Liberate Data Week Hackathon - Day 5 - Fair Data Economy

what are we doing [Music] but are we [Music] so hello my name is charterhin and i will be your host for today the day five of the liberate data week hackathon on the topic of ferrita economy so today is the fair data economy day um i'm a little bit under the weather so if i appear a bit not too enthusiastic it's not because the topic would not be so um this is a very exciting topic and uh today i would uh today we will have uh today we will have uh presentations about uh first by me about uh deferred data economy a short talk and then about fair drive as a personal consent directory which will be followed by mit hub presenting uh a demo of their app called brightview the demo called bright future for self-sovereign identity followed by introduction to common endpoints for personal data by salman and later on a workshop about the conceptions of the fair data society principles and data commons by trilater trilateral research so this will take place um until around 5 pm central european time and after that there will be time for some questions for everyone so what i would like to first stress is that uh so welcome er to everyone uh to all the participants and also the panelists so if you want to participate you can either ask a question in the chat or raise your hand to be given a voice by the by the moderator so if you want to ask a question and another thing that i would like to stress is that tomorrow and saturday there is also a program planned so saturday is the open day when the program is actually set up at hook according to the interest from from the weekend we already have quite a lot of interest so there will be the program will be starting at a little bit earlier so at 14 30 central european time and will probably take a place all the way up to around 6 p.m central european time so take note of that the exact problem program will follow for you to see so uh first let me say something about fair data economy so it is of course a very complex topic but uh maybe to simplify it in a few words so data economy is data economy done in a fair way following fair data society principles so the principles you have all probably already seen we have them published on a web page i will share all the links later on in the chat and this fair drive project that we are that we developed is meant to be the sandbox for fair data economy like the fulcrum point for projects to come together and develop around data and uh of course the idea is that in fair drive the individual would have all his or her all their data stored so there would be one access point to all these individuals data and different apps would use it and different storages could also be linked to this fair drive so um for this uh to be achieved interability is crucial also for an economy to interoperability is crucial also for an economy to emerge and there are initiatives on many levels tackling these problems let me mention just a few of them that we know better or even cooperate with so one of them is the my data ngo which is all about people being at the center of control over their personal data so how to enable that on different levels one of our presenters uh later on so salman is also part of this my data initiative uh tackling a specific problem which we'll describe in more detail then there is uh perhaps an example of these things being done at a national level is the finnish citra which is like a fund for that pushes interesting projects and they are they have the fair data economy in their sites as the future and another initiative uh interesting interest interesting in our discussions is the european data spaces initiative which is a european level initiative part of the european data strategy so to establish these sort of verticals uh that within which data can be freely shared can freely flow like labor and capital can flow inside european union so for example could data be uh be shared an exchange within like let's say a health vertical or a mobility vertical as they call them we see swarm as one of the enablers of a fairer data economy i will just stress a couple of points here one is that with swarm you you you avoid siloed data so no more silo data and you gain data sovereignty on the level of people as well as nations so this uh storage is under your own control right so for more details about this uh so how we see uh swarm contributing to the data economy you could also take a look at this swarm enterprise hub i will share a link later there's some top there's some uh so topics that are handled there are about data economy privacy and regulation aspects and now i will spend a few minutes talking about the idea of fair drive as a personal consent directory so for a transparent and fair data economy personal data sharing has to be based on consent so this is uh the standard in large part of the e this is the standard in the european union uh becoming also standard elsewhere so this this kind of movements are at least in the us india and probably elsewhere but i think maybe eu is here leading the field and um a way to formalize this consent relationship could be with a consent receipt you can imagine a consent receipt being like a receipt you get in a grocery store for the groceries you purchase but on this consent receipt you uh you get the info of what data you shared with whom for what purpose and so on so all the fields that maybe are required by gdpr and sorry if i'm a bit more european-centric i know that the listeners might be from elsewhere but hopefully you are familiar with some of these terms some gdpr is regulation in europe about how personal data should be handled and um although this receipt is not required it is highly practical for the reasons i'll go into uh in the following um and also know that the concentration concept is not the only basis for uh usage of data so other legal bases could be used uh so concentris it could be perhaps expanded with a more general data receipt so for each data that is used even if it's uh based on some law you could get a data receipt into this uh one imagine having one folder in in your fare drive where all these consent receipts and data receipts are gathered and you can always just click into that folder and look at which consents you have given who has your data and so on so a lot of transparency is achieved this way but you also have the options of if somebody builds the right tools right on top of this uh data in your folder to act on the consent so uh you could maybe revoke consents or ask for the data that that you know somebody has about you to be um exported to you so this data portability right and so on but also just seeing where this data is which who has what kind of data about you maybe you can plan around this and enable different services to to connect to that data and use it in ways that you can't even imagine yet now so um this is what is achieved with this transparency and we think uh fair drive could be a a a perfect uh place for this or like a decentralized storage is a perfect place for that since it is always accessible and it is a shared single source of truth for our parties so all parties see the same consent receipts and concentric cities basically a json file with all these data inside it that is maybe signed by by both parties and that could be randomly rendered on screen in human readable form right and so actually a concentric suit was built uh to facilitate the data economy uh as part of one of the projects that citra financed and this concentric institute is open source and in and and it enables you to generate and view cantara compliant consent receipts so cantara is an organization that specified this the fact of standard it's not yet an iso standard i believe but it's in the process and this consent receipt suit so it's like meant to be modular so you can generate view cantara consent receipts with it uh you can also store them to swarm uh and sign them by both parties although this part would if you go and check it out and try to use it would probably need updating due to the new b release but in any case i encourage you i will share the links later and encourage you to see this so what i'm trying to stress is yes we will support this um as part of fair drive and this consents consent receipt should be the standard way uh to [Music] to record any kind of personal data exchange and they should be all available to the individual and this could be achieved with a consent directory inside fair drive so as i said i'll share the links later but uh i think we could start already with with the first with the first speaker today actually there will be two speakers so like alexander and eugene i think uh who will pray so alexander is also one of the uh maybe you can already turn on your camera so that you see that everything is happening yes okay so um alexander is also one of the contributors to the enterprise white paper and so they will demo the application and it is about cell sovereignty um about identity so alexander please i will give you the microphone now thank you thank you chair hi colleagues so i would ask my colleague eugene to demonstrate the screen today we would i represent my name is alexander parton and i represent the meet hub team developing the meet up platform so just a second yep okay now i see it so the mishap platform idea is to bring back to the person the control over his her personal data and at the same time we would give the person the high quality and safe tool to provide temporary access to the personal data for the companies who need it for their purposes changing the slide so basically mid-hub concept as i mentioned to bring back to the person the control of the personal data and their safe processing has become possible due to the development of blockchain technology smart contracts cryptography and decentralized storages however for the platform to work on a full scale we would need the safe and reliable decentralized storage of personal data that's why we're working with swarm team so that's warren becomes such a storage and in particular i would mention the dream protocol in this context that we are working together with the swarm team to develop so second uh item uh we built the platform based on trust and transparency so the source code of all key platform applications will be open after the public beta and will be subject for the analysis and joint collaboration at the same time the user's personal data will not be accessible even to the platform administrators as we vote for the society where only people control and manage their personal data i also would like to point out that the platform participants should not only rely on trust as the smart contracts will guarantee that all processes work as it's declared and before we start the demo i would present the main participants of the platform so basically first and which are in the center of the platform the users the users will be able to upload store and manage their personal data on the platform and provide access to this data to the companies who are interested in processing it uh second which is actually on the slide the websites the third one so the websites are exactly the companies uh who need to get access to the personal data to provide the services to sell the goods etc so that the websites can be sure about the correctness of users personal data uploaded on the platform we have the validators and these are specific companies who check that the user's personal data is correct when comparing with the data from the user's official documents this is done before the data is uploaded to the platform uh and also like the first participant uh we provide the ability uh for all others to for our participants to interact with authorities on the platform for whom we created a special workplace under the term authorities i mean any governmental body in particular it could be like data protection authorities supervising gdpr and as chart mentioned talking about gdpr uh in our project we use gdpr as the uh at the the law in the personal data protection area which is basically like the most contemporary one and the one which puts the interest of the person in the center comparing to some other countries where the law may protect the interests of others so basically we have also created separate workplaces for other platform participants and overall we deeply developed many questions but within the current demo we will show only part of our functionality which is basically three scenarios so i will talk about the user who has just registered on the platform and wants to upload the data from his password uh second scenario the user will use the data uploaded to the platform to register on some website for example to purchase some goods and third if the user decides for some reasons to revoke access to his personal data from the website we will show how this functionality works on the platform okay so that's all for the intro let's come to the demo and basically um first of all i want to like describe what you can see on the screen so the user use the platform we as a mobile application and on the right of the screen you can see the screen of the mobile app that we have on the left you can see the workplace of the validator validators website authorities other platform participants have their own workplaces working in the web browser so in particular you can now see on the screen that in the mobile app there is no data yet so the person has just registered and i also want to mention like the interfaces are working progress definitely it's like we created them but it will be reworked in the future so let's come now i as a user wants to register to put some data onto the platform so basically i push the button add document and goes to the screen now i need to choose the country uh from where i have my citizenship i will choose the uk um and definitely it's like what kind of document i want to upload to the platform or data from the document i will choose a password as the websites might have different requirements for kyc of the user we have created on the platform different levels of verification of users personal data for example you can see on the screen like different colors the yellow level of verification means that the validator checks users data online the green one the validator does it in person for the purposes