The GDPR which comes into force in May 2018 includes 6 ways to assure lawfulness of processing, of which consent and legitimate interests. The ePrivacy Regulation, a lex specialis of the GDPR, remains in draft mode, waiting for trialogue. This presentation will explain what a risk based approach means for the advertising sector, taking the angle of media and communication agencies, vendors of tools as well as their end clients, the advertisers.

1. @aureliepols
From GDPR to ePrivacy
What does it mean to the Advertising sector?
Aurélie Pols – Data Governance & Privacy Engineer

2. @aureliepols
Data Governance & Privacy Engineer
Data is the New Electricity – Privacy is the New Green – Trust is the New Currency
Dutch nationality, French mother tongue, works in English, lives in Spain
AURELIE POLS,
DATA GOVERNANCE
& PRIVACY ENGINEER
• Chief Visionary Officer – Competing on Privacy
• Ethics Advisory Group (EAG) – European Data Protection Supervisor (EDPS) Towards a digital ethics
• Professor of Ethics & Privacy, Big Data & Analytics Master – Instituto de Empresa (IE), Madrid;
guest professor DPO certification courses Maastricht University, faculty of law (NL) & Solvay Business School Brussels.
• Vice-chair P7002 – Data Privacy Process – IEEE
• DPO for mParticle - contractor
• Speaker/writer/consiglieri: SWSX, Strata (+ Hadoop World), IAPP, Piwik, AT Internet, industry associations, AdTech &
MarTech vendors, …
2003:
OX2 Co-founder
Webanalytics.be
2008:
Sold to Digitas LBi
(Publicis)
2

3. @aureliepols
The GDPR buzzwords I’ve been through
• Accountability
• Privacy by Design & by Default
• Security – Hashing – SHA256
• DPIAs
• Reasonable effort
• High risk
• Legitimate interests
• Risk based approached

4. @aureliepols
Risk based approach: for who?
Who Data Controller? – You? Data Processor?
4

5. @aureliepols
Some examples
5
Source: http://www.businessinsider.com/infographic-the-mobile-advertising-ecosystem-explained-2013-5 Source: http://data.iab.com/ecosystem.html

6. @aureliepols
Gentle reminder: joint-controllers (art. 26)
1. Where two or more controllers jointly determine the purpose and
means of processing, they shall be joint controllers. […]
2. The arrangement referred to in §1 shall duly relfect the respective
roles and responsbilities of the joint-controllers via-à-vis the data
subjects. The essence of the arrangement shall be made available
to the data subject.
3. Irrespective of the terms of the arrengement referred to in §1, the
data subject may exercise his or her rights under this Regulation in
respect of or against each of the controllers.
6

7. @aureliepols
What’s the
problem?
7
Source: https://www.firstimpression.io/blog/advertising-ecosystem/
Data babies
Leakage
Leakage = breach?
If leakage = breach,
who is responsible?

8. @aureliepols
Now, let’s go back to the beginning
6 bases in the GDPR to assure Lawfulness of Processing (art. 6)
1. Consent => article 7: Conditions for consent
2. Contract
3. Compliance
4. Vital interests
5. Public interest
6. Legitimate interests* => “balancing test” (goes beyond DPIA) +
NOT for public authorities
8
* Legitimate Interests NOT for now in
the ePrivacy draft
http://www.europarl.europa.eu/sides/getDoc.do?
type=REPORT&reference=A8-2017-
0324&language=EN#title2

9. @aureliepols
Covers art. 6, how about the principles? (art. 5)
1. Principles related to processing of personal data
a) Lawfulness, fairness and transparency
b) Purpose limitation
c) Data minimisation
d) Accuracy
e) Storage limitation
f) Integrity & confidentiality
2. Accountability: The controller shall be responsible for, and be able
to demonstrate compliance with, §1
9
Note: Storage limitation = data retention

10. @aureliepols
These are
global
principles
ie the European Union
didn’t just make this up ;-)
10
Note: standard!
Convention 108 for the Protection of Individuals with regard to
Automatic Processing of Personal Data, the first legally binding
international instrument in the data protection field.
Creation date: January 1981 – signed by 51 countries

