[Music]
good morning and it's a pleasure to be
here this morning talking about
something that's important that isn't
current politics that the only silver
lining I found from the brexit episode
is that now I'm a call upon expert
within the company for dealing with
shocking surprising and in some cases in
most cases unwelcome election results
thinking about what I won't talk about
today I thought the important thing
would be to reflect on some of the
learnings that we have had as a company
as Paul said I think we're a company
very publicly has faced an enormous
amount of scrutiny for what we've done
in relation to our compliance model in
the way that in particular we've rolled
our privacy policy updates over time I
want to share some of that learning with
you because I think it's particularly
timely right now as actually our first
speaker said as more and more of the
devices that we use start to become
devices that are in some way connected
with the use of personal data so in
other words the need for a broader range
of products and services to think about
their privacy policies think about how
they're going to explain to the people
using that service their use of data
that's important and then also in the
context of the general data protection
regulation which I'm sure there are
large numbers of people in this room
right now who are spending time figuring
out what updates if any they need to
make to their policies in the context of
the new regulation so what I wanted to
in particular think about whether the
regulations that we have and the ways in
which we comply with them help people in
the way in which they're intended to be
looking at that that specific example in
the EU we've defined privacy as a
fundamental right and we've also in the
European Convention on Human Rights
articulated a view that privacy again is
a core human right but this doesn't need
translating into practical regulation so
we have the core right but there's
practical regulation that's given effect
previously through the
or currently through the data fiction
directive as transposed international
law and soon through the data protection
regulation and when we translate that
fundamental right into a regulatory
framework we need to do it in a way
where it doesn't cause paralysis there
is no intention I think when you define
something as a fundamental right for it
to prevent all kinds of activities that
are actually in the public interest in
the interests of people rather it's
intended to create a framework within
which those activities can take place
but at the same time respecting that
core right I spent some time some years
ago as a legislator new UK Parliament
and one thing stuck out for me was when
we modified our law on communications so
communications are not a fundamental
right in European Union law but we
needed to give effect of the regulation
of the telecom sector and we debated for
a long time how we should call the
people whose interests we were
regulating for there was a debate
between calling them citizens and
calling them consumers quite a
philosophical debate as to whether or
not that would change the way in which
you gave effect to the regulation and in
the end we compromised by calling them
citizen consumer so classic political
compromise for their citizen consumers
in the regulation but I actually find
that quite a nice phrasing when we think
about regulating businesses in the
context of some of these core rights we
have interests as a consumer and we
shouldn't forget those the interest as a
consumer primarily other service that we
like and and want to use is able to be
delivered to us but we also have broader
interests of citizens there is a sense
in which rights like the right to
privacy have a broader societal impact
than simply the right of me as the
individual use of a consumer I'm so
thinking of people our as citizen
consumers and then thinking about how we
can give effect to those I would say
complementary interests through
regulation brings us to look again and
saying does a privacy policy does the
way in which a service interact with its
citizens consumers accurately capture
their interests and develop their
interests
one of the other core values that we
have at face because we like to think
we're at learning culture so the classic
thing that we do is we do something it
doesn't go the way that we expected we
learn from that and we don't repeat the
mistake but after seven years of the
company and having issued multiple
privacy policy updates for multiple
products I can't yet say that we've got
to the stage where we can now launch
privacy policy update and nothing will
happen
it'll be simply a sort of routine
business there's clearly some challenges
still around that we've tried many
things and again I'm sure people here in
the room who have been through these
exercises we tried briefing regulators
we've tried going out to different
expert groups we've tried a whole bunch
of different things to try and help
people understand what it is that we're
doing we feel very carefully about
design we thought very carefully about
opt-in opt-out options we worked for all
of that and yet we still seem to find
ourselves in a repeated cycle where as
we update the product and update the
service we are causing unhappiness and
that unhappiness gives us no pleasure
whatsoever and I don't mean this is a
way of complaint or a wave wind I mean
this genuinely as a this is a challenge
we're going through this repeated cycle
and huge amounts of effort of very
serious and well intentioned privacy
professionals on our side and one
intention and seriously professionals
out there in the regulatory world a huge
amount of that resources being taken up
in many cases over many many months in
trying to unpick what happened when
we've launched a policy update and that
feels to us not the most productive use
of resources so if there are ways in
which we can get past that than we would
like to do so and that's one of the
things that we want to explore actually
again with people in this broader
community rather than those just those
who exist within the company so thinking
about why we do these updates I think
there are really three core drivers one
is technology and again in the open talk
we talked about the evolution of
technology just to give you a classic
example if you as we did operate a
traditional website a website has or
traditionally the websites had very
