Ruben Lasuy: Privacy issues for developers

uh hi ruben so ruben would address the topic of privacy uh ruben is a data privacy and protection specialist so based in brussels with keen interest in the web 3 technologies he's also the co-initiator of the mydata brussels hub and will present views on privacy and how it should be understood so reuben please all right can everybody hear me well yes i can hear you okay perfect i'll share my screen for this week um having a bit of slides to support what i'm going to say and sharing screen one all right and then i should go to presenter mode the irony of presenting slides on google when talking about privacy but that brings me to the first point of privacy and convenience um so for for today's talk the title that we went with uh is privacy issues for developers uh so chef has suggested that and i thought of of it like um to what extent am i the right person to talk about privacy issues for developers what do we mean by privacy issues for developers it's not that that developers have a problem or an issue with privacy i guess um but there are some some dif some interesting um perhaps angles to touch upon in in the yeah in the intersection of privacy and codes and then code would for me be the substitute of of developers or what developers um in the abstract form stand for so just a little bit about myself as chef has already indicated i'm uh i'm based in brussels and i'm the co-initiator of my data brussels lab um i have a keen interest indeed in in data privacy and data governance the intersection of of the two um so data privacy and protection is where where i started my my career in gdpr so i gained i gained interest in in the gdpr back in 2014 when i first heard about it at the time when i was studying my studies were more in the economics and nit related fields but i heard about uh about the gdpr topic and and it sparked my interest so i did my my master's thesis in uh on the topic uh on the topic of uh what what the impact of the privacy regulation that was just being drafted then would be on on the field of information management so specifically for commercial commercial classic classic companies so i at that point i wasn't really aware of the web 3 and the decentralized space yet and that's why in the in the course of the years my focus has been on on data privacy and protection in in the classic sense let's say so how do how do companies that have um that have specific architectures in place how do they adapt to the new regulation and what exactly does it mean for them to have to comply with with these new laws and over the course of the years i actually started to realize that privacy and the legal aspects of of of data privacy were only really a part of the puzzle um so i i gained i gained interest in political economy uh also more in in yeah in what exactly the technologies that could help us with scaling this issue uh were and so i i naturally ended up with uh with interest or with diving deeply in the in the web 3 so that's that's basically a bit of my curriculum so far and through the my data brussels happened my data community in in general i think i uh i'm very happy to to be surrounded by by a lot of experts in different fields and and really as jana has also indicated or pointed out it's uh it's the the collaborative or the the multi um multi stakeholder environment that really makes it interesting and so as i said the the topic of gdpr or data privacy issues for developers is is a bit of a challenging one in a way because it it forced me to think about um the fact that we all have our our specific angles to look at things and i think it's it's probably irrelevant to to just take a bit of a helicopter view and look at what what is actually at stake and and um what we mean by privacy what we mean by codes what we mean by law i'm not going to explain all of it because i don't probably fully grasp all of the concepts myself but there are some some interesting frameworks to to just use as a guidance in this i'm just going to try and see if i can get okay so the saying of code is law is is quite an interesting one um it shows that um there's there's a lot at play here you have bits and bytes and then we have what we call law which is a more old world or a concept that's that's way older than code um and as asiana has also indicated or pointed out i think most of the current challenges or the turmoils that we're facing as society it's basically because people speaking the language of code and people people speaking the language of law business and other areas they they have not found a way to to actually use the same terminology yet and to translate what have been considered best practices and so all the principles on which regulation is based and not only privacy regulation but also competition law um other types of of law and and ethics um i think as as humans we intuitively really understand what what all of that means um it's just that the the sort of architectures that we're using or that we're depending more and more heavily upon and of course by that by that i'm referring to the um the digital the digital architecture uh that's that's that's uh basically dominating our lives it's it's all forming like part of of uh our sphere of influence but also um all of all of those forces are kind of impacting and and regulating us so lawrence less is lessig who wrote codes of codes of law and cyberspace or codes of cyberspace and and other laws has this prophetic dot theory um which kind of visualizes all of that and in the middle here uh the prophetic dot in this case uh is actually us as individuals so what you see is that um the individual and in the in in this presentation the individual would be hypothetically a technical a technical person that's that's uh developed or that's that's developed a lot of skills in in programming and developing um this person also has this these these forces uh work working upon but also us as regular citizens our non-technical people are facing the same forces and so law is one of the forces that that regulates this environment and by regulation or by regulating we just mean exerting agency over or giving agency to the market is another one the market is pricing what is uh what is good behavior or is pricing uh good ideas or ideas that that might be very that might be very profitable in in the future on the other hand we have architecture which is also multifaceted so biology or just the physical environment iscardo is is part of our architecture but more and more uh the technologies that that uh enhance this environment and augment it um are increasingly part of that uh that sphere of influence and that's fear of regulating regulating things and then there's the norms and uh the ethics by which a