Latest / Agentic Conversations (formally mlops.community) / When Machine Learning meets Data Privacy - Episode 2 with Cat Coode

Transcript

When Machine Learning meets Data Privacy - Episode 2 with Cat Coode · Agentic Conversations (formally mlops.community)

0:16
Welcome to the second episode of the podcast series.
0:20
When machine learning midst data privacy today, the episode will
0:25
be about privacy regulations. Data privacy is a trending
0:31
topic. Since the understanding that the
0:33
collection of consumer data is crucial for modern businesses
0:38
came. Also, the awareness that data
0:40
can tell much more than we want about us due to this.
0:45
Many are the regulations that are nowadays.
0:47
Enforcing data privacy, such as GDP are CCPA LGBT and the list
0:53
goes on. But after all, what are they
0:58
saying about data privacy? What is the definition of data
1:02
privacy? And what should organizations
1:05
comply with to answer these questions?
1:08
I have invited cat could a specialist in data privacy and
1:13
regulations that helps companies keeping themselves compliant
1:17
with regulations. And as per usual, do not forget
1:21
to subscribe. Our amazing ml Ops community
1:25
Welcome cat. Thank you for being here as
1:28
today. On our podcast about data
1:31
privacy for machine learning for the ml Ops Community.
1:35
Today, we count with your special presence on this episode
1:40
yourself. You know, you come from an
1:42
engineering and software background if I'm correct.
1:46
I would like you to walk us through a bit.
1:49
How have you jumped from a technical perspective?
1:54
To the regulation side, then being an expert on data privacy.
2:01
That's great. Well, thank you first for having
2:03
me. This is great.
2:05
So like you said, I started in the software and Engineering
2:08
side. I actually have a degree in
2:10
computer and electrical engineering.
2:11
So I used to work for Blackberry which was Rim at the time
2:17
designing devices and servers and blackberry as a handheld
2:22
device was always Security First.
2:24
And everything we did from the architecture of Designing, how
2:29
the applications worked with the operating system.
2:31
Everything had a Security, First, focus.
2:34
And so, I worked there for a long time.
2:37
Starting in development and Senior Management and
2:40
architecture. And when I left Blackberry, I
2:43
wanted to help people understand data.
2:46
I wanted people to have a better understanding of what they were
2:50
putting into the internet. What they were putting into
2:52
applications and Things had really just started up with
2:57
Facebook and some of the Twitter, like, all of the,
3:00
obviously, the social networks that we note that are really
3:02
big, but then a few years ago, the regulation started to get
3:07
bigger and a lot of the corporate companies that I was
3:09
working with on, Cyber education, came back and they're
3:12
like, what do you know about this gdpr?
3:13
And so I guess, at one point in my life where I had wanted to be
3:17
a lawyer, although I never went down that route but I started
3:21
getting into reading of other regulations and I found them
3:23
fascinating. So I did a certification in
3:27
Privacy Law, and, and I realized a lot, which we'll talk about is
3:31
a lot of these privacy regulations.
3:33
They come from both sides, they come from a legal side, but they
3:36
also come from a technology side.
3:38
And people don't always know how to implement the technology
3:42
piece of it. So a lot of what I've been doing
3:45
is helping understand, helping people understand and companies
3:47
understand how to apply regulations in their company and
3:50
how to become compliant with those privacy regulations.
3:53
That's amazing. And I'm very curious to see how
3:57
like you jumped from. Of course, your your experience
4:01
took to took you through this path but it's very interesting
4:05
how you we see you jumping from a technical perspective towards
4:09
something more related with regulations.
4:12
Although yeah. The the perspective as you
4:15
mentioned of having the regulations having both the, in
4:22
this case privacy having both the side of the Nations.
4:25
And the technical perspective is very interesting.
4:28
I dare to ask you how can we then Define having all these
4:32
perspectives? How we can Define data privacy
4:36
on that sense? Yeah.
4:37
That's always a really hard question and I get it a lot in
4:40
cybersecurity circles and people are like what's the difference
4:43
between security and privacy? So security is protecting your
4:47
assets, right? Security is protecting keeping
4:50
people out from where they don't belong but privacy is keeping
4:53
the information. Ian and the individuals, safe.
