Privacy in the Digital World: Beyond Compliance, Towards Trust

PRIVACY IN THE DIGITAL WORLD: BEYOND COMPLIANCE, TOWARDS TRUST www.wavestone.com

Wavestone is a new consulting brand, formed by the merger of Solucom and Kurt Salmon’s European business (excluding Consumer Goods and Retail Consulting activities outside of France) in 2016. Wavestone’s vision is to enlighten and guide our clients in their strategic, value-adding decision-making by capitalising on our functional, industry and technological expertise. Our firm combines the expertise of 2,500 people across 4 continents. Wavestone is also the first truly independent consulting firm in France.

2 EDITORIAL

Digital data is now a key tool for all organisations. The emergence of new technologies makes it possible to process increasing amounts of data and extract “Data is at the heart of more of the associated benefits. the digital revolution. However, such capacities also spark fear among citizens and regulators, which must be taken into account in order to ensure Trust and transparency the success of digital transformation. will be key factors for In this context, the principle of privacy is evolving, as is the role it can play in cur- enabling its success” rent digital transformation.

At Wavestone, we believe it is crucial that both private and public organisations know how to use and handle personal data in order to become digital champions, whilst maintaining a relationship of trust with their employees and customers. For us, transparency is pivotal for maintaining this relationship of trust.

In this publication, we have sought to shed light on the various facets of this complex subject. In so doing, each organisation may determine its own position in the face of privacy challenges in the digital world. FRÉDÉRIC GOUX Enjoy! Partner

3 AUTHORS

Alessandro Zamboni Gérôme Billois Alessandro is a Senior Manager and Gérôme is a Senior Manager in Cybersecurity leads evaluations and impact analyses of and Digital Trust. He leads large-scale digital European public policies. Alessandro is transformation and compliance programmes a graduate of Politecnico di Milano and for major organisations. He is a board Executive Master post-graduate at the member of the CLUSIF, co-creator of the Solvay Business School. He began his Club27001 and member of the committee career at General Electrics in Hungary of regulation for information protection and the Netherlands. and information technologies. He is an [email protected] engineering graduate from INSA Lyon. [email protected] @gbillois

Raphaël Brun Raphaël is a Manager in Cybersecurity Youri Dufau-Sansot and Digital Trust and has been working Youri is a Masters graduate in International in data protection for many years. He Security from Sciences Po Paris and is a leads projects in personal data protec- Cybersecurity and Digital Trust consultant tion, regulatory compliance and business at Wavestone. He has worked on projects in or cybersecurity crisis management. ISO personal data protection compliance with 27001 Lead Auditor certified, he is a grad- the new European regulation (GDPR), as uate of the University of Technology of well as business and cybersecurity crisis Troyes (UTT). management exercises. [email protected] [email protected]

We would like express our sincere gratitude to Tine A. Larsen and Milad Doueihi for having provided us with two interviews for this publication. We would also like to thank Armand de Vallois, Jean-Christophe Procot, Hervé Commerly, Pauline Rouaud and Julien Douillard for their contributions to this document.

4 SUMMARY

06 Preface

What does privacy mean in a digital world? 08 An exclusive survey conducted by Wavestone

Which legal frameworks should be implemented on 22 an international scale?

Respect for privacy in digital transformation: 30 key challenges and principles

44 The future of digital privacy

5 Privacy in the digital world: going beyond compliance and making a success of your digital transformation

6 PREFACE

In this publication, we seek to provide We hope that our insights will enable large readers with an understanding of the organisations to confront the challenge of concept of privacy in the digital age, privacy in a digital world by aligning their both from a general public and regulatory programmes with the increasing expecta- perspective. tions of states and citizens.

1 2

IN A DIGITAL WORLD, WHAT LEVEL WHICH LEGAL FRAMEWORK AT OF PRIVACY? AN INTERNATIONAL LEVEL?

We used a survey to ask this question to citizens, Protection of personal data is now regulated whether European, American or Chinese. throughout the world and is increasing Overview of the results of this survey, followed exponentially. by the first part of the interview of Milad Doueihi, Overview of the main approaches, supplemented philosopher. by an interview with Tine A. Larsen, President of the Luxembourg regulator.

4 3

WHAT ARE THE NEXT RESPECTING PRIVACY IN DIGITAL CHALLENGES ? TRANSFORMATION: KEY CHALLENGES AND PRINCIPLES Personal data will be at the heart of the Based on the analysis of concrete projects in next digital evolutions, especially through different business areas, we provide the keys to algorithms. implement a strategy of trust and transparency with Such evolutions must be anticipated now, and end clients and consumers. are at the core of our consideration enriched The breakdown is illustrated by the testimonies by the second part of the interview of Milad of Armand de Vallois, Jean-Christophe Procot and Doueihi, philosopher. Hervé Commerly, experts from Wavestone.

7 WHAT DOES PRIVACY MEAN IN A DIGITAL WORLD? AN EXCLUSIVE SURVEY CONDUCTED BY WAVESTONE

In the digital world, citizens, irrespective of their country of origin, are increasingly concerned about respect for their privacy. They trust few organisations; namely traditional players such as banks. Their most important priority? Having control over the data they entrust. Their biggest fear? New technologies leading to a world of increased surveillance.

8 AN INTERNATIONAL SURVEY ABOUT HOW Among the majority of respondents were CITIZENS PERCEIVE PRIVACY younger generations, often perceived as “digital” citizens and more intrigued by the The results presented in this paper form subject of privacy in a digital world. a synthesis of the survey as a whole. Detailed results and analysis are available on: www.wavestone.com/insights A CONSISTENT VISION ON AN INTERNATIONAL SCALE The results of this survey should not be viewed as scientific evidence. Rather, it The countries selected for the survey, is representative of global and national namely France, Italy, Germany, China, the trends in the perception of privacy by United States and the United Kingdom, individuals. The survey considers the were selected on the basis of their responses of 1,587 participants, between socio-economic environments and the July and August 2016, across 6 countries. diversity of regulatory frameworks concerning privacy protection. These elements can influence the perception and Panel overview opinion of citizens regarding the protection of personal data.

However, despite initial contextual differences, we observed through collected responses that the theme of privacy is 1587 Collected In perceived in a relatively similar way questionnaires within 4 weeks 6 countries across the surveyed countries. Que signifie aujourd’hui la vie privée dans le numérique ?

GENDER AGE NATIONALITY –31 +31 18% 19% 16%

47% 53% 61% 39% 16% 16% 15%

9 Indeed, there are differences and partic- FROM FREEDOM TO CONTROL: ularities: notably in how German respon- EVOLUTION OF THE MEANING OF dents place particular importance ahead “PRIVACY” of their counterparts on the definition of privacy relating to personal freedom. Privacy is traditionally seen as the possi- Responses from the United States demon- bility for an individual to retain some form strate less confidence in public institutions. of anonymity in his or her activities and to have the ability to isolate oneself in order Generally, however, there is greater global to best protect his or her interests. It is awareness among individuals about pri- intimately linked to the notion of freedom. vacy and personal data topics. This can be explained by the borderless nature of However, analysis of the survey results data and the digital world, with the digital shows that this notion tends to disappear citizen expecting his or her privacy to be in favour of the control of information. respected regardless of borders. We have proposed to our respondents to This observation reinforces the importance select one or more definitions that relate of respecting privacy in digital projects, to either notion. regardless of the country and population in question.

