On Apr 19, 2017, at 5:21 AM, Iain Henderson <
" class="">
> wrote:
Yes, but isn’t that just one of several variants of option 3?
That is to say, the way I ‘commission’ the adverts I am willing to see is by telling the brands I engage with that I consent to receiving adverts from them.
Yes. This is exactly what we propose with the #nostalking term, which says this:
Nobody will get that message except through tools of our own and terms of our own.
We have tools with browsers that have ways (e.g. http headers) of signaling intent and proffering terms. (e.g. “here’s a link to my #nostalking term at customercommons.org/terms/nostalking). We need tools that work through mobile devices and apps as well.
Given that the world is still massively defaulted to industrial age norms, which assume full agency only for governments and large organizations (especially companies), and subordinate or victim status for “users” or “consumers” of industrial services and goods, nearly all the work, all the media coverage, and all the development, is toward solutions that go top down, for example though policies such as the GDPR, best practices such as PbD, and countless CRM and CX systems that work toward improving our “experiences” or “journeys." The GDPR and PbD are good and necessary, because they create the corporate-side sympathies and environments we need for our terms to be heard, agreed to and acted upon. And we’ll need CRM and CX systems that can be programmed to shake hands and deal with independent individuals acting with full agency.
But it’s our job to make those tools and come up with those terms for individuals. Without them, we’ll stay trapped and split into as many different “experiences” and “journeys” as there are companies obeying regulations and behaving nicely.
I believe we can nail down the generalities of #nostalking at VRM Day and finish the job at IIW. Publishers and advertising folk will be there. We also need next steps through allies within publishing, advertising, and the policy, code development and consulting worlds. Some of those folks will be at VRM Day and IIW as well.
Here are some posts on #nostalking and the reasons for it, with the most recent first:
An alternate would be a hybrid of 2 and 3, whereby I consented to a Brand tracking/ profiling me WITHIN site/ that context, but not cross-site.
3) New ‘post-GDPR' digital advertising models not based on tracking/ profiling.
I see that as a second #nostalking term that allows permitted tracking (though we might want to use another term, especially if there is mutually consented non-tracking code involved) by companies with which individuals already have relationships. On 19 Apr 2017, at 12:00, John Wunderlich <
" class="">
> wrote:
Option 4:
I want site relevant brand advertising without tracking.
How will one signal relevance? Possibly through a third #nostalking term. The risk with this one is that brands and their allies among Big Data, AI and ML suppliers will all say “Only our big machines can fully know who you really are, what you really want, and therefore what’s most relevant to you.” They have been in the business of disrespecting and diminishing individual agency, autonomy, originality and intelligence from the start, and won’t be stopping soon. I'll build my relationships with brands through purchases and inquiries.
Again, we need to be in charge of the methods by which this is done—on our side as first parties, not on the brands’ side with us only as dependent second parties.
Thanks, John
4giv spellin errurz from mobile devize
From: Iain Henderson <
" class="">
>
Sent: Tuesday, April 18, 2017 3:25:14 AM
To: Mike O'Neill
Cc: Aurelie Pols; Tim Walters; Doc Searls; John @ BB; ProjectVRM list
Subject: Re: [projectvrm] Princeton’s Ad-Blocking Superweapon May Put an End to the Ad-Blocking Arms Race - Motherboard
I think the existing Section 4 provision (Right to Object and Profiling, main clauses below) in GDPR will put paid to current ad tech models. Those behind the tracking cookies, in the main, don’t have direct relationships with the individuals they’d have
to seek consent from; and I can’t imagine too many brands willing to take the hit and seek consent on behalf of those unknown businesses.
Good. We need to cite that section in our work on #nostalking and #intentcasting. Thanks for supplying that.
By the way, we will have the first #intentcasting terms ready for VRM Day and IIW. They are being prepared as we speak by the Cyberlaw Clinic at Harvard Law School. As you say, companies would likely be best served by just accepting that people don’t want the current model and moving on.
And it will be easier for them to accept that fact if individuals arrive as first parties with friendly terms, such as #nostalking provides publishers and advertisers and #intentcasting provides the parts of CRM that like to hear from self-qualified sales leads.