of the demo i wouldn't describe the screen of a lake in all the details we will just use the yellow one so i'm choosing the yellow now the user needs to fill the data in to save time we preview the application uh but in reality the user will either put data manually or use some kind of a tool solution to scan the data from the password and let's change the place of birth for example so it's b swarm and we will put like beehive for sure it's like since we we show the demon swarm hackathon we decided that the user should be let's go to the next screen i confirm and now we need to attach the photo of the passport so that the validator can actually compare the data from my application to the photo and the passport we have yes the passport of the bee so we make a photo and we attach it great so i put the check that i agree to the consent to the terms of the platform and push the button and the file is now uploaded so what happens now i submitted the application we see that the platform is looking for the validator and to describe the validator is chosen randomly so basically all applications from the user are put in one curve and the first validator and occur takes the first application on the line so now we go to this screen of the validator and i am the validators employee uh working on the applications so i push the button to take the first application in the line uh it takes some time because we are working on the blockchain and smart contracts and actually we use we use it for the demo purposes so now we see the first application is coming to the screen and yeah fortunately it's the same applications that i just put using the mobile app okay never mind just a joke of course you might see in the mobile web actually that now i as a user have an active chat with the validator but i am currently working as a validator so let's send some hello to the user and what would be reply from the b of course it would be like [Music] now um let's continue so as a validator i check uh the validators application the the user's application compare its data with the photo of the passport attached and see whether the information is correct i see that definitely it's like there is a mistake with the place of birth so on the document that's this worm in the application we see that it's beehive so i have an ability as a validator to change i'm doing it as soon as i am sure that everything is right i confirm the application so in the validators workplace actually the verification issued is shown in the respective section and the validator can also view uh the statistics of the issued verifications including by each validator's employee the remuneration that he gets from the platform for the verifications and also to change settings and manage access for the validators employees so not coming back to user i see my data verified by the validator once again i check that everything is correct from my perspective and then push the button confirming that i agree to upload the data on the platform at this moment the data is put into swarm and at the same time the fact of verification of my data is recorded in the blockchain of course my data is not recorded on the blockchain just the fact of its verification by the specific validation in order to protect confidentiality of the user's personal data uploaded to swarm the data is encrypted using is 256 and as i mentioned in the intro we are working with worm team on the dream protocol that will enable anyone to upload the data to swarm in a way where the owner of the data can manage access to the filing form you can also okay so yeah uh i might rate the the validator and going next uh we can check that yeah on the screen on the mobile app we can see that i have now the data i can go through and look what data i have now uploaded to the platform you can see the button update this is basically in case for example i as a user is the b i changed my passport and respectively i need to update the data if i do it once again the new data needs to be verified by the validator and only after that it is uploaded to the platform so basically this is like the first scenario let's come to the second one so uh in the second scenario we will provide the data to the website for example if i want to register to purchase some goods and what's what the website as a b i want to purchase some flowers for sure but first of all let's see like how the workplace for the website works for the website employees so each website before being able to process the user's personal data with the platform needs to register on the platform and get access to its workplace and also just the point i use the term website just for the demo perspective basically it might be any company who wish to process uh the personal data of the users but for the purpose of the demo i would just name this company as the website the myth platform is designed based on the gdpr requirements as i mentioned including privacy by design and privacy by default it's also aimed at protecting the user's interests for as maximum as possible in the area of personal data so the mandatory condition for the website to start processing personal data is drafting the respective privacy notice which talks about the purposes of processing specific activities etc on the platform we have a specific construction tool helping to create the privacy notices in a flexible way and the website can create one or several privacy notices i it's like it's not the purpose of the demo to so to show uh this construction tool so i would just show how it works uh for the purposes of the demo we have a pre-filled privacy notice and as a website employee i can see how it looks like for example from the user's perspective so basically now as the user i would like to register on the website so let's come back to the website so i'm a b as i mentioned i need some flowers first of all i need to register so i push the register i have like the usual choose i choose mid midhub as a way to register on the platform so i see the qr code and now i'm using my mobile app to scan this qr code in the right up side of the mobile app i see this specific sign and i'm using my phone i put it on the screen whoop so now on the screen in the mobile app i can see that there is information which personal data is requested by this website i can see which specific data is requested what is the ground for the provision of the personal data whether is consent contract law legitimate interest or anything else if the ground is consent according to the gdpr i can choose which data to provide which not if it's a contract i can just check like which date is requested and of course this is like just how to say summary of the data but if i push on the image of the privacy notice i can read the privacy notice from this website in full okay i think i agree uh this is not a big amount of data to provide and might i might agree to provide uh the place of birth uh the date of birth it's okay i push confirm as soon as i do it i can see in my mobile app that now we have a line with the name of the company to which i provided my personal data if i push on the image of the agreement i can also check which data exactly i provided to this company and i can do it i mean any day any minute just opening my mobile app even after the year if i forgot already which data i provided i can open the mobile app and check it not only can i check it and also it's like not only can i check the amount of data provided i can also read once again what was the text of the previous notice that i consented to because for example if i believe that my my rights are violated in a way i can just compare my understanding on which conditions the data can be processed with the exact text of the privacy notice so um the the fact that i provided access uh to the website for my personal data is also recorded on the blockchain and is always available for both parties me and the website to be read and also to if we come back to the screen of the website you can see that i successfully registered on the website with just a few clicks on the mobile app it's done and also uh how to how it's looked from the website employee perspective uh i see that as a website i have several people provided me with personal data now it's like uh in this way but if i click on one line uh i might get access to the personal data if of course as an employee i have a right to do it uh i have a warning that all my actions are recorded on the website it's done for uh to to protect the user's data from the leaks i push consent and now i can see yeah the data for of the b uh is seen by the website that's the second scenario so coming to the third scenario um let's imagine as a bee for some reasons i'm not worried to say i don't like the way how the website treat my data and uh i well i like the prices for the flowers so i wish to continue to be the customer of this website but i decided to revoke the consent for processing the date of my birth since i provided it on a constant persp only on the basis of consent i can do it so coming to the mobile app i'm just going to the specific section and choose manage access to the data that is provided on the basis of consent i'm worried that if i revoke the consent for processing of this data this might lead to some negative consequences in my relationship with the website so for example i don't know uh i might not get access to some functions of the website some additional like bonus etc um so i choose which data i want to revoke and basically click we have only one line so i click it and confirm that yes i want to revoke this data i want also to point out that this is i can i'm able to revoke this data because it was provided on the basis of consent if it's provided on the basis of a contract for example as a user i can't unilaterally get this data or like revoke the access only with the consent of the website as a second party but now we are talking about the basis of consent so i revoked it and let's check first on my side as a user we see that the data is not provided and on the part of the website let's see how the platform functions so as a website employee once again i click on the user and we see that uh i don't see anymore the data for uh for the date of birth so it's important to point out that uh again the actions of both user and website are fixed in the blockchain recorded there and that's why for example revoking of consent is also recorded in a blockchain uh as to the actual like technical aspects of revoking this exactly done using the dream protocol or would be done using the dream protocol that we are currently developing together with swarm team that's all for the demo just a few words uh in the end of our presentation so the functionals that we showed is just a part of what we have on the platform the purpose of the demo is basically to get you acquainted with our project as i mentioned before our function also includes interaction with authorities ability to create drafts of the documents using which the data might be uploaded by the users the tool helping to draft the privacy notices remuneration systems different level of verification etc the first version of the platform at the launch will be with the larger functional and for sure uh i want to mention uh like mention a huge thanks to the swarm team to our partners with whom we continue the active work so that swarm may become the decentralized storage that providing the user with the ability to store and manage their personal data in a safe and fair way thank you to listening for us thank you guys hi alexander thank you this is this was very nice actually this was actually the first time i saw your demo although we have been working together for some time so um i'm quite impressed you also have some kudos from uh from from the um audience so uh yes please uh um let the audience ask some questions now yeah sure but colleagues just just take a moment i'm the privacy council so i'm a lawyer and if you ask some technical questions i will try to answer uh but it might take some time for me to okay uh did anyone raise a hand maybe i have to check this no i don't i don't think so or just type the question to the aha so uh dietmar is asking can you provide a github repo for this we actually haven't yet opened the the code as i mentioned we will do it on the public better during the public battle so at the moment we don't have any github rep where you can change it definitely will do it so maybe i have a couple of questions so do we have a roadmap so when will this beta be out and also the other question would be so why did you choose why did you choose swarm for this uh talking about the roadmap we are currently developing the one as soon as it's ready uh we will definitely announce it uh talking about swarm uh i would mention that uh we swarm we actually got acquainted back in the end of 2019 and we we see swarm uh as very much how to say we fit each other talking about the principles because worm is developed based on the user's interests in the center based on the fair data society principles etc and we have the same principles uh in the center of our platform so i see it and also from technical perspective currently we see that swarm is the best which fits the idea of storing personal data as i mentioned we need to make some other tools like the dream protocol but for us it's the one and the best decentralized storage who can do it okay so we have actually uh some additional questions um so are there any any plans to add an expiration date to consent from hetero phytic uh yeah well it's like um as i mentioned the demo is quite short one uh just to get acquainted uh we have many ideas uh which we want to include on the platform uh expiration date might be one thing uh among others uh and we want to it's like we make it what to say as much automatic as possible so for example if i am the as a website uh gets consent for a year we want to make it happen using smart contracts that after the year it is revoked but as a lawyer i can give i can also tell that there are some scenarios where the website may need this data even after one year i don't know for example if there is an active suit uh in a court between the website and the user and the website now has to store the data on the based on the law perspective uh so that's why the answer to the question is yes we want to do it the way