4:56
And, unfortunately, the difference with security and
4:59
privacy, I mean, people always use the castle analogy, but
5:03
like, with security, you know, you've got a moat, you've got a
5:06
big wall and if someone gets in, you could probably kick them out
5:08
again. But with privacy is, what is the
5:11
king doing right now? If somebody finds out what the
5:13
king is doing, once they know, they know and so privacy to me
5:16
is really critical because Security.
5:20
I mean obviously security is also important, but from a
5:22
privacy perspective, once the information is out there, the
5:24
damage is done. There's no way to put it back in
5:26
the box, right? You can't shove the toothpaste
5:28
back in the tube case container. So it's really important that
5:32
people prioritize privacy in addition to security because if
5:36
someone gets in only one time out of a million from a security
5:39
perspective and a risk analysis, it's low risk, but again, once
5:43
the data is out there, the risk is already.
5:45
The harm has been done for the individual having in Knowing
5:49
this. Do you think?
5:50
And this might be to of an opinion, but do you think that
5:55
current regulations and from the ones that, you know, why gdpr
5:59
and even see CPA, for example, do you think they do cover
6:04
everything they need to in order to ensure you know privacy?
6:10
I think this is a bit of a wide scope.
6:13
Of course. It it probably is not even
6:16
possible but what's your opinion on this?
6:19
I do. I do think they're a really good
6:21
step in the right direction. So if anyone's listening isn't
6:23
aware of all of this stuff, I mean, we've had things like nist
6:27
and ISO, which you hear about a lot in the security world have
6:29
been around for a long time, right?
6:31
And they are again, security, Focus, so gdpr, which is
6:36
European Union CCPA, which is California pepitone, which is
6:39
what I have in Canada. All of these these regulations
6:43
are trying to put individuals first, so it's privacy, but it's
6:48
always Consider your user. Instead of let's consider how to
6:52
innovate because I find especially coming from a Tech
6:55
Community in a tech background. There's this thing about
6:58
Innovations, we can innovate so quickly online these days.
7:01
Like, it's so easy to create a new app in a day that people
7:04
aren't stopping to think about what the impact is on the
7:07
individual, who's using the app. And so, I feel like these
7:10
regulations are doing that. Well, because they're putting
7:14
their putting the light back on the individual.
7:16
So, they're saying, well, well, before you design this, I no,
7:19
it's cool and it'll make you money but what happens to your
7:22
user and their data when they use this app?
7:25
And on that sensing. Now that you you mentioned that
7:29
I at least from my perspective in this might be a bit
7:32
controversial. Although this laws and
7:35
regulations are saying that and are putting those concerns.
7:38
I'm putting the individual first.
7:40
What happens in a lot of cases is that companies, especially
7:45
the, maybe the smaller ones and the ones that are a bit more
7:49
disrupting are not taking the regulations at least.
7:55
Is, it seems like conceptually this laws, seems only to apply
7:59
to bigger organizations or it seems like the market is doing
8:04
that. At least, I don't know what,
8:06
what is your perspective on that.
8:08
Now, unfortunately, I tend to agree with you, I think we've
8:11
got companies in the spotlight, big companies in the spotlight
8:14
where people saying, hey you know what, you can't be in
8:16
Europe right now. If you're not GDP are compliant
8:19
and so they're doing that in order to maintain European
8:22
customers. And then you've got new
8:24
companies that are Are starting brand new and are trying to
8:27
implement a lot of this privacy first thinking, but you're
8:30
right. I agree.
8:30
There's all sorts of small to medium businesses, which is the
8:35
majority of what we use in the world and the small to medium
8:39
businesses, it costs money to implement regulations because
8:43
often you have to go back and fix the things that are wrong.
8:46
They don't have the time. So, one way, I kind of explain
8:50
this is like, if, if all the buildings had crumbling
8:52
foundation and you needed to fix the foundation, which is what
8:55
Essentially, doing by reapplying privacy.
