one of the early thoughts was the
critique of noticin choice clearly
everybody on every side of the privacy
spectrum has issues with notice and
choice and do they work and are they
ignored and you know do they just
provide a shifting of focus but aren't
really meaningful but other privacy
critics in reacting to the paper or the
concept have said are you proposing to
eliminate individual you know
participation here am I going to
therefore get marketing without being
able to decide I mean where and how are
we minimizing or taking off the table or
are we disrespecting to some degree a
core concept of users having an
important measure of control so would
you give us a reaction to that and yeah
it's one of the themes that that in
thinking about what would be interesting
to advance this is alcohol messaging
which I will touch on that but let me
first give you a little bit more of a
background on how we got to this stage
and then finish with something around
risk although different than perhaps
what Richard talked you yesterday which
i think is relevant to this audience so
Fred talked about 18 months ago of the
seven of us locking ourselves in a very
very very nice hotel to think about what
this new world would look like but the
journey really started two and a half
years prior to that where as part of
kind of our looking at the world are
being Microsoft's view of the world we
said look all the things that Fred
talked about are likely to come in play
and what implications would that have
and that started us on a journey that we
called a global dialogue which involves
over 100 privacy experts ranging from
academics to advocacy organizations to
policy makers to regulations in all five
different parts of the world we chose
not to go to Antarctica as one continent
for perhaps obvious reasons but tech
touched on just about every other part
of the world there were then a global
summit that we hosted on microsoft
campus involving some 70 people and I
always say that the conclusion was
that from those experts that you know
the current model that we have have
grown up with and built with some very
very noble right purposes was not
working today and certainly was not
working tomorrow and I come from kind of
an operational background by extension
if the process is broken one must find a
new process so in other words the
conclusion was almost no one felt that
we didn't need some change the question
was to what change which is where we
started doing much of this work that
Fred talked about this got to a called
the key theme of messaging because
what's interesting about change is that
despite I think people intellectually
perhaps even emotionally recognizing
that we need to evolve to something
better or we could do better to what is
a is a paradigm that is uncomfortable
for many of us in other words we don't
know what the answer is but discovery of
that answer can create some some
emotions about it so what we learnt out
of this is that some messaging
challenges of with Fred suggesting
perhaps a shift more to a use of
information some people interpret it as
well that means consents gone or another
one if we're going to have more
accountability on data stewards that
many of us in this room well that means
all the other fair information
principles are gone well of course none
of that is accurate but it's just this
messaging challenge and this got me
thinking about a called the risk side of
things to for this audience this is
actually the first time that this group
has actually exposed this work to a
group of privacy professionals and so
when I think about risk Fred said
something that is for us as I'll call it
data custodian stewards of organizations
he's really saying this model requires
us to assume more responsibility and
intellectually that sounds good
intellectually I suspect there will be
people in our organizations that would
say hold on a sec consent may not work
but after all that's how we offload most
of our risk on to our unsuspecting
customers
well okay so you can argue about that
since that's just a bad deal for
consumers therefore should be changed
but I'm going to present an alternative
view to you all as I'll call that
custodians the organization's to think
that we can maintain the status quo also
has extreme risk because I think what we
will see is as this model increasingly
comes under stress the natural cycle of
public policy will take place and we
will see reactions to that breakdown of
that and I'm not sure that we'll all be
happy with what those outcomes are so I
think it behooves us to think very
differently pragmatically I think it
behooves us to think differently about
our roles to accept more responsibility
for that to unburden the consumer but to
Jules final question this does not mean
that the individual should not
participate in a strange sort of way if
we find the right solution will in
effect make consent more meaningful
because it will apply to places where
really is important as opposed to the
grad bag as as Christopher said if you
read this treaty longer than Hamlet and
click I agree everything's just fine
that's just probably not sustainable so
we all over responsibility to think
about a different model so the critique
that well I'll be getting all these
marketing messages because someone has
decided that that's low risk and still
likely to have options to absolute
decisions but the more nuanced public
good type decisions or this is a use for
analytics which a user really maybe
isn't in a good position to be seriously
debating and considering we need the
policymakers the thoughtful stewards to
say you know what this isn't a time to
request a consent it won't ever be
meaningful we need responsible thinkers
to say this is something that should
always be happening it's in the benefit
of the individual benefit of society
here this is a discretionary thing
somebody should be asked to take a box
is that affair for all good intentions
we collectively those of us here those
of us there those of us on both sides
Atlantic
have created the hamlet style privacy
notices we've said Wow individual needs
to be in control the way they get
control is to be more transparent that
means that is eighty thousand words and
everything's just fine and we've
sleepwalked a little bit into thinking
that even for example obvious uses of
information I'm going to provide you
with my address because I'd actually
like the package that I ordered from
Amazon to be delivered which is part of
that eighty thousand treaty like notice
it is is part of the whole deal and we
should think about that and say well
yeah that may be should be discoverable
but it shouldn't be part of the click I
agree notion that covers every single
terms of use including parts of
information use that might really apply
to fundamental human rights we've got it
I think just think differently about
I'll call it mixing up the the pieces so
that it provides a more effective model
but it absolutely still means that the
individual has some control some choice
just the model where it's where it
really does apply