society is guided that if if i do something wrong then there's a society or or people around me that that might indicate that that's against some of our uh some of our commonly agreed upon norms and that's a bit of the the four major actors in um in a society at work and what we see is that if we're focusing too much on on on one side of of this four uh the four uh four angled um diagram then it gets out of balance and i think what we're realizing now is that the architectural and the market side of things has been gaining a lot of traction over over the last few decades and actually the the norms which we still intuitively understand uh that are there and the laws that that uh that are physically or that that are in place uh actually have have decreased in in their yeah they're harnessing um their harnessing capabilities or their harnessing possibilities um and that's probably the balance the balance that we have to restore um and so in the context of of the web 3 i think it's interesting um to see that there isn't there is actually a very uh very important um change or a very important paradigm shift uh that's currently being undertaken and that's accelerated by kovit of course and that is that the the protocols that underlie all of the applications and all of the architecture that was that was mentioned in the previous slide the protocols before were basically mostly captured in the application layer and that's why um the protocols that were beneath so the tcp protocol html and https etc and they were thin protocols in the sense that the applications built on top of them um have been able to exert power over us in in their their captive or the the way in which they have been able to uh to capture attention and and to to harness the network effects that come with with social media and the likes what we see now with blockchain is that the value that's captured by the ecosystem at large is way more positioned on the protocol layer and so the regulatory power that comes from from the protocol and the design of the protocol is is actually bigger now than the regulatory power that comes from applications in the web 2 environments because the regulatory power of google facebook and other big companies is of course very very noticeable um and we see that just just by looking at the market cap of some of the bigger uh tokens um that the the majority of the value is in the tokens themselves so in the in the in the layer one token so to say and then there's applications on top of them but most of the applications and most of the the processing startups that that are uh predicated on on using web3 protocols they or their their value is is proportionately uh way way smaller than than the value of some of the bigger winners in the in the web 2 in the web 2 sphere and that's an interesting it's an interesting shift in in power because uh it means that the underlying infrastructure uh the soft infrastructure so to say um is is actually where the focus is and should be and the good thing about decentralization of course is that it's it's um it's a shift in who holds the power over those networks um because it's it's it's more uh it's more evenly spread and it's a it's a commonly managed infrastructure and that's why some of the authors that i'm i'm quite interested in lately have been saying that that coins or the the cryptocurrency language that's used is is a bit unfortunate because actually it's it's its networks and its infrastructure that we're basically talking about and so infrastructure is a very powerful means to to actually change forces in in that same society [Music] and so as i said my my my sphere of interest and my my professional expertise thus far has focused on data governance and data governance in itself is is um a term that a lot of people uh interpret differently but in in the context that i've been using uh it myself so far it's it's basically meaning uh all kinds of frameworks regulations and rules from a top-down perspective in in in large companies that determine what what the data generation uh storage and analysis uh including the legal and administrative directives of of the data uh data infrastructure should uh should entail so in in companies you you of course have top level or top top-down policies that that regulate all of that and they have to take into account the the the regulations outside of their sphere so in society um that that have to be translated in internal internal policies but there's more it's there's more at play of course of course there's also the the market itself which which which is a regulating force and which exerts a sort of power over the data governance inside a company there's also the ethics and then there's the technical rules of what can we actually achieve with the database architectures that we have uh as uh yeah as means or as available to us and the reason i'm bringing up data governance or governance as a as a concept is that um i think one of the pitfalls for develop for developers and for for technical people in the web3 space is to to go from the assumption that because of uh because of the the innovations that are possible in in blockchain related technologies that this idea of governance has become obsolete and that we can um we can obey or that that we can um just disregard any form of politics that that no politics are at play anymore in in the regulation of of the infrastructure for the uh for the web 3. and i i would like to to bring a bit of of um a counterin a counter a counter argument for that because i'm um i'm quite convinced that the the power has been shifting or the power is shifting from applications and from from centralized uh technologies are from centralized uh companies and so to say to decentralized ones but even the decentralized environment is regulated by a group of people that's at the core of the development of of the protocols that underpin uh in that infrastructure and the decisions that these these developers make or these developers make also have very large uh impact in in society so it's it's i think it's it's important to understand that that the the technologies are the infrastructure that we're developing here is not neutral uh in in its design and that's why i i think uh initiatives and and um associations such as the the swarm community and um society or are very important in that regard because i think the main the main objective of of uh of these organizations is to point towards that yeah towards the fact that that ideological biases might still uh might still influence uh the direction that these technologies take in the future and then it's it's not just a deterministic uh given that um just by by the nature of having a decentralized technology that that society would become more uh more