European Data Protection Board

But if you take the GDPR, there are...

So many things that are counterintuitive and also some of the guidelines coming from the EDPB, they are so hard to follow that sometimes it gets, you know, if you have the cloud guidance from the EDPB where it says you have to name all the sub-processors the whole way down in every software you use, and then you have to tell, for example, the employees when you process that data, about every system and all the chain down, but you also have to do it in a nice, transparent way.

And you can do that.

You can give that information that is technical and a lot of things for all the system where you have that data and then do it in a nice, easy way.

You know, since you mentioned this, I'm thinking also of a list of sub-processors.

And I know it's not as crazy here as it is in the EU with the EDPB now asking for so much transparency, cutting across all of these layers.

But to at least have a couple of layers of sub-processors, since everyone is relying on someone else, and there's more modularity, there's all these components that people recycle, some of them open source, and there's more and more people relying on the modules that others have published.

And so you see that whenever you buy a tool, you're already buying a cluster of solutions.

I mean, you raised an important point.

We need DPIAs because we chose to incur in risks that were already predefined as requiring a DPIA, for example, in the EDPB or, you know, supervisory authorities guidelines, right? But now that we've fully matured and use privacy enhancing technologies and data minimization and key anonymity and all of these tools that everybody's using because they come also bundled with many of the layers in the stack that people are using.

then we don't need it.

This privacy by design is in there.

Yeah, I mean, the definitive term that we all know and love is, you know, who makes the decisions and who guides that, which dictates who the controller is.

However, you have a bit more nuance to that.

Technically, the service provider, at least from EDPB or Working Party 29, I think it's the former, who had a good resource on this, who did recommend that it's actually okay to have some things you're doing as a service provider, say for analytics or business process improvement.

If you're crossing the line and improving the data you're getting from your customers into a commercial perspective, that's where you might cross the line.

So I've just been spending quite a bit of time on anonymization, um, over the summer, which has been quite fun to do.

So I was looking at taking what the work that I'd done over the last kind of five years or so and the principles that I'd applied in health research, look at the, um, European Data Protection Board's anonymization guidance that came on the back of SRB versus EDPS.

There's a lot of letters in that sentence.

And it was really interesting, just as much as anything to kind of compare what I'd done and some of the thinking I'd put together before the ICO's guidance came into being, and just go, "Actually, this has sort of stood up quite well," which is kind of nice to have.

Look, this is an issue that's not, it's not unique to Ireland.

Our colleagues in the European Data Protection Board are all dealing with the same thing.

And actually, I just had lunch today with a friend who works in another regulator.

They're seeing the very same thing, you know.

The EU is also moving on this.

So a report from the European Data Protection Board on smart glasses should soon be released as well.

But I'm feeling a little bit more optimistic that something's actually going to happen and that we're not going to just live in this dystopian hellhole where everyone's... filming each other and can work out who you are through facial recognition just by looking at you so yeah that's my happy ending

beyond any doubt the sponsor of this episode is the word regulation

But there are tons of companies out there who do fraud prevention with automated means.

We've seen before in decisions from also published by the EDPB that in any case, they would allow legitimate interest as a legal basis for automated decision making for fraud prevention.

But there now seems to be some sort of limit of what you can do as an organization to counter fraud in an automated way.

So I'm very curious to see what detail there would be available here.