What is yourWhat definition is your definition of privacy of today? privacy today? (Figures correspond(Figures tocorrespond the number to theof persons number whoof persons selected who each selected answer) each answer)

China FranceChina GermanyFrance Germany 1092 1092 1012 1012976 976 Italy UnitedItaly KingdomUnited KingdomUnited States United States 858 858 732 732 537 537520 520

16 16

Have control HaveNot havingcontrol to NotHave having control to HaveNot control being NotHave being "your" HaveNot "your" being NotNot being being Not Otherbeing Other over who can getover disclose who can what get discloseover the what type of overobserved the type orof observedmoments, or on moments,monitored on at monitoredsystematically at systematically information youinformation consider to youinformation consider to informationdisturbed by disturbedyour own, by yourthe own, oce theidentiﬁed oce in identiﬁed in about you beabout a matter you of becollected a matter about of collectedothers about withoutothers being without being public spaces public spaces privacy against privacyyou against you monitored by monitored by your will your will others others

Control Control Freedom Freedom > 60% > 60% < 40% < 40%

10 It is also important to provide customers Providing stakeholders and employees with assurance that they have control over their data. This is possible by providing individuals with simple with the feeling that and autonomous means of access.

they are in control ALL PERSONAL DATA ARE VIEWED AS of their data is SENSITIVE IN THE EYES OF CITIZENS When questioned about the level of sensi- imperative tivity, the panel showed slight differences in their responses. Citizens considered most of the proposed types of data as The most frequently selected responses sensitive. They did not perceive that relate to control. This pattern is confirmed leakage of certain data types could have by observing the intermediate proposals. serious or even irreversible consequences For example, “having control over the type (e.g. health data), in contrast to other data of information collected about you” is a types (e.g. financial data), for which most more widely selected response (more than countries have already implemented reg- half) than “having moments alone, with- ulatory frameworks which protect individ- out being monitored by others”, relating uals (for example, rapid reimbursement in to freedom. the event of fraud).

According to you, what are the most sensitive data ? (rating from 1 to 5)

4,13 4,02 3,96 3,87 3,87 3,85 3,83 3,83 3,28 3,14

0,45

Financial Health Personal Behavioural Contact Family Data on Localisation Audio or Lifestyle Other data data data data details status devices and data video data data (name, age) data IT network used

11 This demonstrates that, regardless of the data for previously authorised use. type of personal data handled by a proj- We can differentiate between three main ect, special attention must be given at groups of actors. Firstly, the actors grouped least to the communication of protection under the category of “institutions” command levels. the highest level of trust among respondents. TRUST VARIES GREATLY FROM ONE // This includes public institutions, SECTOR OF ACTIVITY TO ANOTHER semi-public institutions or entities from the traditional economy with We asked respondents to indicate which which individuals have historically type(s) of organisation(s) they trusted the shared a relationship of trust. This is most with regard to using their personal particularly the case given how such

Which organisations do you trust?

51% 45% China France Germany

Italy United Kingdom United States 34% 29% 24%

14% 13% 13% 11% 10% 9% 6% 5%

Banks Medical Public Payment/ Insurance Energy Transport Tele- Local Other Web Technolo- Social organi- organi- credit compa- suppliers operators comm- shops or companies gical media sations sations card nies unication online companies companies operators shops

Banks, Health, Public institutions, Energy, Transportation, Web companies, Social media, Credit card providers, Insurance Telecoms, Retail Technological companies More than 25% Between 10 and 20% Less than 10%

12 institutions have processed sensitive data throughout their history (medical data, etc.). We also find significant differences within this category, with more than half of respondents claim- The social media ing to trust banks with the processing of their data. Image and reputation paradox: lowest in are therefore crucial for banks, which serve to meet customer expectations confidence but highest in the aim of retaining their position as the number one trusted partner. in use

// Secondly, an intermediate category encompasses the actors of daily life such as transport operators and // Mistrust towards such companies can energy suppliers. Such B2C actors be attributed to the amount of data carry out swift digital transformation they collect and use on individuals, as and benefit from the existing relation- well as recent high-profile prosecu- ship of trust. tion cases related to such use.

// Thirdly and finally are actors in the However, this result reveals a paradox. digital economy, whether web giants Despite this evident lack of trust, indi- or technology firms. viduals continue to frequently use the services provided by these actors, due in part to a lack of alternative, as well as the information entrusted seeming to be, often Banks are the number wrongly, harmless and insignificant in the eyes of the individual. one trusted partners - a place to be cherished!

13 NEW TECHNOLOGIES RAISING FEARS

The panel highlights four technologies most likely to put their privacy in danger, according to respondents. What do they all have in common? Making it possible to collect data without this activity being under the control of the persons concerned. This would, for certain individuals, equate to a form of surveillance.

On the other hand, technologies which Although not traditionally thought of as provide citizens with the ability to choose “sensitive”, data on individual behaviours the data they share, such as connected and actions are now viewed as a signifi- objects or Cloud services storing private cant stumbling block between customer information, are considered less risky in expectations about the respect for pri- terms of privacy and therefore do not fea- vacy and the increasingly personalised ture as any of the four technologies. customer relationship.

In your opinion, which technologies can threaten your privacy? (rating from 1 to 5, from the least to the most threatening)

Public WIFI Drones recording images, Technologies for capturing Cameras recording images, to surf on the videos and sounds in a moods, opinions and how videos and sounds in a Internet public space, and the people behave when using public space, and the behavior of people Internet behavior of people

3,87 3,79 3,78 3,75

14 CITIZENS WHO TAKE ACTION // Measures to improve the security TO PROTECT THEIR DIGITAL of the data provided: increasing the PRIVACY level of security of online accounts such as strengthening passwords, More than half of respondents claimed changing passwords regularly, check- that they had made certain changes to ing access rights and being more their online behaviour in order to better attentive when sharing personal protect their data. This illustrates a height- information over the Internet… ened level of awareness by individuals concerning the protection of their privacy. // In addition to such measures, we find more extreme solutions. This ranges It is worth analysing how the means indi- from the complete closure of accounts viduals take to ensure such protection. Our on social networks, exclusive use of respondents described the measures they trusted and tested sites or technolo- took, divided into two categories: gies, to deleting history and cookies // Measures to limit the amount/ with every use of search engines. type of data provided: provision of While these individual initiatives can con- inaccurate/incomplete information tribute to increasing the protection of when creating an account, such as privacy, they may conflict with new uses the use of a nickname or discarding and innovation promoted by organisations, non-mandatory fields or the use of thus limiting or even preventing the per- anonymous accounts... sonalisation of the customer relationship.