I think what comes next is then the far more interesting discussion. I guess the choices are:
1) No digital advertising for EU based individuals (unlikely)
2) Digital advertising targeted only at those EU individuals who have provided valid consent (the default position, but which means tiny volumes).
We need to be careful with consent.
My concern with Consent Receipt is around who is the first party and who is the second party.
If Consent Receipt is primarily a tool of advertisers and publishers who want to preserve the adtech system while complying with the GDPR—with the adtech side as first parties and us as second parties—we lose. Let’s be very clear about that.
If Consent Receipt is primarily a tool of individuals obtaining consent to our terms or preferences as first parties, from publishers and/or advertisers and agencies as second parties, we win—and so do they. Because then we can start to build The Intention Economy where signaling between demand and supply is direct, clear and useful, and spying-based robotic guesswork is minimized or eliminated.
3) New ‘post-GDPR' digital advertising models not based on tracking/ profiling.
Right. That’s what I unpacked above.
The VRM community should have an interest in type 3.
Exactly. Of course the initial answer to the question ‘what digital advertising would you want if you had control?’ might well be ‘none’.
This is a question I’m visiting as I write The Biggest Boycott: People vs. Advertising. When I wrote What if we dont’ need advertising at all? last year, I thought I was just raising a helpful question. Now I’m starting to think the answer might actually be “Yes.” But not an absolute one. Here’s what I wrote in The Intention Economy:
When the backlash is over, and the advertising bubble
deflates, advertising will remain an enormous and useful business. We will
still need advertising to do what only it can do. What will emerge, however, is
a market for what advertising can’t
do. This new market will be defined by what
customers actually want, rather than guesses about it.
So if customers want brand advertising in their magazines (which apparently they do, in the likes of Vogue and Field and Stream), or billboards along highways that say you can find breakfast at the next exit, fine. But customers will be the ones taking the lead in that dance, at least half the time.
That’s understandable given where we are today,
but will also put lots of publishers out of business.
Or keep them in business. Joyce and I still work with Linux Journal, which does no adtech and is victimized by the adtech-only advertising distribution system we have today. I can tell you with absolute confidence that Linux Journal readers would love to be able to signal #nostalking as a way to attract back brand advertisers for equipment and services relevant to Linux geeks.
I would contend we need to aim at leas some bandwidth at what we do want in the post-GDPR world; that is something that cannot be defined from the classic second party standpoint.
Exactly.
Now is the time, folks. See you at VRM Day and IIW, or here if you can’t make it there.
Also think about follow-ons in Europe (and .au, where there are also strong privacy laws). Some events are set up already, but we may need some new ones too. A lot depends on the energies gathered at VRM Day and IIW.
Doc
Cheers
Iain
_________
SECTION 4 RIGHT TO OBJECT AND PROFILING
0.
The data subject shall have the right to object, on grounds relating to their particular situation, at any time to the processing
of personal data which is based on points (d), (e) and (f) of Article 6(1), unless the controller demonstrates compelling legitimate grounds for the processing which override the interests or fundamental rights and freedoms of the data subject.
1.
Where personal data are processed for direct marketing purposes, the data subject shall have the right to object free of charge to
the processing of their personal data for such marketing. This right shall be explicitly offered to the data subject in an intelligible manner and shall be clearly distinguishable from other information.
Measures based on profiling
0.
Every natural person shall have the right not to be subject to a measure which produces legal effects concerning this natural person
or significantly affects this natural person, and which is based solely on automated processing intended to evaluate certain personal aspects relating to this natural person or to analyse or predict in particular the natural person's performance at work, economic
situation, location, health, personal preferences, reliability or behaviour.
On 17 Apr 2017, at 13:41, Mike O'Neill <
" class="">
> wrote:
If that slips presumably the ePrivacy Directive still holds, which in some ways is stricter – there is no exception for first-party analytics for example. Anything that is vague or unsaid
in that presumably gets covered by the GDPR anyway, and that must include the sanctions.