little notion of location they're not
location-based services they're sources
used from a static point when you take
that service and move it on to mobile
and it starts to become predominately
used on mobile platforms all of a sudden
you've unlocked a whole range of
location-based services there there's no
reason why consumers shouldn't have them
they're very consumer friendly but
clearly as a service you have now
extended your service from a static
service to a location-based service and
you do need to go explain that to people
explain why you're doing it explain that
you will now be capturing location data
and using it in certain ways and frankly
if you make those kind of large
technology transitions you can't say to
people I want the version without
location because the service has a whole
has been updated it is now using
location in many ways would be
inaccurate to say to people well our
service now uses location but you're
particularly use of it will not involve
involve location the technology has
moved on it is now a feature a facet of
that service so there are technology
changes like that where the platform has
evolved and now offers something
different and the policies must reflect
that difference the second driver a
business drivers and again the most
recent update that we're talking about
they their whatsapp privacy policy at
Davis made a few headlines is is very
much about a business update and again
these are quite normal as businesses
evolve there's no fundamental reason why
a business should not be able to evolve
its business model and equally there's
no reason why businesses shouldn't be
able to change their structural
configuration because of normal business
drivers and that can be entirely in the
consumer interest that once you do that
you're able to offer better more
enhanced services that's why these
structures change over time and why
business models change over time again
some people will object to the evolution
the business model but I don't think
there's any core in principle reason why
that can't happen but when it does you
need to be transparent and explain to
people that the business model has
changed and then I think the last core
drivers regulations I said something
like the general data protection
regulation coming into force will
require everyone to look at their
policies
but there's also a lot of specific
changes and again one of the ironies
from where we say is I again intend as
an observation not a complaint but one
of the ironies is that the outcome of a
regulatory action very typically is a
requirement to put more language into
your privacy policy and often at the
same time has been criticized having too
long a privacy policy you will get a
requirement to say in sections 3 5 & 6
there's insufficient information it's
not clear therefore I'm asking you or
requiring you and in some form to add
additional language into your policy and
clearly you then need to go and do an
update so again from sitting inside a
company perspective you have a queue of
changes that are being made the
technology is evolving the business
models may be evolving and you've had a
series of interactions with regulators
who have told you that you must make
changes in order to reflect concerns
they have about inadequate or
inappropriate language in the policy
so those things queue up and at a
certain point after that gestation
you're ready to go and you launch the
princi policy update those drivers I
think are all perfectly natural and
perfectly normal and indeed I think one
of the concerns we have is that because
of the climate that we've created where
these updates are difficult to do I
suspect there are people sitting there
who really should be making updates but
prefer not to do so or they will leave
it as long as they can in order not to
get into one of the kind of cycles that
we've been involved in so those
requirements are there we do need to
figure out how to update them on a
regular basis but I don't think any you
know across the industry we figured out
quite how to normalize this how to make
it so that this is a routine part of
business is still seen as something
exceptional that's something surprising
when say from our point of view it's
really quite normal and I think part of
the problem is some of the assumptions
that are made about the purpose of a
privacy policy again I'm sure people in
this room are familiar with the research
done a few years ago by the researchers
at Carnegie Mellon where they looked at
the amount of time it would take
somebody to read privacy policies for
typical services they used if they did
that and it turned out to be more than
200 hours a year so we're talking about
five working weeks a year
to read the privacy policies back then
roll forward to 2016 and you're probably
you know you could spend a couple of
months a year actually reading the
policies of all the services that all of
us typically use so it's not gonna
happen
and I think we need to recognize that
the privacy policy fundamentally it is
not a user facing communication it
exists for them but it is primarily a
legal document that exists to underpin
the service that's there in the case of
dispute and as part of our conversation
with regulators who quite properly want
to check that we're doing things but in
the same way that if I buy a car I don't
read all the safety certification
documents or indeed if I buy a financial
services product I'm primarily going to
rely on brand and trust that all the
underlying compliance work has been done
I think similarly with the services that
we use that sort of formal compliance
mechanism I think people will trust that
that has been done and they're not going
to engage with the detail of the
document in most cases there will be
exceptions to that but most people are
not going to do that I say particularly
as as the use of the documents and the
use of personal data is spread so I
think we need to think much more and
focus much more on how we give people
information outside of those policies
and again that's been an evolution with
us and I think is an evolution for
others as well that while we need to get
the legal documents right and do the
compliance and we have no complaint
about doing the compliance we want to
take some of the energy the drive the
expertise of our privacy professionals
and direct them more towards
communicating with people outside of
that privacy policy so that we can help