8:57
As you know, the big office building that houses, a thousand
9:00
people has to fix the foundation or, or they won't be able to
9:03
rent any of their units. Because those companies are
9:05
saying, hey, you have to do this, but the smaller companies
9:09
are like, we don't have the money to fix the foundation,
9:11
right now, we just have to run our business, so hopefully it's
9:13
fine. Hopefully, it's not a problem
9:16
that, that, that is the feedback I get.
9:18
When I go into a company and I'm like, okay, you know what,
9:20
here's the 12 things you need to do for compliance, and here's
9:23
the order and priority in which you need to do them.
9:25
And They're like, yeah, we only have a budget for one so it's
9:28
not a priority. It's not a priority for at least
9:31
right now. Yeah, that's a good point.
9:33
But one other thing that I feel in this might be from a consumer
9:37
perspective. I tend to see that this new
9:41
generation is getting more and more aware, and more concern
9:45
about the privacy, in the use of their data, do feel like in the
9:49
end it will have to be the consumers.
9:53
Forcing companies. Is to well adopt privacy in
9:59
order to not be canceled. I think so.
10:02
I think people again, we've become so complacent with a lot
10:06
of these social networks that people are used to using in the
10:08
amount of data. Like, if you look at Tick-Tock
10:10
Tick-Tock takes so much of your data the whole generation of
10:14
people who just love it because it's fun.
10:16
They don't want to know like it's like an out of sight out of
10:18
mind thing. I don't want to know what it's
10:20
taking because it's too much fun.
10:22
But I agree. I think I think as As people
10:25
become more aware of privacy and other options come up, I think,
10:28
is there are options to say you could use this product, which
10:32
will protect your privacy. Like, you see people picking
10:34
Brave as a browser or no, as a texting app.
10:39
So there, as soon as choices become present, I think people
10:42
are going to move towards that for sure.
10:46
Now, situation related with machine learning and even how
10:50
companies do the ones that are investing in the eye.
10:54
How does? This regulation can be framed in
10:58
the context of data collection, because I guess that's one of
11:02
the major questions or at least that a lot of companies don't
11:06
think about when, for example, setting up their data collection
11:10
by Pines or even they their data strategy, that's a lot to
11:14
unpack. So, I mean, one of the main
11:16
principles behind all of this is data classification, and that
11:20
that is always to me. The first step that all
11:23
companies should be taking is to list all All of the data that
11:26
they're collecting and then classify that data into whether
11:29
it is personal information or personally identifiable
11:31
information. If it's identifiable
11:34
information, if it's anything that you can use to identify an
11:39
individual in a single piece of information or a combination of
11:42
information, that information has to be protected.
11:45
And so, in some ways, technology is great because you can use
11:49
techniques to anonymize info. So that's great, right?
11:53
So you could say, look, I've got Got 17 data points on an
11:56
individual and four of them are identifiable.
11:59
And if I strip them out, then I still have 13 great data points
12:03
and then that way, they don't connect anyone and then that
12:06
information could be fed into things like machine learning
12:08
algorithms. But you have to pull that
12:10
personal information out because soon as you start sticking that
12:13
in there, again it has to be protected.
12:15
You have to ensure that that it's being processed in a way
12:18
that individuals have consented to allow their information to be
12:22
processed. That way all of these
12:24
regulations apply Basically to identifiable information and as
12:28
soon as you can change that then everything just becomes easier
12:33
because it's not sensitive anymore and it's not private.
12:36
Yeah, makes sense makes sense. Another question that I have in
12:39
this is a bit related with a study that exists in this about
12:44
sensitive information. If I'm not mistaken that study
12:48
says that in the u.s. although you might be hiding for example,
12:53
they age their name of the person In.
12:55
If the sex of the person, you can still identify that person
13:00
based on other few informations that person has such as, for
13:05
example, postal code, and the combination of any other thing
13:09
about that person. So let's imagine that.
13:12
In that case we have removed all of that.
13:15
With for example if exception of a postal code is that possible
13:19
for us to understanding an automated way that we really are
13:24
privacy concerns Client when we just left the postal code, but
13:28
it's still possible to re-identify someone.
13:31
Yes, the argument is, if you can re identify them in any kind of
13:34
way shape or form than it's not Anonymous.
