data.bythebay.io: Francoise Gilbert, Hot Legal Issues
Recording: data.bythebay.io: Francoise Gilbert, Hot Legal Issues
So, so let's get going. So, my name is Franis Jilber and I'm I'm a lawyer. I I practice at the law firm Greenberg Tuare. Um, in uh we are the third largest law firm in the country. We have uh 2,000 lawyers and we have a presence uh in 38 different uh we have 38 different offices, 10 of them around the world. Um I I work the on data uh all day long but uh as a lawyer not as a as a software engineer. And my my particular interest is on um um global issues and uh the big red thing is a book I have written and I keep up to date that covers the privacy laws of 68 different countries. So uh I try to keep up with the with the world
So let's talk about about uh why we are here or why I think I'm here is to talk about the legal issues surrounding the the world of big data and um when I think of big data as a as a as one of few as a as a software engineer as a whatever a a designer a creator uh someone with an analytical mind I I get very excited because there is uh there is a lot to do, there is a lot to discover, there are a lot of inferences to to create. So it's it's a very exciting world and and for you I think uh it's probably something new. It's something well that has um u evolved over the years but that in the recent years has really exploded. And so it's it's very exciting and and but it it's new from your standpoint. It's not necessarily new from the legal standpoint. And uh what I want to uh to stress to you is that there is a certain uh framework within which we have to fit your wonderful work in sometimes very old laws. And the the creations, the reports that you create are used or could be used for a number of purposes. And some of these purposes are great and will be approved by society as a whole
But some of these purposes may not be that great. And actually we have laws about that. And uh one of the most important laws is the um fair credit reporting act. The the Fair Credit Reporting Act is um a very broad law that has to do uh in general with the um relationship between your credit report. Hopefully, you all know what a credit report is. It's something that's put together by a number of organizations and that is used for a very uh significant number of purposes. For example, if you want to lease a car, they're going to ask you for your credit report. If you uh um rent an apartment, if you apply for a mortgage, the these are very important documents that have a very significant role in whether or not you can get the car or you can get the apartment or you can get the mortgage
So that's what the the Fair Credit Reporting Act um does. And uh there is a a a restriction on the uses of these credit reports. And uh and so uh it has to do with the use of this information to determine the eligibility of people for credit uh employment, insurance or housing. And so those companies that use these credit reports for that purpose, they are highly regulated. And so it's not just like anybody who can just pull out a credit report and and and do make decisions about that. You have to respect certain laws. And so one of the main um uses of of your big data reports unfortunately could find their ways into being deemed a credit report that people that companies use for making determinations for employment, insurance, housing and credit. And that becomes illegal
And we have a case right now actually the Supreme Court made a final decision just on Monday. It's a case against Spokio. I'm sure you all know of Spokio. And Spokio got in trouble because it was advertising that people could use its service to um make employment decisions and that's a big no no. And so there was a lawsuit and that went up to the the Supreme Court. So watch out when when you do uh your work that the work may be used for those purposes and that would be an illegal purpose. So you should uh at least alert the uh organization who is asking for that. And going even uh broader than uh than this is another set of laws that we have in the US that uh not just focus on employment or credit but that focus on discrimination in general and there are a number of laws uh which go under the umbrella of equal opportunity laws
So there are a number of them and they they are listed here and and the goal again of of these laws is to prevent discrimination against people for many reasons for their age, their sex, their their religion, their age. And uh the the intent of the law is to protect people from being discriminated against. And um so when um um when your reports may be used for those purposes again you are uh the report is used for illegal purpose and so you need to again uh make sure that you you you you stop that you prevent that you alert whoever is asking you to do that because you would be aiding in an illegal purpose. So these are the two major sets of laws that I wanted to alert you about. But then there is uh something even uh more uh broader than that. It's the section five of the FTC act. And what the section five of the FTC act does is simply prohibit unfair and deceptive practices. And and you can see how this can be interpreted in in zillion ways