Over the last years, have you changed your behavior to better protect your privacy and limit the sharing of your personal data?

Yes 10 %

52 % No 38 %

Don’t know/No opinion

15 FOCUS OF THE SURVEY

Are you concerned about your privacy? All respondants

6% 19%

75%

By country 307 283 253 252 247 245

81% 53% 97% 65% 72% 78%

35% 27% 2% 14% 24% 19% 1% 5% 12% 8% 4% 3% China France Germany Italy UK US

Yes No Don’t know/No opinion

Respecting privacy is a concern for three-quarters of respondents. Chinese respondents were by far the most concerned about the subject (97%). The United States and France share similar responses to this question despite different visions on the subject. Germans seem less worried about the @gbillois topic, 35% of them don’t feel concerned about their privacy, which contrasts from their other answers. Opinions were more dubious on this question in Italy and the United King- dom.

100

80 16 60

0 Chine France Allemagne Italie Royaume-Uni États-Unis To what extent do you feel that you have control All respondants over your private information? 4% 11% 17%

68% By country 307 283 11% 8% 253 252 247 245 11% 16% 13% 6%

70% 68% 54% 75% 72% 68%

36% 17% 17% 12% 9% 13% 5% 4% 3% 4% 6% 3% China France Germany Italy UK US

No control at all Partial control Complete control Don’t know /No opinon

Generally, respondents estimate that they only have partial control over their personal information. The proportion of respondents thus represent a markedly120Chine similar percentageFrance inAllemagne five of the countriesItalie surveyedRoyaume-Uni (betweenÉtats-Unis 68% in France and the United Kingdom and 75% in Germany). The United100 States is to be analysed separately, insofar as more than a third of respondents claim to have complete control over their personal information.80 60 40 20 0

17 In general, do you think that public or All respondants private organisations use the information you provide only for a purpose you have authorised ? 20% 30%

50% By country 307 283 20% 253 252 247 245 17% 48% 21% 29% 49% 64% 59% 59% 45% 37% 35%

26% 15% 16% 24% 21% 16%

China France Germany Italy UK US

Yes No Don’t know/No opinion

A first group stands out, more than 60% on average of French and Italian respondents join their German counterparts in claiming not to trust that organisations use their data exclusively for the purposes announced at the time of collection. Even if they entrust them with their data These responses contrast with those of Chinese and American respondents, who demonstrate a stronger tendency to trust public and private organisations. It should also be noted that this is a complex issue for several respondents. Thus, one in five respondents are not commenting.

Chine France Allemagne Italie Royaume-Uni États-Unis To what extent do you agree that existing laws All respondants provide a reasonable level of protection for your privacy? 2% 7% 15% 18%

36% 22%

By country 307 283 3% 253 29% 252 247 245 5% 7% 43% 6% 27% 33% 35% 43% 27%

28% 43% 37% 31% 21% 28% 25% 17% 12% 11% 19% 5% 10% 6% 7% 7% 10% 6% 4% 3% 3% 2% 5% 2% China France Germany Italy UK US

Fully agree Somewhat Neither agree Rather Fully Don’t know/ agree nor disagree disagree disagree No opinion

This question triggered a wide range of responses among the respondents. Half100 (51%) of respondents somewhat or completely agree with the sta- tement that existing laws protect their privacy, while one-quarter (25%) somewhat80 or completely disagree. Almost a quarter (22%) of respondents were unable to decide. More60 than two-thirds of Chinese (80%) and US (70%) citizens somewhat or completely agree, whereas in both countries, national regulations are less developed than in Europe. 40 About one-third (38% and 31% respectively) of citizens in France and Ger- many tend to somewhat or strongly disagree, underlying the need for even more20 regulation. 0

19 INTERVIEW WITH Milad Doueihi, philosopher

The first part of our interview with Milad So the challenge of today would be to Doueihi, American philosopher and Chair redefine the notion of a private life in of Digital Humanities at Paris-Sorbonne a digital world? University, placing privacy in the context Yes. It is interesting to redefine because it of a more global evolution of digital cul- has been subject to many modifications. ture and its impact on privacy. Some studies show that adolescents, at Is the notion, or indeed value, of a particular moment in time, agreed to share more information which their par- private life still relevant today? ents would have considered as private. It is relevant, but not as we understand it. Gradually, behaviours of this type have Private life does not carry the same mean- become more commonplace. What would ing as in the past, even the recent past. be interesting to see would be embedding What has changed, with social networks this alteration of private life into the alter- or the Internet in general, is the scale of ation of digital data itself. metadata and logs. Such evolutions in digital technology, There is a massification in the production of data and this data is now analysed to as you mentioned, involve progressing identify, to follow – that is not to say to spy from a fixed digital culture to one of on – people. Thus, the cultural landscape mobility in which people enter the in which we go about our private lives and public space and interact with others. the way that individual, public and collec- Has such evolution also changed our tive actors perceive it, has changed. relationship to others and our own private lives? Absolutely. Mobility can be interpreted in different ways. Firstly, there is essential type of mobility through transitivity

Find the full interview on our website: www.wavestone.com/insights

20 Returning now to the notion of digital identity, it was introduced by the digital revolution and can be “There is a massification in differentiated from civil identity. Has this changed our relationship with the production of data and others and has it redefined what we are this data is now analysed willing to share about our identities? The first phase of digital identity was to identify, to follow – that straightforward: aggregation of our is not to say to spy on – online presence. However, due in part to mobility, the massification of data people.” and the emergence of digital sociability has evolved. We have witnessed a para- digm for personalised recommendations, which harness the elements of the digi- between support and tools. We see this tal identity. This modifies the context of today with a kind of continuity (moving social or economic pertinency, shifting from a tablet to a phone to the computer) how we view and understand confidence which did not exist previously. Secondly, a and trust. It is one of the most important significant amount of data and metadata success factors which arise with this new logs contain geo-location information, form of digital identity. The association of transmitted by mobile phones. Finally, the tabular choices, suggested by algorith- third type of mobility could be related to mic platforms deriving their choices from platforms which collect data. This is the the analysis of interactions, will produce case for the Cloud, for example, which recommendations. We therefore witness complexifies jurisdication surrounding the a shift from an era defined by measure- framing of data, calling the need for super- ment to an area of social precision, of vision of data transfers through devices pertinence. This modifies the perception such as safe harbors or privacy shields. of our relationship to others.

21 WHICH LEGAL FRAMEWORKS SHOULD BE IMPLEMENTED ON AN INTERNATIONAL SCALE?

Since the introduction of digital privacy in legislative literature, regulations have become increasingly stringent. The European Union is the engine driving this trend with the General Data Protection Regulation (GDPR), although other countries have not faltered behind as we witness a global effort in establishing regulation for the handling of personal data.