13:37
I have that question once where someone was like, What if I for
13:40
anonymous tables but when I combine them then then I can re
13:43
identify someone. I'm like then they're not
13:45
Anonymous if by definition you've pulled that data out
13:50
there should be no way to reverse it in any way to
13:53
identify an individual but I what you hit the nail on the
13:56
head which I love is. I was just people are always
13:59
trying to automate this stuff and there are amazing tools out
14:02
there. Don't get me wrong, especially
14:03
for big companies, that will pull personal information and
14:06
try and classify it for you. But that is a perfect example
14:10
with this postal code of How It's situational.
14:14
If you are dealing with the rural community, where it's
14:16
possible, that there's literally a house at that postal code,
14:19
then like you just said, you've potentially identify that
14:22
individual. So if you were, if you said man,
14:25
Or woman like you said to gender is usually not identifiable.
14:29
But if you said man or woman at this postal code and in that
14:32
particular house, there was only one man or one only one woman
14:35
then you have identified. The man suddenly postal code is
14:37
not, that is not obscure enough to make an anonymous data set.
14:41
You really have to look at the context of your information.
14:44
I great example, I use often is there was a high school in
14:47
British Columbia here in Canada, where they had been using gender
14:50
because it wasn't identifiable and then one of the children at
14:53
that school. Now, identifies as Non-binary as
14:56
a gender. And so where it would have said,
14:58
hey here are the grade 12 chemistry marks for the average
15:01
for girls, the average for boys in the average for non-binary.
15:05
All of a sudden that's not an anonymous data set anymore, you
15:07
know exactly the individual that's referring to.
15:10
So we have to consider the size of the data set.
15:14
I mean, there's a lot of things to look at, but the is that
15:16
information really anonymized? So, in a sense and as a you
15:22
said, it's not. Well, In machine learning, in
15:26
this case to identify eventual, Pi information can be used but
15:31
not everything it is possible to.
15:33
Like it's not the recipe at least at the sense that I get
15:37
from, it's not like there is a script that tells you bi
15:42
information, is this sort of fills.
15:44
So there are always the contextual information that you
15:47
can extract from an external database that can make your
15:51
data. Well, not private anymore.
15:54
Is that correct? Correct.
15:55
Yeah absolutely. So you're right so you can exist
15:58
together, but yeah. Okay, so in a nutshell would say
16:02
that organizations are still being able to collect data being
16:06
compliant, as long as they take in consideration.
16:09
All of this is that correct? Yeah.
16:12
So so first, you have to say, I'm only collecting the data I
16:15
require, that's a legal basis. This is the data I required to
16:18
do. What I do, this is not extra
16:20
demographic data, or extra other data.
16:22
I'm only taking the data. I actually need then you're
16:25
Asking your user for consent to collect and process that data.
16:28
So they're aware that that data is being used.
16:31
And then when you do use the data, you're ensuring that when
16:33
possible, you've anonymize the data.
16:35
So if you are collecting that, if you're a doctor's office and
16:39
you have to collect Health Data in order to your patient, then
16:42
yes, you need access to that that personal information and it
16:45
has to be identifiable. But if you're a hospital and you
16:48
want to run some kind of learning or something on
16:51
symptoms, or you're trying to run an algorithm somewhere in
16:53
the background to bed. I understand, you know, what's
16:56
happening with this particular symptom and this like with
16:59
covid, then you have to find a way to anonymize the data or the
17:02
individual has to know that you're using the data for that
17:04
purpose and now that you mention covid.
17:07
And it's a very, very good example, at least here in
17:11
Portugal. We had this kind of a situation
17:13
where people researchers specifically or asking access
17:18
for covid related data from patients and there was this
17:22
question. We're in a matter of National
17:26
Security or urgency the access to this kind of sensitive data
17:31
should automatically approved because it's a matter more
17:36
important than the privacy of it in individual, there's a gray
17:40
area so I know that's come up a lot.
17:42
Like there's a gray area between where it benefits the greater
17:46
good and your privacy. So I mean if you looked at it,
17:50
if you could stop a disease from spreading, if you knew someone
17:53
had a disease and you could stop it from killing.