how how we do it how we develop we also need to take into account some legal aspects and maybe the interests of different parties thank you so actually there's quite a lot of questions we so let me remind the uh the the audience that there will also be time to ask questions uh at after all the presentations uh so at around five five o'clock central european time so we can try to tackle some more uh actually i have to scroll up now there's so much chatter uh so maybe these two or we could quickly try to answer uh does this use ssi uh so self-serve and entity decentralized identifiers and what kind of the id auth protocol and then another one so do you think this can reduce consent fatigue on the part of the user i guess maybe applying to the expiration um yeah us answering the first question definitely we will use gids um unfortunately it's like as i can't answer the second part of the question what kind of did the auth practical uh we are using as i mentioned i'm a lawyer but yes for sure it's like the ids we will use it and we also have some ideas connected to it how to make that uh how to use the dids without undermining the confidentiality of the user's personal data i would mention it this way not the technical questions yes i believe that it's like definitely consent fatigue on the part of the user we can reduce it simply by the mobile app that you can saw in the functional it's very easy easy to check is it to understand so in full compliance with the gdpr principles okay thank you so uh there's one more question that i would uh alert you to so contact details uh ditmar is asking for this maybe you can paste them to chat uh later on yeah so thank you alexander we would now move to our next presenter so uh salman will someone if you can check your camera um bye bye bye bye put uh turn on your camera hi simon hi sir hi so salman uh we'll be talking about common end points for personal data storage in short steps uh summon is one of the very active people in the my data community uh specifically tackling the problem how to enable interoperability when working with several personal data storages personal data storages are sort of places where you you can store your personal data and i guess like fair drive could be one of them or fair drive is actually the plan is to integrate many of these pds is under fair drive but so he'll explain in more detail but so it's about interoperability and um it's very interesting uh for us so to build this uh society we need this summon if you're ready yeah sure um let me share my screen um it should be here and let me get i assume you can see that and let me just get the powerpoint going perfect um is that working yes i can see the power point perfect so hello everyone yeah so as jared mentioned i'm here to introduce steps which is common endpoints for personal data personal servers and data stores and i'll come back to what that means but um i guess my presentation first has some historical context especially for the for the younger people in the audience um so i thought i'd do that using using emojis um so um see when when we forget that when the web was first conceived it was conceived as a network of peers where all the network nodes are like these smiley emojis they're all equals happily communicating with each other and in fact the first web browser that was created by tim berners-lee at cern actually here in geneva and and by the way maybe that's why um zahur showed you geneva yesterday so the first web browser was was actually a browser and editor so you could create and read web pages and basically the web was supposed to be distributed and peer-to-peer before we started using those terms of course that's not exactly how how the world has has turned out but i would argue that's sort of the current structure of the internet is kind of like an accident of history when the web took off in the 90s it took like millions of dollars to set up a simple web service so you had companies like yahoo which spent those millions of dollars to run their site and then they had to pay for that infrastructure so they came up with a simple business model and that was to show you some ads of course then some other companies realized that if they had a lot of data about you they could sell their ads for more money and that proved to be a really powerful business model and so the main operating model of the web for the past two decades became established of course um that's a model that many of us think kind of sucks but i'm saying this because i want to make the point that the web was conceived as being decentralized and that things don't have to be that way and even without blockchains the web has a lot of technologies and infrastructure which is decentralized that that you know fits the ideals of everybody i think in this hackathon so um for example as as you've mentioned also in the in the previous talks you know some of us think that it's better if our um if our data was sitting on our personal web servers like data stores that we fully control and of course if developers um like the people in this hackathon create great great applications um where we can and and store our data on our data stores then we would be the kings right and in that way swarm or or fair drive can be seen as personal data data stores especially because of the work that the fair data society is doing um and um you know we would then you would use web apps or other or adapts or other apps to store data and on these drives and i'll get back to what these drives could look like a little bit more but the problem until now is that a lot of these these personal data stores these pdss haven't really worked with each other each one of them has their own standards and interfaces and apis and they're all kind of isolated on their own sort of largely uninhabited islands so and of course the question is you know why would anybody want to build applications for pds based on some proprietary interface so not many people would and if nobody builds apps then um to store your data then there's no data to store and so what's the use of having a personal data store um and of course that's why events like this hackathon are so important um but i guess what i'm the argument that i'm trying to make is that these apps would be so much more powerful if they had a larger audience um so as as chair mentioned there's this wonderful organization called my data and their mission is to um and it's it's a powerful wording it's it's to empower individuals by improving their right to self-determination regarding their personal data and that's something that i would really sign up for and actually i have done as fair data society has as well and and we're both members um and um my data has has these annual conferences and the last in the last actual in-person conference they had before covet a few of us got together for a drink and we came up with this idea and we thought wouldn't it be nice if we have one interface you know one api that any application developer could use to communicate with any pbs so when an app developer creates an app that works for one type of data storage effectively it could work with all of the other pdss and that would motivate app developers to create more apps and there'd be a bunch of um apps using the same api then more people will actually find pdfs as useful which should attract more app developers and pdss and pds users and then you can start to imagine a rich ecosystem being developed where each of us has our own server and controls all of our data so earlier this year a few of us from within the my data organization that are pds enthusiasts agreed on a specification for apps to read and write data to any data store that uses this interface so we call that steps 1.0 and i'll give you an example so let's say there's a calendar app on www.bestcalendarapp.com right so when i sign up for the app i tell calendar app that my server i give them my server address and that's at salmonff.

com my name and i tell my server i want to use calendar app and that calendar app can access my data store on my server and specifically only one data table called com.bestcalendarapp.entries and then all calendar app needs to do to create a calendar entry and store it on my data store is to send this post request to my to my server and that's it so instead of my data sitting on a calendar app server it's sitting on my server on my data store and that's the idea of sept and all an app needs to know is my server's url and all my server needs to do is to make sure that if an authorized app writes to my server slash step slash write slash table name that it stores the entry in the right place that that's it um and ultimately all applications use four or five basic commands the crowd commands and you read write update query and and delete data in the data store so in steps we agreed that if all pdss use the same paths to allow apps to read and write records then app providers can write their apps once and it could work on all pds's that it offsets and we also put in a simple authentication mechanism based on oauth2 which which i'll come back to a little bit later as well um but let me also as seems to be the case for people in this um as seems to be the case here in this uh in this hackathon let me start with a demo and this demo um is actually i'm gonna you know i built this um this chrome extension um which is a chrome extension which basically has all the functionality that i i always wanted to have in in a chrome extension and it's called view log and basically i can you know if i'm on a web page i can use that chrome extension you know i can right click and i can highlight text and i've got this little shortcut where i can turn on edit mode and then i get this sort of like ugly but useful like highlighter and i can um you know change my colors and highlight whatever i want and if there's a link that i want to see later if i go on the link i can add links to my inbox right and i sort of add all these links to my inbox and um you know it's it's just a chrome extension right and basically in this chrome extension i go to my inbox and i have my you know the things that i want to read later um it's got some other things that i always wanted like to actually store all your your browser history and on your data store and and i can remove the the the cookies on their website places but you know all of this functionality is obviously sort of around in in a lot of other extensions as well but the difference here is that basically the um vlog um stores my data my highlights my browser history whatever i want on my server in this case i'm logged into my server stylemonff.com so vuelog is sending this data over to my server and if i sort of go to salmonff.com i'm just going to refresh this is sort of um it's a demo account but i sort of i see what i just added to my inbox here and i can also see my browser history um again this is a demo account so it's not going to see all my browser history but you know you see what i've just been browsing in in the past couple of days um and here so i'm and i also sort of if i go back to my home page um this is based on freezer which is kind of my conception of um of what what a personal server should look like it's actually the personal server i've been using for the past few years for myself um and um you know i which which has sort of like a blogging app and and actually have a note-taking app and such things um installed on it and i'm gonna divert a little bit from steps here because you know sort of this my freezer which is my personal data store is a little bit different from um from seps it it's an implement it's implement steps but i think it'd be useful to sort of see where where kind of at least i see this going and where some of us see this going um so i'm gonna i have this demo the second demo on on on localhost because this is a little bit on development but the idea is that you know you should be able to go on and sign on to your data store um and the data store you know is basically or the server acts like a key manager so if you enter your amazon key if your data store is on is on amazon but here we should also have fair drive right and hopefully we will soon where fair drive acts as your data store but for the moment we're going to authenticate with dropbox so basically i'm coming onto the server i'm going to authenticate i'm going to you know get this terrible warning and and say so yeah use my dropbox as my data store right and i also to keep my files and i also can use my files as a database right i can also use and other things but i'm going to use my files as database and i put since i've already sort of logged on i'm going to create an account for for church here um and i'm going to say okay create my you know launch freezer basically create my data store um right oh this that i'm not sure if the demo gods are are with us today but basically what happens then if i go to my dropbox right um what i should see is that my freezer is created but i should see maybe i just need to refresh here um so basically yes and if i refresh i see that sort of on my dropbox basically um i've um there's been a data store space created for for you know sure like assuming my name is church and it sort of created an already created database if i go back to my my my freezer there's no my my personal server there's no apps there obviously so there's a you know there's a few ways to define what an app is and there's a few ways to think about apps um i created this little app for a demo that i made at the same my data conference that i that i mentioned it was in finland and this is called ixi note because it's it can store only one node and it's on github and i can just say okay take this app um from github and install it and basically if we look at my github all this app is is basically a css file an html file and a javascript front and basically the point of this app was to create an app in like 30 lines of code so that's why it's such a simple app and basically what this does if i refresh here again is that if i you know on um oh there we go i um well these demo gods are not with me today so um i got a little bit of an error here so let's see if it um if it cooperates a little bit better this time um and here you see that um basically the app has now been created on my data store it's this app called organized.

