Privacy, GDPR and Ireland as a one stop shop

THE VIEW FROM GOOGLE: PRIVACY, GDPR AND IRELAND AS A ONE STOP SHOP

In his address, Mr Enright, Google’s Chief Privacy Officer, shares his perspectives on Google’s experiences of GDPR, almost one year on. He discusses lessons learned along the way, as well as sharing perspectives on how Google approaches privacy and data protection, and the importance of Ireland as a One Stop Shop.

About the Speaker:

Mr Enright was appointed as Google’s Chief Privacy Officer last year. He joined Google in March 2011, with nearly 20 years of experience in creating and implementing programs for privacy, data stewardship and information risk management. Prior to joining Google, Mr Enright served as the most senior privacy executive at two Fortune 500 online and offline retail enterprises.

The IIEA is Ireland’s leading European & International Affairs think tank. We are an independent, not-for-profit organisation with charitable status.

Our role is to identify key European and international policy trends, which will inform the work of Ireland’s decision makers and business leaders, and enrich the public debate on Ireland’s role in the EU and on the global stage.

Social media doesn’t need new regulations to make the internet safer – GDPR can do the job

Social media doesn’t need new regulations to make the internet safer – GDPR can do the job

Eerke Boiten, De Montfort University

From concerns about data sharing to the hosting of harmful content, every week seems to bring more clamour for new laws to regulate the technology giants and make the internet “safer”. But what if our existing data protection laws, at least in Europe, could achieve most of the job?

Germany has already started introducing new legislation, enacting a law in 2018 that forces social media firms to remove hateful content. In the UK, the government has proposed a code of practice for social media companies to tackle “abusive content”. And health secretary Matt Hancock has now demanded laws regulating the removal of such content. Meanwhile, deputy opposition leader Tom Watson has suggested a legal duty of care for technology companies, in line with recent proposals by Carnegie UK Trust.

What’s notable about many of these proposals is how much they reference and recall the EU’s new General Data Protection Regulation (GDPR). Hancock, who led the UK’s introduction of this legislation (though he has also been accused of a limited understanding of it) referred to the control it gives people over the use of their data. Watson recalled the level of fines imposed by GDPR, hinting that similar penalties might apply for those who breach his proposed duty of care.

The Carnegie proposals, developed by former civil servant William Perrin and academic Lorna Woods, were inspired by GDPR’s approach of working out what protective measures are needed on an case-by-case basis. When a process involving data is likely to pose a high risk to people’s rights and freedoms, whoever’s in charge of the process must carry out what’s known as a data protection impact assessment (DPIA). This involves assessing the risks and working out what can be done to mitigate them.

The important thing to note here is that, while earlier data protection laws largely focused on people’s privacy, GDPR is concerned with their broader rights and freedoms. This includes things related to “social protection, public health and humanitarian purposes”. It also applies to anyone whose rights are threatened, not just the people whose data is being processed.

Existing rights and freedoms

Many of the problems we are worried about social media causing can be seen as infringements of rights and freedoms. And that means social media firms could arguably be forced to address these issues by completing data protection impact assessments under the existing GDPR legislation. This includes taking measures to mitigate the risks, such as making the data more secure.

For example, there is evidence that social media may increase the risk of suicide among vulnerable people, and that means social media may pose a risk to those people’s right to life, the first right protected by the European Convention of Human Rights (ECHR). If social networks use personal data to show people content that could increase this risk to their lives then, under GDPR, the network should reconsider its impact assessment and take appropriate steps to mitigate the risk.

GDPR provides an existing remedy.
Shinonome Production/Shutterstock

The Cambridge Analytica scandal, where Facebook was found to have failed to protect data that was later used to target users in political campaigns, can also be viewed in terms of risk to rights. For example, Protocol 1, Article 3 of the ECHR protects the right to “free elections”.

As part of its investigation into the scandal, the UK’s Information Commissioner’s Office has asked political parties to carry out impact assessments, based on the concern that profiling people by their political views could violate their rights. But given Facebook’s role in processing the data involved, the company could arguably be asked to do the same to see what risks to free elections its practices pose.

Think about what you might break

From Facebook’s ongoing history of surprise and apology, you might think that the adverse effects of any new feature in social media are entirely unpredictable. But given that the firm’s motto was once “move fast and break things”, it doesn’t seem too much of a stretch to ask Facebook and the other tech giants to try to anticipate the problems their attempts to break things might cause.

Asking “what could possibly go wrong?” should prompt serious answers instead of being a flippant expression of optimism. It should involve looking not just at how technology is intended to work, but also how it could be abused, how it could go too far, and what might happen if it falls victim to a security breach. This is exactly what the social media companies have been doing too little of.

I would argue that the existing provisions of GDPR, if properly enforced, should be enough to compel tech firms to take action to address much of what’s wrong with the current situation. Using the existing, carefully planned and highly praised legislation is better and more efficient than trying to design, enact and enforce new laws that are likely to have their own problems or create the potential for abuse.