22 AN INCREASINGLY INTERNATIONAL Sweden was the first state to establish leg- REGULATORY FRAMEWORK islation on the subject in 1973. In France, the “Loi Informatique et Libertés” was The concept of privacy, as understood enacted in 1978, following debates over in history, can be understood across the Safari project, aimed at creating a several centuries of legislation. It began centralised database of information about taking shape in 1948, inscribed in Article individuals. 12 of the Universal Declaration of Human Without reviewing each national law and Rights: “No one will be the object of arbi- its timeliness, an analysis of the initiatives trary interference in his private life (...). implemented on regional scales provides Everyone has the right to be protected by a holistic view of the main privacy trends. law against such interference or attacks”.

Regulation around the protection of per- EUROPEAN UNION: THE STATE sonal data is a more recent phenomenon. PROTECTING ITS CITIZENS It is directly linked to the development of The European Union was the first institu- information technology and the increased tion to establish legislation on the subject collection of data by organisations. In in 1995 with the publication of Directive addition, the market value of data adds 1995/46/EC. This first attempt at creating a further layer of complexity with the legislative harmony on an institutional and emergence of an international regulatory European scale has been followed by the consensus. implementation of numerous principles,

Entry into force: 25th May 2018 MAIN OBLIGATIONS General Data Protection Responsability STRENGTHENING EXISTING MEASURES Regulation Single Data protection point of contact by design

Fines up to €20 million or 4% The regulation “lays down Data violations of global turnover the rules on the protection of reporting individuals regarding the processing of personal data by institutions and Consent Data protection bodies of the Union and on the free Portability delegate movement of such data.” ? Right to oblivion

23 defined in the law of various Member take place in e-privacy in the near future, States, including the establishment of aligning traditional requirements on pri- supervisory authorities. This legisla- vacy with more recent developments and tion is rooted in the “Guidelines for the innovation, thus addressing the topics of Protection of Privacy and Transborder secrecy and correspondence in the digital Flows of Personal Data” published by the age. Through such literature, the European OECD in 1980, which were non-binding. Union will adopt the position as a protec- tor of citizen data. In April 2016, the European Union elected to strengthen its legislation with the General Data Protection Regulation US: MAKING PEOPLE AWARE OF THEIR (GDPR), which, unlike the 1995 directive, RESPONSIBILITIES will be directly applicable in the law of the There is no specific regulation nor regu- Member States of the European Union. lator within American law which oversees Its implementation is planned for May the collection and use of personal data at 2018, when organisations must ensure a federal level. Instead, the United States their compliance with the requirements operates under a combination of laws of the regulation. Developments will soon

24 ensure the protection of data transfer In 2016, the United States between the EU and the USA until October 2015, thereafter invalidated by the Court and the EU drew up a new of Justice of the European Union (CJEU). According to the CJEU, the level of data arrangement, the Privacy protection offered by the United States was no longer satisfactory in light of the Shield, designed to offer information leaked by Edward Snowden better protection for data regarding the global surveillance programme operated by the American gov- transfers ernment. In February 2016, the United States and the EU drew up a new arrangement, the Privacy Shield, which came into force in August 2016 and is designed to which apply to certain sectors or states. offer better protection for data transfers. Some regulation covers specific categories of personal data, such as financial data or ASIA: A SITUATION UNDER health-related data, while others regulate DEVELOPMENT activities which exploit such data, such as digital marketing. In addition to such With respect to data protection, we can regulations, best practices developed by categorise Asian countries and territories federal agencies and industrial groups in two ways. Some are relatively mature are also used as a means of auto-regu- on the subject, including South Korea, lation. The Fourth Amendment of the US Singapore, Hong Kong or Taiwan. Until Constitution can also be referenced for recently, China did not have any spe- the protection of personal privacy. Finally, cific personal data protection legislation. laws around consumer protection, while However, in November 2016, new regula- they do not regulate personal privacy, tions applicable to operators from June forbid practices around the disclosure of 2017 were implemented. This new regu- personal data. Nevertheless, American lation will integrate widely agreed princi- citizens display a certain degree of flex- ples on respecting personal privacy and ibility regarding the distribution of their will require the storage of personal data personal data. on Chinese territory.

As shown by the evolution of “Safe On the other hand, other countries in the Harbor”, differences exist between the area are yet to implement regulations American and the European vision. This regarding the protection of personal data legal mechanism was implemented to on a large scale, despite on-going debates.

25 REST OF THE WORLD: REGIONAL Arabia do not have specific legislation INITIATIVES UNDER DEVELOPMENT regarding the protection of personal data. Specific to these countries is the applica- In Africa, the first legislation on the sub- tion of Sharia law, stating that damage can ject was implemented in 2001, in Cape be claimed if the disclosure of personal Verde. In 2004, Burkina Faso was the first data leads to abuse or damage. state to establish a national regulator. In South America, several countries imple- At the regional level, the African Union ment independent regulators. Moreover, Convention on Cybersecurity and Personal they benefit from constitutional guaran- Data Protection, signed by 18 countries in tees regarding personal data protection. 2014, incorporates notions derived from This is particularly the case in Uruguay European legislation, with no legal binding. and Argentina, two countries recognised In the Middle East, states such as the by the European Union as providing suffi- United Arab Emirates (UAE) and Saudi cient levels of data protection.

Countries of the EU or the EEA Considered as acceptable by EU Independent authority and law(s) With a legislation No laws Source: Cnil. Source:

26 INTERVIEW WITH Tine A. Larsen, president of the National Commission for Data Protection (NCDP) of Luxembourg

How has the role of a supervisory authority In your view, why have the topics of like the NCDP evolved over the past few privacy and data protection become so years? Will the role change again under the important for the general public over the new GDPR? last few years? The role of the NCDP is constantly evolv- With the “computerisation” of our society ing as it must address the changes driven over the last two decades, the develop- by developments in information tech- ment of blogs and social networks and nology. The last 15 years have witnessed the internationalisation of nominative the emergence of social networks, Cloud data flows have radically changed the computing and an exponential increase in game. The exchange of personal data has collected data. It is now easier than ever to become a global phenomenon, corpo- acquire the necessary IT resources to pro- rate IT infrastructure is increasingly out- cess such data. The NCDP must adapt its sourced to the Cloud and the Internet is role when facing these new challenges. In the most widely used tool in our daily lives. addition, citizens are more and more con- Moreover, the volume of personal data has scious of their rights and the necessity to witnessed an explosion indicated by the better protect their privacy in an increas- unprecedented rise of data storage cen- ingly digital world. The new European reg- tres across the world. The development of ulation reinforces the supervisory role of new technologies such as artificial intelli- the NCDP, allowing the NCDP to stricter gence and data mining techniques will also impose administrative fines which must considerably increase data processing and be effective, proportionate and deterrent. analysis capabilities.