17:55
Killing other people by knowing, they had the disease.
17:58
And arguably, it's more important to know that they have
18:01
it. Like, I'm looking at, not even
18:03
covid. I'm looking like way back in
18:04
time. When people knew someone had the
18:06
black plague right? Like that with covid, like I
18:09
look at it like I had to go get my laptop fixed.
18:11
So I had to go to the mall to do that and they took my
18:14
temperature before I could even go in the store and it was in
18:17
Irving, it was weird because I was standing in the middle of
18:19
the mall. And so if I'd had a fever and
18:22
they turned me away, anyone in that mall would have That
18:25
information. So I from a privacy perspective,
18:27
I'd love that. But at the same time it's for
18:30
the greater good of the people in the store, they that was the
18:33
condition of getting into the store.
18:35
So you know, workplaces are now sticking in thermometers or like
18:39
infrared in order to get into the office in the morning, you
18:42
have to check your temperature. So yeah, there is a line where
18:46
you can say, look this is I appreciate that this is private
18:48
information, but it's for the greater good.
18:51
And so understanding of course that someone has Tested positive
18:56
pretty crucial for the health and well-being of others.
18:59
If it's. So there is there is definitely
19:02
a line in there. There's numerous lawyers that
19:05
have written really good articles.
19:07
So if you're in a position with your company where you're like,
19:09
I don't know where this line is and I need to cross it or not
19:12
cross it there's some really great outlines of when you can
19:18
publicly disclose information in relation to this kind of thing
19:21
and when you need to keep it private.
19:23
So like if an employee calls and says I've got But I'm not coming
19:25
in. Do you tell everyone else in the
19:28
office? Why that person is not there, or
19:31
do you have to protect their privacy and not tell anyone why
19:33
they're not there? Yeah, makes sense.
19:35
Because if the person app contact with others, for
19:37
example, that might be a situation where it could be good
19:41
for the others to know. And take measures well, a few
19:45
years have passed from this. Since these regulations were
19:49
out, gdpr is from 2018. We could expect that.
19:54
So, Some organizations, at least would have already maturity in
19:59
what concerns data privacy and protection.
20:01
Especially the ones that are in a bit more of a spot Spotlight
20:05
regarding these topics, do you feel like we have achieved that
20:10
maturity or we are still in that path?
20:14
And what are the more usual errors?
20:19
When, when it comes to this subject, I don't feel like we've
20:23
had that maturity. I think it's It's interesting
20:26
that when CCPA came out which was in 2020 companies weren't
20:30
ready for it even though they most of those companies were
20:33
serving European citizens and should have been GDP are
20:35
compliant. Anyway, and CCPA is very much
20:37
like gdpr. I think there's a scramble to
20:41
check a lot of boxes. And the biggest issue I always
20:44
see is again, these regulations are coming down from a legal
20:47
perspective. So gdpr, you're supposed to
20:49
assign a data Protection Officer.
20:51
And that data protection officers supposed to oversee,
20:53
the implementation of the Ation and often that DP 0 is a lawyer
21:00
and you can get some highly technical lawyers for sure.
21:03
But there are elements in GDP are we're especially the bigger
21:09
companies that I've worked with I think at the harder, it is
21:12
because they're siloed. So the lawyer will have to go to
21:16
the development team and say to them.
21:18
Hey, have you implemented privacy by Design or do you have
21:22
encryption on transfer of information or Have you
21:25
anonymized data sets and they have to rely on the development
21:30
team to just say yes or no? And then that DP 0 is checking
21:34
off a box. The issue is that for me
21:37
everyone has a role to play. In this product managers, who
21:41
are designing, products need to understand these regulations so
21:45
that they're not designing products that take sensitive
21:48
data or or that take more data than you need.
21:52
And then the development teams who are actually, We making Tech
21:56
products, need the understanding of how best to protect that
21:58
information and limited and and again, encrypted or protected
22:03
transfers and storage and are you using real data in your
22:07
test? So they need to understand it
22:09
and then customer-facing people need to understand it because
22:12
when the customer calls and says, hey, I'd like a copy of my
22:15
India. Everyone needs to be able to
22:17
answer that properly with. Are you a European citizen?