Even if the lobbyists manage to get the “legitimate interest” catch all put into the Regulation (unlikely as it’s not in the Directive either), it cannot override fundamental privacy rights,
and there is still the right-to-object to it “by automated means”.
On the Consent issue my view is that companies should just accept it, people just do not want to be tracked without their agreement. As Doc has said the AdBlocker phenomena in the biggest
consumer boycott in history and there is little sign of it going away. There is no point in lobbying against the law and standing in the way of popular opinion, much better to embrace the change.
Thanks for your reply Doc and for pitching in Mike and Tim, much appreciated!
As far as I recall, this thread is about AdBlocking and thus ePrivacy, and most importantly whether article 6 of the GDPR will be reflected in it's entirety in article 8 of ePrivacy. Whether ePrivacy will be wrapped up in time is still open, let's hope for
the best and I prefer not to speculate as I don't lobby. My job is helping both controllers and processors in aligning with new compliance requirements brought about by the GDPR, for now. I consider ePrivacy to be lex specalis and we'll see whether legitimate
interest makes it into article 8. If not, consent will be a tough cookie to crack (pun intended), certainly for those non EU based intermediaries that make money out of the data market that has taken shape over the years.
It's also in that regard where I have problems reconciling with this idea of data minimization, hence my question about what compliance actually means for companies wanting to align with the GDPR, in the EU and abroad.
I'm seeing 2 opposing camps: total ignorance or brushing off as "this does not apply to us", as if we were still in an "we don't collect PII" era or general hysteria "oh my God, we need to get going", of course because of the sanctions, making this a risk factor
that has entered board room discussion levels.
My personal interpretation, and I'm happy to be proven wrong, is that GDPR brings along 2 major changes compared to the current Data Protection Directive: territoriality (art. 3), which is why companies outside the EU should care ("processing of personal data
of data subjects who are in the Union") and the fact that pseudonymous data, which includes cookies and unique identifiers, is subject to privacy obligations (reading lawfulness of processing is an issue hence the outcome of article 8 of ePrivacy is going
to create quite some turmoil for this sector imho).
Last but not least, I am witnessing a lot of opportunities here as well, ranging from indeed as Tim pointed out article 5.2 on accountability: how do we make sure we keep those traces?
to how to help controllers with all those Rights: SARs (art. 15: Right of access by the data subject), which are not new of course but how far does this rabbit hole go exactly, certainly with the introduction of pseudonymous data? are questions that need to
be asked by processors to make sure they have the traceability mechanisms in place to help their clients comply (and avoid those hefty fines);
Right to Rectification and Erasure (art. 16 & 17) when for example data is being backed-up and there is a cost to restoring this data even before any rectification or deletion can take place; Right to Object (art. 21 & 22) as art. 18 stems from the technical
measures of the articles cited previously.
While I think there are technical solutions to solving the above issues mentioned, hence again my question about what does compliance to the GDPR mean exactly?, it's also broader than that in the sense that companies need to assure accountability on a number
of fronts to indeed push these ideas of PbD, DPbD, blablabla. I'm not a big fan, I have to confess as it's too vague and I have difficulty translating this into actionable items.
I've therefore cut down the GDPR in 10 pillars, ranging from Data Security & Breach Notification to SOPs (Standard operating Procedures) and actually reaching out to DPAs, now SAs (I have trouble evolving!) in case of doubt. Data flows and classification of
data types (anybody have a list of Purpose by any chance?), cross borders data transfers, the different rights partially enumerated above are part of this
exercise.
I see the GDPR as a team effort where, depending upon the issue, one of the actors of a "GDPR Steering Committee" would step-up. Typically, security measures and data breach detection would not fall under the DPO. It should be a joint effort with IT/CISO that
knows which mechanisms exist within a company once a breach has been detected. At this point, collaboration is needed, not before.
Same for a data scientist, who needs to understand the logic of privacy law, and can escalate when needed once a specific data type is being collected or processed: training is required to implement those reflexes that can then be taken over by those part of
that Steering Committee.
This is what I understand for starters by compliance with the GDPR and it's not by any means written in stone nor complete.