Find the full interview on our website: www.wavestone.com/insights

27 From a citizen point of view, if you ask a for the protection of personal data (suc- young person what is their most important cessor to the working group of “Article 29” possession, the majority will answer “my established in the 1995 directive) will har- smartphone”. This object, coupled with monise the application of the regulation data servers hosted across the Internet, inside the European Digital Single Market. holds information about most aspects of their lives and the associated data. Citizens What should we retain from GDPR and wish to benefit from services generated by the main developments it brings to the global collection of data (personalised citizens, companies, administrations services, social networks…) whilst preserv- and public entities? ing their privacy. This new regulation clearly prioritises Is there any difference in perception addressing the concerns of citizens, between European regulators over what consumers and indeed all stakeholders is at stake and the future application of involved in the field of data protection. GDPR? It is built upon transparency, requiring To implement GDPR, European legisla- companies to use easily understandable tors will benefit from experiences from and accessible language in all communi- the application of the 1995 directive. cations with individuals. The list of infor- The transposition of the directive by the mation which must be communicated has Member States generated national legal also been considerably extended. The con- literature marking differences between ditions for obtaining prior consent were each country, which did not contribute to clarified, including for children and adoles- the uniform application of the principles of cents. Finally, individuals benefit from new data protection at the European level. The rights such as the right to erasure (right to choice of regulation as a legal instrument oblivion) and the right to portability allow- rather than a new directive is justified by ing for better control over what happens the desire to avoid discrepancies between to personal data. Member States and to contribute to the The regulation not only affects the way emergence of a Digital Single Market. companies can be held accountable, but There are perceived differences around the links the processing of personal data to the regulation because of the history and the entirety of the sub-contracting chain. We modus operandi of the different supervi- can expect a net decrease in declarative sory authorities. However, such differ- constraints to the NCDP. But the conse- ences should only play a minor role in the quence of this reduction places the expec- application of the regulation by European tation of robust accountability measures by authority, while the European Commission companies, whilst offering them increased

28 “A very important risk freedom in the implementation of their personal data management policy. At all is the generalisation of times, such companies must be capable of demonstrating the relevance and adequacy automated decision-making of technical and organisational measures implemented to guarantee data protection. based on the increasingly

Administrative and public entities must detailed digital profiles of also be compliant with the requirements of the new regulation. However, the liter- individuals” ature allows Member States to legislate in the relevant public authority domain, such as for national security. To support One benefit of the new regulation is that stakeholders in the implementation of the it avoids specific mention of technologies regulations, data protection officers will and rather concentrates on risk manage- become mandatory, while only compulsory ment principles and techniques linked to in certain situations for companies. data protection. However, risks will indeed evolve with technological advancement. Numerous digital initiatives have It will therefore be necessary to maintain taken off in recent years (Big Data, efficient and appropriate risk management IoT, Blockchain). What risks do these strategies. technological advancements carry for citizens? Is the impacts of innovation well understood by citizens? A very important risk is the generalisation of automated decision-making based on As with every new technology, we always the increasingly detailed digital profiles find discrepancy between its introduc- of individuals. Technologies are shaping a tion into society and the perceived risks society where algorithms will soon dictate or disruption this technology will create. all decision-making. This context raises However, with data protection principles questions about the human aspect as well applied from conception and by default, as the quality and reliability of data found European legislature will in any case in digital profiles. However, this is not just require that the creation of new devices about risk. Such technologies also hold and services will consider data protection fruitful opportunities for improving the requirements from the offset. In the same quality of life of citizens. For example, the way that passenger safety is central to blockchain system has become an integral the manufacturing of cars, data protec- component of finance in the economy of tion will serve at the core of technological Luxembourg. advancement. .

29 RESPECT FOR PRIVACY IN DIGITAL TRANSFORMATION: KEY CHALLENGES AND PRINCIPLES

Ensuring the respect of privacy in a digital world not only requires integration into every project, but integration into every company culture. This approach will also facilitate compliance with new regulations in the respective countries.

30 MANY PROJECTS AIM AT DIGITALISING opportunities around energy saving and BUSINESS PROCESSES AND CUSTOMER fraud management through the collation RELATIONSHIPS IN ORDER TO of consumption data. In the insurance sector, accumulating data on customer OPTIMISE EXISTING PROCESSES, preferences enables the personalisation INTRODUCE CUSTOMER PROXIMITY OR and customisation of services and the OFFER NEW SERVICES development of additional offerings.

The following examples, based on Such developments require the collation Wavestone’s consulting experience, illus- and manipulation of masses of personal trate such trends. data.

Historically, postmen, meter readers and CYBERSECURITY ALONE IS NOT service technicians have worked with paper (address databases, meter-reading SUFFICIENT FOR PROTECTING DIGITAL or maintenance documentation). Work is PRIVACY organised according to the tasks to be To protect personal data so crucial to the performed and can usually be operated digital market, organisations will pursue alone and independently throughout the cybersecurity measures, such as secure day, before information is collected and transfer protocols or data encryption. consolidated at the end of a work shift. However, we may question if such mea- The dematerialisation of such paper-based sures are sufficient, while concerns over processes is intended to help organisa- data misuse, profiling and automated deci- tions or agents in their activities by col- sion-making intensify. An IT security-ori- lecting data, better organising the work to ented approach alone is not sufficient. be performed and sequencing tasks. To address the fears over the respect of privacy, it is essential for organisations to This digitalisation process occurs reassure individuals by guaranteeing the in different sectors for specific pur- non-manipulation of data without their poses. For example, in the energy prior knowledge and against their will. sector, smart meters create innovative

31 FOUR MAJOR PRINCIPLES pseudonymisation (replacing direct iden- tifiers with “codes”), randomisation (ran- The following guiding principles are to be domly generated data which retains the applied in the collation and use of personal statistical value but conceals the origin) or data. generalisation of data sets.

Communicate transparently Regarding data sharing and exchange, 1 and explicitly, informing indi- mathematical methods facilitate the viduals on the data that is col- exchange of data between two organi- lected about them even if not directly sations, whilst ensuring data anonymity. obtained from those concerned. Our When selecting such methods, it is import- survey essentially illustrates this meaning ant to assess their limitations. A poorly of privacy to citizens: what kind of infor- executed “sensitivity reduction” can still mation is accessible about me, and to directly lead to the source of original data. whom? It also means sharing the reasons For example, this can involve deleting the behind data collection and the intended name but keeping the date of birth, place usage. Under no circumstances should of birth and address. data be collected without the purpose of Such methods enable organisations to collection disclosed to the persons con- optimise the customer relationship in two cerned. Recent sanctions from regulators ways: by providing a better understand- have illustrated that such activity is always ing of the digital customers’ profile and exposed in the media, with heavy reputa- by demonstrating respect for customer tional impact and lost customer confi- privacy. This is the path chosen by Apple dence often the damaging consequences. through the concept of differential privacy Building a relationship of trust takes years, to differentiate from competitors Google whereas losing it only takes minutes. and Microsoft.

Minimise the collection and 2 storage of personal data. Less Ensure individuals are in con- data collected about an individ- 3 trol of their personal data not ual means a lower risk of unauthorised and by generating value through the non-compliant use. For existing data, it is access to data, but rather by providing possible to process data while minimising individuals with control over their data, risks through the use of “declassifying” allowing services to develop based on techniques such as anonymisation, their needs.

