Latest / The FIT4Privacy Podcast | Exploring ISO Standards AI Privacy | Grow Skills Store / World Privacy Forum with Pam Dixon and Punit Bhatia in the FIT4PRIVACY Podcast E157 S07

Transcript

World Privacy Forum with Pam Dixon and Punit Bhatia in the FIT4PRIVACY Podcast E157 S07 · The FIT4Privacy Podcast | Exploring ISO Standards AI Privacy | Grow Skills Store

• 0:00
  World Privacy firm has been the forefront of privacy research.
• 0:04
  It has been shaping how privacy evolves and what is done in
• 0:07
  privacy for last few decades now.
• 0:10
  How about understanding digital trust, the future of privacy or
• 0:15
  maybe medical identity theft or topics like how is OECD shaping
• 0:20
  AI? What are the principles it's
• 0:22
  based on? And is there anyone research
• 0:24
  like India's Aadhar card which is making World Privacy Forum
• 0:28
  proud? Or what's happening on data
• 0:30
  governance and data protection? Well, all these are very
• 0:33
  interesting questions and if we have to look at it from the
• 0:36
  perspective of World Privacy Forum, there's none other than
• 0:40
  who's better suited to do this then Pam Dixon, who is the
• 0:44
  Executive director and founder of World Privacy Forum.
• 0:47
  And I have the privilege and honour of welcoming her to Fit
• 0:49
  for Privacy podcast. So let's go and talk to her.
• 0:52
  And as we do that, take a moment to visit fitforprivacy.com for
• 0:56
  your consulting needs and Crow Skills Dot Store for your
• 0:59
  training needs. Welcome to the Fit for Privacy
• 1:02
  Podcast where your host Puneet Bhatia discusses the latest
• 1:06
  trends, challenges and opportunities in privacy,
• 1:09
  artificial intelligence, sourcing and related fields with
• 1:12
  industry leaders and experts. Whether you're a professional
• 1:15
  business leader or just passionate about topics like AI
• 1:18
  and privacy, this is your go to place for insightful
• 1:21
  conversations and practical advice.
• 1:23
  The Fit for Privacy Podcast is brought to you by Fit for
• 1:26
  Privacy, your trusted partner in AI, privacy and sourcing matters
• 1:30
  and gross skill store. Your go to destination for top
• 1:33
  tier training on ISO standards and key EU regulations.
• 1:36
  Remember that opinions expressed in this podcast are not legal
• 1:39
  advice. Now it's time to dive in today's
• 1:42
  episode. Hello and welcome to another
• 1:47
  episode of the Fit for Privacy podcast.
• 1:49
  And today we have a special guest, Pam Dixon.
• 1:52
  Pam, welcome to Fit for Privacy Podcast.
• 1:54
  Well. Thank you for your kind
• 1:56
  invitation. I'm happy to be here.
• 1:58
  It's a pleasure to have you and for somebody who has such a vast
• 2:02
  knowledge, experience and background in privacy, I'd like
• 2:05
  to ask you, how would you define trust in this digital AI and
• 2:11
  emerging technology world? Well, if.
• 2:15
  You look at the world. Economic Forum conception of
• 2:18
  this and then compare it with, for example, the issaka
• 2:22
  conception of this there there are many different.
• 2:24
  Ideas about what? Quote unquote digital trust
• 2:27
  means. However, I think we can agree
• 2:29
  upon a baseline definition is that it's a bit of a new
• 2:34
  iteration of. What I would call trustworthy
• 2:36
  AI, but. More broad to encompass the
• 2:39
  entire digital ecosystem and ecosystems.
• 2:42
  Across the globe. And so it encompasses privacy.
• 2:48
  Data flows, Cross-border data. Flows cybersecurity.
• 2:53
  It encompasses provenance. It encompasses many, many
• 2:58
  different. Aspects of trustworthy digital
• 3:02
  ecosystems. That's very well said and I
• 3:06
  think that means doing the right things.
• 3:08
  But in all this, when we talk about trust, AI and all these
• 3:11
  things, we say what's happening with privacy?
• 3:14
  Where are we going? What is going to happen in next
• 3:18
  few years? Is it going to remain important?
• 3:21
  Are there some topics we need to be concerned about, aware about?
• 3:24
  So what's your view on that privacy going forward?
• 3:28
  I don't know how much horizon you want to cover, but privacy
• 3:31
  going forward. Yeah, so I actually wrote.
• 3:35
  About this in a fairly recent report called Risky Analysis.
• 3:39
  It's a 2023 report. Robert Gellman and I wrote an
• 3:43
  introduction to the. Report It's not clear that we
• 3:46
  wrote it. But we did, and it's.
• 3:47
  Really talked about the past of privacy where.
• 3:51
  From the 1970s approximately until our current time to I
• 3:56
  would peg it to approximately 20/17/2018, right around the
• 4:03
  time of the development of the really transformative deep
• 4:07
  machine learning and new AI models and also the effectuation
• 4:14
  of the General Data protection Regulation, which all kind of
• 4:17
  happened around the same time. It's basically.
• 4:20
  That era. And.
• 4:22
  What you saw or could see is a lot of.
• 4:25
  Experimentation It was the development of the fair
• 4:28
  information principles first in the US at the H.
• 4:32
  EW. And then at the.
• 4:33
  OECD. And then diffuse.
• 4:36
  Through. EU 9546 and through laws all
• 4:40
  around the world, privacy laws all around the world, in the US,
• 4:44
  everywhere, a lot of different places, and then slowly but
• 4:47
  surely. As.
• 4:48
  The ecosystems, the digital ecosystems evolved with the
• 4:52
  inception of the Internet and with just how how much faster
• 4:58
  data was moving, how much more data we could store, the compute
• 5:03
  that was becoming more advanced. And sophisticated.
