Last week, Ranking Digital Rights participated in PrivacyCamp and the Computers, Privacy and Data Protection (CPDP) conference in Brussels. Two issues dominated the discussions: government mass surveillance, especially in light of the Schrems Safe Harbor decision (PDF), and the new EU General Data Protection Regulation. Participants also discussed corporate practices and their impact on privacy.
At CPDP, the panel “Appfail or Appwin” discussed how mobile apps may or may not respect users’ right to privacy. For example, Finn Myrstad of the Norwegian Consumer Council investigated the terms & conditions of apps, which may sometimes change without notice, and sometimes impose perpetual, worldwide and irrevocable licenses on users. They conducted a fun experiment to see how that plays out in the streets of Oslo. The Council will soon release a report about apps’ terms. In turn, Richard Tynan of Privacy International explained that even if apps don’t demand your real identity, your device collects enough data to compile a reliable picture of who you are. An audience member working for the Dutch Data Protection Authority called on Google to require that app developers publish a privacy policy, as well as to add an option for users to temporarily grant permissions for apps to do certain things such as access location only at specific times, but not generally.
Other sessions also touched on how companies should address privacy concerns. We learned that more and more companies are thinking about privacy impact assessments as ways to mitigate risks and ensure legal compliance, even though, according to one speaker, individuals within companies conducting the assessment may lack sufficient awareness about the range of privacy risks people might face when using the company’s services. Also, accountability frameworks are emerging as instruments for companies to go beyond compliance with data protection regulations, to being able to credibly demonstrate their practices to external stakeholders. For example, in order to meet RDR’s standard for corporate policy and practice, companies should be accountable not only to business partners and regulators, but also to affected individuals and the wider public.
In a panel on transparency reporting, Artur Alves of Concordia University recognized that transparency reports have beefed up over the past years, but could gain more in uniformity and transparency on internal processes. Microsoft’s Mark Lange highlighted the company’s Transparency Hub, and further talked about national security related requests. He explained that Microsoft is limited in its disclosure on receiving such requests, due to U.S. legal restrictions. Niels Huijbregts of Dutch ISP XS4ALL, said that customers welcome their transparency reports, but he had to overcome hesitation within XS4ALL’s parent company KPN, where some feared harming government relations. Nate Cardozo talked about EFF’s Who’s Got Your Back report, and said that companies are still deficient when it comes to national security-related reporting, reporting on government requests for terms of service enforcement, as well as reporting on informal processes.
Further discussions at CPDP dealt with anything from interactive toys and the need to have granular control over what kind of data they collect from children, to data minimization, where a European Commission panelist called for privacy compliance as a competitive advantage.
Ranking Digital Rights supports the view that improved privacy practices provide business opportunities for companies. The many conversations at CPDP confirmed that a human rights-centered approach to privacy accountability is necessary to improve companies’ practices.