data.exe and actually if i go to [Music] if i actually use a a drive i can hold on one second if i go to [Music] my data store you can see i it's also dropbox re-replicates this basically on my on my data store and on on my on my desktop and if i go to my users i can see chart here and i can see my apps basically what the app does is that it basically allows me to write one note so basically i'm going to say hello swarm um right um much like the much like the app yesterday and basically this is now it just sort of this is a demo to say well i'm gonna you know it wrote to the database and you know writing to the database means that if i go here now and i can see that yeah actually i have written hello swarm to my database right the other thing that's interesting about this concept which is also a similar concept to the fair drive is that my apps are also sitting on my data store as well so basically if i go to you know you know let's say if i open open my this html file which is part of my which is part of my app um it's here i can you know because it's shared we're going to call this ana node instead of ixi notes and we're gonna save it so basically what's going on here is that um now you know my app is updated so as a developer i can actually refresh this and i've updated the app that's sitting on my data store um and the demo gods are again not with us today um well they're partly with us maybe um and if i now go to my app um on xenos basically um you know i've edited my app it's called ana note now instead of execute so this sort of in a way is a demo too to sort of again emphasize the power of actually controlling your data be and your code your apps being code are also your data and you control them so that's it for my demo i'm gonna go back and i know i've sort of run a little bit longer because of this demo than i anticipated i hope that's okay chart but i'll try to i'll try to sort of finish finish this off in terms of in terms of the presentation which is basically coming back to this diagram which is that um you know really you know you're storing your data storing your data on your own data store is very empowering because the data's you know not stuck on some silos sitting on my server i'm free to take my data files and move it from dropbox to fair drive or wherever else and my data is fully autonomous it has that degree of freedom and more importantly i can give other apps access to my data so if you create a better app i can get rid of ulog and use your app to do my bookmarking and just give that app full access to my view log data tables or if you build an app that visualizes all my browser history and then all i need to do is to have both apps and give access to that data to that data to that sort of to that app and the point being that you don't have to ask for view logs permission to access your own data in the world of step is seps it's the app that needs to ask for your permission to access your pds you're in control and so it's not just that you're liberating data your data is autonomous so it's liberating you and empowering you to use it freely and gain value from it and actually all of that can be done with steps 1.0 um i you know so the next step for steps basically is to figure out how to figure out how to share data among pdss and um for example if i want to share like one of the bookmarks with with um with chart and or if i want to share my location history how would i do that and to do this basically you would need all of these data stores to authenticate against each other and so that so that you can share data and again because i've run a little over i will i will just mention that you know if you think about the web technologies like oauth they're actually you know even though they're not built for a centralized specifically built for being a centralized application the factor they are centralized because they force you to actually you know sort of register yourself manually on the app server the centralized app server and without getting into details um what sort of we created with steps 2.0 is basically what we've called kind of like an out of band call back mechanism see justin richard who created a gnap which some of you might know called it that um because basically it allows two different servers to authenticate against each other without having the centralized authority um that that is dominant and where you have to go register manually um and so with that basically um you can start sharing with each other and this is what we would call steps 2.0 which we're hoping to finalize um and then we would each be reading and writing from our own servers and data stores um and much like the web was originally conceived and so that's it thanks for for the opportunity to present steps to you and obviously if you're interested um you can um you can get in touch and preferably by my data so thank you salman that was a very dynamic uh and interesting presentation so uh it also shows how much aligned we are with what we want to do actually so so first i would like to remind uh the audience to please ask questions or raise your hand if you want to ask a question i think we can uh spend another five minutes on this topic and later on return to it the ask me anything so we actually will support sapps uh we by we i mean faraday society by uh uh implementing it with ferro s dfs so and also contribute um to the to the specification uh so imagine that steps will be will be the uh i mean the language that uh all the apps will be using uh when also different storages will be inside fair drive which is also the goal so um and i also want to uh remind the audience that yeah actually so we're talking about personal data you might think this not this this is not this does not apply to you as much but actually i would say that most of app data so app data is probably tied to some particular person right so most of app data actually is personal data in that sense so so it falls under that category um okay i will check the questions now so you have uh from dietmar a thumbs up and from okay so this is actually not for you uh greg or also yeah uh thank you for the talk so uh any questions so maybe uh hands raised or something now is the time um so what i actually wanted to ask you maybe provoke you a bit so when will a view log be available in fair drive are you will this be during this hackathon or well if you like is available for anybody to download then it's a question of when can we well when can fair drive implement steps which will hopefully be soon so then as soon as it's fair if steps is implemented in fire drive obviously you can just sort of um sort of log into your your fare drive from view log and store all your browsing history and make bookmarks there so that's that's uh yeah yeah okay so uh gregory is sorry uh greg is asking could your solution in future be an alternative to centralized biometric databases creating something i'm sorry this is alexander i'm just answering some questions oh okay sorry i thought it was maybe a bit strange because i saw it before uh okay sorry um yeah but it also applies to save so it's good okay uh well then let's try let's try it could your solution in the future be an alternative to centralized biometric databases created by state actors and tech titans um so you know my personal i mean in theory yes i think my personal view around this ecosystem is that um as as we've seen here around swarm as well there's a number of different efforts um and sort of the presentation we saw last was sort of down the road of sort of the very serious app and taking advantage of the security of and and all the sort of a lot of great features around swarm um i think what seps is kind of orienting towards is more kind of the lighter apps and and not saying hey our our fort is to be able to store like you know strong you know sort of like your your passport and your id and all this you know that kind of sensitive data but like it's more about hey your view log or your notes and apps that you use every day where you have these interactions are much less formal so i think our first view is hey we don't want to go to the more more sort of more serious i say apps but sort of be geared towards more lightweight issues where people start using decentralized storage as kind of the way they interact with each other and and their data on a day-to-day basis for little things and just that's just the sort of the the lightweight approach that we've taken and you'll see it in the simplicity of the of the things that i showed you is just you know very simple stuff can we do the simple stuff here and create really really easy fun apps that you know we just use like that yes that's probably a good way to start uh something not to get blocked down in in complexity right so thank you salman uh so maybe it's a final one okay so yeah there i don't think there are any more questions at this moment so um of course there's the mea at the end so thank you salman for your presentation and i will thank you very much for for letting me present to this audience that's great and i would like to invite so um mr lady and robin to to to to check their cameras to turn on the cameras so the upcoming session by trilateral research will include a couple of presentations uh followed by a discussion um moderated by robin and this will also uh include the audience so you can ask questions uh maybe you will even be asked questions i don't know and it will tackle so the session will tackle the topics of data commons you data protection public data your data spaces and others so uh i guess uh maybe who do i give the word to me style you start or robin yes yeah yeah okay please thank you church thank you hi everyone uh i'm mistah from trilateral and i'll be presenting today with my colleagues aditya and robin and i'm just gonna jump right in because we don't have lots of time and we've specifically set aside some time for questions and a discussion at the end so i'll start with a presentation about um data privacy principles and then aditya will focus a little bit more on data commons and then we'll go into our discussion moderated by robin okay so the basis of this presentation is some research funded by swarm that will hopefully eventually turn into an article or something so the whole three is called conceptions of the fair data society principles and the data commons and within that i've been looking at which i called towards extra slash territorially found data privacy principles setting global norms so if i just deconstruct that from the bottom up the global norms that i want to refer to pertain to data privacy or informational privacy or data protection whatever nomenclature depending on where you're from but i'm trying to look at globally shared conceptions of that of which there isn't a norm at the moment i argue and a way to get there is to have local laws or norms or standards or principles extend extra territorially so beyond for instance the territorial boundaries of the eu so i'm going to see whether that works and trace the development of data privacy laws in several jurisdictions plus also um globally shared ones such as these fair data principles that i guess we have come up with and to see what this says about territory and shared values so firstly i'll be looking at the fair information practice principles from the us and there's a common narrative why this is interesting is there's a common narrative that the eu kind of started data protection or had the golden standard and i think it does and it suddenly did in most countries data protection laws originated in the eu but it's incorrect to say that vis-a-vis the u.