• 5:06
  And capable. All of these things led to a
• 5:09
  much deeper form, a much more efficient and effective form of
• 5:15
  machine learning. Which I would call for our
• 5:19
  purposes deep learning. But also the transformer models
• 5:22
  that we saw come out in 2017 this this ended up changing.
• 5:31
  The trajectory of where privacy was about to go.
• 5:35
  So I remember reading some research papers in 2017 and
• 5:39
  going oh. Oh boy, I don't know where this.
• 5:43
  Goes, but it's going somewhere and it's going a different
• 5:46
  direction than we've been going. This is a sea change and I
• 5:50
  really wasn't sure where it was going to go.
• 5:52
  But right around that time I started working with OEC.
• 5:55
  D on the OECDAI. Principles and that took up.
• 5:58
  About two years of work it was. Completely worth it, but in 2019
• 6:03
  I. Very actively.
• 6:04
  Began looking at this question of OK, what happens to privacy?
• 6:09
  At one point I wasn't. Really.
• 6:11
  Sure, privacy. Was going to survive this
• 6:13
  transition, however, what has happened in the intervening?
• 6:17
  Years is that it has become very clear that privacy appears to
• 6:21
  be. Part of the human condition or.
• 6:25
  Prerequisite. Prerequisite for really good.
• 6:29
  Human flourishing, so privacy is not going.
• 6:32
  To go away, however, what I would say to you is this.
• 6:36
  I've come to a very, very deeply researched opinion that this
• 6:40
  revolution will be automated and what I mean by.
• 6:44
  That is that. Going back to the risky analysis
• 6:48
  report in that. Report We created a global index
• 6:51
  for all of the tools the AI. Governance tools that were being
• 6:57
  used by the governments at that time, and what we found is that
• 7:04
  really the. It was the.
• 7:05
  The the beginning of the cusp of automation of trustworthy AI.
• 7:12
  So if you're. Going to automate trustworthy
• 7:14
  IAI. Privacy is part of that.
• 7:16
  Bundle means we're going to be automating privacy and we're
• 7:20
  going to be pulling it to scale. So how do you scale something as
• 7:26
  ephemeral as privacy? How do you make it into
• 7:29
  something that's scalable? Well, the answer is is that.
• 7:33
  You have to have a really serious audit, that is.
• 7:36
  Not just a risk assessment, but a true.
• 7:38
  Audit like AA12. 1200 point audit to a 1700 point audit, A
• 7:43
  genuine into in depth audit that is then quantifiable overtime
• 7:50
  and benchmark able and there's good metrology associated.
• 7:55
  With it so. I think this is where privacy is
• 7:59
  going. Because it's.
• 8:02
  Just not going to be. Possible to effectuate privacy
• 8:07
  by. Hand, if you will, maybe if
• 8:09
  you're a very small business with with and you're doing
• 8:12
  everything on paper, but I think that's going to be fewer and
• 8:15
  fewer ecosystems now. Right now we're kind of in a
• 8:19
  time of mixed. Ecosystems where we have.
• 8:21
  Analogue and digital, but we're really rapidly moving into a
• 8:25
  fully digital series of ecosystems and the larger a
• 8:28
  company, the more. Digital it is that.
• 8:31
  You know that. They are likely to be.
• 8:33
  So and our lives are becoming increasingly digital.
• 8:37
  So I I do. Think that we'll see automated
• 8:39
  privacy. So what changes, what stays the
• 8:42
  same? That's really the question we're
• 8:44
  looking at. How do you regulate that?
• 8:47
  Can you regulate that? These are some of the very
• 8:51
  important questions when I talk about this.
• 8:55
  Typically constitutional lawyers will agree with me and they'll
• 9:00
  say, yeah, we agree. And there is not a very good
• 9:05
  match between artificial intelligence, machine learning
• 9:10
  and constitutional law and. Basically.
• 9:13
  Basically various legal concepts.
• 9:16
  And we have to find what allows them to communicate to each
• 9:20
  other cohesively, systematically and you know, dependably.
• 9:28
  We quite haven't quite found that yet.
• 9:30
  We're still working from older models and we've got people
• 9:34
  working from older models. We've got people working from
• 9:37
  newer models. But I would propose that.
• 9:39
  We haven't found the actual kind of middle.
• 9:42
  Road yet where we're. Going to have to have a more
• 9:44
  hybrid model of working with. This, that's, that's that.
• 9:48
  Really creates substantive improvement over the matching of
• 9:54
  what we're doing now. In other words, matching what
• 9:57
  we're doing to the. Reality of the ecosystems,
• 9:59
  that's really what we're. Looking for and that's a big
• 10:02
  tall order and I don't think anyone's got a corner on that
• 10:06
  market yet. No, I think that's to be seen
• 10:11
  how it goes and how fast or how far we go in that direction.
• 10:15
  But I'm glad you believe, like many others in privacy space,
• 10:19
  that it's here to stay and it will evolve into digital
• 10:23
  privacy. Now there's another field where
• 10:27
  privacy, especially sensitive data or special categories of
• 10:30
  data is used. And when we say in the US terms
• 10:34
  in HIPAA terms or health related data, and we talk about medical
• 10:38
  data and there is the concept of medical identity.
• 10:42
  And you've done some interesting research on medical identity
• 10:45
  theft. Of course, you did it way back
• 10:48
  when people were not talking about it.
• 10:49
  But I'm curious if you can summarise or if you can share
• 10:53
  two cents about it. What is it and how do you see it
• 10:57
  in the current setup? Yeah, so, so medical identity.