32 Use cases for self-data are also subject Transparency to research in the insurance sector, with i some insurance companies contemplat- ing the complete removal of client spaces to instead install them on self-data Cloud platforms. The insurer will then have Minimisation / access to the data belonging to his client Desensibilisation but is no longer in ownership of that data. Beyond self-data, such trends may even lead to the “Green Button” mechanism where individuals explicitly validate Control access to their data at any time. This by individuals principle, albeit difficult to implement in practice, can be restricted to particularly sensitive data, such as health data.

Implement a win-win model by Win-Win model 4 clearly demonstrating the benefits generated by collecting and using data, not only for the organisation but also for individuals. Such benefits This approach, labelled “self-data”, can be can be shared with customers through applied in the context of an energy con- various means, such as additional services, sumption optimisation project, an example rebates and compensation. of which is to ask customers to indicate This approach may even drive the ease in the temperature in their homes to record adoption of new uses in an environment the potential cost savings associated with where increases in market share carry sig- heating reduction. An individual will then nificant impact. be informed of the potential cost savings by autonomously using and managing Ultimately, we are able to identify several a self-data Cloud platform, connected levers in motion for building an honourable to his personal equipment to enable the circle of trust when using an individuals’ cross-analysis of data through consultation data with respect and for the purposes of of his digital thermometer and energy bills. increasing the level of confidence.

33 INTERVIEW WITH Armand de Vallois – Consummer goods & distribution

What changes have occurred over For example, the “opt-in” option is a good the last few years in the mass retail way to ensure that customers are well sector? informed and accept the collection and processing of their data. Over the last decade, we have shifted from a distribution model focusing on costs and Increasingly, rewards are used as a means volume to a model based upon under- for encouraging customers to accept the standing our customers. Mass distribution disclosure of their data. However, this is thus a thing of the past, as it completely model has its limitations. It is essential to overlooks the interests of the customer ensure that services are of interest to cus- relationship. Nowadays, our model gath- tomers and contribute to the ease of their ers and stores knowledge about our cus- lives, as well as ensuring that individuals tomers, allowing us to develop closer have agreed to provide their data. proximity with the customer and loyalty programmes which support the frequency Do you have some examples of projects and consistency of their purchases. which created apprehension? How should organisations handle such The introduction of RFID chips (integrated changes? technology which enables the identification and follow-up of objects or people) In recent years, awareness by business in electronic tagging is a good example. stakeholders of the opportunities that come with the high potential of cus- Many projects have been launched in tomer data has increased. Nevertheless, the textile industry based on optimising resources must be used wisely in sup- production costs, inventory automation porting the efforts of organisations to get in stores and warehouses as well as the closer to their customers. Data must be ease of chip insertion into clothes. It is collected, handled and reconciled against crucial to have real-time knowledge of frameworks which correspond to customer stock levels and to have reliable informa- expectations and regulatory requirements. tion in an omni-channel context, where it

34 How did you address these concerns? “Increasingly, We implemented what we call “Privacy By Design”, which goes beyond strict princi- rewards are used as ples regarding chip use (identification and a means for encouraging follow-up of products, not customers) and incorporates several other principles:

customers to accept // A visible marker showing that clothes the disclosure of their are equipped with a RFID chip // Training sales teams so they are data” better qualified to respond to customer queries, such as informing customers that chips may be removed by cutting the tags attached to a is increasingly common to see online pur- product, a service offered in stores, chases made ahead of in-store collections. or declaring that the company in RFID chips can also contribute to data question will never connect a cus- production based on customer journeys tomer and a chip and the actual product itself, for example calculating ratios to record the number // Dedicated webpages for commu- of times a product has been tried on in nicating all information required to a fitting rooms compared to successful understand the chip and the data it purchases of that product. This type of collects information is essential in the context of These are some examples of best prac- fast fashion in the textile industry. tices which are applicable to all projects However, such chips are also a cause involving the treatment of sensitive data. for concern. For example, salesmen can We must lead by example when handling “potentially” connect a customer to a and informing individuals about how to product (the RFID chips use unique iden- handle such data. It is therefore crucial tifiers) and track their activity over the to reassure customers and answer their duration of their shop visit (the chipset questions so as to anticipate and alleviate remains activated). their concerns.

35 INTERVIEW WITH Jean-Christophe Procot & Hervé Commerly – Human Resources

How is the concept of privacy between What explains such concerns? employees and employers perceived? It should be understood that employers It is a concept that has changed signifi- are increasingly interested in collecting cantly over the last few years. The pri- data to improve understanding of their vacy concerns of employers about their employees. Employees are increasingly employees is that they often do not devote reluctant to communicate this informa- enough time to their work. For employees, tion, especially the younger workforces. the notion of privacy is goes hand in hand Employers wants to retain their employees with flexible working conditions such as for longer, facilitate their decision-making flexible hours, reduced surveillance and and help them to perform more effec- teleworking arrangements. Employees also tively and efficiently in the professional value a limit on the amount of information and personal lives. The employer collects that the employer can gather about them. such data not directly communicated by the employee themselves but from third On the basis of this concept of privacy and parties, such as social networks, previous to improve employee privacy, employers employers, managers, and data inputs increasingly seek to support employees from work tools. in their personal lives through well-being services such as laundry and daycare Both employees and customers are con- services, company restaurants and com- cerned by this development. It would plementary insurance. However, provid- almost say that, by definition, employ- ing such support also requires that the ees suspect employers of attempting to employer knows more and more about the monitor their every move. The employee private life of employees, such as the com- is then left to wonder how it is possible position of their family and eating habits to retain control over privacy if employ- linked to religious beliefs. ers collect all this information about them,

36 not necessarily provided by the employee to ensure that his or her data will not be themselves, leaving them powerless if the used for any purposes other than that employer chooses to correlate data for previously agreed to, such as modifying making decisions about an employee, a salary due to learning the employee’s unbeknown to them. ancillary income.

Do you have an example of a recent What developments have taken place project which echoed such concerns? in human resources management that The plan of the French government plan will impact the protection of personal to introduce a tax withheld at source. An data? employee’s salary witheld is an example Several major trends have emerged: of this. The aim is to simplify an individ- // Big Data in recruitment activities, ual’s life by avoiding deferred payments particularly sourcing, which should be which can lead to difficult situations. For supervised in order to ensure legiti- example, tax collection methods for the macy when collecting data state can be improved with a reduction in income set by the employer as an indi- // The multiplication of decision-making cation that an employee is no longer able for career managers (for example, the to pay the tax rate of the previous year. creation of succession trees or the However, citizens are quick to express identification of key personnel) for concerns about the information their automated decision-making, a sen- employer holds about them. As well as sitive topic for regulators financial information, a tax return can contain additional private information such as // Mobility, with an increasingly frequent marital status, children, ancillary income introduction of new professional and any assistance provided to persons mobile terminals which do not facili- with difficulties. The objective should be tate the separation between the data therefore to ensure that the purpose of produced in private settings and data the data collected will be limited to tax produced in professional settings. purposes and that access to such data The question of the “right to discon- will be controlled. The employee wants nect” is also alluded to regularly.