s the eu was a forerunner because for instance they had these for information practice principles around the same time that european countries were even getting data protection laws so you had tessa in germany the state getting the first ones in 1970 i believe and then sweden in about 1971 and then there was a cascade effect and so from that so i want to acknowledge the us's role and then i'll look at eu data protection law and then moving away from national or supranational jurisdictions i'll look at the fair data principles the newly proposed eu data governance act and then ask whether there's some kind of shared standard and within each of these substantive topics i'll mention the territorial or extra-territorial dimension so the fair information practice principles or fips were a product of the ftc the federal trade commission in the u.s which is a consumer protection organization and it also enables competition so antitrust law and in 1973 the department of health education and welfare released a report called records computers and the rights of citizens and within that they outlined these principles that are written on the screen and these were widely accepted principles about maintaining informational privacy in an electronic marketplace um i used information privacy as a more u.s term and then data privacy is a kind of anglo-saxon term and data protection when they talk about the eu so here they're talking about information they're talking about an electronic marketplace and also consumers rather than maybe data subjects or individuals and you can see i've i've in the swarm orange i've highlighted some values or concepts that uh are recurring because in the the other three principles that i'll look at all i guess sets of rules or things to strive towards you can see these notions coming back and recurring so yeah notice awareness choice consent is always a big one and just mentioned that access participation you can see the individuals starting to enter into the picture here and that follows subsequently as well integrity security that's quite a technical measure um and enforcement and redress and these principles were actively adopted or definitely influenced the adoption of the oecd so the organization for economic cooperation and development guidelines governing the protection of privacy and trans water flow of personal data in 1980 and then in 1981 the council of europe is called convention 108 but it's about data protection and it's still enforced today so they these concepts spread from the us to these kind of regional um treaties or guidelines so not directly influencing one national jurisdiction necessarily but influencing sources of law or sets of rules that were shared between jurisdictions in one particular region then from the fifth we moved to the good old gdpr so yeah the eu regulatory framework was relatively young you had the data protection directive which started applying in 1995 but they were concluding it in the early 90s they being the european commission and yeah as you probably know gdpr was proposed in 2012 adopted 2016 started applying 2018. but here are its uh cornerstone principles as it's outlined in the actual text of the regulation so they start with lawfulness fairness and transparency and within that within lawfulness which was also actually mentioned is consent as a basis for lawful processing of personal data and also other things like legitimate interest i mean there's a bit of a sense that consent is monarch which may or may not be a good thing but it seems to be the most readily acceptable basis for the whole processing of personal data then you have purpose limitations so if a processor collects personal data for well the purpose needs to be specified and limited and along with that as well actually they're all interlinked data minimization so to achieve that purpose the controller needs to obtain the minimal amount of personal data to ensure that accuracy so the data must be correct accurate relevant up to date storage limitations a bit like data minimization so once the personal data is no longer useful for the original purpose for which was collected must be deleted um integrity and confidentiality this is about technical and organizational measures to maintain data security and accountability is about the chain of who has what data and when and so someone's always accountable or responsible for it and i added in that eighth one as a principle because the gdpr outlines data subject rights a lot so here they foreground the individual again and you have things like the right to eurasia or right to be forgotten right to access um right to request deletion and right to rectification for instance so the individual and this harks back to what both of you actually before me was saying the individual has a degree of control over their personal data so this goes along with uh the right to data protection being a personality right and giving someone a degree of informational self-control the gdpr so those are the substantive parts in terms of extra territoriality it has a lot of explicit and indirect as well influences on third states so non-eu states laws and practices for multiple reasons so for instance its territorial scope of application is quite wide so if there is a business offering goods or services to those in the union that's that's how they phrase it or monitoring the behavior of individuals in the union no matter whether or not they're established in the eu or have a subsidiary there they need to adhere to at least some of the um aspects of the gdpr for some of the processing purposes so you know you could imagine that that a company has very very little to do with the eu uh or definitely individuals in the eu but might be caught by that by that um it's article three by that specific provision and they're other sorts of ways so adequacy requirement you may only send personal data to a third state if it's got an essentially equivalent degree of data protection as in the eu so that's kind of a soft law effect of um this adequate standard that has actually been in place for quite a long time so you can say that the eu's setting a golden standard actively and it has been fairly successful at influencing the content of most states data protection laws today i think there are about 120 business laws but why that is i don't know is it for fundamental rights protection or is it just so they can gain market access or somewhere along that spectrum i think it's probably somewhere along there but this notion of extra territoriality has successfully influenced some kind of globally shared norm then moving away from these kind of hard and fast legal documents although the fits is not legally binding you have the fair data principles which is uh part of what we're explicitly discussing today and you can find them in the link that put in the chat some of the recurring themes i mean you can read those yourself so i won't go into them in the interest of time but some of the recurring themes are foregrounding the individual in terms of ownership and control over their personal data again consent pops up and then you can see these kind of normative underpinnings so social good and this follows in the the next thing that we're going to show you um but also the notion of ethics by design you see something similar in the gdpr uh including privacy by design and by default and data protection by design by default i think it's interesting but it makes sense with the fair data society that they've gone for the ethics terminology or concept um but the whole the whole set of principles certainly compared to the fips builds upon them and has perhaps more of a values based rather than a market or trade-based um kind of structure or terminology or narrative and that said it builds upon the skeleton of what the fifths outlined the principles to my understanding are supposed to be unterritorial so just apply everywhere all the time or online and there's no kind of limiting clause so in that sense they could have a wide sphere of influence and finally the eu data governance act proposal this was a commission proposal from that came out 25th of november of last year so it's very recent and it's part of the whole um digital services approach of the eu they've just oopsies they've just released um that strategy so some of the terms that you see in it and it is just the proposal but they're talking about data sharing services in an open and collaborative manner um again giving the individual an overview and control of their data i just like to add that it's personal data so related to an identified or identifiable individual but also non-personal data so once you start getting big data machine learning combining data sets there's also this concept of data altruism they have a whole chapter on it which is basically about the data voluntarily made available by individuals or companies for the common good so this ties a little bit with the fair data principles and i thought that was quite interesting to find in an eu regulation and within that they want to have this set standard of consent so a common european data altruism consent form which could be quite interesting i i haven't seen the draft of it but however that materializes this proposal doesn't have a territorial scope in it it does say that a data sharing service that somehow interacts with the eu needs a representative in the eu in one of the recitals but i think based on the rhetoric with which the eu's been promoting it i think they're trying to have a wide sphere of influence as well setting standards across the globe so uh for the end this is from this slideshow template but i thought that's actually a great picture to end with when i'm talking about extra territoriality and unclear lines and some notion of information and data sharing so thank you swarm for that uh i'll pass to my colleague aditya now and then we'll have time for lots of questions and answers after his presentation thank you hi can everyone hear me i can hear you yes okay uh i need to share my screen [Music] um can never even see my presentation yes okay great um thank you mr for that um presentation and introduction so today i'm going to be talking to you about swarm as data commons um and with that i'm going to give you a brief uh introduction to the commons and the concept and its evolution and specifically i will then talk about the design principles of the commons and how they can give us certain perspectives uh for how we might design distributed networks going forward and then make a connection with uh european data futures uh what the european union has planned for its uh data economy so when we talk about the commons quite simply it's a resource system that's shared and managed by a community that operates beyond markets and states um i see why i think the lens of the comments can be really useful when we're thinking about swarm and distributed networks is because they basically function as commons for storage and bandwidth and possibly data so i think there are some strong intersections between how we how we design uh distributed networks like swamp and how what we think of governance when we think about the comments um so a quick history of the comments we most people understand the comments from or remember the comments from the idea of the tragedy of the commons which was something garrett hardin talked about and his idea was that any resource that is shared by a community will always fall to over exploitation and pollution and overuse because people will always pursue that individual self-interest but uh this was uh strongly refuted by the contributions from eleanor ostrom who went on to win the nobel prize for her contributions because she demonstrated thousands of instances where communities had managed resources sustainably and without resorting to assignment of private property rights or centralized control by the government um so that was the original context of the creation or of the of the concept of the comments as an analytical tool um and a descriptive framework uh and then more recently more people have extended the framework of the comments to more intangible things like imagining knowledge as comments and that can be something more tangible like libraries but also digital comments like uh the open source software or wikipedia or community networks as uh infrastructural commons and what that can also show you is that the commons in the context of digital networks inc operate across layers so that kind of raises the question uh something to think about is what is a swarm and that's something that i will come back to but i think the the important thing to understand about the commons uh as a tool is that it is the way of seeing the commons is descriptive because it lets you describe instances of commoning uh in