• 11:01
  Theft is something I discovered. Accidentally, I had been asked
• 11:05
  by a congressional, US Congressional subcommittee, the
• 11:08
  National Committee on Vital and Health Statistics, to come
• 11:12
  testify before them. This would have been in 2000 and
• 11:17
  I think. 4 or. 5 right in there, sorry it was a long time ago and
• 11:25
  I was sitting there thinking and the the my topic was the NHIN,
• 11:29
  the National Proposed National Health Information Network and I
• 11:32
  thought what? Are the risks the digital?
• 11:34
  Risks in such a network. And I was thinking and thinking,
• 11:38
  and I had time to prepare for this testimony I had about.
• 11:41
  Three weeks. Which is always dangerous, which
• 11:43
  means you, you, you have too much time to prepare and think,
• 11:46
  right? So I'm sitting there for days
• 11:48
  thinking, OK, what are the risks?
• 11:49
  And I outlined all the risks, but I kept coming back.
• 11:51
  To identity risks because identity risks really show up
• 11:56
  very. Strong in very strong ways in
• 11:59
  digital ecosystems and they're very complex and they're they're
• 12:04
  quite profound in in the harms that they can cause it's a
• 12:08
  really foundational harms that identity harms can cause so I
• 12:12
  thought I wonder if medical. Identity theft.
• 12:14
  Exists because we know identity theft at that time was a huge
• 12:18
  problem in the. US credit card fraud.
• 12:21
  What not? So I did a keyword.
• 12:23
  Search on all the various search engines for medical identity
• 12:26
  theft and nothing came up. It was not the term and I
• 12:30
  thought OK. So I bet this exists.
• 12:32
  Under different names, so I checked the legal research
• 12:36
  databases. Such as pacer, the court.
• 12:38
  Systems and I looked for a combination of medical data and
• 12:46
  fraud and identity and I found four cases right away and I I
• 12:52
  dug into those cases. I interviewed people.
• 12:55
  I interviewed the insurance companies.
• 12:58
  The providers I interviewed a lot of people.
• 13:00
  Before this testimony happened, and I wrote, I think it was 20
• 13:03
  or 22 pages of testimony and I included this topic in it and I
• 13:08
  said, hey, there's something called medical identity theft
• 13:11
  that's running through this ecosystem.
• 13:13
  Already you already have people. Posing, taking the health
• 13:18
  records of people, altering them and pretending to be those
• 13:23
  people and billing in their names in order to make money.
• 13:26
  It's a sub form. Of healthcare fraud.
• 13:29
  And it's very dangerous. People have.
• 13:32
  Been misdiagnosed, people have been laying on surgical tables
• 13:36
  and people have almost operated on the wrong organ.
• 13:40
  Because their health record had. Been altered and I said this is
• 13:44
  going to be a serious problem and no one had ever even had
• 13:47
  this research in their hands before.
• 13:50
  The providers hadn't been discussing it, No one had really
• 13:53
  been discussing it because it just wasn't a public issue at
• 13:56
  that time. So.
• 13:59
  The chairman of the committee came up to me immediately after
• 14:03
  the testimony and he said you need to.
• 14:05
  Write about this. No one's heard of this.
• 14:07
  And it's very important and people can die from this.
• 14:12
  And I said, yeah, I think so. And he said, I hope you can go
• 14:16
  do it so without any funding at all.
• 14:18
  To do this work. And no backers.
• 14:20
  At all to do this? Work I went ahead and researched
• 14:23
  it took. About half a year.
• 14:25
  I worked as fast and as hard as I could.
• 14:28
  And the following year in 20, I think it was 2005 or 2006 in the
• 14:34
  spring, we came out with a report.
• 14:36
  I worked on the report with Robert Gellman, who's one of the
• 14:40
  leading health experts in the entire world and has been for
• 14:43
  many, many decades. He's an incredible legal mind.
• 14:47
  So we looked at. You know what are the problems
• 14:50
  here? How deep is it?
• 14:53
  How? Big are the problems and it was
• 14:54
  very. Very substantive.
• 14:57
  We were able. To get the numbers and quantify.
• 14:59
  All of this for the first. Time and then talk about the
• 15:03
  solutions and the report made a massive splash when it was
• 15:07
  published and what ended up happening is I was invited to
• 15:11
  speak to hymns, which is the entire nation in the.
• 15:15
  US of the Health. Information management system at
• 15:17
  the which at the time was different.
• 15:19
  There were thousands of people in the audience and they allowed
• 15:22
  me to talk about solutions for medical identity theft.
• 15:26
  And this was a real turning point because, you know, it's
• 15:28
  one thing to do the research and to write a report and point out
• 15:31
  what's wrong, but then you need to take the next step and work
• 15:35
  toward a solution. So I'm very.
• 15:37
  Proud that I worked with all of these folks.
• 15:40
  To come to a solution and what would work.
• 15:43
  So we came to a. Variety of really effective
• 15:46
  solutions. For medical identity theft, one
• 15:48
  is called a Jane and John Doe file extraction, which means
• 15:52
  that you remove the fictitious information from the file while
• 15:55
  retaining the legal integrity of the file.
• 15:58
  Because it's actually in HIPAA you don't have the.
• 16:00
  Right to delete data. So even if it's fictitious data
• 16:06
  and could kill you, you can't delete it.
• 16:07
  So there's now a method that you can do that and there's.
• 16:10
  Red flags, there's all sorts. Of name warnings.
• 16:14
  There's there's, there's huge. Advancement so medical.
• 16:17
  Identity theft is. Becoming much less prevalent.
• 16:20
  People know about it, it's well known, and I I the problem is
• 16:25
  greatly improved from where it. Was, so that's that work.
