christopher graham talked about the
brave new world i hope i'm not part of
the sad old world chris
at the heart of my career has been the
consumer i worked for the national
consumer council the office of fair
trading
and i was deputy chairman of which the
consumer organization throughout my
career quite apart from being
information commissioner it was the
consumer cause which really protested
against this
alienating approach it was which
magazine which revealed that hamlet has
30 066
words
shakespeare's longest play
paypal 34
798 one of our poor sad researchers had
to count the words
um it's also been revealed
yes
um microsoft does have a technology
that'll do that
exactly i know i know that i know that i
can get you a copy
i don't know how many people here signed
up to game station where seven and a
half thousand people assigned their
immortal soul
to a game station without reading the
small print
i don't know how many people signed up
to pc pit stop where in the small print
anyone who writes in gets a thousand
dollars
it took four months before anyone wrote
in to get their thousand dollars
consumers don't want to be
made to be liars
and if you tick the box which says
i have read
i've understood and i accept all these
words
otherwise i cannot take part in this
activity or have the service delivered
you are a liar and that is not good
public policy to make
a nation a continent a world of liars
and what's worse
the notice-based approach
i think allows far too much
permissiveness on the part of
organizations if you get a good lawyer
to write into your clauses this out of
the other it gives you incredible
freedom that is not acceptable in terms
of good effective regulation my slogan
in all of this fuel duels is effective
data protection in practice
pragmatism is a word which i am proud to
use
one of my concerns is i'm not going to
be attacking the european approach or
praising the us approach i mean here in
the uk we sort of look both ways and get
shot at from both sides so
we're used to that
but i think in some ways the european
approach
is too short on words
in some ways far too long
fundamental rights and freedoms that
phrase is used a lot both in language
and in the texts of the legislation
my experience the vast majority don't
understand what is meant by
fundamental rights and freedoms it's
either meaningless or ambiguous and that
includes software engineers doctors
policemen bankers who need to understand
this sort of concept
and yet at the same time the european
approach can be far too
wordy
far too i've used the word theological
um i started looking at the opinion the
article 29 opinion on legitimate
interest i'm sure it's packed full with
very good stuff i haven't got far i
haven't got beyond much this executive
summary but the entire opinion is 68
pages
of dense argument it's all good stuff
when you get into it but 68 pages is not
the right way to communicate what we're
trying to do
so i'm much
we talked i took part in this group
which fred and peter have mentioned and
if you read that you'll see a balanced
nuanced approach
aiming for effective data protection in
practice it is if it comes about a brave
new world it won't come about
immediately but i think it's signpost
but it does in particular signpost
a greater emphasis on use it's not as
peter said an abandonment of a focus on
collection but it tries to look at
what's happening in reality not just
what might be happening not just at the
collection stage and it does try to
articulate the fundamental rights and
freedoms in terms of harms and risk
and most of you know i'm now with the
center for information policy leadership
we pioneered the work on accountability
and we now have a project which is
underway on what is really meant by a
risk-based approach and i talked to a
small workshop here on tuesday about
that it's still very much work in
progress we've drawn upon the work which
the canil in france did on risk
methodology on the work which uh chris
and my former colleagues in a very
non-bureaucratic environment uh have
been doing on privacy impact assessments
and and so on and essentially what we're
trying to say is that we need to
communicate what this privacy protection
is all about and trying to identify
tangible harms whether that's bodily
harm
loss of liberty loss of freedom of
movement
damage to earning power significant
damage to economic interests
they're moving on to the intangibles
reputational harm
detriment from the monitoring or
exposure of identity characteristics or
activities
fear anxiety or embarrassment arising
from unacceptable intrusion into family
life
discrimination and stigmatization trying
to bring these to life are not as
concrete perhaps as they might be in
some respects but trying to bring a more
objective contextual approach and not
last but not least societal harm where
there can be damage to the democratic
institutions of nations or continents or
loss of social trust where people don't
know who knows what about whom
and what we're trying to do is bring
more concrete pragmatic language into
the debate and make that the focus of
regulation and the final word i use
because it's relevant to all this it's a
phrase i have used before once or twice
selective to be effective it has to be
about prioritization it has to be
looking at those areas where there is
the greatest risk the most
most likely that substantial significant
harm is going to be caused to consumers
or to society and that i believe is the
way forward not the old bureaucratic
tick box approach