Who goes there? It’s a question as old as time that is asked at the beginning of most transactions. In order for people and organizations to do business they must first ask – Who are you? How can I trust you? Digital identity is becoming the most important challenge to solve at the intersection of people, process, and technology. Ask people about digital identity and they might think of a password and user ID to access services. But it’s much more. Digital identity is the digital representation of you – the Facebook you, Twitter you, and Google you. Why is digital identity challenging? Perhaps because digital identity must intertwine with existing and evolving governance and cultural norms. Notions of privacy and sharing can vary greatly from person to person and from culture to culture. This workshop explores what it means to be you in the digital world. We’ll uncover the forces and influences that impact the digital you – for better or for worse. Attendees will gain introductory insights about how digital identities and digital relationships connect and interact within a society. Join us to learn how Canada will advance digital identity for the socio-economic good of all. https://fwd50.com/session/demystifying-digital-identity-for-all-1-2/

1. @aureliepols
Digital identities
Playing devil’s advocate: what could possibly go wrong?
Aurélie Pols – Ottawa November 2018
1

2. @aureliepols
Data Governance & Privacy Engineer
Data is the New Infrastructure – Privacy is the New Green – Trust is the New Currency
Dutch nationality, French mother tongue, works in English, lives in Spain
2
AURELIE POLS,
DATA GOVERNANCE
& PRIVACY ENGINEER
• Co-founder – Competing on Privacy
• DPO Customer Data Platform mParticle
• Ethics Advisory Group (EAG) – European Data Protection Supervisor (EDPS)
• Professor of Ethics & Privacy, Big Data & Analytics Master – Instituto de Empresa (IE), Madrid; guest lecturer DPO certification courses
Maastricht University & Solvay Brussels School, board member of European Centre on Privacy and Cybersecurity (ECPC)
• P7002 – Data Privacy Process – IEEE
• Speaker/writer/consiglieri: SWSX, Strata (+ Hadoop World), IAPP, Piwik Pro, AT Internet, industry associations, AdTech & MarTech
vendors, …
2003: OX2 Co-
founder
Webanalytics.be
2008: Sold to
Digitas LBi
(Publicis)

3. @aureliepols
Talked about this back in 2013
Prismatic identity Single identity policy?
3
Hint: there is case law
here in one of the
(obscure) German
länders

4. @aureliepols
Worlds are colliding!
Privacy by Design
lady
7 principles:
1. Proactive not reactive, preventive not
remedial
2. Privacy as the default
3. Privacy embedded into Design
4. Full functionality – positive sum, no
zero sum
5. End-to-end security – Lifecycle
protection
6. Visibility and transparency
7. Respect for user privacy
4

5. @aureliepols
Some family history
5

6. @aureliepols
What data can also reveal
6
Sounds familiar?

7. @aureliepols
Technology in trouble?
7
Facebook & Myanmar
Salesforce & ICE

8. @aureliepols
The most powerful LEGO blocks?
8
From Privacy Engineering Manifesto

9. @aureliepols
GDPR: 6 basis for lawful processing
Article 6.1:
(a) Consent => where conditions are laid out in art. 7
(b) Contract
(c) Compliance
(d) Vital interests
(e) Public interest
(f) Legitimate interest => NOT available to public authorities!!!!
(and requires a balancing test ie closer to a philosophical human rights essay
than a linear consent trail)
9

10. @aureliepols
Infamous art. 30: Records of processing activities
10
• Purpose classification • Consent trails and traceability
(including reverse engineering
between parties/legal entities)

11. @aureliepols
Key ideas
1. Identity for an individual but also as a household, part of a tribe
2. Human in the loop for “outliers”?
• Technology can NEVER define ALL possible use cases (revenge porn)
3. Consent is one of 6 lawful basis for data processing
• It goes together with purpose => classification?
4. Merging data:
• What happens with consent? For what? Which part?
• What happens with identifiability & PII/Personal Data/Personal Information?
(Sweeney: zip code + gender + date of birth= 80% of US population)
11

12. @aureliepols 12

13. @aureliepols
Followed by
• Once we get to accountability, we can revisit the obsolescence of consent
(the Chinese are already there) in light of IoT
• While recognizing that PII/Personal Data/Information is porous at best
• Because the rule of law is the most powerful LEGO block, it’s not
technology! (code is not law, it can’t be at this stage)
• My name is Aurélie Pols, I am a 3rd generation holocaust survivor and have
multiple identities. Views from the Privacy Engineering trenches,
free of disclaimers aka just my views and not any of my clients - European
at heart
13

14. @aureliepols
Thank you for
your attention
aurelie@mindyourprivacy.com
14