• 16:29
  No, that's indeed an area and you have done a huge
• 16:34
  contribution through World Privacy Forum and your research
• 16:37
  in that space. And you, another area that comes
• 16:40
  to my mind in which you have contributed immensely is the AI
• 16:45
  Principles, especially at the OECD level.
• 16:48
  Because a few years back, if I recall well and recall our
• 16:52
  conversation, there was nothing and you were part of the group
• 16:54
  that created the AI principles. Tell us something about that as
• 16:57
  well. Yeah, so I've actually worked
• 17:01
  with OEC. D for about 20 years, but I was
• 17:03
  mainly working in health. Privacy I was part of their
• 17:07
  health data. Uses working group many many
• 17:09
  years ago in the Super early 2000s.
• 17:13
  But what happened is that I had been invited to a group in
• 17:18
  Switzerland to make a very technical AI presentation on.
• 17:23
  Basically how AI ecosystems operated and how the data flows.
• 17:27
  And then where? Trustworthy AI could be
• 17:30
  articulated. Within that and where it
• 17:32
  couldn't be. So I gave this.
• 17:35
  Extremely technical presentation and IT.
• 17:37
  Just so happened that two people from OECD were there.
• 17:40
  And the audience. And it just so happened that
• 17:43
  they were scouting for people who knew, who understood the
• 17:48
  tech technology. Of AI but who also understood
• 17:51
  the trustworthy aspects. And I had the privacy piece.
• 17:55
  In a way that most people who are in AI don't have in that I
• 18:00
  have. You know the kind of the legal.
• 18:02
  Privacy and then the technical. Privacy that's that's fairly.
• 18:05
  Rare even today. So they approached me and they
• 18:09
  asked me if I might want to join a new.
• 18:12
  Effort that the OCD had. Going to develop multilateral
• 18:17
  principles on trustworthy AI and I'm like oh are you kidding?
• 18:21
  You can't hold. Me back, so I started with.
• 18:23
  That immediately there was a. Core of us it was called I go
• 18:28
  the AI. Network of experts and I think I
• 18:32
  mean it was a very small group to begin with and it was a
• 18:35
  really incredible conversation I'm still in touch with most of
• 18:39
  the people who are in that group.
• 18:40
  Marco Groeberlingkit from Slovenia, just really, really
• 18:46
  amazing researchers and and thinkers and people.
• 18:50
  So I did that until 2019 while still doing work at.
• 18:55
  Well, full full time at World Privacy.
• 18:57
  Forum. It was a very busy.
• 18:59
  Time, but that work was. Extraordinary.
• 19:02
  It was really foundational in really talking.
• 19:05
  To all of the stakeholders, because it was a very broad
• 19:08
  effort. By the end, I think they were
• 19:10
  about. I think the group expended to
• 19:13
  about. 54 experts. Plus all the governments and IT.
• 19:16
  Was it was a very robust, very, very.
• 19:20
  Incredible conversation, very rich.
• 19:22
  Important time of transition. That makes sense.
• 19:26
  But is what's happening at OECD level or cross country level in
• 19:30
  terms of AI right now? Because, OK, it's good to have
• 19:33
  principles. Now we have this EUAI Act, we
• 19:36
  have a few legislations on EUAI fragmented, but is there
• 19:42
  something happening at the OECD level on AI?
• 19:46
  Yeah, so the OECD. Has a very extensive programme
• 19:50
  on AI. It's.
• 19:51
  It's actually called G Pay. It's A.
• 19:53
  There's two programmes. There's the original I Go
• 19:55
  programme, which is being run in the OECD.
• 19:59
  I'm a part of that through what's called the the.
• 20:02
  Civil society advisory group. But there's another.
• 20:05
  Part of I go that's very broad. It's called G Pay or the Global
• 20:10
  Partnership. On AI, now the global
• 20:13
  partnership on AI is a little. Different because what it has.
• 20:16
  Done. It's actually very important.
• 20:18
  Which is that it is. Expanded the number of countries
• 20:21
  that are. Involved so for example.
• 20:23
  India is is right now one of the.
• 20:27
  Leaders of of G Pay. India is not a full member.
• 20:31
  Of OECD, it's it's a. Partner, but it's a full member.
• 20:35
  Of of the G pay. And there are African countries
• 20:39
  which are not members of government, members of formal
• 20:42
  OEC. D but which?
• 20:43
  Are full formal members of G Pay.
• 20:46
  So in this way, G Pay expands the country footprint of OECDS
• 20:52
  work in AI. And I think that was a really,
• 20:55
  really beneficial, important step for OECD to make, and I
• 20:59
  think it's very helpful. So their work has.
• 21:01
  Become much more international and.
• 21:06
  Spread across the. The regions, which is very, very
• 21:09
  important. Absolutely.
• 21:11
  So we can talk about ages for about the work you've done, but
• 21:17
  is there anything specific? Of course, there'll be many
• 21:20
  things you'll be proud of, but is there anything specific that
• 21:23
  comes to your mind when we said this research or this
• 21:27
  contribution of this collaboration, of this
• 21:30
  engagement is what I'm proud of or this outcome I'm proud of?
• 21:34
  Well, I'm really proud of medical identity theft because
• 21:36
  that changed a lot in the US. It really.
• 21:40
  Helped a lot of people. And it actually saved lives in
• 21:43
  the long run, and that's a really good thing.
• 21:46
  Of course, it's hard to quantify all of that.
• 21:48
  But. We know.
• 21:49
  That the risk is terrible, but a lot of.
• 21:52
  That risk has now been mitigated.
• 21:53
  So that's great. Another piece of research I'm.
• 21:56
  Really, really proud of IS. The research I did in India from
• 22:00
  2010 to 2014 on Adhar and you already know Adhar is the
• 22:06
  largest biometric real time digitally born identity
• 22:11
  ecosystem in the entire world. More than 1.4 billion people are
• 22:16
  enrolled in this ecosystem and there is nothing like it in the
• 22:19
  world. I know that people think China
• 22:21
  has this great. ID.