22:20
Yes, that's under gdpr. I will get you a copy.
22:22
And then finally the cxo team To get this because like I've said
22:26
before teams are not being given the resources, they need,
22:30
they're not being given the time or the budget to actually be
22:33
able to implement the Privacy stuff properly.
22:35
The biggest problem I see is that one person is assigned
22:39
responsibility for this. They're trying to basically herd
22:42
cats right there. Trying to get all these
22:44
different organizations involved and to do their peace and nobody
22:47
really knows why. Or what they're supposed to do.
22:51
Smaller companies, I have seen are more successful with this
22:55
Maturity model because they're not a siloed and they usually
22:58
have lunch product, right? So it's much easier for them to
23:02
change a product and they you can get all of those
23:05
stakeholders in one room and be like, here's what you need to do
23:08
this, and they are all on board, but yeah, in a bigger company
23:11
it's it is very, very difficult to do this.
23:14
And what I'm what I'm seeing is that we're getting bigger fines
23:17
from the data protection authorities.
23:19
And that might be what we need to push some of these bigger
23:22
companies in the right direction.
23:23
But I'm A hard hard job for whoever is the sign that dp0
23:27
role because again, you have to get so many people involved to
23:31
get this right. Just as you said, doesn't sound
23:33
like a one-person job and especially, when involving so
23:39
big companies, where you have this, a lot of different
23:43
products for a lot of different teams.
23:45
So, yeah, on that sense and without incurring in the risk of
23:51
entering in a kind of a checkbox besides all All that, you have
23:55
to exposed there are ways or tools or any method that can be
24:01
used in order to measure the degree of privacy and
24:05
organizations. For example, so organizations
24:08
can become more conscious. Let's say conscience of the
24:12
level they are. I don't like there's lots of
24:14
tools out there, unfortunately, there's no one way of doing this
24:19
so like I mentioned, I so is Big with companies its International
24:23
Right iso. At least a 27 thousand seven
24:28
hundred and one which is a privacy addendum to their
24:32
security. Their cybersecurity that ISO is
24:37
very GDP are like because gdpr is new and some companies have
24:41
to be ISO compliant because that's what that's the standard
24:45
that they've set themselves to their isn't like a real
24:47
checklist for that, but I'm hoping it's long.
24:51
It's a really long thing to I don't recommend it for reading
24:54
in this one. I'll sleep but if you look at it
24:56
like I said, it's it might be good for companies that are that
25:00
are aiming for ISO to actually come and say, okay.
25:02
Well now there's a privacy piece.
25:03
So now I have a little more guidance and then they could
25:06
measure themselves that way. There is no such thing right now
25:09
as a certification for gdpr. So if there's a company out
25:13
there telling you they will certify you, as GDP are
25:16
compliant. That's a lie because it doesn't
25:18
exist. Whereas at some point, the iso
25:20
auditing will there. You can't audit right now.
25:23
You can just get like an Then to 27,000 once that auditing comes
25:28
in, if that's what it company needs is.
25:30
Okay, I need to measure myself, then I think that might be the
25:34
first standardized measurement. I had to come up with my own
25:38
checklist. I have like it 14-page checklist
25:41
I use with companies because if you go online and you type in
25:45
GDP our checklist, you could get 10 things you could get like ten
25:48
checkboxes. Do you do you, do you?
25:49
And you could just say yes and I'm like no it's not it's not
25:53
that simple. You can't like I said, You can't
25:55
just say, do you use privacy by Design?
25:57
Yes. Do you can you access a user's
26:00
data? Yes.
26:01
Okay, great. But can you access it under
26:04
load? Can you act like how are you
26:06
authenticating that user? When they ask for their data?
26:08
There's a your so many underlying questions to that
26:11
checkbox that yeah, that's, that's my concern is.
26:15
There's no real standardized way to measure it right now.
26:18
People really need to go through.
26:20
Whoever, your DP 0 is really needs to pull gdpr and actually
26:22
go through the entire document. It is not a simple.
