Episode 24: The future of privacy

Inspiring Legal

The privacy landscape is moving fast these days, and increasingly so. That's why we're dedicating the following weeks fully to privacy here at Inspiring Legal. Stine Tornmark will take you through what you need to know and what's on the horizon for digital privacy.

Thank you for listening to Inspiring Legal.

Full episode transcript: [00:00 - 00:16] Welcome to Inspiring Legal, the podcast for in-house legal. Get insights, learn from peers, life lessons from some of the most influential GCs.
[00:16 - 00:38] If it's related to in-house legal, we cover it. For more inspiration, go to Openli.com slash community. So welcome to another episode of Inspiring Legal.
[00:38 - 00:54] My name is Stine and I am a CEO and co-founder of Openli. But what I'm also is a passionate person when it comes to privacy. I strongly believe that privacy is a fundamental human right.
[00:54 - 01:12] And it's not to put myself on a pedestal, but it's just to say my life. It's as much online as it is offline. That's just the name of the game today. With chat DBT and what's going on now with AI, well, that's only going to increase.
[01:13 - 01:29] So in this little episode, I'm going to be talking about data. I'm going to be talking about transferring data from the EU to the US. It doesn't sound super interesting, but I'm sorry to say it's impacting
[01:29 - 01:45] you and your life every single day. You might not be on Facebook, you might not use Google, but you will most likely either use Instagram, you might use Apple.
[01:45 - 02:05] Well, they're all US-based companies. So when I'm talking about data and I'm talking about data transfers, I'm talking about your everyday life because American tech companies are de facto in our lives and that isn't necessarily a bad thing, but take a step back.
[02:05 - 02:26] What is it that I'm really talking about? Well, in the EU, we have GDPR, right? We see it as a fundamental human right. The right for you to own your data. In the US, up until now, the focus has been very much about the companies owning data.
[02:27 - 02:46] We're seeing more legislation coming from the US, for example, in California with the CCPA, but we don't have the same standards yet anyway. What we're also seeing is a very strong intelligence agency in the US that have
[02:46 - 03:06] far-reaching rights to access your data, to use it in whatever way that they deem appropriate or not appropriate, but for whatever means they want the data. So therefore, there has been a lot of decisions over the last couple of years
[03:06 - 03:25] with Strems 2, if you've heard about that, the privacy shield falling apart, and all due to the fact that the US didn't provide the same level of protection. So what we then got was a period of time where everybody was running around
[03:26 - 03:41] and not knowing what to do. Then we got the SECs, that's the transfer mechanism enabling businesses to send data between the EU and the US, but that in itself isn't enough. You need to have additional safety measures.
[03:41 - 04:01] You need to make sure that your data is safe. So many kind of thought, okay, let's try and see if we can figure that one out. Not easy in any way. And I'm not promoting the only service, but that is a part of what it is that we're doing, trying to really help with that transfers element, as many of
[04:01 - 04:18] the things we're doing. But what we then saw is Google Analytics getting in trouble. It started in Austria. And what happened was that the Austrian data protection authorities found that there wasn't additional, the safety wasn't good enough.
[04:18 - 04:37] Transfers of data was happening, IP addresses and so forth in clear text. Big issue. Therefore, they kind of like said, Google Analytics violating GDPR, therefore, you can't use it. We then saw that the EU was also doing a lot of things that were not
[04:37 - 04:54] you can't use it. We then saw that spreading out. Moving to Italy, moving to France, moving to Denmark and the EDPB, that's the European Data Protection Board, issued a statement saying, this is an issue.
[04:55 - 05:15] So everybody started looking at, okay, I need to change. I need to find an alternative to Google Analytics. That's an episode we could take kind of like on its own, I know, but let's just focus on the transfers for today. So everybody, I think many were thinking, okay, we'll get a solution from the
[05:15 - 05:32] politicians. They will figure out a way for us to send data. They will create a framework and we're still waiting for that because the Biden administration came out not that long ago and saying, well, we're getting closer. We're going to get some kind of transfer in place.
[05:33 - 05:49] What Mark Schrems did, and that's the Austrian data protection, let's call it, I don't know what to call him. He is not an activist, but he's also, they're kind of like a non-profit
[05:49 - 06:10] organization enforcing GDPR and privacy rights. Well, he kind of came out and said, well, that's going to be lipstick on a pig. Meaning, don't expect this to solve anything anytime soon. So everybody kind of like still hope and anticipate that we might be seeing some
[06:10 - 06:29] kind of change with the authorities in Europe and the US coming into some kind of agreement. Yeah, well, then comes meta, meaning Facebook. For many years, it's been the Irish regulators that have been responsible for
[06:29 - 06:45] enforcing privacy when it comes to Facebook because Facebook has their European headquarters, if we can call that, in Ireland. So many have been talking back and forth about the Irish data protection agency
[06:45 - 07:00] not being that enforceful. And I'm not trying to do any kind of conspiracy. I'm not saying that whether or not they're good, but given the fact that the Irish have a lot of tech companies, at least the Irish data protection agency
[07:00 - 07:17] has a lot of things they should be looking for. So what happened was that the European data protection board, which is composed of data protection regulators from each member state in Europe, they get together
[07:18 - 07:33] on a regular basis and they figure out on a European level, because it's one law, right? It's the GDPR applied to the entire Europe. They figure out what they think in different areas. And they have now issued a statement when it comes to Facebook.
[07:34 - 07:53] So what did they say? Well, we don't know exactly because they haven't made that statement public, like the decision, but they made a statement. And what they said was the Irish regulators have one month, one month to get things
[07:53 - 08:09] going when it comes to Facebook. And it is anticipated that there will be a ban of transfers between the EU and the US in regards to Meta Facebook.
[08:10 - 08:30] In that regard, I can mention that Facebook has been going out publicly and warning if there will be such a ban. They might be forced to close down Facebook in Europe. Boom. So when I'm talking about Facebook and I'm talking about transfers, I am talking
[08:30 - 08:48] about potentially far reaching implications. Imagine Facebook closed in Europe, closed up. Because of transfers. So if you're sitting there and thinking, why is she talking about those bloody transfers?
[08:49 - 09:05] I'm talking about you not having access to Facebook and you might be sitting there and thinking, OK...