• 22:22
  System. But there's nothing like
• 22:23
  India's. Nothing.
• 22:24
  There's nothing like it. And it is.
• 22:28
  It's a full digital backbone. That reaches.
• 22:31
  All the way to the. Last mile of everywhere and.
• 22:34
  To achieve that is just really a.
• 22:38
  Staggering feat and it's you know, I can say.
• 22:40
  These words. But it's unless you were there,
• 22:43
  you. You.
• 22:44
  Can't even imagine it. So I went to India.
• 22:47
  I found out about adtar. Pilots in Andhra Pradesh, India,
• 22:51
  which is a southern part of India and.
• 22:54
  It was just a little pilot. It was, I think. 200 people and
• 22:57
  then it. Grew to like 200. 1000 it just
• 23:01
  kept growing by and that was in 2009 and then by 2010, Nandan
• 23:08
  Nakani. Was a very wealthy.
• 23:10
  Businessman in India. Had fully supported the
• 23:12
  programme. And I thought.
• 23:14
  This is just way too. Important This is going to be
• 23:17
  the model for identity systems. Across the world going forward,
• 23:21
  we have to go so. It was a long board conversation
• 23:26
  about this and a lot of planning, but in June of 2010 I
• 23:30
  went and I began interviewing across India.
• 23:34
  I thought that. I only needed three months to
• 23:37
  complete this research, Yes, and I did.
• 23:40
  I knew nothing and I was completely ignorant of how India
• 23:42
  works. So basically in three months I
• 23:45
  had just basically. Figured out how to get.
• 23:48
  Started. I was so inefficient at the
• 23:50
  beginning and I was working like you know, 10/12/14 hour days,
• 23:55
  but I was still inefficient. India is a very complex, rich
• 24:00
  society with a lot of people and getting to the right people to
• 24:03
  interview in government really took some time and just trust in
• 24:07
  a lot of things. But anyhow, at the end of that
• 24:10
  three months I. I.
• 24:11
  Came back to the USII. Reconvened with some desktop
• 24:16
  research and set interviews and then went back, and that's how I
• 24:19
  kind of conducted myself over those years.
• 24:22
  So I was able to. Get a lot done.
• 24:27
  But the the research basically. Entailed looking.
• 24:30
  At adhar that system. As it was being built from the
• 24:34
  ground up. So I literally.
• 24:35
  Went to where people were enrolling and I interviewed
• 24:39
  them. I interviewed people on the
• 24:40
  street in in most areas of India, whether from the smallest
• 24:45
  villages in Andhra. Pradesh to the largest cities in
• 24:48
  Delhi. I talked to people and I got to
• 24:52
  know, you know what, what they were thinking about Adhar and
• 24:56
  what they were saying. And I also went to the places.
• 25:00
  Where this? Extraordinary thing was
• 25:02
  happening and you, you have to understand something.
• 25:06
  Which is if you. Look at India in 2009.
• 25:09
  India was an analogue country if you would go into.
• 25:13
  Like police stations or libraries, et cetera.
• 25:16
  There, there, there was. The the most amazing amount of
• 25:18
  paper you could even imagine because of the.
• 25:21
  Records of a. Billion people, right?
• 25:23
  Hospitals were paper. But you know to move from that
• 25:29
  and in five. Years to go to a.
• 25:31
  Full digital identity system is. It's not even possible to
• 25:35
  believe it. But what happened is in 2010,
• 25:38
  India had a census and the census takers went and they
• 25:41
  were. Part of creating the atar.
• 25:44
  And so I literally went to places and there was one very
• 25:49
  small town called. Putaparti it it was.
• 25:51
  The most mind boggling place I went it it I went into and it
• 25:56
  was being done. At one of the police.
• 25:58
  Stations. I went into the police station
• 26:01
  and I walked in and there was a room full of very young.
• 26:05
  Boys, you know, I'd say you know.
• 26:07
  Teens and 20s. And they were at.
• 26:10
  Computer terminals and they had. Stacks and stacks of.
• 26:13
  Paper, and they were the paper census forms that had been
• 26:18
  filled. Out by all these.
• 26:20
  Census workers you saw all over India in 2010.
• 26:23
  Just they were everywhere, you know, people wearing these
• 26:25
  little grey outfits. Grey and white.
• 26:27
  Was cute with clipboards but they did a.
• 26:29
  Paper census, a very thorough one, and then these papers went
• 26:34
  to these stations where they were typed in.
• 26:38
  Character by character by character.
• 26:41
  Now in some places. They had character.
• 26:44
  Recognition and a little more advanced stuff, but in many
• 26:48
  places in India this was done by hand by 10s of thousands of
• 26:53
  people. Over the course of.
• 26:55
  Five years. It was probably more like
• 26:57
  hundreds. Of thousands of people, but.
• 27:00
  There were then there would be these rooms where the the old.
• 27:03
  Papers were stacked up the ones that had.
• 27:04
  Been, you know. Transferred to digital and it it
• 27:08
  just was. Unbelievable, the amount of
• 27:10
  paper and it was like watching a society go from digital or.
• 27:16
  Go from a paper based society to a a digital society.
• 27:20
  Just in front of your eyes. And I, I've never seen anything
• 27:24
  like it and I don't think I'll ever see anything like it again.
• 27:27
  It was amazing. But going digital at scale at
• 27:31
  speed is an extraordinary feat. So the thing I'm proud.
• 27:36
  About is that. When I did the interviews I
• 27:39
  found some very significant problems with the the the
• 27:43
  privacy controls in auto they were.
