Text archives Help


Re: [projectvrm] Princeton’s Ad-Blocking Superweapon May Put an End to the Ad-Blocking Arms Race - Motherboard


Chronological Thread 
  • From: Doc Searls < >
  • To: Aurelie Pols < >
  • Cc: Iain Henderson < >, John Wunderlich < >, Mike O'Neill < >, Tim Walters < >, "John @ BB" < >, ProjectVRM list < >
  • Subject: Re: [projectvrm] Princeton’s Ad-Blocking Superweapon May Put an End to the Ad-Blocking Arms Race - Motherboard
  • Date: Thu, 20 Apr 2017 14:13:59 -0700

On Apr 20, 2017, at 12:44 PM, Aurelie Pols < " class=""> > wrote:

I'm not sure if you guys saw this: point 17 of the EDPS' opinion on digital content so dumping this here. Hopefully it makes sense

17. There might well be a market for personal data, just like there is, tragically, a market for live human organs, but that does not mean that we can or should give that market the blessing of legislation. One cannot monetise and subject a fundamental right to a simple commercial transaction, even if it is the individual concerned by the data who is a party to the transaction


Good catch!

Except for the incentives by the data market actors/data brokers/... what ever you want to call them to bypass any obligations put forward by the GDPR, ranging from internally lack of transparency to interesting engineering solutions to separate unique identifiers from the data, hashing and what ever, as well as lobbying/praying to get legitimate interest into ePrivacy, I see a clash between the US view of data ownership and the European stance that fundamental rights can not be monetized.

Yes. We should also be careful not to be overly broad in our characterizations and thinkings, since there are many in the US, and within US companies, that share the European view (including most of the US folk on this list); and European companies are not off the hook for behaving or acquiescing to norms such as trafficking in live human data organs. That those practices were normalized primarily by US companies is beside the fact that they are morally (and soon legally) indefensible except in terms that reduce people to digital honey-pots.

Also, even within Google, Facebook and Amazon there are many people who are appalled at those norms and want to change them. Apple is already on the individuals’ side to a high degree http://apple.com/privacy, and that helps.

Many here know large global companies that are variously worried and activated by the approach of May 2018, and that much of the conflict between those two views is internal as well as external for those companies. Also, best practices are exactly that, no matter where they take place.

Our challenge here is to show how the individual-side code and terms we develop are going to be good for companies—and to develop reciprocal code that works on the corporate side as well.

Just wanted to mention that, not sure if it's directly useful but felt it should be pointed out.

It’s very useful. Thanks!

Doc

Gracias,
Aurélie


On Wed, Apr 19, 2017 at 2:21 PM, Iain Henderson < " target="_blank" class=""> > wrote:
Yes, but isn’t that just one of several variants of option 3?

That is to say, the way I ‘commission’ the adverts I am willing to see is by telling the brands I engage with that I consent to receiving adverts from them.

An alternate would be a hybrid of 2 and 3, whereby I consented to a Brand tracking/ profiling me WITHIN site/ that context, but not cross-site. 

3) New ‘post-GDPR' digital advertising models not based on tracking/ profiling.







Option 4:

I want site relevant brand advertising without  tracking. I'll build my relationships with brands through purchases and inquiries. 

Thanks, John
4giv spellin errurz from mobile devize
From: Iain Henderson < " target="_blank" class=""> >
Sent: Tuesday, April 18, 2017 3:25:14 AM
To: Mike O'Neill
Cc: Aurelie Pols; Tim Walters; Doc Searls; John @ BB; ProjectVRM list
Subject: Re: [projectvrm] Princeton’s Ad-Blocking Superweapon May Put an End to the Ad-Blocking Arms Race - Motherboard
 
I think the existing Section 4 provision (Right to Object and Profiling, main clauses below) in GDPR will put paid to current ad tech models. Those behind the tracking cookies, in the main, don’t have direct relationships with the individuals they’d have to seek consent from; and I can’t imagine too many brands willing to take the hit and seek consent on behalf of those unknown businesses.

As you say, companies would likely be best served by just accepting that people don’t want the current model and moving on.

I think what comes next is then the far more interesting discussion. I guess the choices are:

1) No digital advertising for EU based individuals (unlikely)

2) Digital advertising targeted only at those EU individuals who have provided valid consent (the default position, but which means tiny volumes)

3) New ‘post-GDPR' digital advertising models not based on tracking/ profiling.

The VRM community should have an interest in type 3. Of course the initial answer to the question ‘what digital advertising would you want if you had control?’ might well be ‘none’. That’s understandable given where we are today, but will also put lots of publishers out of business.

I would contend we need to aim at leas some bandwidth at what we do want in the post-GDPR world; that is something that cannot be defined from the classic second party standpoint.