26:25
People process, it's an important process but it's not
26:28
it's not a one-day check. Check check kind of thing.
26:31
It's not like just I woke up I will be GDP are compliant and
26:36
check all the boxes and that's it.
26:39
So and it makes me wandering in a sense and this more related
26:44
with the implementation of machine learning.
26:47
Well, there are a lot of companies, they're just
26:50
collecting data for the sake of colliding.
26:52
Because one day they might be Eating it.
26:55
You see that sense? It seems like it's doesn't make
27:00
much of a sense or at least it's contradictory to watch.
27:05
It epr says, or any other regulation, there is similar
27:09
where you have to collect the data that you need.
27:13
And not for the sake of you. One day, you might need it but
27:17
for the process of doing machine learning, Well, it is important
27:22
for data science teams to have access to the more data as
27:27
possible. Let's say course this is not
27:29
totally true. And in that sense in your
27:32
perspective, do you think that machine learning can still
27:37
coexist with all this data privacy and all these
27:40
regulations, it really depends on the data you're collecting
27:44
and how you're using it. I would totally understand the
27:47
issue here. So I mean, again, if Were
27:49
specifically asking for a user's data and they know it's being
27:53
used the way it's being used. I mean, if you look at Facebook
27:56
and then they're the worst, but they have the number of data
27:58
points, they have is insane, but their terms and conditions
28:01
pretty much. Say if you're agreeing to use
28:03
our free service, the payment for that service is that we are
28:06
collecting all of this data about you.
28:09
And so they've they've pretty much laid out everything there
28:13
collecting now. Arguably, like you said with
28:15
gdpr, they don't have a legal basis.
28:17
They don't have a real product reason to Left a lot of the data
28:20
they're collecting. And so that's going to be the
28:23
issue. I think with machine learning,
28:25
what people are going to have to do is find better ways to make
28:30
the data less identifiable. So again and it really depends
28:34
on your product and your service.
28:35
But instead of postal code, can you use City?
28:38
And instead of birth date can you use age range?
28:42
And you know like so. So are there ways you can still
28:46
make intuitive machine learning? And say women age 32 34 instead
28:53
of this woman that was born on this date then that's that's
28:58
kind of the way we're going to have to go.
29:01
But again it depends on the data sets.
29:02
Now tend to be with machine learning, you have a really big
29:05
data set so you should be able to do that.
29:07
But with a small data set with sensitive information, you have
29:10
to be very careful. Not again not to have it be
29:13
identifiable when thinking about, for example in
29:16
healthcare, especially when you are dealing with, for example,
29:20
Clinical trials data or something or very similar and
29:24
you provide to third parties. It's the same example you gave
29:27
on the school. Well it doesn't matter if you
29:31
only have 100 persons and there is only one person with a very
29:35
singular characteristic. So I totally get your point on
29:40
this. Well, it was a very interesting
29:43
conversation so far and we have in this podcast this special
29:50
Part of the session, which is the open mic.
29:53
But I usually like to ask to our guests to share an experience as
30:00
a professional deeply related with machine learning and in
30:04
your case, someone with a lot of expertise in the area of
30:08
technology and data privacy. Could you share with us like an
30:13
experience? You had you use think it's
30:16
worthwhile sharing? Oh there's lots, there's lots.
30:20
I think I know privacy is a foundation as a pain.
30:24
I know that and I know it costs money.
30:27
One of the good examples I have from actually when I was working
30:30
at Blackberry years ago, is I was on the original calendar
30:34
code and a lot of things in there were hard coded like dates
30:39
and how we did recurring appointments or a lot of
30:41
hard-coded elements in there, and because of that, we actually
30:46
had daylight savings time, hard-coded.
30:48
And I don't know if you remember, It was probably a good
30:51
14 years ago now, but Daylight Savings Time changed.
30:54
And because everything with hard-coded we had to go into 10
30:57
different old versions of code and update them.
31:00
I was managing the team that had it.
31:03
I was just a like, I was a team lead and, and I kept pleading
31:07
with their managers and directors to fix the calendar
31:10
code because we just kept band-aiding it.
31:13
And so, instead of taking apart a hill and rebuilding it, we
31:17
kept turning it into a mountain, right?