• 27:45
  Very, very serious. And not to be joked.
• 27:50
  About at all there were. A number of very serious privacy
• 27:54
  issues, governance issues, consent issues, just very
• 27:59
  serious human rights problems. So I wrote about those.
• 28:04
  And it was very detailed research and I talked about the
• 28:08
  controls. As they could be against various
• 28:12
  legislative. Formats such as consent formats
• 28:16
  in the US and the EU, structures in in around the world and the
• 28:21
  bottom line I came to. Is it look there are?
• 28:24
  Problems in this system and we must systems that are built,
• 28:29
  digital systems that are built must first do no harm, and this
• 28:35
  system was doing harm. Now it.
• 28:37
  Could be corrected. And my argument.
• 28:39
  Was to correct it. And one of the things that
• 28:42
  India. Lost was a very.
• 28:44
  Well known thing in the. Privacy world called Privacy by.
• 28:47
  Obscurity. Privacy.
• 28:49
  By obscurity is basically what happens with all those paper
• 28:52
  records. If you're living in a paper.
• 28:54
  World, It's really hard to. Find information, but when you
• 28:56
  make that information digital, it's much easier to find.
• 29:00
  And then when you add AI, then some additional things can
• 29:03
  happen. But the bottom line is, is that
• 29:05
  once you. Effectuate a digital A fully.
• 29:07
  Digital environment, it changes privacy and my argument other
• 29:12
  than doing no harm was, hey, the legislation around Adhar,
• 29:16
  there's no privacy legislation in the country and.
• 29:19
  The Adhar Act allows in. You know, commercial.
• 29:23
  Businesses to build individual profiles.
• 29:26
  Using the Autar biometric data and so you have little mini
• 29:30
  autars all over the country that are being built and that's not
• 29:34
  right. So the Supreme Court this this.
• 29:37
  All went to the Supreme Court and the Supreme Court used my
• 29:40
  research in its landmark privacy opinion and it it cited the do
• 29:45
  no harm that I talked about and the privacy.
• 29:47
  By obscurity that I talked about.
• 29:50
  And the decision was really fair.
• 29:53
  They kept. The adtar.
• 29:55
  System. Which was the right decision and
• 29:58
  what? They did, is they?
• 30:00
  Removed one of the articles. Of the adtar act that.
• 30:02
  Allowed commercial businesses to.
• 30:05
  Collect the data, the identity. Data and the biometric data and
• 30:09
  keep it themselves for profiling people and for just making
• 30:13
  databases of people. And I think that's a really fair
• 30:15
  trade off. They so no more profiling and
• 30:19
  the the Supreme Court did something very, very
• 30:23
  consequential, which is they demanded.
• 30:27
  That the. Government of India come up with
• 30:29
  ways to mitigate. The privacy.
• 30:31
  Problems. So as a result, some of the most
• 30:34
  creative technical privacy solutions are coming out of
• 30:39
  India because they've figured out how to make their really
• 30:44
  advanced digital identity ecosystem much more privacy
• 30:49
  enhanced. So they've Federated their
• 30:51
  database. They've done tokenization,
• 30:55
  they've done very, very interesting things with digital
• 30:58
  forms of consent. Nothing is perfect.
• 31:01
  But it is so so. Vastly improved, but anyhow.
• 31:05
  Super proud of that work. And I'm super proud that.
• 31:10
  Yeah, I had the. Opportunity to do it.
• 31:11
  It was once in a lifetime. Opportunity to really.
• 31:15
  Influence a major, major system in this world and you know Adhar
• 31:20
  is in fact being seen and is still seen to this day as a
• 31:25
  system that's a potential model for many other jurisdictions so
• 31:30
  the the model comes with a lot of protections now so this is a
• 31:36
  good. This is all a good.
• 31:38
  Thing. Definitely.
• 31:39
  It's something to be proud of, absolutely.
• 31:42
  So if we shift our focus more from the global perspective and
• 31:47
  any research that you may be doing, is there something you
• 31:50
  can tell us about what is happening in global data,
• 31:55
  especially governance and protection across the world?
• 31:58
  Is there some research you can guide us to?
• 32:01
  Yeah. So in 2024 we finished four
• 32:05
  years of research into global data protection conventions and
• 32:09
  treaties, and fortunately. I I have a very good.
• 32:14
  Friend who works in the UN Statistical division.
• 32:18
  He led one of the working groups at the UN that I Co chaired in
• 32:24
  regards to data governance and statistical division.
• 32:27
  So I I started this research in 2020 during the pandemic to
• 32:32
  figure out, OK, what can I do from a desktop since I'm
• 32:36
  grounded and I can't travel anywhere right.
• 32:39
  And I thought, let's. Look at what the privacy
• 32:42
  landscape is across the. Regions and countries of the.
• 32:45
  World and I thought. This shouldn't be.
• 32:46
  This shouldn't take too long. It should all be online, right?
• 32:49
  No. Nope.
• 32:51
  Nope. Nope.
• 32:54
  Let's say 2/3 was. Online.
• 32:55
  The rest was hardcore research. Going to jurisdictions, talking
• 32:59
  to people, it took so much. Work.
• 33:01
  It took four years of work. And a lot.
• 33:03
  Of that was field work. And again, sometimes you just in
• 33:06
  order to figure out what is happening on the ground, you
• 33:09
  just sometimes have to go to these countries and talk to
• 33:12
  people and and really get the ground truth.
• 33:17
  I'd say that if you see a piece of research.
• 33:20
  On data governance and data. Privacy.
• 33:22
  That's global. And they haven't been to those
• 33:25
  jurisdictions. That's that's probably.
• 33:28
  Not going to be completely accurate so.
• 33:31
  One of the things that that came out of.
