Change is coming. On May 25, 2018, the European Union will activate the next evolution of privacy laws, known as the General Data Privacy Regulation (GDPR). GDPR will introduce new requirements to ensure transparency of data collection, use and sharing by companies – as well as the right to obtain and control your own data and timely reporting of data breaches. Because of the global nature of information technologies and services, many aspects of GDPR will likely make their way into services within North America, bringing benefits to patrons on this shore as well. Join Daniel Ayala, one of the information industry’s leading experts on data privacy, for an overview of GDPR, its implementation timeline, and how it can help change the privacy landscape in America. Daniel will also suggest some practical ways for libraries to educate their patrons on privacy and teach them how they can help keep their personal data safe and secure.

1. Shore to Shore: How Europe's New Data
Privacy Laws Help U.S. Libraries
ALA Midwinter 2018 - 10 February 2018

2. About me…

3. Dilemma:
Data is being collected
everywhere, all the
time.
Source: https://www.domo.com/learn/data-never-sleeps-5

4. Privacy is dead
But still not very
good in the US
NOT YET

5. But first, a question…

6. Privacy is a basic human right.
In Europe.
http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679

7. 7
Increased territorial
scope
Consent
Breach notification
Right to Access
Right to be Forgotten
Data Portability
Privacy by Design
Data Protection
Officers
General Data
Protection
Regulation

8. 8
Cookies
Metadata
E-Marketing
Transparency
Analytics
Cookies
ePrivacy Directive

9. 9
25 May 2018General Data
Protection
Regulation
ePrivacy Directive

10. UsedwithpermissionfromTeachPrivacy

11. 4% of Global Turnover or €20M
11
whichever is greater
The cost of not dealing with GDPR

12. The work to comply is challenging and
complex…
…but having two standards would be even
more difficult.

13. European Global

14. It’s not just
consumer
services…

15. In the “paid for” apps world too…

16. Clearer definition of what
“personal” means LIKELY

17. Definition of
Security &
Privacy Controls.
Establishment of a
Data Protection
Officer
LIKELY
LIKELY

18. Data Protection by Design
LIKELY

19. Controllers, Processors and Data FlowsLIKELY

20. Data Portability, Right to Delete
PERHAPS

21. Explicit Consent
M
AYBE

22. Speedy Breach Notification
MAYBE

23. The data economy still exists wherever it can
But it will be changed forever by GDPR

24. Teach your patrons
well…
Updated
privacy
policies:
read them

25. Teach your patrons
well…
More
granular
controls:
set them

26. Teach your patrons
well…
Greater
control over
cookies:
use them

27. Teach your patrons
well…
Ways to ask
for info and
have deleted:
use it

28. Teach your patrons
well…
Someone
who owns
privacy:
contact them

29. 29
Security &
Privacy Utility
Balance

30. Trust

31. Foundational thinking 31
Data will always be collected
Collection !=
Privacy Violation
Serve the user!
Set principles for use
& sharing
If you collect it, use it wisely
and get rid of it when you’re done!
TRUST!

32. References
• https://iapp.org/news/a/explaining-the-gdpr-to-an-american/
• http://eur-lex.europa.eu/legal-
content/EN/TXT/?uri=CELEX:32016R0679
• https://www.nytimes.com/2018/01/28/technology/europe-data-
privacy-rules.html
• https://www.domo.com/learn/data-never-sleeps-5
• https://www.teachprivacy.com
• https://bit.ly/charlestonprivacy

33. ProQuest &
Ex Libris at
ALA
http://www.proquest.com/products-services/related/ALA-Midwinter.html
http://pages.exlibrisgroup.com/ala-midwinter-2018-landing-page