Latest / The FIT4Privacy Podcast | Exploring ISO Standards AI Privacy | Grow Skills Store / Seven Years of GDPR: Balancing Power Between Organizations and Data Subjects Through Trust

Transcript

Seven Years of GDPR: Balancing Power Between Organizations and Data Subjects Through Trust · The FIT4Privacy Podcast | Exploring ISO Standards AI Privacy | Grow Skills Store

• 0:00
  The power responsibility equilibrium theory, basically
• 0:04
  it's grounded in the idea that where power is exercised, there
• 0:07
  has to be a corresponding and proportionate level of
• 0:09
  responsibility so that organisations that exercise
• 0:14
  power in a responsible way, essentially it leads to
• 0:17
  sustainability. So you get like, you know, short
• 0:20
  term gains if you maybe overuse your power, but you know, if
• 0:27
  you're thinking long game, then you're thinking consumer trust,
• 0:31
  power, responsibility, getting that equilibrium right.
• 0:35
  So, so the theory is not specific to, to privacy or data
• 0:38
  protection. The theory is just a theory that
• 0:41
  I applied in a novel way in, in my research and to, to try to
• 0:47
  develop an understanding, which is very kind of academic.
• 0:50
  That's what academics do is they take a theory from one place and
• 0:54
  try to apply it in another. But if we look at the GDP or,
• 0:57
  and the dynamics of GDP or, and, and sort of first of all, it
• 1:00
  brings rights to the data subject.
• 1:02
  So straight away we see the dynamic power change.
• 1:05
  We're going to give data subject rights in a time when they
• 1:08
  didn't have rights before. And so I see this interestingly
• 1:12
  a power dynamic at play. My partners from the US when I
• 1:17
  have been presented with difficulties, very famous
• 1:22
  example that I use for all my talks is COVID.
• 1:25
  If we remember trying to get money back from airlines, I was
• 1:31
  able to use that data subject right to basically get me my
• 1:35
  refund way before anybody else did.
• 1:39
  Because one might call it a misuse.
• 1:42
  You could call it a misuse, but at the same time I have the
• 1:45
  right to ask for my information and if you tell me that you're
• 1:49
  going to record the telephone call that we've made and you
• 1:52
  don't have a copy of that telephone call, I have the right
• 1:55
  to to lodge a complaint about that.
• 1:57
  And that's what happened during COVID is most of the
• 2:00
  organisations didn't switch over their call centre to record the
• 2:05
  calls. They just sent the call centre
• 2:06
  calls to people on their mobile phones.
• 2:09
  So we started to be empowered not just from a data protection
• 2:13
  perspective, but also from a consumer protection, being able
• 2:16
  to use this piece of legislation.
• 2:18
  Um, but when we talk about the power dynamic, the GDP or
• 2:22
  actually did something else about the power dynamic that I
• 2:25
  think was really novel and really important.
• 2:28
  And it's not about data or do they collect our data.
• 2:31
  It's about how we classify data as whether it's sensitive or
• 2:35
  special category or whether it's standard personal data.
• 2:39
  Because we know that if it's special category, then it has to
• 2:42
  be treated differently. And so we know that if there is
• 2:46
  a power dynamic that pushes anybody into a position of
• 2:51
  vulnerability, then in GDP or it's very difficult to use
• 2:56
  consent as the legal basis for processing.
• 2:58
  So a very good example of this is, and I've seen it happening
• 3:02
  in different jurisdictions. If I am an employer, I have the
• 3:07
  right to say to you, give me all your information and I am so
• 3:10
  vulnerable because I'm a candidate.
• 3:12
  I have to do it because I feel so vulnerable.
• 3:15
  Well, GDP or says, well actually you can't do that.
• 3:18
  You can't just ask people for their information and process
• 3:21
  their information because there's a dynamic at play here.
• 3:24
  So suddenly organisations had to see if they actually had a legal
• 3:29
  basis to collect this information.
• 3:31
  Very good example of this is background cheques.
• 3:35
  So we see a change in organisational behaviours when
• 3:39
  it comes to background cheques and now that empowers data
• 3:42
  subjects and and so there's so many parts of GDP or that
• 3:47
  affected a change in the dynamic of power that I think it
• 3:50
  actually it really achieved the power responsibility
• 3:54
  equilibrium, but not by the method in which the power
• 3:58
  responsibility theory is hoping it will, which is voluntarily by
• 4:03
  the organisation seeking to establish longevity.
• 4:07
  It established this power, responsibility, equilibrium
• 4:10
  through legislation and law, you know.
• 4:14
  So the end justifies the means, if you know what I mean, that
• 4:17
  you got to the end. That is a good end, but not
• 4:20
  necessarily the way I would have liked it to have been, which is
• 4:25