them to understand what exactly is going
on under the hood how to drive the
product as much as how we did the safety
compliance for the product this may seem
at the moment like a large tech company
problem I mean most of the sort of fun
and games and the attention has been on
updates that have been done like by
companies like mine and similar
companies where we've gone out to market
explain how we want to update the
service and there's been a reasonable
amount of interest from regulators but I
think this increasingly this is going to
impact on everyone data using software
is becoming a much broader feature of
our life and
need to update and communicate with our
citizen consumers about those are those
data's and services will grow so again
to take the car example you know today
you buy a car the safety certification
is done when you buy the car the car
drives out the door there's no need to
update the safety certification policies
on the car but the car the futures we
described as was described earlier is
going to be a data using car the car the
future will have software the software
will gain in capability all of the time
and so the car whether it's the car
manufacture the software manufacturer
and in many cases it will be the car
manufacturer will have a requirement to
let the drivers of the car know how
those updates have occurred and so I
think far more sectors are going to be
moving into this regular update
requirement moving into a similar space
to the space occupied by classic
Internet service companies today and
again we can think of other aspects of
our lives like our transport taxi
services food delivery services you can
create a huge long list of services
which previously had no interaction with
personal data and increasingly in the
future will involve the use of that
personal data again in the consumer
interest but there will certainly be a
personal data that is being used those
services will change in terms of the
technology and the technology they can
offer their capability but they'll also
change in terms of their business
structures and there will be different
connections between different businesses
across all aspects of your life so this
notion that we need to update policies
we need to communicate with people about
what we're doing I think is going to
spread across the sector and again
rapidly earlier the new regulatory
frameworks that are coming down the
track I think we can anticipate in the
sense more attention and more regulation
in this space not just in the European
Union but across the world services are
going to have to constantly be
evaluating the levels of compliance of
their existing policies and updating in
reaction to either tweaks or full-scale
rewrites of regulation which are
happening I say from our observation on
an increasing
rapid basis across an increasingly broad
range of jurisdictions so I think we're
going to have to figure out what the
solutions are you know it gives us no
pleasure to sort of be stuck in this
repeat cycle where we are trying to make
sure that we're up to date trying to
make sure that we communicate
effectively with people who use our
services but finding ourselves locked
into cycles where we will spend months
and in some cases years arguing over the
legal documentation that accompanies or
underpins that service I mean we clearly
don't have the answers by our own track
record and so we're very keen to work
with a much broader community and my
colleague Stephen Devlin who many of you
may know who is one of our thought
leaders on privacy globally is working
on this trying to set up some programs
and some structures where we can talk to
a much broader range of people and try
to look at the challenge in terms of
some of the modern technology some of
the modern capability that's available
to us so that's looking at things like
user interface design to the extent to
which the user interface certainly for a
software service that can communicate
the core elements of data usage in a way
that is better than a formalistic legal
document again looking at presenting
bite-sized pieces of information so in
many cases there will be clauses in your
document that really are quite
meaningless unless until you use that
aspect of the service so again to come
back to something like location-based
services we can have three paragraphs
that describe how we will use location
data they will sit in the document but
in many case that's far less instructive
than the point at which within the
service you first access location being
provided human language information
about how that location data will be
used so trying to understand how you can
present information that will be there
in the formal documentation in ways that
are more immediately relevant to the
people using the service and that will
help them to understand it so again huge
amount of work there and certainly we
would not claim any exclusivity of
expertise and I hope that there will be
people
my advertising who are willing and
able to join in those conversations
because they Steven Dedmon is going to
be initiating on our behalf so I think
as as we sort of watched services like
asthma and again I I know there's wide
range of views about our motives about
the way in which we operate I would say
that you know from my experience inside
the company we genuinely are trying to
deliver services that are good for
consumers and we generally are trying to
do that in a way where we deploy the
latest technology we deploy the latest
features to them but we're transparent
about how we've updated our service and
deploy that but but within that
framework accepting that sort of basic
premise that what we're trying to do is
in the interests of the people who are
using the service I hope that others
will say want to join in a conversation
about how we can enable that how we can
make sure that we break a cycle whereby
companies are or I think it's less about
the companies it's more about the fact
that the huge amount of energies devoted
we devoted we think to the wrong part of
this equation the part that we should be
devoting the energy to is that clear
understanding between us and the people
who use our services about how they work
and about how the data is used thank you
for listening to me this morning I hope
that some food for thought and to say I
look forward to continuing the
conversation in the context of the work
that we're doing through Stephens
programs thank you