And um if you pay a little bit of attention to the world of privacy and cyber securities, you will know that uh the Federal Trade Commission has been very active in prosecuting uh a significant number of companies now for their activities that uh the Federal Trade Commission determined to be either unfair or deceptive. And that can be in in so many different ways. For example, uh one of the companies listed here uh is Path and Path is a provider of they have an app and uh the the app was um collecting all of the customers um uh phone address just as as you were uh you know downloading the app. the first thing the app was doing was collecting all of your contact information but was didn't tell you and so that was deemed to be a deceptive practice because they would they would not tell that to the customer and and on and on and so when when you look now at what that means in in your world in the world of big data what what big data or analytics starts with is the collection of a large amount of information and So where does that collection of a large amount of of information fit within the um the constraints of the uh section five of the FTC act because it the section five creates an obligation to let people know that something is happening and if you don't tell them that something is happening it becomes illegal and so when excuse me when uh the the data are are used for for your your big analytics project. Maybe this use of the data is also uh an unfair and deceptive uh practice. Um so what you need to look at is uh whether the company failed to uh disclose uh information to its u customers and uh u and other uh elements and uh I um excuse me um I'll I'll go through through more of those uh later in this presentation. So we have section five of the FTC act which is a huge um very significant piece of of law but we have much more and so uh it's not just that you have to worry about what I I just told you but we have all of these here so if you do any work related to the the healthcare industry for example you have to be careful that there is a law called HIPPA and that's the federal law then we have state laws that also govern the use of information um that that contains um healthcare information. Uh you have Graham Lee BL and a number of other laws that deal with the handling of financial information or credit card report information and so on
And then of course you have the state laws. So again many important layers of information. So you you should don't want to scare you, but you're kind of walking in a minefield and you have to know how to navigate because the the laws that could restrict what what you do or what the uses of the reports you create uh could be very significant. So who enforces these laws? Again, I talked about the minefield. Now I'm going to get to the machine gun because the uh one of the the chief enforcer is the Federal Trade Commission. So they operate at the at the federal level and they have a very broad jurisdiction about many companies. So to give you examples of companies that have been uh um uh investigated and uh and spanked by the Federal Trade Commission, just companies around here to name a few, Google, um Facebook, uh Twitter, uh Snapchat and um many many others. So that's the Federal Trade Commission
Now you also have uh other agencies for example the the Federal Communications Commissions, the FCC uh who is getting into this area as well and has uh um issued a number of judgments recently against Verizon against AT&T for practices that were too loose in connection with the the collection or protection of of personal information. And then we have others. We have the SEC, the Security and Exchange Commission. We have the HHS that has to do with protection of healthcare and statewide we also have the state attorney general who are very very very active and um sometimes have actions on their own sometimes they have actions as a group of state attorney general sometimes it's grouped to the state ages and the federal trade commission so definitely a significant amount of u u enforcers I told you I love international Also I have to have a slide on on on that particular aspect. So uh what does the world look like? You think that America is bad? Well, you should look at the others. So uh first Europe uh Europe is uh is a a region that is very highly regulated and uh anything that has to do with discrimination, anything that has to do with profiling, anything that has to do with monitoring is is uh is not uh accepted. very highly regulated. That um also uh becomes even more evident in the upcoming law that is going to change the data protection regime in Europe
You should be aware of it because it is now official. was voted a couple days ago and that law called the uh European General Data Protection Regulation or GDPR becomes effective in two years uh May 25, 2018. And that law not only keeps the already existing restrictions in many areas but increases the protection of individuals and the obligations of companies and in particular has numerous provision that address directly big data. So uh throughout the law there are uh obligations that are uh increased obligations as oppo as compared to the the general uh use of data. Occasionally you have well if you do what I would translate as if you do work in the big data area you need one more of this or one more of that and that can be obtain obtaining specific permission to to do the the work to uh having very detailed paperworks paperwork to uh doing a privacy impact assessment or a security impact assessment. So, a lot of obligations and and restrictions. Asia is a little bit behind Europe in in some ways, but don't get fooled by generalizations. For example, South Korea is extremely strict
It's even stricter than what we see in Europe. So, be careful where where you are acting in uh in Asia. and uh the group of um Australia, New Zealand, uh Hong Kong very much influenced by British law that means very much influenced by European law and again they have a number of restrictions. Um Africa, Middle East, not too much right now but it's getting there and we have a number of countries that uh enact um data protection laws in particular and these laws uh mimic what is happening in Europe. So the the European influence is basically throughout the world other than than the US and for some reason I don't know I forgot uh Latin America on this slide but Latin America is also very active. We have a number of countries that uh uh have uh adopted uh general data protection laws very similar to uh what we see in Europe. So again with uh a lot of restrictions. So I cannot uh summarize the world in uh in 20 minutes but I wanted to show you what what the world thinks about about privacy and uh information practices because that is uh other than the the anti-discrimination laws that I described earlier this is a very important basis on which your work uh has that your work has to take into account
