebula — UX & Design

— @skynebula — Marketing

— @skynebula — Legal

— @skynebula — Privacy

— @skynebula — Who am I?

— @skynebula Jérémie Fontana Designer  & Privacy Advocate — —

— @skynebula Jérémie Fontana Designer  & Privacy Advocate — — liip.ch Work

— @skynebula Jérémie Fontana Designer  & Privacy Advocate — — hackstock.net Podcast

— @skynebula Jérémie Fontana Designer  & Privacy Advocate — — Support jfontana.fr/activism

— @skynebula — Disclaimer

— @skynebula — Lawyer I am not a

— @skynebula — Consultant I am not a

— @skynebula — Digital marketer I am not a

— @skynebula — IT guy I am not an

— @skynebula — Mark Zuckerberg I am not

— @skynebula That’s why this talk won’t be about… • How to bypass GDPR (sorry, not sorry) • How to setup your SAP • How to conﬁgure Google Analytics • How to protect your backups • How to try to look like a real human

— @skynebula — Questions?

— @skynebula — Ask! whenever you want

— @skynebula Agenda • What is GDPR? • Risks • Beneﬁts • Bad & good practices • Privacy by Design • One more thing…

— @skynebula — GDPR

— @skynebula “ I got 99 problems but your data ain’t one.

— @skynebula 99 articles 88 pages 24 languages

— @skynebula Started 2012

— @skynebula Voted April 27, 2016 #2016/679

— @skynebula Application May 25, 2018

— @skynebula — Principles

— @skynebula Purpose More control over our own personal data

— @skynebula Purpose More responsibility   on enterprises

— @skynebula Purpose Human rights “The processing of personal data should be designed to serve mankind.” — Introduction

— @skynebula Privacy is a fundamental Human Right “No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honor and reputation. Everyone has the right to the protection of the law against such interference or attacks.” — Article 12 of the 1948 Universal Declaration of Human Rights

— @skynebula Scope All personal data “The processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a ﬁling system or are intended to form part of a ﬁling system.” — Article 2

— @skynebula What is Personal data? • Name • Email address • Home address  • Phone number • Location data • Username • Password • IP address • Browsing habits • Device identiﬁers

— @skynebula What is Sensitive data? • Racial or ethnic origin • Religion • Union membership • Political preferences • Health data • Genetics • Biometrics…

— @skynebula Who are the Data subjects?

— @skynebula Data subjects are People

— @skynebula Data subjects are People on EU soil

— @skynebula Who is the Data controller? • Entity established in EU • Entity outside of EU but selling goods/services to people in EU • Entity outside of EU but tracking people in EU

— @skynebula Who is the Data processor? • Entity tracking / processing / storing personal data   for the data controller, inside or outside the EU

— @skynebula — Rights of the people

— @skynebula Rights Information — Articles 13 & 14

— @skynebula Rights Access — Article 15

— @skynebula Rights Rectiﬁcation — Article 16

— @skynebula Rights Restriction of processing   — Article 18

— @skynebula Rights Objection — Article 21

— @skynebula Rights Automated decision-making   — Article 22

— @skynebula Rights Erasure — Article 17

— @skynebula Rights Data portability — Article 20

— @skynebula — Obligations   of enterprises

— @skynebula Obligations Principle of accountability — Article 5

— @skynebula Accountability Reverse onus — Article 5

— @skynebula Obligations Notiﬁcation — Article 19

— @skynebula Obligations Communication   of a data breach — Article 34

— @skynebula Obligations Data minimization — Article 5

— @skynebula Obligations Pseudonymization — Article 6

— @skynebula — Minimization > Pseudonymization

— @skynebula — Minimization > Anonymization

— @skynebula Obligations Encryption — Article 32

— @skynebula Obligations Consent “Consent should be given by a clear aﬃrmative act establishing a freely given, speciﬁc, informed and unambiguous indication of the data subject's agreement to the processing of personal data.” — Introduction

— @skynebula Obligations Consent “Silence, pre-ticked boxes or inactivity should not therefore constitute consent.” — Introduction

— @skynebula Obligations Consent “When the processing has multiple purposes, consent should be given for all of them.” — Introduction

— @skynebula Obligations Consent “If the data subject's consent is to be given following a request by electronic means, the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided.” — Introduction

— @skynebula Obligations Consent — Article 7 • Clearly distinguishable from the other matters • In an intelligible and easily accessible form • Using clear and plain language

— @skynebula Obligations Data Protection Oﬃcer — Article 30

— @skynebula Obligations Data processing registry — Article 30

— @skynebula Obligations Privacy Impact Assessment — Article 35

— @skynebula — And what about Switzerland?

— @skynebula Yes… GDPR applies to Swiss companies

— @skynebula GDPR vs Swiss companies Swiss co. having   a branch in EU — Article 3

— @skynebula GDPR vs Swiss companies Swiss co. acting   as processor   for a EU co. — Article 3

— @skynebula GDPR vs Swiss companies Swiss co. selling goods & services to people in EU — Article 3

— @skynebula GDPR vs Swiss companies Swiss co. tracking behaviors of people in EU — Article 3

— @skynebula — Be there or be square!