If we are to understand data as an asset yet also as something that falls under fundamental Rights, at least under EU law (the US keeps talking about data ownership, which is not imho an angle we can accept in Europe but we're working on possible interpretations
of this issue, beyond Giovanni Buttarelli's daring reference to human organs), it needs to be accompanied by accountability mechanisms and practices that go beyond the current interpretation of the law, bridging the technical and legal worlds.
I'm happy to read DNT is part of the ePrivacy draft and love the idea of VRM. The question is how to turn these concepts into something tangible, hence totally aligning with Tim's last statement: we need to be concrete about what compliance with the GDPR means:
building solutions, standards and processes to avoid indeed these excuses.
thank you for your time, I've love to take a peak at what you mentioned Tim and happy to exchange more.
Happy Easter Monday, gracias,
Yes, the WP247 document that Mike points to is very important. It's also concerning, because I'm not confident that the parliament will be able (because of the effort involved) or willing (because of the industry lobbyists) to undertake the changes to the ePrivacy
draft regulation that have been "requested" by the Working Party.
Over 35 pages, the Article 29 Working Party notes dozens of "grave concerns," "concerns," and "suggestions for clarifications." However, they also endorse the goal of introducing the proposed ePR along with the GDPR in May 2018. I've been wondering about the
next steps and timeline -- thanks to Mike, I'm now enlightened -- vote on a revised Regulation in October, implement in parallel with the GDPR on May 25, 2018.
However, as I think I've said to this group in another thread, industry representatives that I've talked with are adamant that the burden of parallel implementation is unbearable. (And given how much I see firms struggling with the GDPR, they may have a point.)
Moreover, some of them tell me they have met with key EU figures and are confident they can bury ePrivacy in committee for some time. I'm very curious to see how this plays out. If you sense any more smoke signals, please let me know.
Now, as for Aurelie's question: Doc points to the sanctions/fines (Article 83) and, more importantly, to some of the factors to be considered when setting/imposing a fine, such as "the intentional or negligent character of the infringement" and "any action
taken by the controller . . . to mitigate the damage suffered by data subjects" (83(b-c)). The implication being, I think, that companies have an interest in and an incentive to avoid collecting data that they don't (think they) absolutely require, and will
welcome assistance in this regard from individuals.
All good. But if Aurelie or others are looking for specific provisions of the GDPR that would motivate companies to embrace anti-tracking, I think the answer is data protection by design (DPbD) in Article 25 and Recital 78.
From Recital 78: "In order to be able to demonstrate compliance with this Regulation, the controller should adopt internal policies and implement measures which meet in particular the principles of data protection by design and data protection by default. Such
measures could consist, inter alia, of minimising the processing of personal data, pseudonymising personal data as soon as possible, transparency with regard to the functions and processing of personal data, enabling the data subject to monitor the data processing,
enabling the controller to create and improve security features."
Article 25(2) expands in particular upon the data minimization requirement and, in my view, shows that embracing DPbD means not (only) following the seven foundational principles of privacy by design articulated by Ann Cavoukian (https://image.slidesharecdn.com/pbdseminar-150508185502-lva1-app6892/95/privacy-by-design-seminar-jan-22-2015-12-638.jpg?cb=1431111507)
but also more broadly ensuring that the company's behavior reflects the six core data protection principles in Article 5(1). (And, crucially, the accountability requirement in Article 5(2). In short, every affected company must ensure that it respects the
core principles and it must be able to demonstrate (prove) that it's actions and behavior reflect this
respect.)
I just delivered a short webinar on DPbD in the GDPR. It was client-only, but I'll see if I can pry loose the recording, if anyone is interested. In any case, I'll be writing more about it soon.
By the way, Article 25 begins by stating, "Taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for rights and freedoms of natural
persons posed by the processing, the controller shall" implement DPbD. This inescapably creates an incentive for companies to argue that the state of the art is not advanced enough and/or the cost of implementation is too high, etc. That makes it all the more
important for third parties such as Customer Commons, the Cyberlaw Clinic, and the Princeton ad blocking group to develop technologies that defeat these excuses.