Applying impact assessments in this way would share the risk-based approach of enshrining technology firms with a duty of care. And in practice, it may not be too different but without some of the potential problems, which are many and complex. Using the law in this way would send a clear message: social media companies should own the internet safety risks they help create, and manage them in coordination with regulators.The Conversation

Eerke Boiten, Professor of Cybersecurity, School of Computer Science and Informatics, De Montfort University

This article is republished from The Conversation under a Creative Commons license.

Venezuela: region’s infectious crisis is a disaster of hemispheric proportions

Venezuela: region’s infectious crisis is a disaster of hemispheric proportions

Martin Llewellyn, University of Glasgow

Over the last two decades, Venezuela has entered a deep socioeconomic and political crisis. Once recognised as a regional leader for public health and disease control, Venezuela’s healthcare and health research infrastructure has fallen into a state of collapse, creating a severe humanitarian crisis and a major outbreak of infectious disease.

This week, we published the first comprehensive assessment of the vector-borne disease outbreak that is assailing the country. Vector-borne diseases are those spread by insects – mosquitos, sand flies, kissing bugs and others. The “we” is a global consortium of authors, many of whom are Venezuelan doctors and academics working in the country under exceptionally difficult conditions. Others include Colombian, Brazilian and Ecuadorian academics who are witnessing the crisis unfold: Venezuelan refugees on the streets of their cities, diseases (malaria, Chagas disease, measles, diphtheria) spreading through porous land borders, and regional disease outbreaks of unprecedented proportions.

I first travelled to Venezuela in the early 2000s to study Chagas disease, a single-celled parasite spread by the kissing bug, a blood-sucking insect that infests the walls of adobe houses. Chagas disease is a silent killer. Once infected, the parasite can lie dormant for decades in its human host before causing fatal heart disease in middle age.

Kissing bug: spreader of Chagas disease.
schlyx/Shutterstock

You can’t travel to Venezuela, including to the communities where I worked in the Llanos (plains) of the west, without being entranced by the beauty of the landscape and the friendliness of its people. From the laboratory in the Institute of Tropical Medicine in Caracas, where I was taken under the wing of Professor Hernan Carrasco and his team, dancing salsa between the benches on a Friday night, to the villages where we slept under the stars in hammocks while the inhabitants sang joropo music, it is a thoroughly welcoming place.

Venezuela is also a place of extreme inequality. You only have to look up from the glitzy streets of downtown Caracas to the mud and brick ranchos clustered on the hillsides above to appreciate that. It is this inequality that drove the socialist revolution, and while times were good – and oil prices high – much of Venezuela’s wealth found its way into the hands of those who needed it most. Declining oil prices, corruption and mismanagement have changed all that. Alongside economic collapse has come a collapse in basic healthcare, an exodus of medical professionals, and a massive upsurge in disease.

Fragmented information

At the core of the infectious disease crisis in Venezuela is the lack of reliable data. Either through denial, a lack of resource, or both, the Venezuelan state is reneging on its responsibility to report on the extent of current outbreaks. The purpose of our recent review was to draw together fragmented information from Venezuelan civil societies, researchers, international organisations and neighbouring countries to get the best estimate of what is actually going on. Over 400,000 cases of malaria in 2017, 15% of the rural population infected with Chagas disease, surging dengue, Chikungunya and Zika infections. The picture is grim.

Health is highly politicised in Venezuela and working as a researcher is not without risk. My collaborators have been threatened with jail and having their medical licenses suspended simply for reporting outbreaks in the scientific literature. The Institute of Tropical Medicine where I worked has been raided by colectivos (community organisations that supports the Venezuelan government), microscopes smashed, medical records destroyed, hard drives ripped out of computers.

The centre of the current malaria epidemic in southeastern Bolivar state is also the centre of state-sponsored illegal gold mining in Venezuela. The tonnes of gold recently shipped by the Maduro regime to Russia and Turkey is soaked in the sweat and blood of poor Venezuelans, sleeping with their families beside mosquito-infested mining pits. Drawing attention to this malaria epidemic is drawing attention to the ecological and humanitarian disaster in this region where mercury is polluting pristine rivers and thousands are dying for want of antimalarial drugs that the government will not or, more likely, cannot supply.

Illegal gold mining in Bolivar state.
Author provided

Venezuelans are resilient and resourceful people. The Venezuelan researchers still living and working in the country are a testament to that, as is the support they receive from the diaspora of Venezuelans forced to live abroad. In recognising the regional aspect to the crisis, the spillover of disease in the region and the millions of refugees, we hope our review will galvanise international organisations to act. I’m optimistic that we are reaching a turning point in a crisis ten years in the making. I fervently hope the spirit of Venezuelans will break through. I hope that scientists will dance salsa again – and soon.The Conversation

Martin Llewellyn, Senior Lecturer, Institute of Biodiversity Animal Health & Comparative Medicine, University of Glasgow

This article is republished from The Conversation under a Creative Commons license.