  that organisations actually sought to do right by the data.
• 4:28
  That's very well said. I think it balances that power
• 4:31
  responsibility, but it also gives in a consumer dimension in
• 4:35
  which you may not have other means to challenge or ask for
• 4:39
  information and then you can rely on these rights plus that.
• 4:42
  In fact, I have used that many a times because sometimes you
• 4:46
  really get stuck as a consumer. There are no means.
• 4:49
  You go to the privacy notice, find the DPO, send an e-mail and
• 4:52
  then things start to flow. So that's really true.
• 4:54
  But all this, the power responsibility, equilibrium, the
• 4:58
  rights for data subjects, the obligations for organisations
• 5:02
  that was meant to create trust, to enhance trust in the long
• 5:08
  term and of course protect the vulnerable as we call it now
• 5:12
  when this trust concept and that trust concept is also very
• 5:16
  central to the research you do, Valerie so and the work you do.
• 5:20
  So I'm tempted to ask you the follow up question.
• 5:23
  One of the reasons for the GDPR came in was trust.
• 5:26
  And more and more EU is coming up with even more legislations.
• 5:31
  I mean, we have the EU AI Act, we have the Digital Market Act,
• 5:34
  the Data Act and so on and so forth.
• 5:36
  Because if we start, I will certainly miss a few.
• 5:40
  But is then this trust, when you look at it both from your
• 5:44
  academic hat and your operational hat in the industry,
• 5:48
  has GDPR in any way enhanced that trust, the consumer trust,
• 5:54
  I mean in the organisation processing of data?
• 5:56
  Or has it pushed the issue into more of the legal formality,
• 6:00
  compliance cheques wherein we say I must have this, I must
• 6:05
  have that, I must have that. But how do you see that trust
• 6:08
  playing in, especially after seven years of the GDPR?
• 6:11
  So trust is formulaic. It's it's very simply created.
• 6:16
  It's called the ABI of trust. So A is for ability, B
• 6:20
  benevolence, I integrity. So if an organisation and
• 6:24
  studies have shown us, if an organisation consistently
• 6:27
  demonstrates ability, its capability of protecting your
• 6:31
  information, it does so in a way that's benevolent towards the
• 6:34
  data subject and it demonstrates integrity in how it processes
• 6:38
  data, then privacy concerns will decrease and trust increase.
• 6:43
  That's what the studies show us. So do we think that GDPR had any
• 6:49
  influence on ABI, on our ability being consistently demonstrated?
• 6:55
  Yes, it did, because it it forced organisations to have
• 7:00
  technical measures and organisational measures in
• 7:02
  place. So it forced those things to
• 7:04
  happen again. It's about, well, if trust is a
• 7:08
  byproduct of forcing those boxes that needed to be ticked to be
• 7:13
  ticked, is it really trust? It is because you're essentially
• 7:18
  developing trustworthiness characteristics through nothing
• 7:22
  more than compliance. So trust does get generated and
• 7:27
  and it's intention was to increase trust.
• 7:30
  Let's not forget that it was a tool that was intended to
• 7:33
  increase trust across Europe because trust made essentially
• 7:38
  business happen. So this concept of trust it, it
• 7:44
  does come from the legislation, should it?
• 7:50
  No, we should trust organisations implicitly if we
• 7:53
  knew that they'd do right by our data.
• 7:55
  The only reason we don't trust them is because they've
• 7:58
  consistently shown us that they shouldn't be trusted.
• 8:03
  But not all organisations. I mean, to be fair, there's a
• 8:06
  lot of organisations out there that are very compliant focused.
• 8:11
  If I think of the number of organisations that that we deal
• 8:14
  with in, in my own organisation on a daily basis, the only
• 8:18
  reason they're working with us is to ensure that they do right
• 8:22
  by the data, that they do this processing correctly, that they
• 8:26
  make sure that they adhere to to the legislation that's that's
• 8:31
  applicable at the time. So trust does come from
• 8:36
  legislation. You may not like how it's
• 8:40
  achieved, you may prefer it to be achieved through naturally
• 8:46
  doing right by the data, but legislation is born out of
• 8:51
  violations of ethical values. That's essentially how it gets
• 8:55
  born. So it, it is, it is part of the
• 9:01
  human condition that, and part of market economies as well.
• 9:05
  That back to what Carrie was saying earlier, you know, this
• 9:10
  concept of there's so much value in data that there's too much
• 9:15
  value for organisations and they pursue that, that data at too
• 9:19
  great an extent. And so legislation has to step
• 9:22
  in. And we know that self regulation
• 9:24
  doesn't work because so many organisations have shown us that
• 9:27
  it doesn't work. So we have to have the
• 9:29
  legislation and then trust ensues.
• 9:31
  But it's a false form of trust like no doubt.