11. @aureliepols
Purpose, Consent & Data Uses
Purpose
Consent
FIPPs
Data for
approved
use
From: email
Purpose
Consent
FIPPs
Data
analysis or
merging
New
business
opportunity
To: retargeting
Source: http://bluelatitude.net/not-all-data-is-created-equal/
11

12. @aureliepols
Autonomy, beyond Dignity
12
Charter of Fundamental Rights of the European Union
Article 1: “Human dignity is inviolable. It must be respected and protected”.
Charter articles Charter text
GDPR Art. 8: Protection
of personal data
1. Everyone has the right to the protection of
personal data concerning him or her.
2. Such data must be processed fairly for
specified purposes and on the basis of the
consent of the person concerned or some
other legitimate basis laid down by law.
Everyone has the right of access to data which
has been collected concerning him or her, and
the right to have it rectified.
3. Compliance with these rules shall be
subject to control by an independent
authority.
ePrivacy Art. 7: Respect
for private and
family life
Everyone has the right to respect for his or her
private and family life, home and
communications.

13. @aureliepols
2 different legislations, 1 of which is decided
13
Today: Directives As of May 2018: Regulations
Data Protection Directive 95/46/EC GDPR: Regulation (EU) 2016/679
“ePrivacy” and Electronic
Communications
(the cookie wall thing)
Directive 2002/58/EC Intermediary version, not definitive, possibly
some form of this
(Waiting for Trialogue)
ePrivacy is lex specialis to GDPR, dealing with confidentiality of communication &
access to “stuff on your appliances” like cookies, IDs, etc.

14. @aureliepols
GDPR (+ ePrivacy!)
• Alignment between trackers & privacy policy
• Recital 30 of the GDPR: “Natural persons may be associated with
online identifiers provided by their devices, applications, tools and
protocols, such as internet protocol addresses, cookie identifiers or
other identifiers such as radio frequency identification tags. This may
leave traces which, in particular when combined with unique
identifiers and other information received by the servers, may be
used to create profiles of the natural persons and identify them.”
• DNT? => ePrivacy Regulation
14

15. @aureliepols
Now, let’s go back to the beginning
6 bases in the GDPR to assure Lawfulness of Processing (art. 6)
1. Consent => article 7: Conditions for consent
2. Contract
3. Compliance
4. Vital interests
5. Public interest
6. Legitimate interests* => “balancing test” (goes beyond DPIA) +
NOT for public authorities
15
* Legitimate Interests NOT for now in
the ePrivacy draft
http://www.europarl.europa.eu/sides/getDoc.do?
type=REPORT&reference=A8-2017-
0324&language=EN#title2

16. @aureliepols
GDPR, recital 47 ends with 2 phrases
• The processing of personal data strictly necessary for the purposes of
preventing fraud also constitutes a legitimate interest of the data
controller concerned.
• The processing of personal data for direct marketing purposes may
be regarded as carried out for a legitimate interest.
16
Email Retargeting

17. @aureliepols
What privacy engineers should focus on
• Purpose classification • Consent trails and traceability
(including reverse engineering
between parties/legal entities)
17

18. @aureliepols
Interlocking liabilities & obligations
People
Company
(Telco,
Bank,
Insurance..)
Company
(Agency,
consultancy,
vendor, ...)
Cloud
provider• Aligning contract obligations
• (+ enforcement?)
• Providing
• Security
• Privacy features
• Privacy engineering
B2C
B2B
B2B
Privacy
policies
Consent
MSA
SOW
T&C
18

19. @aureliepols
Whish list: nudging data actors to think about
• Aligning economic incentives!
• Is accountability enough?
• The blurring lines of personal data
• Data ownership revisited
• Go beyond linear controller/processor models
• Co-ownership
• Data producers?
• Fostering data exchange and purpose classification standards
19

20. @aureliepols 20

21. @aureliepols 21

22. @aureliepols
Thank you for
your attention
aurelie@mindyourprivacy.com
22