“Employees are increasingly reluctant to communicate this information, especially the younger workforces”

37 Principles around respecting digital pri- employees. Beyond a binding regulatory vacy should establish an enticing corpo- aspect, it will above all ensure that organ- rate culture for customers isations look to develop their treatment of such issues in an increasingly digital Beyond simply complying with different world. Its adoption at a corporate level regulations, not necessarily the most combined with an effective communica- effective means to building trust in the tion campaign will ensure the message is digital customer relationship, the best disseminated across to all employees. It practices described below have proved in will also contribute to the corporate social our experience to be most effective with commitments of the organisation. respect to change management.

Best n°2 Establish a privacy ethics Best n°1 Formalise a company- practice committee practice wide ethical charter To handle the most complex issues at an A company-wide ethical charter will pro- operational level, a privacy ethics commit- vide a strong basis for building respect tee will be implemented. This committee for privacy. Sharing this charter through- may be attached to existing organisa- out the organisation will reinforce key tions responsible for ethics and profes- organisational principles of transparency sional conduct. Composed of members and trust. It can be written as part of the of various business lines, including (but implementation of binding corporate rules not limited to) IT, HR, compliance, legal (BCR), in efforts to establish frameworks and customer relations, the committee treating more important issues than simple will be chaired by a member of senior data transfers. By introducing a selection management. It will arbitrate situations of simple yet effective rules to follow, experienced in particularly data-sensitive such as the introduction of prior consent projects and handle any received com- by default, an organisation can develop plaints. It will also serve as part of the its principles and company philosophy. communication strategy on the subject The charter will aim to cover all personal of respect for privacy. data, whether from customers, partners or

38 in terms of key business stakes. For “high Best n°3 Facilitate the practice implementation of impact” projects, risk analysis methods “Privacy by Design” by or communication kits for customers or the business lines employees can be implemented. Respect for privacy in the digital world is a relatively new concept, yet to be fully Best n°4 Integrate respect for embraced and implemented by organi- practice privacy into business sations. A dedicated operational effort objectives and monitor should be made to equip the relevant their application teams with simple and effective tools to In order to create an honourable circle integrate such concepts into projects. A of trust within the organisation, business privacy impact assessment of projects and / or project manager objectives will (based on the types of data collected and be determined. Objectives will be based how it is proposed to be processed) using on the monitoring of simple indicators put a matrix is a strong lever for privacy by in place to ensure that respect for privacy design, which helps to prioritise projects is reflected in each business project. For

39 example, we can measure milestones or In addition, GDPR is highly regarded as an achievements such as evaluating the risks international benchmark standard, where of data processing or the application of it is viewed that ensuring compliance with measures required for transparency, such GDPR will facilitate compliance with other as communication with customers. The international regulations. control and regular reporting of such Beyond compliance on a European scale, indicators will contribute to best prac- this programme will also have a regulatory tice governance with respect to privacy. function in monitoring regulatory develop- Incentives may even be introduced by ments across different countries, as well as the ethics committee; such as awards for developing the GDPR programme itself to projects demonstrating the most respect ensure a more widely applicable level of towards privacy. compliance.

Best Conduct a compliance Best Equip the CIO with tools practice n°5 n°6 programme focused on practice to protect and monitor (but not limited to) GDPR data This programme will organise all the tasks In order to process data and protect col- aimed at ensuring compliance with differ- lected data, investment in IT-related solu- ent legal and legislative literature linked to tions are necessary. Such investments will the protection of personal data. The big- be towards implementing solutions such gest priority over the next two years (by as anonymisation, data encryption and May 2018) will be the implementation of management of access rights. Investments the EU regulation, General Data Protection in cybersecurity, particularly for detect- Regulation (GDPR). This is largely due ing and responding to incidents related to to the substantial financial impact that obligations around customer notification, non-compliance (fines of up to 4% of will also contribute to efforts in challeng- global consolidated turnover) can inflict. ing cybercrime more broadly.

40 In order to capitalise on such innova- Best n°7 Communicate clearly and practice widely to anticipate tion, observation of regulatory develop- concerns and reassure ments and intelligence processes will be Concerns that emerge from digital innova- necessary. Such initiatives will support tion and development require early commu- approaches based on the rapid adoption nication in order to reassure individuals and of relevant innovation, ensuring effective gain their support for change. Such com- structural positioning over time. munications should be transmitted globally, demonstrating the social commitment of ORGANISATION IS KEY FOR organisations with respect to privacy. For example, this may include incorporation into IMPLEMENTING BEST PRACTICES CSR policy, as well as within each project. Depending on the purpose of organisa- The reasons for data collection, data pro- tions and the nature of their actions, the cessing and the measures taken to ensure implementation and facilitation of the safety can be communicated, without the aforementioned best practices may be use of legal or technical jargon. Such com- conducted by teams responsible for ethics, munications must be prepared to respond compliance, legal issues or even support- to issues or questions raised by customers ing the CIO. European regulation requires and employees. Such interactive aspects the appointment of a Data Protection will be integrated at the project or process- Officer (DPO). Such a role is essential for ing design stage. ensuring compliance by an organisation. Above all, it ensures that the principle of Best n°8 Remain vigilant and know respect for privacy is ingrained within the practice how to adopt innovation DNA of an organisation. The impact of a It is evident that regulatory, technological Data Protection Officer’s actions will cor- and use frameworks centred around the respond to his or her reporting lines and subject of protection of digital privacy are the communication made around his or changing rapidly. her appointment.

41 FOCUS: GDPR COMPLIANCE PROGRAM AND KEY CHALLENGES

In the situation where an organization has to comply with the GDPR, it will be necessary to initiate a specific compliance program to be aligned with the requirements of the directive. With regard to the large number of those requirements, numerous challenges must be undertaken through several major streams:

⁄ Global program steering, including the creation of group guidelines interpreting the regulation in the specific context of the company, the coordination of local tasks and the implementation of change management;

⁄ Compliance with the customers’ and employees’ data requirements, including the production of the inventory of data processing, risk analysis and the associated remediation plan, as well as the roll-out of the consent, information and rights exercise principles;

⁄ Implementation of the accountability, containing the implementation of audit and control plans, the construction of the Privacy by Design process, reporting to top management and regulatory authorities, as well as the reporting of data breaches;

⁄ Management of the IT evolutions, comprising the roll-out of portability, cleanse and anonymization solutions.

These challenges require a well defined program organization and an established associated governance: what are the respective roles of the DPO, of the compliance function, of the legal function, of the CIO, of the CDO (Chief Digital Officer), and of the support business lines and functions ? This organization will need to be able to centrally pilot, coordinate and equip the program to enable the local implementation of the compliance by the teams directly in touch with the processing.