instances of community sharing and managing resources collectively the commons is expressive because it's a way to nominatively assert that a resource should be held in common so when you say data as commons you're kind of asserting that data as a resource should be something that should be should belong to everybody or should be collectively managed and the commons is constitutive which means that the language and the vocabulary of the commons can be used to address and design new commons which is sort of what i'd like to uh present in today's uh talk so one of the key contributions from the literature of the commons is the eight other eight design principles for the commons so what uh what the scholars from the commons noticed across all of those instances so uh it's based on a lot of empirical research done on thousands of instances where communities had managed uh resources sustainably ranging from forests and uh fisheries and farmland and they noticed that there were eight principles or eight broad best practices that were always present in all of those instances of sustainable management um and these are the broad eight uh principles and what i'm going to do today is use those as a form of a way of ordering thinking when we're thinking of governance strategies for digital commons particularly from the respectability of how do you ensure that these institutions continue and sustain themselves and increase that uptake so um the first principle is clearly defined boundaries and that means a clarity on what the resource is and who and what and who should be included or excluded uh in constructed commons like digital commons it's almost automatic because you create them from the ground up but basically it forces you to have some clear idea about what is the community and the users and the maintainers in the context of digital commons and with swarm i see i think it's easy to see uh the swamp as a commons for infrastructure in the sense of network and bandwidth but uh there's an open question about what happens with the content and the metadata and whether the the lengths of the governments can be extended for distributed governance on that level as well uh the a very important principle is the rules being congruent to local context which means they need to match the resource and the community and this is where um in the context of swarm and a distributed networks ethereum and blockchain are such an important part of the puzzle because they allow you to align incentives in a way that matches the costs and benefits of participation or in the commons for a lot of people it's important to understand that um rules can operate at three levels operational collective and constitutional so the operational rules are the day-to-day rules of how people access a resource the collective rules are the rules about how those operational rules are created and enforced and the constitutional rules are the rules about who can participate in the in the in the formation of the collective uh rules um and so it's and that's where i think there's a lot of confusion about governance by blockchain and governance of the blockchain because uh we can have technological governance through blockchain but there are there are institute there are elements of institutional governance that are also important and often are under analyzed and so an important provocation there is can we see open source as an institution for collective choice rules the next principle is collective choice mechanisms which basically means uh people that have uh people are affected by the rules should have say in their formation and we're confronted there with the question of who gets to participate in tool formulation and at what levels um and uh there's a connection here with the fair data society principles of accountability and that's also connected with the next uh with the next uh principle of monitoring mechanism but there needs to be ways to monitor the state of the resource and rule violations and the monitors should be part of or accountable to the community now the interesting thing with digital commons is that there is techno because they're constructed and uh technologically created the enforcement is near perfect the code is law so our idea of monitoring kind of needs to change um so the questions that we might think about are what are the metrics for measuring quality of the resource and i think a very important question to consider is are there actions or actors that are not limited by the architecture and whether in those instances there needs to be additional monitoring mechanisms at an institutional level that that cannot necessarily be captured at the technical or architectural level the next principle is graduated sanctions um and it's simply a system of proportionate penalties and uh that can range from simply notifying offenders that the the violation of a rule has been uh noticed to stronger to stronger sanctions and that can range from penalties or um all forms of enforcement depending on the nature of the commons and again in the context of uh digital uh comments like swarm uh because we have technological enforcement it's important to consider other actions and actors not limited by architecture and what sort of graduated sanctions might be useful to uh to bring into place to ensure trust in the system um the next principle is access to low-cost dispute resolutions uh which need to be which need not be super formal but simply but need to be simple and accessible again in technological comments because a lot of the behaviors are mediated through technology uh it like it's important to consider despite that what are the disputes that might arise and between what kinds of parties and i think a really uh interesting and important conversation is about access to dispute resolution is is the ability is the ability to fork uh can we consider that dispute resolution uh because i think some i think that is an interpretation of dispute resolution when it comes to such projects um but i think what's important to consider is that you can't you can focus the project but you can't focus community so when we're talking about dispute resolution there is a difference between uh mechanisms that provide voice and mechanisms that provide exit as a form of dispute resolution um some of the coming to the final principles uh this is just uh the principle of uh nested governance which basically means that uh it in captures the idea of subsidiarity and decentralization um which i think uh to a large extent are one of the core principles of swarm and distributed networks that um that capabilities uh that capacities to make decisions that that governance needs to be distributed quite simply uh but i think it also captures the idea and the importance of interoperability um and seeing how commons how a particular commons or a particular network can operate within the operate harmoniously and uh appropriately with within a larger ecosystem and i think that's something that we've all sort of addressed in the previous presentations as well because of how uh the applications like my data can uh interoperate with swamp and the final principle is recognition by external authorities uh which basically means that uh for a network to sustain itself um the the rule-making authority of that community within itself should have a certain amount of recognition by external authorities and i think that sort of contr in in the context of uh networks like swamp it confronts us with the question of how do the governments relate to the surrounding legal regime and how how might they interact with uh things like the gdpr and the data governance proposal and that i think is a good segue to think about the european data futures and i think a key question uh underlying this uh discussion is to what extent does data sharing require distributed architecture because data sharing is a very crucial part and a key part of the european data strategy because what they want to do is create sectoral data spaces and pools and um i think it's uh an important question to think about is what additional affordances does the architecture bring it some of that is clear from the previous presentations um and there are some earlier uh examples as well for example the european union's decode project used uh who tried to create data commons based on blockchain technology and they basically created smart rules that allowed granular dynamic uh consent um and uh mrs already talked about the data governance proposal but i think uh some important provocations there are can swarm enable the creation of sharing platforms or can applications that are built on swarm uh create the applications that would be uh addressed or uh that addressed by the data governance proposal and how might uh these applications challenge uh the data governance proposals uh application and enforcement um so yeah with that i'd like to conclude uh thank you for your attention and i'm happy to have i'm happy for any comments or questions or criticisms robin um you're muted thanks uh thank you uh church for letting me know uh mr aditya those are two fascinating presentations i have to say so thank you very much um i learned a lot i think when we initially got the opportunity to do this research project i had hopes that the two of you would get involved and be as enthused as as i sort of was at the start and i think those presentations showed that you are um i did have some provocations um but i think it's probably um more wise just open it up to the group because i think part of this workshop was really getting opinions and perspectives from the swarm community because as much as we may have an understanding of what they're trying to build i think they're going to have the better understanding and and to get those perspectives from them i think is also more interesting for our work um as we try and kind of bind bind the two concepts ideologies philosophies together right um so i i'll hand it over maybe to church or to anybody else in the chat um or anybody that wants to pose a specific question on the presentations and we can go from there so i would i'm sorry camera i didn't turn on so i would remind uh everyone that you can raise your hand somehow or just write in the chat that you are raising your hand so that you can get a voice um to ask or contribute so um do you believe so about this all all these data flows uh that are happening so do you believe maybe that um this is getting to to swarm somehow i guess so um do you believe that some kind of global regulation is going to emerge or maybe that there will be like localized data like nations organized around different regulation having their own data pools or something to that effect and yeah i can take that on thanks to it i personally think i don't think there'll be this return to kind of a territorialized internet where the internet's kind of walled off in the way that sovereign jurisdictions are on the ground i think that the eu's influence will become and it is becoming kind of golden standard also for swarm also for various forms of internet governance and data protection law or similar things so i think it will be this kind of knock-on effect that was originally there for third states to get market access but has taken on more of a normative um dimension or character and in order to trade with the eu states have had to kind of phrase their data protection laws in fundamental rights terms and ratchet up their standards so i think it will be a bit of that soft power i don't think there's enough globally shared attitudes or laws or even desire if you if you've got russia and china who don't want to conclude such a treaty then it'll already be difficult and then you've got you know another western liberal democracy the us that's also got such different conceptions that i think legally it'd be really hard to find a shared approach and therefore a global treaty that could govern such um transactions so i think i think ultimately it will be some kind of devolution to the to the eu standard that would regulate things such as swarm so because actually so i don't want to um like dominate here or anything but um okay so we have a question but maybe just i'll ask later uh so uh gregory is asking uh uh if she commends you on the presentation one question that comes to mind is the principles are maybe also in any conflict or in opposition with gdpr and others you maybe encounter that the fair data society principles he means ah okay yeah i think well they go far beyond the gdpr i think gdpr is obviously very legalistic and very technical and it doesn't have those sort of um you know social good principles underlying them underlying it i don't know well apart from this kind of fundamental rights rhetoric but it's for different um goals i don't know if any of them contradict