Realizing the Potential of Big Data under GDPR is Frenemy Status Inevitable? Rebecca H. Davis, Director - Privacy, Walmart Inc.

Transcription

1 Realizing the Potential of Big Data under GDPR is Frenemy Status Inevitable? Rebecca H. Davis, Director - Privacy, Walmart Inc.

2 It is not a case of big data or data protection, it s big data and data protection; the benefits of both can be delivered alongside each other. Elizabeth Denham, U.K. Information Commissioner

3 BIG DATA! What s the big deal?

4 Almost every day I read news articles about its capabilities and the effects it is having, and will have, on our lives. -Elizabeth Denham AI helps us solve many societal challenges. -European Commission (A European approach to Artificial Intelligence, 25 April 2018) A LOT!!! What s the big deal? Increased efficiencies and resource savings [m]edicine, education, healthcare and transportation can all benefit from these processes. -Article 29 Working Party (Guidelines on Automated individual decision-making and Profiling for purposes of Regulation 2016/679) Big Data is currently the best method we have for making sense of an increasingly complex world. - Cecilia Esther Rabess (Can Big Data Be Racist?) Healthcare is one of the most important fields AI is going to transform. Sundar Pichai, Google CEO

5 So, what s all the fuss about?

6 Data Analytics Overview

7 Machine Learning Artificial Intelligence What are we even " talking about? Big Data Data Analytics

8 Asset Tool Analysis Big Data Is difficult to analyze using traditional data analysis methods. Machine Learning techniques and tools that allow computers to think by creating mathematical algorithms based on accumulated data. Artificial Intelligence giving computers behaviours that would be considered intelligent in human beings. Big Data Analytics

9 Signs You re in a Dysfunctional Relationship Won t tell you what he wants out of the relationship. (Algorithm use) Refuses to explain himself. (Opacity) All take, no give. (Over collection) Re-gifts your presents. (Repurposing) Changes the rules of the game. (Use of new types of data)

10 GDPR Requirements

11 Do we even need to worry about being friends? (Article 3 Territorial Scope) (1) In the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union (Their side of the pond) (Our side of the pond) (2) by a controller or processor not established in the Union, where the processing activities are related to: (a) Offering of goods or services to such data subjects in the Union; or (b) Monitoring of their behaviour as far as their behaviour takes place in the Union

12 GDPR Territorial Scope (Article 3) > Monitoring In order to determine whether a processing activity can be considered to monitor the behaviour of data subjects, it should be ascertained whether natural persons are tracked on the internet including potential subsequent use of personal data processing techniques which consist of profiling a natural person, particularly in order to take decisions concerning her or him or for analysing or predicting her or his personal preferences, behaviours and attitudes. Recital 24

13 GDPR Requirements Automated Decision Making & Profiling (Art. 71) - Generally Data Protection Principles Lawful, fair and transparent Further processing & purpose limitation Data minimisation Accuracy Storage limitation Special Categories of Data Lawful Bases for Processing Consent Performance of a contract Compliance with a legal obligation Protect vital interests Public interest or official authority Legitimate interests Rights of the Data Subject Right to be informed Right of access Right to rectification Right to erasure Right to restriction of processing Right to object Article 22 Solely" Automated Decision Making Decision based solely on automated processing Legal or similarly significant effects Exceptions from the prohibition Special categories of personal data Rights of the data subject Establishing appropriate safeguards

14 GDPR Requirements > Generally Profiling and Automated Decision Making - Generally Data Protection Principles Lawful, fair and transparent Further processing & purpose limitation Data minimisation Accuracy Information security Storage limitation Accountability Special Categories of Data Lawful Bases for Processing Consent Performance of a contract Compliance with a legal obligation Protect vital interests Public interest or official authority Legitimate interests Rights of the Data Subject Right to be informed Right of access Right to rectification Right to erasure Right to restriction of processing Right to object Algorithm use Opacity Over collection Repurposing New types of data

15 GDPR Requirements > Soley Automated Decision based solely on automated processing Legal or similarly significant effects Rights of the data subject The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her. Exceptions is necessary for entering into, or performance of, a contract between the data subject and controller; is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject s rights and freedoms and legitimate interests; or is based on the data subject s explicit consent. Appropriate safeguards Appropriate safeguards Special categories

16 Compliance Toolkit

17 What the therapist recommends - Big data with privacy Be willing to compromise. (Anonymization) Stop making excuses. (Privacy notices) Take time for self-reflection. (Privacy impact assessments) Start each day out on the right foot. (Privacy by design) Treat others how you would like to be treated. (Ethical approaches) Show your cards. (Algorithmic transparency)