42 What would be the 3 challenges to be tackled first and foremost ?

The implementation of Privacy by Design, a pre-requisite to 1 improve over time. It is the obligation to perform risk analyses related to the privacy of individuals (discrimination, dissemination of confidential data, etc) before implementing the most sensitive processing, and with each modification of the processing. Companies will have to adopt appropriate security measures in order to mitigate such risks. Concrete actions to be conducted include an update of the project methodology to identify sensitive processing as soon as possible, as well as the definition of a risk analysis method to be introduced. Support can be found in the practical guides developd by the regulatory authorities, including the CNIL’s “The study of the impact on Privacy”), which will need to be simplified and adapted to the context and specific needs of the company.

The notification of data breaches, a challenge for the 2 client relationship. The regulation introduces an obligation to report data breaches to the competent authorities. The notification of such data breaches to the concerned individuals is only mandatory if the company is unable to prove that it has taken appropriate steps to make such breaches inconsequential. Hence the benefits gained from a properly carried out risk analysis and from the definition and implementation of appropriate measures. To meet this requirement, two processes will have to be developed or overhauled: the first one is a detection and alert process for data breaches, which will integrate the reporting to the authorities, and a new client relationship process to ensure that, when compulsory, the correct actions will be taken to notify the clients (by email, registered letter, press release…) and to manage subsequent interactions with all stakeholders (questions, complaints…), which will often be dealt with via the implementation of dedicated call centers and the quick training of the relevant parties.

The adoption of the principle of accountability. Every 3 company will now need to be able to demonstrate its compliance with the regulation. This requirement will be reflected by the implementation of a personal data management framework policy; an associated organization; operational procedures covering the topics of the regulation (information, respect of the rights of the people, transfer to sub-contractors…). The company will also need to be able to prove the application of such policies, and, consequently, to implement audit and control processes.

43 THE FUTURE OF DIGITAL PRIVACY

The future evolution of digital technologies and how they are used, particularly for automation and artificial intelligence, will place even greater importance on personal data. How do we prepare for such developments?

44 PROTECTION OF DIGITAL PRIVACY: Algorithms and associated digital services BEYOND COMPLIANCE… do not appear today as neutral and independent actors. We have seen on an increasing scale that It is therefore necessary to develop trust, digital transformation raises concerns at the risk that new proposed services related to data protection, as well as to will not be accepted by individuals. the legitimacy of the purposes for which This move is anticipated by major Internet data are used. companies such as Amazon, Google, Digital technology is perceived as acceler- Facebook, IBM or Microsoft, the latter ating, informing and increasing the reliabil- of which recently announcing a partner- ity of the decision-making process. In the ship to develop artificial intelligence for future, automated use cases of technol- the benefit of citizens and society, with ogy will emerge: for automating financial the immediate involvement of an ethics investment decisions, predicting diseases committee. and finding their cures, autonomous vehi- cles, not to mention the arrival of robots … TOWARDS BUILDING TRUST FOR in everyday life. THE FUTURE However, in order to address this level of automation, it will be necessary to collect For all organisations and companies con- data directly or indirectly (via the Internet, cerned, trust must be a criteria of differ- from partners, etc.) from individuals. This entiation in customer relationships and data will have to be increasingly intercon- human resources management. nected in order to facilitate these new Meeting the challenge of building digital uses. trust should therefore not be seen as a The multiplication of this correlated data regulatory or security issue. Rather, it combined with the emergence of automa- should be seen as an in-depth transfor- tion through the use of algorithms under- mation of the customer and employee standably provokes fear in individuals relationship and the way in which digital about the decisions over which they have technology is used. This change must be no control. deeply rooted in the foundation of organisations and businesses. To capitalise on the next stage of the digital revolution, employees and customers Protecting privacy in today’s digital world will thus have to be prepared to partially means doing digital differently. or fully delegate decision-making. Such delegation, as Milad Doueihi claimed, involves the action of entrusting a third party.

45 ENTRETIEN AVEC Milad Doueihi, philosophe

The second part of our interview is with Nowadays, we are faced with the Milad Doueihi, American philosopher choices suggested by these algorithms, and Chair of Digital Humanities at Paris- which anticipate what we will be Sorbonne University, placing privacy in interested in. For example, Facebook the context of a more global evolution of will prioritise showing our closest digital culture and its impact on privacy. friends’ posts. Does this lead to a restriction of our freedom in exchange In the world of digital technology, the for a little more convenience? word “algorithm” comes up often. Do algorithms produce unbiased choices Other forms of individual autonomy or are they like people, with a digital appear because of increasing levels of identity? automation through algorithms and the gradual removal of classical interme- There is type of a fetishism surrounding diaries. What is crucial to me is under- algorithms. We have witnessed a shift standing the links between autonomy from the era of data to what we could and automation. Instead of questioning call algorithmic governance. We are gov- liberty, we should be questioning auton- erned, shaped and spied on by algorithms, omy. Autonomy is now a method of dele- whether from large corporations or intelli- gation. We agree to delegate through an gence services. In my view, an algorithm is established trusted third-party: for exam- a digital cultural “being” because it is built ple, a friend. Nowadays, we are witness- by people who make decisions informed by ing a transformation in the way we are economical or cultural factors, which are autonomous in public spaces, as well as in mostly implicit. Moreover, such algorithms private and confidential spaces, which is can produce unexpected or not necessarily particularly striking to me. The boundary programmed results. There is certinaly an between the two is difficult to determine element of the unknown in the results. and maintain.

46 “Yet, through the blockchain, we will transfer our trust from banks and states and into the hands of the colossal computing and calculation power of machines. This signifies a major shift in delegation”

Can we delegate in a trustworthy the problem. In fact, we must surpass the manner with current Web tools and classical juridicial sovereignty of states, digital technologies in general? which is a territorial sovereignty. The data characterising a citizen’s identity should In my view, we should master the tools be accompanied by legal frameworks not we use and monitor the transparency and restricted to location but which are intrin- loyalty of the algorithms on which they sic to a citizen’s country of origin. are built. We should understand how algo- Another solution which seems realistic rithms produce recommendations before to me and which can be applied in firms, a decision is made. There is a form of rec- as well as on a national scale, is to have iprocity between individuals, their inter- explicit and accessible customer policies actions and the way that the algorithm on the way data is handled. We have the fuctions. right to access, control and appeal the content of our data within legal bound- In your view, how should the aries. Yet, this principle is not consistently consequences of digital cultural applied. evolution and private life be taken into consideration by governments and To conclude, could you share with the business world? us what you believe could affect the evolution of digital in years to come, Data and its management has become especially related to privacy? a real factor of trust between people, communities and societies. I believe that Blockchain seems interesting to me, states, as is already the case in Europe, because it helps to automate and erase should contribute to protect the personal the human factor, often considered the data of its citizens. Such data is meant to weakest element of the chain. Yet, through be protected by a “jurisdiction embassy”. the blockchain, we will transfer our trust This means applying rules governed by from banks and states and into the hands the citizens’ country of origin and not of the colossal computing and calculation the country where the data is stored or power of machines. This signifies a major processed. Sovereignty is at the heart of shift in delegation.

47 www.wavestone.com 48