• 33:33
  This research, which? We published the first iteration
• 33:36
  of in June 2024. We're about to publish the.
• 33:40
  Update now because you know. The the.
• 33:45
  Each each month, each year. The the.
• 33:50
  The number of countries. That passed data.
• 33:52
  Governance legislation changes and and.
• 33:55
  Gets larger, obviously, but. A very resistant.
• 34:01
  Area to desktop research was. Africa, the region of Africa,
• 34:06
  and the reason is, is because it is the most complex region in
• 34:11
  data governance I have ever, ever encountered.
• 34:14
  So Europe is pretty uniform because of the GDPR.
• 34:18
  Asia is not as uniform, but it's still fairly consistent with
• 34:26
  some important differences. The US is kind of its own thing.
• 34:32
  Canada, Australia, New Zealand. They're, they're just they're
• 34:38
  they're, they're simple to talk. To and and you can kind of
• 34:41
  understand where they went, but Africa is so complex.
• 34:45
  So what I. Encountered in Africa was a
• 34:49
  landscape of a continent that you know the at the time and as
• 34:56
  I was doing the research, most people that had maps of African
• 35:02
  data protection and actually this is still happening to some
• 35:05
  degree. To this day, they would just say
• 35:07
  that. Most countries hadn't passed
• 35:09
  comprehensive data protection legislation, but you know what?
• 35:14
  There are conventions and treaties that are meaningful,
• 35:17
  and if they're ratified by the government, this does form a
• 35:21
  basis. For.
• 35:23
  Qualifying it as having some form of comprehensive, you know,
• 35:27
  data protection doesn't mean that it's GDPR, but it means
• 35:31
  that it does exist. So for example, there's the
• 35:36
  convention one O 8 and convention one O 8.
• 35:39
  Plus, which is European. Convention multiple African
• 35:43
  countries, for example Mauritius have passed both.
• 35:48
  Morocco has passed convention one O 8.
• 35:50
  Mauritius has passed one O 8 and one O 8.
• 35:53
  Plus, Mauritius has also passed. GDPR, similar legislation.
• 35:59
  But Morocco is also. Party to the Malabo Convention
• 36:04
  so the Malabo Convention is a convention that includes data
• 36:09
  protection and governance and every member of the African
• 36:12
  Union is. Also a.
• 36:14
  Party to the Malabo Convention. So you must, if you're talking
• 36:19
  about Africa, you must acknowledge the validity of the
• 36:23
  Malabo Convention as a data governance comprehensive law.
• 36:28
  Is it as strong as GDPR? No, but I wasn't making that
• 36:32
  qualification. But is it comprehensive?
• 36:34
  Yes. There's another convention
• 36:36
  called the Echo was convention. That's really the western part
• 36:41
  of Africa and. The echo was.
• 36:46
  Echo was convention or treaty. Is is.
• 36:50
  Actually pretty comprehensive. And it's closer to GDPR.
• 36:53
  So we included for Africa, we included Malabo Ecolas
• 37:00
  convention one O 8, Convention one O 8 Plus and then
• 37:03
  comprehensive legislation that was similar.
• 37:06
  To GDPR. So.
• 37:09
  All of those instruments are. Present in Africa.
• 37:12
  And in some countries in Africa, all of them are present at the
• 37:17
  same time. So this made it complex and you
• 37:20
  know the. Africa is also in the process.
• 37:23
  Though those countries. That have passed data
• 37:26
  protection. Legislation that looks like
• 37:27
  GDPR? Many of them either.
• 37:30
  Have data protection. Authorities now or in the
• 37:32
  process of setting them up? But also I have to say, because
• 37:37
  Africa has. You know, come after a lot of
• 37:40
  countries had already passed legislation.
• 37:43
  There are there are cases where. African data protection
• 37:47
  legislation goes further than. The JDPR so.
• 37:51
  For. Example can, oh, absolutely,
• 37:54
  yes, it's stronger. So you see this in Kenya, you
• 37:57
  see this in Togo, you see this in a number of jurisdictions, so
• 38:02
  for example in Mauritius, Mauritius.
• 38:06
  Gives the the, there's the, there's the there's space
• 38:13
  withheld. Within the legislation, the Data
• 38:17
  Protection Authority of Mauritius can oversee certain
• 38:22
  national security and law enforcement data.
• 38:24
  Flows. Should they choose to, they have
• 38:26
  the. Authority to do so.
• 38:27
  This is not something that exists in most European versions
• 38:32
  of GDPR. Now Georgia, The country of
• 38:35
  Georgia. Also has this.
• 38:37
  Provision and they. Very actively do this.
• 38:39
  It's. Very unique part of Georgian
• 38:43
  GDPR. You know how they did their law.
• 38:47
  So you. You.
• 38:48
  Start to see these regional differences and these these
• 38:51
  country level differences. But but there the complexity.
• 38:54
  Is so intense and. Yeah, I learned a lot.
• 38:59
  And what I can tell you. Is that GDPR has evolved?
• 39:03
  From its passage in 2018 and the countries that are passing
• 39:07
  legislation now are adapting it and there are AI adaptations
• 39:13
  adaptations there. Are there are other?
• 39:15
  Meaningful adaptations here and they.
• 39:19
  I. What I think is very.
• 39:21
  Helpful is that they are. Being adapted to suit the
• 39:23
  context, the jurisdictional context.
• 39:28
  For that legislation and we. Have to remember, you know,
• 39:32
  every country is different, not every country.
• 39:34
  Can pass. Legislation that's huge and
• 39:37
  heavy and you know, countries can and should adapt legislation
• 39:42
  to their context. Yeah, I think context matters.