Cheers,
tw
I did not see if thus had been posted here yet, but it is the DPAs (Article 29 Working Party) response to the ePrivacy Regulation proposal. This is before the European parliament (who are very influenced by Article 29's output) now, aiming for a vote in October,
so it can become law in May 2018 when the GDPR will apply.
http://ec.europa.eu/newsroom/document.cfm?doc_id=44103
They are calling for mandatory DNT.
-----Original Message-----
From: Doc Searls [mailto:
" target="_blank" class="" style="color:purple; text-decoration:underline">
]
Sent: 16 April 2017 20:55
To: Aurelie Pols <
" target="_blank" class="" style="color:purple; text-decoration:underline">
>
Cc: Tim Walters <
" target="_blank" class="" style="color:purple; text-decoration:underline">
>; John @ BB <
" target="_blank" class="" style="color:purple; text-decoration:underline">
>;
ProjectVRM list <
" target="_blank" class="" style="color:purple; text-decoration:underline">
>
Subject: Re: [projectvrm] Princeton’s Ad-Blocking Superweapon May Put an End to the Ad-Blocking Arms Race - Motherboard
> On Apr 16, 2017, at 2:14 PM, Aurelie Pols <
" target="_blank" class="" style="color:purple; text-decoration:underline">
> wrote:
>
> Can I ask a silly question?
Sure. But this one isn’t silly.
> When you say "Motivation on the corporate side for agreeing with these terms is compliance with the GDPR.", which part of the GDPR is referred to exactly? I'm curious about the various interpretations that are circulating and how "corporations" are indeed
motivated, certainly as ePrivacy is still in discussion.
> Please enlighten me ;-) muchisimas gracias
> Aurélie
This part: <https://en.wikipedia.org/wiki/General_Data_Protection_Regulation#Sanctions>
Or, from the law itself: <http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#d1e6226-1-1>
Companies wishing to comply with the GDPR will continue to work on their own privacy-assuring schemes, of course, and that’s cool. What we’re offering here is the beginning of something new: individuals taking the lead in helping companies deal with a compliance
issue that has at least some of those companies scared, and therefore willing to do new things.
Doc
> On Sun, Apr 16, 2017 at 5:26 PM, Doc Searls <
" target="_blank" class="" style="color:purple; text-decoration:underline">
> wrote:
>
>> On Apr 16, 2017, at 11:10 AM, Tim Walters <
" target="_blank" class="" style="color:purple; text-decoration:underline">
> wrote:
>>
>> Nice. But what we really need is a superweapon that blocks tracking.
>
> We’re working on one at Customer Commons, with help from the Cyberlaw Clinic at Harvard and working groups at Kantara. The weapon is terms we can assert as first parties that sites and services can agree to as second parties. Those terms can, and will, involve
requirements restricting or preventing tracking.
>
> Motivation on the corporate side for agreeing with these terms is compliance with the GDPR.
>
> The latter was the subject of an earlier thread here, and both topics will be up front at VRM Day and IIW. Register here:
>
> http://bit.ly/vrmday2017a
> https://iiw24.eventbrite.com/
>
> To be clear, blocking tracking directly will also be on the table. Hope developers of those will be there as well. (We had Privacy Badger folks last time.)
>
> Doc
>
>> Most of the ads can stay as far as I'm concerned. I just ignore them.
>>
>> tw
>>
>> On Sun, Apr 16, 2017 at 4:11 PM, John @ BB <
" target="_blank" class="" style="color:purple; text-decoration:underline">
> wrote:
>> https://motherboard.vice.com/en_us/article/princetons-ad-blocking-superweapon-may-put-an-end-to-the-ad-blocking-arms-race
>>
>> John
>>
>> [Powered by an iSomethingOrOther]
>> +1 808 344 2914
>>
>
>
>
>
> --
> --
> Aurélie Pols
>
> Skype: aurelie.pols
> Mobile: + 34 630 687 112
--
--
Aurélie Pols
Skype: aurelie.pols
Mobile: + 34 630 687 112
This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.
|