18 Be willing to compromise. (anonymization) The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. Recital 26

19 Stop making excuses. (privacy notices) People don t read. And they don t care! There s no good place to give notice. It s just too hard to explain! The Whine Factory

20 Take time for self-reflection. (PIAs) Where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data. Article 35

21 Start each day out on the right foot (PbD) Taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for rights and freedoms of natural persons posed by the processing, the controller shall implement appropriate technical and organisational measures, in an effective manner and to integrate the necessary safeguards into the processing in order to meet the requirements of this Regulation and protect the rights of data subjects. Article 25

22 Treat others how you would like to be treated (ethical approaches) Organisations should define the benefits of the analytics. They should not incur the risks of big data analytics if the benefits could be achieved by less risky means. The insights should be sustainable. The processing should respect the interests of stakeholders. The outcomes of the processing should be fair to individuals and avoid discriminatory impacts.

23 Show your cards (algorithmic transparency) Bake auditability into algorithms at the development stage Interactive visualization systems Ethics boards

24 In the beginning Big data wouldn t say what it wanted out of the relationship, refused to explain itself, only took and never gave, re-gifted your presents, and kept changing the rules of the game. Algorithm use Opacity Over collection Repurposing Privacy & Big Data Anonymization Privacy notices PIAs Privacy by design Ethical approaches Algorithmic trans. Then they were willing to compromise, stopped making excuses, took time for self-reflection, started each day on the right foot, treated each other how they would like to be treated, and shared their cards with one another. Use of new types of data and they lived happily ever

25 Thank You Continue the conversation on #GRCSummit

26 Appendix: GDPR Provisions

27 Art. 22 Automated individual decision-making, including profiling (1) The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her. (2) Paragraph 1 shall not apply if the decision: a) is necessary for entering into, or performance of, a contract between the data subject and a data controller; b ) is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject s rights and freedoms and legitimate interests; or c) is based on the data subject s explicit consent. (3) In the cases referred to in points (a) and (c) of paragraph 2, the data controller shall implement suitable measures to safeguard the data subject s rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision. (4) Decisions referred to in paragraph 2 shall not be based on special categories of personal data referred to in Article 9(2)1), unless point (a) or (g) of Article 9(2) applies and suitable measures to safeguard the data subject s rights and freedoms and legitimate interests are in place.

28 Recital 71 Profiling The data subject should have the right not to be subject to a decision, which may include a measure, evaluating personal aspects relating to him or her which is based solely on automated processing and which produces legal effects concerning him or her or similarly significantly affects him or her, such as automatic refusal of an online credit application or e-recruiting practices without any human intervention. Such processing includes profiling that consists of any form of automated processing of personal data evaluating the personal aspects relating to a natural person, in particular to analyse or predict aspects concerning the data subject s performance at work, economic situation, health, personal preferences or interests, reliability or behaviour, location or movements, where it produces legal effects concerning him or her or similarly significantly affects him or her. However, decisionmaking based on such processing, including profiling, should be allowed where expressly authorised by Union or Member State law to which the controller is subject, including for fraud and tax-evasion monitoring and prevention purposes conducted in accordance with the regulations, standards and recommendations of Union institutions or national oversight bodies and to ensure the security and reliability of a service provided by the controller, or necessary for the entering or performance of a contract between the data subject and a controller, or when the data subject has given his or her explicit consent. In any case, such processing should be subject to suitable safeguards, which should include specific information to the data subject and the right to obtain human intervention, to express his or her point of view, to obtain an explanation of the decision reached after such assessment and to challenge the decision. Such measure should not concern a child. In order to ensure fair and transparent processing in respect of the data subject, taking into account the specific circumstances and context in which the personal data are processed, the controller should use appropriate mathematical or statistical procedures for the profiling, implement technical and organisational measures appropriate to ensure, in particular, that factors which result in inaccuracies in personal data are corrected and the risk of errors is minimised, secure personal data in a manner that takes account of the potential risks involved for the interests and rights of the data subject, and prevent, inter alia, discriminatory effects on natural persons on the basis of racial or ethnic origin, political opinion, religion or beliefs, trade union membership, genetic or health status or sexual orientation, or processing that results in measures having such an effect. Automated decision-making and profiling based on special categories of personal data should be allowed only under specific conditions.