maybe these notions of how they view consent and their degree which it's informed or unambiguous and having well at least in their data society principles focus so much on this um kind of control and ownership of an individual whereas gdpr focuses more on the data controller as the owner of that information and then the individuals can exercise certain rights vis-a-vis that data controllers ownership so that might be a way there in conflict but i haven't thought about it so much it's interesting yeah i don't know if you have something to add yeah i had some dad because when i was listening to both your presentations and especially yours miss style there was a sense that there's sort of a movement um well initially there was a movement towards centering the individual and the individual's rights and we kind of see that in the gdpr and then in the fair data principles um we start and in the eu data spaces or the data governance act we see a movement towards the concept of data altruism or data for the public good and i just thought that was really interesting in itself um that there was sort of an acknowledgement or a move towards i mean i don't want to bring politics into it but to a more kind of socialist ideal regarding data and then that links back into what aditya was talking about with the data commons i don't know if you had any thoughts of that or anybody else in the swarm group had thoughts in it but i thought that was really interesting in itself so i would actually try to give voice to rinka because he had maybe he'll comment this but he also has a question so ring are you ready to to talk where do you know yeah i'm here oh you're already here oh oh sorry you're uh yeah okay yeah yeah so actually like the question which i which the answer which i wrote in the chat i think it ties into what you just mentioned robin because um i think when we're talking about swarm um as as a personal uh data storage then you know you can definitely put your data on swarm and you encrypt it and it's only accessible to you but i think like one of the interesting things that i personally find about swarming so that kind of like allows a new paradigm and this paradigm is basically that i'm allowing data i'm putting data on swarm i don't encrypt it so it's available for everybody but after i send it to the swarm network it is you know it belongs to the network and the network belongs to nobody so basically this data that then is in the swarm network you can kind of see that it is owned by by everybody and nobody at the same time so i think that that maybe also ties into this this data altruism and and uh like what a detail was talking about but i'm just curious um to to hear your thoughts uh on this kind of architecture and and whether this is even considered by the eu i'm like like it's something new and that's that's interests me about swarm thank you um can i respond oh yeah i think that's a great question because um that was one of the provocations that we had in our that we sent out in our abstract uh is the is the governance of the what i mean we called it is the governance of metadata distributed but the metadata was a loose term for exactly what you're talking about basically all forms of non-personal data that might exist in the swamp network and um that's i think a completely open discussion in the sense i i'm not an expert on swam i've tried to become familiar with it but right now i don't uh it it's an open question in my head of what happens with that data and i think that's good that connects with uh robin's uh question as well because i think the real dichotomy now in ideas of data protection is exactly what you said by the way uh ideas of data protection that center completely on individual control and ideas of data protection that consider more collect center more on groups or collectives or more democratic uh formations um so the current european approach um even for example uh the data protection uh the the decode data commons project and even a lot of the a lot of platforms like like the ones that we've seen today really ultimately center on individual control of data but uh there is now a real sense that maybe we need to move beyond a build additional layer an additional layer of governance on it where there can be more as you say social or collective models of data decision making around data um and i think the data altruism model begins to take the first step towards those sort of uh data futures but it's really a conversation that's happening as we speak and that's why you have so much discussion about data unions and data trusts and data data cooperatives and data collaborators they all often talk about the same things but to me i think the real distinction or the the real analytical differences might be where does the do we focus only on the individual or do we also have an institutional process for thinking about collective decision making about the data that was really long but i hope that made sense yeah that's that's wonderful uh thanks for that um yeah what i said i i think that uh that that swarm would be especially uh suitable and very interesting to to analyze form in the aspect of actually like shared data and uh and doing that like you can definitely make like private data thoughts on one swarm but the the underlying architecture of swarm is such that uh actually we're sharing all the data to the network and once this data is in the network it's like you know we can hack around and making it only accessible to me but on the network like the the lowest layer it is just owned by the network so that that's interesting yeah i would love to uh to to talk more about that but i'll send you an email yeah you can you also use this opportunity um but so there's also a question from from gregor should there be more comments like infrastructure comments data commons and so on so i would maybe add my um my thoughts here because i have them written down um so i think as if i understood the presentations correctly so the the network itself can be considered the comments right according to these principles but data is a different thing so and i think maybe yeah this is also what we have been talking just now we drink it's some of the data is like public and some of the some of it is is is private and i guess yeah it it is different right uh the public data i guess it's common or what and the private one it depends on how you use it or oh yeah i think yeah the network the network itself can be seen as a commons and when you say data com the the data and the data the data commons on swarm is a whole other thing like it can be it's it's it's a completely it's it's its own conversation and that's partly what like rincey also addressed because it's a completely different set of questions um when you're thinking about just the data and the the eight design principles that i talked about you would think of them in slightly different ways when you're thinking about data and for example one of the complications will always be what is personal data because then you have to come back to then you not just have don't just have the concept of the comments but you also have to align it with uh data protection uh principles so i think the the the analogy would be if you think of wikipedia wikipedia is a commons at the layer of content um and but it's not a commons at the layer of its infrastructure um and so and more and the discussion that we've had and swan can be more easily seen as a commons at like closer to the way com wikipedia is not a commons which is to say at the end closer to the infrastructure level but not at the uh not at the or not automatic it it's not automatically your commons at the content level in terms of what we do with the data um so the commons and that's the principle of nested uh governance as well that the commons can operate at multiple levels and it's an open question about how how we make that um happen yeah i just want to jump in there because you mentioned governance i think that's really really interesting to talk about um from from you know from the from the context of swarm because we have this idea of maybe an architectural commons and we have the idea of the data commons but ultimately it needs to be governed by the community or by the network and there needs to be some processes in place that go beyond just the algorithmic processes for governments um you know whether that's consensus mechanism or whether it's a uh you know code repository there is a human layer and and i think that those questions surrounding governance and nested governance which you mentioned are also really interesting so maybe that's something we can throw back to members of swarm how they imagine the governance um um you know manifesting as this moves forward or how has it maybe manifested you know up to this point and will it have to change when swarm gets deployed in in in a real live setting so i would pass the governance to someone else the governance question hi uh yeah maybe maybe i can address it i would say uh we actually address uh try to address this at the multiple levels so uh and uh each of these levels is the at a different point uh as you as you said with uh if we speak uh strictly about the small network of nodes pushing chunks back and forth so to speak the infrastructure and this has uh been already well defined through uh through our incentives uh through the incentives design we are aware as uh that there's also the aspect of basically addressing the data commons that this this more defines like the direction into which an uh the ecosystem on top of swarm uh is uh developing and uh for this this is uh we are very uh very early on this is why we are here uh today and uh your uh presentations uh are uh very valuable uh actually also uh for for this part and then you know of course uh to figure out uh long term uh how um the network infrastructure and the data aspect how they work together and how they uh can uh operate independently of uh any entity so yeah so uh we should be uh over time go uh deeper uh into the rabbit hole of decentralization yeah so i would actually squeeze in a question here so we can of course extend this to five past uh since we started late um there are also other questions i would give maybe the voice later on to the person asking sorry but uh so we're talking about commons a lot right it's like we imagine what this is but um as i was uh a while back reading about comments and then all these things surfaced that you mentioned like trusts and collaboratives and i don't know like seven or ten different terms that are used frequently and i don't know how many more that um are used less frequently uh and then you sort of get confused and so on so what is it exactly that we're talking about the comments i guess it is not like a legal thing it's more like a i mean it's a common something that is legally recognized at least throughout the eu like this is governed as a commons so legally this should be perceived as this and this thing and also maybe uh if i squeeze in uh the eu data spaces in here so if i participate in a uh eu data space uh sharing data with other people can i have a comments is that enough or do i have like to have like if this is a legal thing or do i have to have like a trust or a collaborative or cooperative or yeah so this is basically the core of what my current research focus is because there is so much discussion about data trusts and data commons and data cooperatives but it is very difficult to come up with any clear sort of analytical or conceptual distinctions between these models um they all really draw from each other it's not always they're actually the description of how they're supposed to operate is uh there are strong overlaps in all of them so um i think some of the the differences that i've i can sort of point to are they all sort of come from slightly different term traditions so when you're talking about data commons um they try they draw from as i said these you know these uh this very rich history of uh people managing resources uh in a way that everybody has um access to it in some way when you're talking about data trusts it comes they're trying to build on top of more legal concepts like the idea like like trusts as a concept and fiduciary duties where you appoint someone as uh or you appoint a data a point an entity or a person uh with power to take decisions on your behalf uh and they and the ideas that the data trust can negotiate with uh bigger platforms and negotiate that trust um so for example in the presentation we saw from uh midhub the idea is not that you have the app the the difference with some of the ways people talk about data trusts is that instead of the app where you're constantly having to uh you know monitor and self-manage your privacy you have sort of appointed someone that you