fair as a result it's it's still it's still a uh it still very much depends on on how we design or how we go by these principles to design to design the the infrastructure and just looking at the time and so i think in in if you if you're still following the on the right-hand side we had the law and and so the legal regulations um and in that sense i think the gdpr is a very uh a very good starting point because um talking about the responsibility of developers and of of technically um enabled people to um to build technologies that that that will uh that will form the infrastructure or the shared infrastructure uh for the for the decades to come i think it's important to understand that principles uh are the key the key building block or the key the key element to take into account and so the principles into gdpr are interesting because um they they are based on human rights and um principles yeah principles that that come from human rights um law and so fairness transparency purpose limitation data minimization accuracy storage invitation and security or the mains one the main ones that we find in in the in the gdpr um okay the the articles and the recitals are mentioned here but the um the interesting part is that uh and kavukian and her team uh have actually drafted seven foundation foundational principles of what is called privacy by design so they are mentioned or they they are uh they're shown on this slide and i i took the the freedom to um you have to to use uh a slide of deloitte here you might recognize the colors and so the first principle is that we should always work proactively and not react and anticipate current or anticipate possible problems so things should be preventative and not remedial we should lead with privacy as the default setting it should it should be embedded in the design and and and that's an interesting one because i think the design itself uh goes all the way to the to the to the layer one protocol because we're probably oftentimes mistaken in thinking that design of an application is um is equally important of it has the same value as design of the protocol but i think there's there's there's a limit to what we can achieve with with privacy embedment of of of uh the design of of uh of applications that we should really go all the way to uh to the protocol so that's that's a good a good good thing to take into account um and then there's some other ones but the the practical ramifications of these um can be can be seen as such and and i've i've um have used young young hank of japan hoopman's um open sourced uh methodology for this and he's he's actually taken the principles set forth by and cavuccian and her team um one step further and and um translated them in in data oriented strategies that focus on on the privacy friendly processing of data themselves or of of the data itself so these four are more technical in nature and then the the process ones are more operational and organizational in nature so the data-oriented ones just say that we need to minimize data so if we can do the same thing with less data then it's always optimal to to go for the the minimal subset of data we need to separate the data as much as possible to make sure that it's it's harder to identify uh or or combine data in the end then we need to to abstract so if we uh if we can make abstractions of certain data and aggregate that's all that's always uh that's always preferred and then we need to hide data um from from unauthorized or um from from eyes that should not see it so um that's a bit of of a sometimes a difficult thing to achieve of course in blockchain related environments and then in terms of the processes you will see that these uh that the processes focus on on the the relation with the data subject and then the relation with the data controller and that's where of course architecture such as the the operator one or are very relevant very relevant pieces of of work so the inform the inform principle says that we should always inform a data subject so as to minimize the um the the uh of course the information asymmetry that might that might result in power imbalances and and lots of agency and then the other ones control so the pro we should provide a data subject with adequate control even then control is is a sort of very abstract principle to take into account um i don't think i think i'm almost almost reaching the hour so i should come to a close um there's one more element that i uh that i think is relevant for for developers and for technical people and that's to realize that the the web 3 is in essence um and i'm using uh the words of sherman gear here uh it's it's it's really a social uh social economic revolution whereas the web 2 was more of a front-end um technical revolution the web 2 will will be more in the back end um and and will be all about merging and and really bridging the the gap that's currently existing between between the technical and the technical world and the human world and hopefully we can do this um but but it will only be possible if we if we if we embed principles if we embed principles sorry microphone if we embed principles in the design of the tokens that form the sort of uh structural building block and and the most fundamental building block of the web tree and so probably uh token economics and token engineering will will be one of those engineering practices um that's that's that's going to raise a lot of traction in the coming years and i hope that in the in the process of of engineering tokens uh which is of course in its in its nature a a technical or we would be inclined to think that it's it's it's a technical um activity that that uh that we really understand that it's important to have this this multi-stakeholder um consulting model with that and and to not to not only let the engineers or the technically uh the technically skilled people define what is going into the engineering or in the design of of tokens so i i would i would uh really like to uh to point towards the book of of uh chairman vojm on token economics um her work is fantastic in in really showing that yeah decentralization and commonly managed infrastructure uh comes with with a range of of new possibilities also new threats but that the the frameworks that we've been using so far in terms of governing our societies should be not replaced maybe replaced in the long term but really be amended by new frameworks um yeah that take into account this these engineering principles for for the web3 and that's where i'm going to end my kind of discourse here if there's any questions of course i'm very happy to to help thank you thank you ruben for your uh interesting presentation um yes if there are any questions i would have a quick one otherwise so so