— @skynebula GDPR principles are coming to Switzerland Swiss privacy law   is being revised   to match GDPR

— @skynebula — Risks

— @skynebula — Human risk

— @skynebula Human risk The psychiatrist   & Facebook

— @skynebula Human risk The online platform   for children

— @skynebula — Business loss

— @skynebula Business loss Startup at EPFL

— @skynebula — Reputation

— @skynebula Reputation Facebook &   Cambridge Analytica

— @skynebula — Fines

— @skynebula Fines Up to € 20 million…

— @skynebula Fines or 4%   of worldwide annual turnover…

— @skynebula Fines Whichever   is higher!

— @skynebula — Benefits

— @skynebula Beneﬁts Human rights

— @skynebula Human rights Signal • End-to-end encrypted messaging app • Censorship circumvention • No logs

— @skynebula Beneﬁts Competitive advantage

— @skynebula Competitive advantage ProtonMail • Encrypted email service

— @skynebula Competitive advantage Cozy • Secure personal hub

— @skynebula Competitive advantage Nord VPN • “No logs” Virtual Private Network

— @skynebula Competitive advantage Wire • End-to-end encrypted messaging app

— @skynebula Competitive advantage Apple • Sensitive data computed and stored only on the device

— @skynebula — Bad & good practices

— @skynebula — Bad practices

— @skynebula — Dark patterns

— @skynebula Dark patterns

— @skynebula Lawyers and yield-maximizers can ﬁnd ways to use ﬁne print and digital maneuvers to get the same sort of low-grade tolerance and low-impact marketing they've always gotten. “ — Seth Godin

— @skynebula Realize that the GDPR is a net positive for people with something to say, something to sell or something to change. Because the noise will go down and trust will go up. “ — Seth Godin

— @skynebula — Good practices

— @skynebula Talk to people who want to be talked to. Market to people who want to be marketed to. In two simple words:   Ask First. “ — Seth Godin

— @skynebula Good practices

— @skynebula — Privacy by Design

— @skynebula Privacy knows no borders: we have to protect privacy globally or we protect it nowhere! “ — Ann Cavoukian, Ph.D

— @skynebula — 7 principles of Privacy by Design

— @skynebula Privacy by Design, principle #1 Proactive   not reactive Preventative not remedial

— @skynebula Privacy by Design, principle #2 Privacy as   the default setting Privacy by Default

— @skynebula Privacy by Design, principle #3 Privacy embedded into design

— @skynebula Privacy by Design, principle #4 Full functionality Positive-sum, not zero-sum

— @skynebula Privacy by Design, principle #5 End-to-end security Full lifecycle protection

— @skynebula Privacy by Design, principle #6 Visibility   and transparency Keep it open

— @skynebula Privacy by Design, principle #7 Respect   for user privacy Keep it user-centric

— @skynebula — Practical examples

— @skynebula Example #1 Newsletter

— @skynebula Newsletter OK Don Required First name Draper Required Last name [email protected] Required Email address

— @skynebula Newsletter SUBSCRIBE TO THE NEWSLETTER I agree to subscribe Optional First name Optional Last name [email protected] Required Email address

— @skynebula Example #2 Personal details

— @skynebula [email protected] Required Email address Don Required First name Draper Required Last name Select Required Gender Select Male Female Personal details

— @skynebula Don Required First name Draper Required Last name Select Optional Gender [email protected] Required Email address Personal details

— @skynebula [email protected] Required Email address Don Required First name Draper Required Last name Select Optional Gender Select Female Non binary Male Other Personal details

— @skynebula Example #3 Public proﬁle

— @skynebula I don’t wanna share my proﬁle publicly I wanna share my name I wanna share my email I wanna share my phone number Public profile

— @skynebula I wanna share my proﬁle publicly I wanna share my name I wanna share my email I wanna share my phone number Public profile

— @skynebula Example #4 Tracking

— @skynebula ↳ IP address ↳ Country ↳ Region / City ↳ Precise location ↳ Browser ↳ Operating System ↳ Device ↳ Battery level ↳ Browsing history ↳ Social media proﬁles Log ﬁle / database Tracking

— @skynebula A good designer ﬁnds an elegant way to put everything you need on a page.   A great designer convinces you half that shit is unnecessary. “ — Mike Monteiro

— @skynebula — Ethical Design

— @skynebula The only important thing about design is how it relates to people. “ — Victor Papanek

— @skynebula Respect

— @skynebula — One More Thing…

— @skynebula — One.Thing.Less

— @skynebula

— @skynebula Empowering digital trust.

— @skynebula

— @skynebula May 25. onethingless.com

— @skynebula — Thank you! ↳ jfontana.fr ↳ @skynebula ↳ liip.ch — Jérémie Fontana Slides: ↳ liip.to/webmardigdpr — —

— @skynebula Credits Font Icons Neue Haas Grotesk Streamline by Christian Schwartz by Webalys Ethical Design Manifesto Ind.ie by Laura Kalbag & Aral Balkan

Webmardi - GDPR

Webmardi - GDPR

More Decks by Jérémie Fontana

Other Decks in Design

Featured

Transcript