Cheers

Iain

_________

SECTION 4 RIGHT TO OBJECT AND PROFILING

0.     The data subject shall have the right to object, on grounds relating to their particular situation, at any time to the processing of personal data which is based on points (d), (e) and (f) of Article 6(1), unless the controller demonstrates compelling legitimate grounds for the processing which override the interests or fundamental rights and freedoms of the data subject.

1.     Where personal data are processed for direct marketing purposes, the data subject shall have the right to object free of charge to the processing of their personal data for such marketing. This right shall be explicitly offered to the data subject in an intelligible manner and shall be clearly distinguishable from other information.

Measures based on profiling

0.     Every natural person shall have the right not to be subject to a measure which produces legal effects concerning this natural person or significantly affects this natural person, and which is based solely on automated processing intended to evaluate certain personal aspects relating to this natural person or to analyse or predict in particular the natural person's performance at work, economic situation, location, health, personal preferences, reliability or behaviour.


Parliament’s provisional agenda for ePrivacy was tweeted by the rapporteur Marju Lauristen in March https://twitter.com/LauristinMarju/status/841311908330381318
 
If that slips presumably the ePrivacy Directive still holds, which in some ways is stricter – there is no exception for first-party analytics for example. Anything that is vague or unsaid in that presumably gets covered by the GDPR anyway, and that must include the sanctions.
 
Even if the lobbyists manage to get the “legitimate interest” catch all put into the Regulation (unlikely as it’s not in the Directive either), it cannot override fundamental privacy rights, and there is still the right-to-object to it “by automated means”.
 
On the Consent issue my view is that companies should just accept it, people just do not want to be tracked without their agreement. As Doc has said the AdBlocker phenomena in the biggest consumer boycott in history and there is little sign of it going away. There is no point in lobbying against the law and standing in the way of popular opinion, much better to embrace the change.
 
 
 
 
From: Aurelie Pols [ " target="_blank" class="">mailto: ] 
Sent: 17 April 2017 11:30
To: Tim Walters < " target="_blank" class=""> >
Cc: Mike O'Neill < " target="_blank" class=""> >; Doc Searls < " target="_blank" class=""> >; John @ BB < " target="_blank" class="">john.philpin@beyondbridges.net>; ProjectVRM list < " target="_blank" class=""> .harvard.edu>
Subject: Re: [projectvrm] Princeton’s Ad-Blocking Superweapon May Put an End to the Ad-Blocking Arms Race - Motherboard
 
Thanks for your reply Doc and for pitching in Mike and Tim, much appreciated!
 
As far as I recall, this thread is about AdBlocking and thus ePrivacy, and most importantly whether article 6 of the GDPR will be reflected in it's entirety in article 8 of ePrivacy. Whether ePrivacy will be wrapped up in time is still open, let's hope for the best and I prefer not to speculate as I don't lobby. My job is helping both controllers and processors in aligning with new compliance requirements brought about by the GDPR, for now. I consider ePrivacy to be lex specalis and we'll see whether legitimate interest makes it into article 8. If not, consent will be a tough cookie to crack (pun intended), certainly for those non EU based intermediaries that make money out of the data market that has taken shape over the years.
 
It's also in that regard where I have problems reconciling with this idea of data minimization, hence my question about what compliance actually means for companies wanting to align with the GDPR, in the EU and abroad.
I'm seeing 2 opposing camps: total ignorance or brushing off as "this does not apply to us", as if we were still in an "we don't collect PII" era or general hysteria "oh my God, we need to get going", of course because of the sanctions, making this a risk factor that has entered board room discussion levels. 

My personal interpretation, and I'm happy to be proven wrong, is that GDPR brings along 2 major changes compared to the current Data Protection Directive: territoriality (art. 3), which is why companies outside the EU should care ("processing of personal data of data subjects who are in the Union") and the fact that pseudonymous data, which includes cookies and unique identifiers, is subject to privacy obligations (reading lawfulness of processing is an issue hence the outcome of article 8 of ePrivacy is going to create quite some turmoil for this sector imho).  
 
Last but not least, I am witnessing a lot of opportunities here as well, ranging from indeed as Tim pointed out article 5.2 on accountability: how do we make sure we keep those traces? 
to how to help controllers with all those Rights: SARs (art. 15: Right of access by the data subject), which are not new of course but how far does this rabbit hole go exactly, certainly with the introduction of pseudonymous data? are questions that need to be asked by processors to make sure they have the traceability mechanisms in place to help their clients comply (and avoid those hefty fines); 
Right to Rectification and Erasure (art. 16 & 17) when for example data is being backed-up and there is a cost to restoring this data even before any rectification or deletion can take place; Right to Object (art. 21 & 22) as art. 18 stems from the technical measures of the articles cited previously.
 