So on this slide you have what we call the fair information practices principles and if you want it's like the ten commandment it's it's it's very high level uh concepts that you can find in almost every single data protection law and privacy law in the world and so I I use that because it helps you find a very simple framework. There was a a young lady earlier who said g give me just a few word that I have to remember. Well, if you don't remember anything, try to remember this particular slide because it summarizes a number of of your obligations. So, I'm going to go through through some some of these in the in the next slides. Uh, one of the most important principle is is notice. So, when when when something happens when your company collects my data, they have to tell me what they're doing. And and the typical um the typical uh information that is expected to be given in a notice is what information is collected, how it's used, who gets access to it and also what kind of rights the user the the individual u person the data subject has and uh and um and and so on. And so you can see how this notice can be important in the in the in the big data context because um currently most of the notices that are published don't really say clearly um whatever data you're going to to give us, we're going to put that in a big pot and stir it with all sorts of other data and come up with um with conclusions that that is not there
And that makes a big difference because it's one thing for me to give you uh my name and my address. It's another thing to know that all of a sudden now you have put me in the category of uh uh people who live in ABC area and therefore uh have that uh social profile that type of uh of uh income and so on. This is not what I what I registered for when I registered to get my whatever my cooking app. So very very important in in the big data context. The the other part is the consent. So you you you notify me but now I have to I have to agree and I have to be able to choose and to choose also to to walk away and say no I don't want you to do this. And so that's often a I used example that uh you you can relate to because these are disclosures that you see on u on websites. Uh that's often the notion that your the person is giving consent is often at the very top of most privacy policies
And basically it says uh for example here on the top one uh when you use the service you also consent to the collection, transfer, manipulation, storage, disclosure and other uses of your information. That that's where the consent comes. Um but remember that consent should also have a meaning and and this is a consent today now because I go for the on the site for the first time. But what happens if you change if you change your practices? If you do something that last year you didn't tell me you were doing and then all of a sudden now you know it started with a a nice happy website with nothing and then one year later you change. Well, you should tell me the the customer, you you should inform me that this is changing and I should have the opportunity to say stop. I don't want to be there anymore. So that's where the notion of choice comes up. And that's that's a very very important component, the ability for the user to get out to for the individual to get out of the of the pool
Uh another principle that is very frequently found in uh in most data protection laws is the notion that you should collect only what is necessary. And uh you see the the contradiction between collecting only what is necessary and then your objectives as as data engineers of having as much as you can so that you can uh cut and and and parse and organize to to find um whatever correlation and inferences you want to find. So a a a difficult situation here where we we as a society need to make a decision on on what what is acceptable or not. And uh in in particular I want to bring your attention to this particular slide. The the example I I used was location information. uh th this is a very sensitive area and um in in uh if you pay attention as as just a an iPhone or portable phone user very frequently when you open an app you you have a request to uh to collect your location information and and that's because location information is uh has been recognized now both here and throughout the world as being a very sensitive uh information because if you know my location throughout the day, you know who I am, you know where I am, you know where I live, you know where I go to lunch and and you can establish a very very clear profile of who I am. And so um that that's an example of something where um society has decided we should we should be careful on the collection of location information. And and there was a case actually um filed by the Federal Trade Commission on exactly that particular issue where you had a a company that was offering a uh flashlight app
That was before before the iPhone had the the nice uh flashlight incorporated. And uh so you would download the app, but the app was not just used to give you the light. It was also used to collect your location information. But that was not said in in the in the disclosures. The the the users never had an opportunity to say, "Well, that's okay. You can you can figure out where I am. I I need I need the torch right now." So um that went uh again was investigated by the Federal Trade Commission and the company now is under a 20-year consent decree with the Federal Trade Commission. So pretty serious