trust and they are negotiating with entities uh not only from not only from a perspective of data protection but also from uh in to also more positive ways of using data so giving your health data away for covet research like the data altruism model is sort of based on that idea and then if you have data unions and data collab cooperatives they are trying to build from the traditions of these communities uh like unions and uh cooperatives and people coming together from existing communities and having stronger bargaining rights and bargain a stronger bargaining position against larger platforms so that is only so that is one way to look at the differences that they're trying to build from different principles but in real uh in real terms there there's a strong overlap i recently went to uh this discussion where the people that are strongly piloting the idea of data trusts were talking about how maybe we should look at data com how may be how we should look at commons principles to actually operationalize how we really do data trusts so it's uh i it's everybody's still kind of trying to tease out the analytical and conceptual differences to my mind uh i think one clear way to maybe look at it uh is what i mentioned earlier where does how where does the decision making where does the locus of decision making happen are you constantly um managing your privacy and accepting cookies or not uh or have you given that away to a trusted entity of that i think can be one way to that that to me is one clear diff uh two different models but then and and that has its own sort of issues about how do you operationalize that trust or that democratic control over data um but yeah it's a little all over the place that's for sure thank you so uh would you like to ask so via voice today i can click here allow to talk let me try will you hello hi hi so my question was uh does metadata on the swarm not default to a commons in the sense that since it's a permissionless network uh you can collect this information if you have the capacity to do so uh to whatever degree you focus on it and can derive you know products from that data freely right is that not just a commons then can i just jump in quickly i think this is one of the hard questions i think uh you know and it and it's difficult from a number of perspectives um you know philosophical ideological but also legal um because metadata in itself does not necessarily uh mean it's not personal data in the in the eyes of the law and this has sort of been at least at least been part of guidelines drawn down by the european data protection supervisor with respect to the metadata that is generated in um in piloted vehicles or autonomous vehicles so um i don't know i mean mr you're the legal expert here i mean metadata is is a is a is an area which which is very complex at least from my understanding of it um and it's very murky waters and and i think it would be hard to fall on either side of the fence um uh with any conviction from from my perspective but i know mr maybe you could expand on on your view of this well if we if we're just looking at the regulatory framework because it pertains to uh personal data then it you know prima facie wouldn't fall into that but once you combine metadata sets and find suddenly that certain individuals are identifiable then that kind of legal protection comes into action but yeah it's a really mucky area and difficult to answer with legal clarity for sure okay um so there's actually something that's um on my mind also so so swarm has this uh peer-to-peer infrastructure so the the benefits of it are that so nobody is actually in control right i mean nobody can take it down uh if there is data on there nobody can sensor it or shut it shut it down so do you maybe see um with all these well in the economic sense and in the legal sense uh benefits and problems so um would would nations opt for this kind of thing uh as like uh if there's some cooperation between multiple nations like that will be perhaps in data spaces although that might not be the best case but uh so nobody can like take away that data nobody can censor it or maybe there are also some difficulties with this this problem so would would the european union say oh no this is too complicated uh to use there's all sorts of legal issues and so on yeah i think i think they might well say that because suddenly you throw into question like any sense of clarity predictability but also chains of responsibility and accountability which are quite cornerstone principles for you know not just out of protection though but you mentioned mentioning kind of freedom and expression those sorts of things um so i think definitely it would be a legal and probably policy minefield as well therefore very difficult i mean you also see just if you're dealing with things with no central authority in a like public or permissionless blockchain and almost anyone can theoretically add personal data to it who's the data controller who's the data processor is it um you could interpret it as a user who enters the personal data as the data controller and anyone who has a copy as a data processor but it's just not it's just very difficult to regulate so in that sense um to your original question i think it would be very difficult for the eu to do so and maybe little political ones but i'm curious what everyone else thinks yeah i i just want to add that um i think that was the original sort of seduction of like distributed networks that you would create these permissionless platforms that states can't directly regulate um so i think on some level they are sort of clearly antithetical and that's something governments will always struggle with unless they can co-opt it in the way that for example now blockchain is something that is just an efficient data storage way for for big companies and uh governments to operate um but i think and this is connected to what misstoll also said that and to also answer your question i think the the question of business models and incentives is always going to be a problem in terms of uptake because for example if you're not if so much of the business model is based on uh the analysis of personal data if you're taking away big chunks of it then there is an open question about how you're going to scale basically for to make these the dominant way of how we design things online and even if you take away control from the government i don't think you can run away from questions of governance so questions of data protection still exist and accountability still exist and questions of content also still exist um i mean the the big boogie man on the internet is for contact regulation is uh child sexual abuse material and so i mean if i could use that as an example uh networks that cannot be inherently surveilled or censored have have to address the possibility that they can be used for that material and you can be okay with that from the point of your libertarian ethic but um that's still a question that needs to be considered when you're talking about from the point of view of governance because that is just not good or ethical design so just to say that you uh it is antithetical to governments but i it's not antithetical to governance um there was a there was a great comment i don't know uh uh hetero heterotic uh i i don't know if you want to jump in and give your view on this because i actually think this is a really interesting perspective that maybe we could talk about the kind of what i just really want i i just really want to recognize what aditya just said right um i mean it really does come back to this idea that governance and governments aren't necessarily the same thing um but this is an important responsibility of the designers of systems and so it bears deep reflection in the bzz in the swarm uh community here for sure um i mean to a certain degree there's anonymity but organizations that are large enough to track interactions across nodes especially with regards to some of the tools that we've discussed so far this week um really exposes and what i see it is a security you know opsec uh uh it's a security issue if these uh end points expose the network to the powers that beat that because there are lives you know being forced right now right now i i mean just from my perspective i suppose it depends on who you think the powers of vr right um it doesn't necessarily have to be the governments it could also be the big tech companies who have kind of proven to be most harmful to our own um well dignity and and privacy right um i do think that there's a still a really interesting question regarding and i know a detail you touched on this so maybe you could provide somebody around accountability and and you you mentioned something about technologically enforced accountability um which which is maybe really difficult to achieve on on a permissionless network i.e if there is a violator who you know you have removed consent for use of the personal data and they continue to use it how are they held accountable at the networking and that is something i think that would have to a bridge that would have to be crossed by swarm at some stage um because i think it's really interesting topic i didn't know a detail if you had any more thoughts on that i think i i think that's connected to what heterototic just pointed out that um distributed architecture doesn't fix privacy it changes the threat model um so what you you might not have to worry about centralized surveillance but um in a way what you might then have to worry about is vulnerable appears or malicious peers in the network um and so and then yeah when we're talking about the network these networks like these so much because so much of the enforcement is technological it's uh this is basically i think new ground we're so used to more uh in like human based in an institutional sort of um frameworks of accountability um and governance um in some ways this was the this was the new the shiny new thing right you could use blockchain to align incentives you could use uh you could you you could do away with like sort of human human issues with this and code the trust yeah you don't have to trust the institution you could just quote the trust into the code um but that also means that uh yeah you have to come up with novel ways of addressing the questions that you just talked about um which is like like i said it's it's novel and it's something that we begin to examine now when we create networks like these so um maybe just this one more comment and then we go to the maa since we're out of town so gregor i don't know do you want to speak this or should i read it to your comment um so gregor says that uh the gdpr and similar should be addressed on layer two where data subject to gdpr is shared and stored in appropriate way essentially a subset of swarm and the metadata especially linked to personal data can be reduced eliminated with single own thing some kind of chunks right so this puts more focus also on education of the users so and um mr i think you maybe would want to comment on this or you found it interesting yeah i just found it an interesting idea maybe it's like a kind of more practical solution that can have something kind of tangible and useful come out of it and thought about it before okay thank you so um i guess we can conclude now with with the workshop so thank you for for this but uh please stay on uh for um maybe any more general questions uh the ama and i would like uh all the presenters to um would ask all the presenters to turn on the cameras and maybe if there are any more questions for either alexander salman or mr dtl robin hello so i guess we did have a lot of discussion during the the uh action presentations or after the presentation so uh i would like to thank you all for for participating it was a very interesting uh uh interesting presentations an interesting discussion i think we gained a lot of insights so thank you for that um i guess maybe uh you should also if you want to post your contact details into the chat or somewhere if if you haven't already and thank you also to the to the attendees um i would remind you again that tomorrow although saturday is also a day with the program actually a bit more problem than usually so uh the um it starts at 14 30 central european time and i think the uh the the uh titles of the presentations are already available if they are not they will be shared with you um i guess via email also if you're one of the attendees so um i don't know if maybe somebody would last call otherwise it's friday so yeah have a good weekend and and thank you all yes again stay healthy thank you so much uh really really nice session thank you thank you thank you thank you alexander thank you all bye bye bye bye thanks very much thank you salman bye-bye bye-bye bye-bye [Music]