our panel here today is going to focus
significantly on some recent work that
seeks to certainly bridge those islands
and builds on some of the work that has
been done over the years on
accountability and risk based models but
I think in a sophisticated way that
tries to really build on some of the
earlier work and really address both
global principles and European
principles of data protection law in a
way that seeks to update them and we'll
debate here today whether or not these
papers and processes that the gentleman
here have been involved with do so and
we'll try to critique and push back and
and debate it so let me lead off with
Fred Kate who as the one of the lead
offers authors of some of these papers
together with Victor Meyer Schoenberger
and with Peter Cullen and input and work
from Richard have really now sought to
put this issue on the table so Fred
would you give us a bit of an overview
of the recent work and kind of the key
points and then we'll we'll try to
elucidate and and debate and see if we
can make some progress I'm delighted
thank you I'm delighted to be here I'm
still really in a bit from being called
pragmatic and interesting and in an
academic world that would lead to my
almost certain firing so for those of
you watching on TV she was talking about
somebody somebody else it also had not
occurred to me Jules until your
introduction that jakub I'm afraid
you're surrounded by people who have
actually worked in part on this project
it's it's not it's not as it's not a it
wasn't intended that way but isn't it
but I gosh I think it exactly right but
let me do say how important i think the
project you were announcing earlier is
and how proud i am to be part of it and
i think the idea of working
pragmatically to try to bridge gaps
which have for far too long separated us
and that I think we have with more
experience more practical ideas now for
to how to make those gaps be less of a
barrier I think it's an incredibly
important initiative and
I offer congratulations even while
people might wonder why you allowed me
to be part of it they never there you
may wonder by the but by the end of this
so let me just say a very very briefly
what would normally take on you know an
hour or 45 minutes to cover which is I
think we're all aware of this rapidly
changing world in which data protections
taking place and that's very much a
theme here the advent of big data the
tremendous rise of government
surveillance that tremendous rise of
surveillance technologies in general and
i don't mean surveillance necessarily in
a in a bad sense in other words we all
carry cell phones that locators that
provide us maps we increasingly are
integrating technology into our lives in
ways that the technology will be
embedded will be connected will be
wearable you know i wear an insulin pump
now which provides a constant stream of
data about me all the time but over time
that's going to get smaller and smaller
and it recently will be implanted it
won't even be a separate device and of
course has also been discussed here the
Internet of Things where we're going to
be surrounded by devices by lights by
cameras by refrigerators and toasters
and other appliances that are constantly
yielding a set of data that will be
linked to individuals and so I think the
challenge that we face across the world
by no means limited to Europe of the
United States is how to keep data
protection current in the face of those
challenges how to exactly the challenge
that a commission Graham was talking
about how to make sure that without
changing any of the fundamental goals
here we make sure that we're using tools
that work in this weather you think it's
a brave new world or horrible new world
it seems to be the world in which we are
emerging into so to address that
challenge of 18 months ago I've just
outside of London a group of us got
together three former three former
commissioners including including
Richard and economist and Victor and I
as academics and Peter who was there as
the token Canadian so it sounds a little
bit like a bad joke five lawyers and
economists in a Canadian walk into a bar
and
this is what happens but our goal was
trying to think in terms of meeting
these new challenges what what are the
fundamental changes or evolution of our
current system that would be necessary
to ensure that the rights that we
consider fundamental are in fact
protected in this in this face so let me
just make for quick points here the
first and that is that the data
protection systems around the world need
to place more responsibility for data
stewardship and liability when the
stewardship fails so both stewardship
and liability on the users on the
processors of data and place less
responsibility on the individual in
terms of notice and choice right we all
live through a sea of notices virtually
nobody ever reads them they're
incomprehensible when you do notice is
may serve many important purposes but
there may be better ways to accomplish
those purposes and in fact of greatest
concern to all of us in that group was
the fear that choice was being used too
frequently on both sides of the Atlantic
but frankly may be no place clearer is
this in Canada and the United States a
choice was being used as a way of
shifting responsibility onto individuals
to say you consent it and therefore now
we can do something with your data which
might not actually be in your best
interest so the second point is that as
we engage in this increasing focus on
data stewardship and data land liability
for for uses of data outside of
appropriate stewardship but we should
focus more and more attention on uses of
big data as opposed to focusing
exclusively or or significantly as is
the case for example the United States
on collection and retention of data and
the reasons for this I think we're
obvious but especially in a world of big
data in which data have enormous value
for all sorts of uses that will have
utility that in some cases can be in
fact life-saving if we still go back to
what was the moment at time in which the
data were collected and what was the the
terms of consent at that moment or what
was a stated purpose we are inevitably
going to be restricting valuable
potentially critical uses of day
or over I think one of the things that
really struck us in this process is that
uses of data are where individuals tend
to be most affected and I don't at all
mean to suggest that individuals are not
affected by collection or access of data
by the way access would be considered to
use but rather to say that there's there
so often is an obvious reason for
collecting the data look at Edward
Snowden's revelations for example the
data were all lawfully collected the
phone companies collected them others
collected them the question was the
subsequent use made of the data it's in
that context that we suddenly see a
significant threatening privacy
violation when they are repurposed in a
dramatic way that takes no aventis focus
so much more on the power of the
government or on the terms of collection
rather than on an assessment of risk
around use and that assessment for risk
seems incredibly important as a way to
allocate scarce resources as a way to
focus attention but not as a replacement
for other types of protection rather as
a focusing mechanism as many of our
participants refer to it the third
principle is that as we increasingly
focus on risk which we're already doing
we have risk assessment requirements
throughout Europe we have them in the
United States we have them in much of
Asia for privacy impact assessment or
for other types of assessment we need to
start thinking more collectively about
what are the types of risks were worried
about up until this point it's largely
been satisfactory to say well we worry
about collects such as non compliance
with the law well that is a real risk
and we should worry about that but
increasingly because of the role that
individuals of that information plays in
individuals lives we better be worried
about the the the other the practical
harms the tangible harms the harms that
can result in significant economic
disparity that can result in people
being disadvantaged in extremely clear
and direct ways and we really need to
focus on a way of developing a common
vocabulary for risk assessment what is
it we think when we're doing privacy
impact assessments what are those
impacts we're worried about what our
categories of impacts what our tools
what our methodologies and this is an
area in which richard has been quite
influential in spoke I think yesterday
you're about and then finally I know
those are the words you're looking for
we need to ensure that as we continue to
evolve data protection to respond to
these significant challenges that we
always are enhancing transparency and
redress and enforcement and transparency
especially if we focus less on long
notice is that nobody reads which I
would argue don't really provide very
effective transparency we need to be
thinking of better tools for providing
transparency how do we achieve the type
of openness that that builds the
confidence that we care about that
people have that their privacy will be
protected how do we ensure that there's
redress for individuals who are harmed
or injured or affected in some way by
the use of their data and how do we
ensure effective well-financed well
targeted enforcement and without those
tools no system is going to be effective
in the future so let me say I don't
think we proposed January now 18 months
ago an answer to all of these problems
we proposed a big inning of a process to
try to look at them a way to not in any
way alter our understanding of
fundamental rights but rather to ensure
that those rights continue to be a
protected as we move into the brave new
future