31:19
We Would just, oh, well, that doesn't work.
31:21
So let's add this new thing to fix it.
31:23
Let's add this new thing to fix it.
31:25
It was taking people forever to make changes to this code
31:31
because it was a disaster. And we kept getting pushed back
31:34
from the company that we didn't have time to take it apart and
31:37
rebuild it, because we had to keep moving forward on the
31:39
product, the fast forward, a few years later and I ended up the
31:42
director of the team. And so I had the authority to do
31:44
it, so we took it apart and we rebuilt it, it took more.
31:49
Time and money to rebuild it years later that it would have.
31:55
Obviously, at the beginning that once did it saved more time and
32:00
money than we check to rebuild it.
32:03
So again, I'm on the foundation, I'm always on, I use foundations
32:07
of houses because it's the same thing, nobody cares about the
32:10
foundation of your house. You will never invite someone
32:12
over and be like, Oh come check out the foundation of my house.
32:15
It's really cool. You won't do that.
32:17
We will be like, look at the new paint color I made.
32:19
And look at my new pouch. It's the same thing with
32:22
products. We nobody ever goes.
32:24
Look at how awesome my architecture is, and how privacy
32:26
by Design is embedded in it. No one will do that.
32:29
But what would they will do is look at the cool features and
32:31
look how awesome this this product is and all the great
32:34
things it does. So the any kind of have to live
32:38
it to know it but spending the time and energy and money to fix
32:41
your foundation, today will come back to you later.
32:46
If you don't have privacy at the Base of the foundation of your
32:51
product, it will be harder to maintain it.
32:54
If you're collecting too much information, then you have to
32:56
protect more information. If you don't have it encrypted
33:00
on transfer, then you are more likely to get breached and and
33:04
have a privacy incident. So the risk of the what it's
33:08
going to cost you. Whether it's next week or next
33:12
year is going to be higher than it would to take the time to get
33:17
your development team to rip apart.
33:19
What's there? And pick fix it and put a higher
33:21
a better foundation. So again easier to patch up and
33:25
fix and tear down a wall, okay? Then it is to have a massive
33:29
leak in your basement, your entire house collapses and now
33:32
you have to rebuild the whole house.
33:33
So how an anomaly and allergies I can throw it, you, but a lot
33:36
of them. But the bottom line is, I cannot
33:38
stress enough that even though it's going to take time and
33:43
money, it is worth fixing the Privacy today.
33:47
Privacy by Design, which was actually designed by Doctor and
33:50
kooky, and who is Canadian. She was an Ontario, privacy.
33:53
Commissioner, it is part of GDP. Are it is in LG PD, which is
33:58
Brazil's, privacy regulation. It's at the base of a lot of
34:01
privacy regulations and basically it's got seven
34:04
principles. And it essentially, if you walk
34:06
through the seven principles, you will ensure that your system
34:09
has a privacy First Foundation. And you will, you will make sure
34:13
that you're putting the individual first and that again,
34:18
when it comes to being Compliant or adding new features.
34:21
You're adding new features on this tiny Hill and not on a
34:24
mountain and you don't worry about the whole thing
34:26
collapsing, underneath you. Yeah, that I, I can get you on
34:30
that then. Well, hopefully companies will
34:34
understand that will cost way more to have to change their all
34:38
architecture in the future rather, if they born or change
34:42
right now to a more privacy oriented, especially in the
34:48
cases where they live, A lot on data cats, it was a pleasure to
34:52
have you here. I thought our listeners will
34:56
have enjoyed a lot, our session as well.
35:00
And for that reason, I would like to ask you.
35:02
Well if they want you to contact you in any way because of
35:07
privacy challenges they are facing or even if their
35:12
organizations want some help on this, how can they reach you
35:16
out? So I am cat coat.
35:19
So, OD e, you can find me on LinkedIn.
35:23
I should be the only one and you can also find me at koat.com, so
35:29
that's just see. ATC Ood e.com.
35:33
Thanks Scott. It was a pleasure to have you
35:35
here. Take care.
35:36
It was a pleasure to be on. Thank you so very much.