IAPP Intensive France – 17 & 18 March 2022

EDPO attended the IAPP Intensive in Paris (17 March). Here are the main insights from this first day of conferences:

🔐 International data transfer remains the hot privacy topic. There still doesn’t seem to be any solution at the moment. This issue should be handled at the political level…which could take quite some time.

🔐 Metrics can be very useful to assess your compliance and convince your boss and the board to focus on data protection. Key words: cost & time.

🔐 Privacy regulations are popping up all around the world. Some are very similar to (and inspired by) the GDPR. So being GDPR compliant is a great baseline but let’s not forget that the right to privacy isn’t a fundamental right in every country.

🔐 Privacy by design and operational efficiency: Data Protection Impact Assessments are the most challenging part of building privacy into technology

🔐 Nothing is impossible in terms of GDPR compliance – it’s just a question of cost

🔐 Perform cookie audits at least once a year to make sure that what goes on in your system matches what you say on your cookie banners

Some of the key discussions and funniest outtakes from the second day of the IAPP Intensive in Paris (18 March):

🔐 European Data Protection Board announced the creation of a GDPR compliance tool for SMEs and upcoming guidelines on fines

🔐 The number of sanctions and fines are through the roof, and authorities are only going to pick up the pace

🔐 The question is not “are you going to have a breach” but rather “when is it going to happen?”!

🔐 A few funny DPO stories:
– data subject asking to remove personal data so that their partner doesn’t find out what they’re up to
– what song best fits the DPO’s: role? “I will survive” or “Compliance” from Muse
– don’t be surprised if your kids don’t want to provide their personal data to anybody: you “privacy-by-designed” them!

IAPP Intensive UK – 23 & 24 March 2022

EDPO attended the IAPP Data Protection Intensive in London on 23 March and 24 March and it was a success! Here are some insights from the conferences:

🔐  Online advertising is in the spotlight. Multiple businesses play in the chain of services or products and need to be compliant. Some want to pull back and reduce the number of players having access to data. Does that mean going back to the 1980s? Other say that we have to move forward and need to think differently to bring data closer and safer to the user without removing any parties from the game.

🔐  The responsibility is always on the individual to give consent – or not – with very complex privacy policies to read through. We need to take a different approach: fairness should be guaranteed by the company. The user should have the ability to make choices, not feel obliged to give consent.

🔐  We need to stop thinking about data as a thing to manage through tech, an asset to leverage or a risk to manage. Is it data protection or data protectionism? Data is a powerful economic tool. Data serves the economy, the society, and businesses. Data protection shouldn’t be a barrier to anything.

🔐  SCCs are all the same and don’t work. Nobody reads or audits them. Why not take aproactive approach? “Privacy in practice rather than privacy on paper”.

🔐  Is GDPR the golden standard? Many countries don’t have the same rights and privacy regulations – e.g., Africa andChina don’t have legitimate interest. The GDPR has a dominant approach but the ultimate goal is to draw approaches together and not just stick to the most influential one. After all, they’re seeking the same outcome.

🔐  The UK is looking to develop a unified framework. Supporting businesses and protecting the rights of individuals is not incompatible! Transparency is the key.

🔐  Can the UK make meaningful changes on data protection and still have the adequacy decision from the EU? Yes. The point is to not travel in different directions but to make sure that the framework is well-thought and adapted to the reality of society.