While I think there are technical solutions to solving the above issues mentioned, hence again my question about what does compliance to the GDPR mean exactly?, it's also broader than that in the sense that companies need to assure accountability on a number of fronts to indeed push these ideas of PbD, DPbD, blablabla. I'm not a big fan, I have to confess as it's too vague and I have difficulty translating this into actionable items. 
 
I've therefore cut down the GDPR in 10 pillars, ranging from Data Security & Breach Notification to SOPs (Standard operating Procedures) and actually reaching out to DPAs, now SAs (I have trouble evolving!) in case of doubt. Data flows and classification of data types (anybody have a list of Purpose by any chance?), cross borders data transfers, the different rights partially enumerated above are part of this exercise. 
I see the GDPR as a team effort where, depending upon the issue, one of the actors of a "GDPR Steering Committee" would step-up. Typically, security measures and data breach detection would not fall under the DPO. It should be a joint effort with IT/CISO that knows which mechanisms exist within a company once a breach has been detected. At this point, collaboration is needed, not before. 
Same for a data scientist, who needs to understand the logic of privacy law, and can escalate when needed once a specific data type is being collected or processed: training is required to implement those reflexes that can then be taken over by those part of that Steering Committee. 
 
This is what I understand for starters by compliance with the GDPR and it's not by any means written in stone nor complete. 
If we are to understand data as an asset yet also as something that falls under fundamental Rights, at least under EU law (the US keeps talking about data ownership, which is not imho an angle we can accept in Europe but we're working on possible interpretations of this issue, beyond Giovanni Buttarelli's daring reference to human organs), it needs to be accompanied by accountability mechanisms and practices that go beyond the current interpretation of the law, bridging the technical and legal worlds. 
I'm happy to read DNT is part of the ePrivacy draft and love the idea of VRM. The question is how to turn these concepts into something tangible, hence totally aligning with Tim's last statement: we need to be concrete about what compliance with the GDPR means: building solutions, standards and processes to avoid indeed these excuses.
 
thank you for your time, I've love to take a peak at what you mentioned Tim and happy to exchange more.
 
Happy Easter Monday, gracias,

Aurélie

 

Yes, the WP247 document that Mike points to is very important. It's also concerning, because I'm not confident that the parliament will be able (because of the effort involved) or willing (because of the industry lobbyists) to undertake the changes to the ePrivacy draft regulation that have been "requested" by the Working Party. 

Over 35 pages, the Article 29 Working Party notes dozens of "grave concerns," "concerns," and "suggestions for clarifications."  However, they also endorse the goal of introducing the proposed ePR along with the GDPR in May 2018. I've been wondering about the next steps and timeline -- thanks to Mike, I'm now enlightened -- vote on a revised Regulation in October, implement in parallel with the GDPR on May 25, 2018.  

However, as I think I've said to this group in another thread, industry representatives that I've talked with are adamant that the burden of parallel implementation is unbearable. (And given how much I see firms struggling with the GDPR, they may have a point.) Moreover, some of them tell me they have met with key EU figures and are confident they can bury ePrivacy in committee for some time. I'm very curious to see how this plays out. If you sense any more smoke signals, please let me know. 

Now, as for Aurelie's question: Doc points to the sanctions/fines (Article 83) and, more importantly, to some of the factors to be considered when setting/imposing a fine, such as "the intentional or negligent character of the infringement" and "any action taken by the controller . . . to mitigate the damage suffered by data subjects" (83(b-c)). The implication being, I think, that companies have an interest in and an incentive to avoid collecting data that they don't (think they) absolutely require, and will welcome assistance in this regard from individuals. 

All good. But if Aurelie or others are looking for specific provisions of the GDPR that would motivate companies to embrace anti-tracking,  I think the answer is data protection by design (DPbD) in Article 25 and Recital 78. 

From Recital 78: "In order to be able to demonstrate compliance with this Regulation, the controller should adopt internal policies and implement measures which meet in particular the principles of data protection by design and data protection by default. Such measures could consist, inter alia, of minimising the processing of personal data, pseudonymising personal data as soon as possible, transparency with regard to the functions and processing of personal data, enabling the data subject to monitor the data processing, enabling the controller to create and improve security features." 

Article 25(2) expands in particular upon the data minimization requirement and, in my view, shows that embracing DPbD means not (only) following the seven foundational principles of privacy by design articulated by Ann Cavoukian (https://image.slidesharecdn.com/pbdseminar-150508185502-lva1-app6892/95/privacy-by-design-seminar-jan-22-2015-12-638.jpg?cb=1431111507) but also more broadly ensuring that the company's behavior reflects the six core data protection principles in Article 5(1). (And, crucially, the accountability requirement in Article 5(2). In short, every affected company must ensure that it respects the core principles and it must be able to demonstrate (prove) that it's actions and behavior reflect this respect.) 