decentralized technologies do you think by themselves will they be enough for improving on privacy and data governance what do they bring to the table i think what they bring to the table is um architecture architectural building blocks for embedding these these uh these principles of privacy and then also the sub-principles minimization accountability uh transparency i think the inherent nature of web technologies and and the transparency the lineage that they can provide um it's yeah it's it's where their strength is but in themselves they will never be sufficient to do so um but they they have inherent uh characteristics that are not available in other technologies so immutable ledgers uh in in that sense uh definitely form a key component if they are combined with with um yeah with with legal engineering and and if yeah if if if it's not just a one-sided story but privacy um privacy is it's it's a complex a complex word in itself because even i think even academically are not um not fully aligned with all of the potential ways in which you can view privacy there's there's different paradigms privacy as control privacy as practice privacy has confidentiality and depending on who you ask you will get a different answer of what exactly is privacy i personally i prefer talking about agency and agency is is it's a much more i think easily understandable concept for most people because if if you ask people do you think privacy is important then we end up with the privacy paradox where people say yes it's important but they they let it be violated day in day out but if you if you talk about agency and democratic democratic oversights or or democratic participation um and if you would ask people like if if your privacy is eroded over time so it would mean that that you don't have a democratic uh say anymore in in the regulation of society uh would you mind i think that's that's a different way of phrasing it and i i think democracy in itself can be considered an end and privacy is a means toward that end um so if we talk about privacy that's my it's my opinion i'm not i'm not saying that that's correct but that's that's how i view it and and i think the point i'm trying to make is that democracy democracy is is a it's a it's an infinite game um and um i think the the the principles of democracy are self-steering or or self um self-healing in a way or self-regulating and and making sure that that we constantly take into account new things and i think blockchains and and web3 technologies definitely enable us to uh to do governance at scale and to to work in trustless environments but they will never i think outsource trust or outsource the need for governance um yeah so so they they are they are helpful and and very powerful building blocks but governance will always be needed as long as there's there's humans that have a keen interest in in having agency in a certain sort of environment i guess thank you so we actually have uh two more questions although we ran out of time i think we should maybe dedicate a couple of more minutes um to try to tackle this so um thank you for the talk would you say that privacy my design has become a more moral responsibility for developers and a must have and additionally how about data sovereignty so i think a moral responsibility um it's it lays a lot of a lot of responsibility with with designers i think we all have a responsibility uh and i think communities like this exist to uh to make sure that developers that that feel this moral responsibility and that are aware of it can find the right information and can can liaise with with people um outside of their their usual sphere so to say but the same goes for for for non-technical or legal people i think we all uh we all have these these inherent biases or these these these um not fears but but these uh yeah i think biases are or the best way to describe it that that we will we will we will only seek or or primarily seek viewpoints and and other people's perspectives that uh that enforce our own um so i think if if if we can build communities where these uh yeah these these stakeholders from all walks of life can can find themselves can find each other and and collaborate on things based on a common language um then that moral responsibility of one party uh in and of themselves um will not be will not be seen as the only uh the only pressing point so to say and and i think we all we're all looking for um for answers um and nobody nobody has the entire picture uh so if if we can collaborate on it and and support each other uh wherever needed be it be it in technical or non-technical uh worlds then then we can only progress as uh as a result i guess thank you but privacy by design is one of those principles uh definitely to take into account from now on so robert said he has met mr hepman and liked his work on irma technically we have the opportunities to design as privacy-minded as possible in your opinion having experience close to the legal developments do we have the legal framework you eu wide in place to cultivate such paradigms i i really believe that the legal framework is it's never finished but there's always the question of of to what extent can you operationalize your policies and that's where i i think to me the um the parallel between my work in in multinational companies as well that have that have very uh very ambitious policies and strategies the the point of a strategy is always that's useless without execution and i think the parallel with with uh legal frameworks is the same if the enforcement mechanisms for one that we have and the architectures to to enable the actual embedment of of the principles on which the regulation is based uh if if that's if that bridge is not made then we can make we can make the best the best regulations and the best policies um but we will never be able to to to practically reap uh reap the rewards um so i think that's that's that's probably where the focus of of regulators and and um democratic institutions should also lie in in um yeah in finding ways to to uh to bridge that gap and to really uh look at at the fact that we're regulating top down but there should be bottom-up capacities to to to deal with with that regulation as well um and probably other types of of policy uh instruments such as an industrial strategy or or a large-scale um yeah a large-scale mobilization of of uh in the european sense than european enterprises is is needed as well and that's where projects like that gaiax can make the difference um if the collaboration between the regulatory uh forces and then the uh the technology the technology enablers on the on the field can work together uh that's that's where the real value lies thank you roman um for your presentation and your answers