• 39:45
  Even in application of the law, in the context you have to weigh
• 39:49
  in the necessity and proportionality and that's goes
• 39:51
  without saying. So I'm glad we have had the
• 39:55
  conversation around all this. But then would you like to tell
• 39:59
  us what does World Privacy Forum do and how can people take
• 40:03
  advantage from the research that you're doing?
• 40:06
  Yeah, so we'll Privacy Form is fairly unique.
• 40:10
  We were founded more than 20 years ago.
• 40:14
  I founded World Privacy Form to fill a.
• 40:16
  Really big gap in privacy. Which is to have independent in
• 40:20
  depth privacy research into complex ecosystems so we've.
• 40:25
  Always been very technical researchers, but in the area of
• 40:29
  privacy, so the the idea. Here is that we really.
• 40:34
  Want facts about how? Privacy is working on the ground
• 40:38
  in reality, not an ivory. Tower, OH.
• 40:42
  We need this in privacy. Well, show me the facts.
• 40:46
  Show me the evidence. We want evidence.
• 40:47
  Based work that allows people to really figure out OK, what
• 40:54
  actually is privacy. On the ground and how can we
• 40:57
  make things better for people and groups of people?
• 41:01
  So that's that's really what we do.
• 41:03
  So we're getting ready to publish a large report.
• 41:06
  Of probably the next two weeks on content provenance.
• 41:09
  It's a very, very fact based report.
• 41:12
  On how it works and. How it How?
• 41:15
  It how it touches privacy. And we're also getting ready to
• 41:22
  publish. Actually, I'm getting ready to
• 41:24
  publish a journal article on what I call.
• 41:27
  Collective. Privacy Collective.
• 41:29
  Privacy is something that happens in AI ecosystems where
• 41:34
  you you all of a sudden have groupings of people and
• 41:38
  groupings of people. That have particular scores or
• 41:41
  predictive attributes. Ascribed to them and if.
• 41:45
  You are part of that group of people.
• 41:47
  That can impact you as an individual, and there are other
• 41:51
  significant impacts that can flow from that.
• 41:53
  This is not something that's addressed in law and it is not
• 41:57
  something that people are talking about.
• 41:59
  Quite yet, but we're. Talking about it.
• 42:01
  So this is the kind. Of thing we like to do, we like
• 42:03
  to be ahead of trends. We like to find trends that are
• 42:07
  meaningful and have high impact and really, really.
• 42:11
  Dig out the facts. And present them to people and
• 42:14
  then have discussions about OK what what will solve.
• 42:18
  These. Problems and I think this also
• 42:20
  helps make us very very different.
• 42:22
  We work with a. Lot of stakeholders.
• 42:24
  I'm a delegate. To the OECDI.
• 42:26
  Also am an advisor. To the board of the.
• 42:29
  World Health Organisation Health.
• 42:31
  Data Collaborative. On data governance and still
• 42:34
  work with the UN statistical Division on on data governance
• 42:39
  in the statistical context so we really.
• 42:42
  Try to to work collaboratively. And pinpoint the solutions.
• 42:48
  Find the problems collaboratively and then make
• 42:51
  sure that they can be put into practise in very.
• 42:53
  Practical, helpful ways. Absolutely.
• 42:57
  I think they're shaping the privacy world, as we say.
• 43:01
  But if somebody wants to contact you, what's the best way?
• 43:06
  Yeah, so the very best way is on our website.
• 43:08
  It's just world privacy. Forum dot OR.
• 43:11
  G World Privacy Forum dot. Org.
• 43:14
  We we have a lot. Of this data on our website and.
• 43:18
  It's a pretty heavy website. In that there's a lot of
• 43:21
  material there. We have a.
• 43:22
  Lot of data visualisations we have a lot of.
• 43:25
  Work that I haven't mentioned here because there's not enough
• 43:28
  time. We have many, many reports.
• 43:32
  The scoring of America is a really big one.
• 43:35
  We risky analysis of my heavens. We have data.
• 43:39
  Visualisations on identity ecosystems around the world we
• 43:43
  have an forthcoming very important data visualisation
• 43:47
  regarding AI globally we have. The global tables of privacy
• 43:51
  laws. And treaties, etcetera.
• 43:55
  And that's all this amazing data visualisation that our visual
• 43:59
  designer John Emerson did. It's it's incredible.
• 44:02
  You can philtre by region. By type of legislation.
• 44:07
  He did an amazing job. Anyhow, it's worth exploring.
• 44:11
  No, no, it's absolutely. The work you are doing and your
• 44:14
  team is doing is phenomenal. It's impacting the world of
• 44:18
  privacy in a big way. Thank you so much for doing that
• 44:22
  and making that contribution to the world in view of time.
• 44:27
  I would say thank you so much, Pam, for sharing your time,
• 44:30
  sharing your insights, and of course, for audiences if they
• 44:33
  want to take real benefit, visit the website wordprivacyforum.org
• 44:37
  and take advantage of the research and you can learn a lot
• 44:41
  and how privacy is shaping. Thank you so much, Pam.
• 44:45
  Well, thank you, it has been a joy and a pleasure.
• 44:47
  To talk with you. I really appreciate it.
• 44:50
  Same here. Thank you for joining us on the
• 44:54
  Fit for Privacy podcast. We hope you found today's
• 44:57
  conversation valuable and thought provoking.
• 44:59
  Subscribe for more insights like this.
• 45:01
  If you enjoyed this episode, we'd appreciate that you'd share
• 45:04
  it and write us a review. For consulting, visit
• 45:07
  www.fitforprivacy.com. For certifications and training
• 45:12
  on ISO standards, visit www.growskills.store.
• 45:17
  You can also contact us for bespoke training for your staff
• 45:20
  and management. Until next time, stay safe, stay
• 45:23
  compliant, and grow your skills.