Why the new Arctic ‘Cold War’ is a dangerous myth

Danita Catherine Burke, University of Southern Denmark

All too often the Arctic region is portrayed as an area on the cusp of military crisis. This is an easy narrative to sell; it harks back to the Cold War. Potent imagery persists of submarines trolling silently beneath the Arctic ice and nuclear ballistic missiles pointed across the North Pole.

During the height of the standoff between NATO and the USSR, the world feared a barrage of nuclear warheads streaming in from the frozen north – and this experience has imprinted on the collective imagination and created distinct ideas about the region. This fear, for example, motivated from the 1950s the construction of the Distant Early Warning (DEW) Lines, a system of radar stations across the northern US (Alaska), Canada, and Greenland. The DEW Lines were meant to give the US and its NATO allies an early warning of an incoming Soviet nuclear strike.

The Cold War was a significant period in history. But catchy headlines playing off the parallels between the region and a new “cold” war are misleading. There have, of course, been increased tensions between the West and Russia since 2014 due to the conflict over Ukraine and Crimea. The 2018 Trident Juncture exercises in the Arctic, featuring “50,000 personnel from NATO Allies and partner countries”, are evidence of this. But the tension is not Arctic-specific and militaries are diverse actors in the region. This nuance, however, is often overlooked.

Current military exercises and equipment acquisitions fuel old Cold War perceptions. And a certain militarisation is indeed occurring in the Arctic. Russia, for example, has recently invested heavily in updating its northern military infrastructure. So too have other Arctic states, such as Canada and Denmark. But military activity has, to varying degrees, occurred for decades in the north – it was just largely ignored by those not living there until recently.

What’s changed?

The Arctic states guard their land and waterways through aerial, submarine and surface ship patrols, much as they have done for years. This hardly constitutes an escalation of military tensions, even if the infrastructure is being updated and, in some cases, increased. Despite this, talk of a new Cold War is heating up.

A nation’s armed forces often play a range of roles – beyond their traditional responsibilities in armed conflict. They are useful for rapid response during disasters, for example, and provide a range of security roles that don’t necessarily mean an escalation to war. They offer search and rescue (SAR) services and policing support.

In Norway, for example, the coastguard is one of the branches of the navy, along with the armed fleet, the naval schools and the naval bases. In Denmark, meanwhile, the coastguard’s Arctic activities are managed by the Royal Danish Navy.

In Canada, the coastguard is a civilian organisation. It “is the principal civilian maritime operational arm of the government of Canada”. But it also works closely with the Department of National Defence to provide Canada’s search and rescue services, including aerial support.

The US coastguard is part of the Department of Homeland Security, which “secures the nation’s air, land, and sea borders to prevent illegal activity while facilitating lawful travel and trade”. By law, however, the US coastguard is outside the Department of Defence “in peacetime and is poised for transfer to the Department of the Navy during war”.

Because of affiliations such as these, the line between military and civilian activity can become blurred. But that doesn’t mean all military activity is hostile or equates to an escalation towards war.

Changing environment

Climate change and technological advances have begun to open up the Arctic. And this means that more policing is required in a region that is remote and often out of reach for traditional police forces.

Other issues are also arising from climate change, such as increased forest fires. In July 2018, Sweden suffered major forest fires. As part of its effort to combat the fires it deployed “laser-guided bombs to douse forest fires”. This initiative was led by the Swedish air force. By using laser bombs, the “shockwaves simply blew out the flames in the same way our breath does to candles”.

As the region’s economic activity expands, armed forces are also being asked to assist more with civilian issues. In 2017, for example, the Norwegian coastguard was called in by local police in Tromsø to help police Greenpeace protesters who had entered a 500-metre safety zone around the Songa Enabler rig in an effort to stop drilling in the Korpfjell field of the Barents Sea. The Norwegian coastguard vessel, KV Nordkapp, responded, resulting in the seizure of Grenpeace’s Arctic Sunrise ship and the arrest of all 35 people on board.

Given the Arctic’s growing economic potential, military infrastructure is getting more attention. Russia, in particular, has made it clear that with economic potential on the line in the Arctic, a military build up is essential. For Russia, Arctic resources are central to the country’s economic security so the government line is: “National security in the Arctic requires an advanced naval, air force and army presence.” But issues of national security are wide ranging and are not solely a matter of building capacity to defend oneself from or in war.

Overall, it is vital to remember that while militaries are tools of war, they are not just tools of war. They also contribute to and provide a wide range of security services. This does not mean that increased military spending and activities should not be viewed with a critical eye. Indeed, they should. But discussing “a new Cold War” is sensationalist. It detracts from the broader roles that militaries play throughout the Arctic and stokes the very tensions it warns of.The Conversation

Danita Catherine Burke, Marie Skłodowska-Curie Individual Fellow, Centre for War Studies, University of Southern Denmark

This article is republished from The Conversation under a Creative Commons license. Read the original article.