I just delivered a short webinar on DPbD in the GDPR. It was client-only, but I'll see if I can pry loose the recording, if anyone is interested. In any case, I'll be writing more about it soon. 

By the way, Article 25 begins by stating, "Taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for rights and freedoms of natural persons posed by the processing, the controller shall" implement DPbD. This inescapably creates an incentive for companies to argue that the state of the art is not advanced enough and/or the cost of implementation is too high, etc. That makes it all the more important for third parties such as Customer Commons, the Cyberlaw Clinic, and the Princeton ad blocking group to develop technologies that defeat these excuses. 

Cheers, 
tw 
 
I did not see if thus had been posted here yet, but it is the DPAs (Article 29 Working Party) response to the ePrivacy Regulation proposal. This is before the European parliament (who are very influenced by Article 29's output) now, aiming for a vote in October, so it can become law in May 2018 when the GDPR will apply.

http://ec.europa.eu/newsroom/document.cfm?doc_id=44103

They are calling for mandatory DNT.




-----Original Message-----
From: Doc Searls [mailto: " style="color:purple;text-decoration:underline" target="_blank" class=""> .harvard.edu]
Sent: 16 April 2017 20:55
To: Aurelie Pols < " style="color:purple;text-decoration:underline" target="_blank" class=""> >
Cc: Tim Walters < " style="color:purple;text-decoration:underline" target="_blank" class=""> >; John @ BB < " style="color:purple;text-decoration:underline" target="_blank" class="">john.philpin@beyondbridges.net>; ProjectVRM list < " style="color:purple;text-decoration:underline" target="_blank" class=""> .harvard.edu>
Subject: Re: [projectvrm] Princeton’s Ad-Blocking Superweapon May Put an End to the Ad-Blocking Arms Race - Motherboard


> On Apr 16, 2017, at 2:14 PM, Aurelie Pols < " style="color:purple;text-decoration:underline" target="_blank" class=""> > wrote:
>
> Can I ask a silly question?

Sure. But this one isn’t silly.

> When you say "Motivation on the corporate side for agreeing with these terms is compliance with the GDPR.", which part of the GDPR is referred to exactly? I'm curious about the various interpretations that are circulating and how "corporations" are indeed motivated, certainly as ePrivacy is still in discussion.
> Please enlighten me ;-) muchisimas gracias
> Aurélie

This part: <https://en.wikipedia.org/wiki/General_Data_Protection_Regulation#Sanctions>

Or, from the law itself: <http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#d1e6226-1-1>

Companies wishing to comply with the GDPR will continue to work on their own privacy-assuring schemes, of course, and that’s cool. What we’re offering here is the beginning of something new: individuals taking the lead in helping companies deal with a compliance issue that has at least some of those companies scared, and therefore willing to do new things.

Doc

> On Sun, Apr 16, 2017 at 5:26 PM, Doc Searls < " style="color:purple;text-decoration:underline" target="_blank" class=""> > wrote:
>
>> On Apr 16, 2017, at 11:10 AM, Tim Walters < " style="color:purple;text-decoration:underline" target="_blank" class=""> > wrote:
>>
>> Nice. But what we really need is a superweapon that blocks tracking.
>
> We’re working on one at Customer Commons, with help from the Cyberlaw Clinic at Harvard and working groups at Kantara. The weapon is terms we can assert as first parties that sites and services can agree to as second parties. Those terms can, and will, involve requirements restricting or preventing tracking.
>
> Motivation on the corporate side for agreeing with these terms is compliance with the GDPR.
>
> The latter was the subject of an earlier thread here, and both topics will be up front at VRM Day and IIW. Register here:
>
> http://bit.ly/vrmday2017a
> https://iiw24.eventbrite.com/
>
> To be clear, blocking tracking directly will also be on the table. Hope developers of those will be there as well. (We had Privacy Badger folks last time.)
>
> Doc
>
>> Most of the ads can stay as far as I'm concerned. I just ignore them.
>>
>> tw
>>
>> On Sun, Apr 16, 2017 at 4:11 PM, John @ BB < " style="color:purple;text-decoration:underline" target="_blank" class="">john.philpin@beyondbridges.net> wrote:
>> https://motherboard.vice.com/en_us/article/princetons-ad-blocking-superweapon-may-put-an-end-to-the-ad-blocking-arms-race
>>
>> John
>>
>> [Powered by an iSomethingOrOther]
>> +1 808 344 2914
>>
>
>
>
>
> --
> --
> Aurélie Pols
>
> Skype: aurelie.pols
> Mobile: + 34 630 687 112

 


 
-- 
-- 
Aurélie Pols

Skype: aurelie.pols
Mobile: + 34 630 687 112



This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.




--
--
Aurélie Pols

Skype: aurelie.pols
Mobile: + 34 630 687 112


Archive powered by MHonArc 2.6.19.

§