Uh another principle that is very found very common in the uh in uh the privacy and uh security world is the limitation on the use, the disclosure and the retention of information. And and that too is is a a horrible thing for data engineers because you want exactly the opposite. You want to do any kind of use any kind of disclosure and keep that stuff for as long as we want. So it's a it's a it's a dilemma. I'm not telling you what to do. I'm just telling you this is this is my world and I know that your world is different and and we need again as as a society to make a decision as to what uh what can be done in what circumstances and for what purpose. Uh another principle that I mentioned earlier is the the right for people to have access to their information and this is something that is very much uh universal. uh it's not totally widespread in the US but it's it's getting there
uh we have that in particular in connection with credit information for example have a right of access uh health information gives you a right of access and many companies that operate on an a global basis are required to do that in other countries and offer that also in the US. Uh here this is an example of uh Twitter and and that's the section uh related to your right to have access to your information. Uh when when you are in a in a big data environment you can imagine how difficult that could be. I I have a client right now with whom I'm working and her her her issue is not really big data. Her issue is that uh the um u she has received a request from the department of homeland security homeland security for having access to certain data about one of her customers and uh and the data is everywhere and she says if if I have to respond to their question it's going to take me 10 engineers and and a month to to to grab grab grab every piece that that they want and uh what do I do with that? So, we we're negotiating with Homeland uh DHS to to make it work for for both. But in in in your situation, you you could find yourself exactly in that same situation where you have this huge data bank and then for some reason some entity has the right to have access to that whether it's an individual or whether it's a government agency. What do you do? How do you handle the particular situation? And all of that is actually uh connected with this particular principle which is the principle of accountability. Meaning that that you are responsible for the data in your custody
So what does that mean? That means that you have to be careful to whom you give it. And that goes back to my very early slides when I said be careful. There are things that are illegal. And if you have your report and you know that the report is going to be used for things that are illegal now uh you you you have to be careful not to become an accomplice to to this illegality and that's tied to to this concept of accountability. So accountability is is broader and um it has to do with your relationship with a number of entity whether it's your service providers your your business partners or uh in in the big data case in particular the the the clients who are asking you to do to do certain things and so going back to what I was telling you earlier uh related to the international situations it gets it becomes very very complicated when that involves data of foreign origin because there are even more restrictions. And that reminds me, by the way, that um I told you earlier that Europe has just adopted. Am I already out of time? No, ma'am. 10 minutes
10 minutes. Okay. um that Europe has uh adopted the general data protection regulation and I have in the back of the the room a summary of it and then so you can help yourself and then um I'll bring the remainder upstairs in the the sponsor's room so that everybody can take a copy of this article. Okay, continuing u for my last 10 minutes. The la one of the last principles is the principle of providing security. uh it's obvious you have data that could be very sensitive and so you have to protect it. Um and I'm sure someone is going to tell me, oh well that doesn't apply because most of the data I have is anonymous. And I hope that at least people of your caliber and your experience and your knowledge know that there is very little that is anonymous anymore because of the big databases
So uh don't give me that excuse. Think about security anyway. So security is is complicated but that's one of the areas where there is a lot of guidance a lot of rules and um companies can can find guidance in in in many many documents uh those that uh um is are often used is the ISO standards but there are more and um and I'm happy to give you even more guidance on that. So uh to to conclude on on this part, you see that that there is a very significant disconnect with the needs of the of the big data and the analytics community and and the legal structures that are in place that have been created to protect uh people's uh people's privacy, people's rights, people's ability to find a job, people's ability to uh uh freedom from from discrimination. and so on. So it's it's a difficult uh situation and uh and we need to uh to u to work around that. Uh we we've talked here we have a summary of of the the the big hazards of of big data the the um the indiscriminate collection of of of data the the the profiling possibilities uh and the errors that can be can be done there. They are always and I know you guys are perfect and you have the best intentions but sometimes you make errors occasionally
My favorite one was the one of the very early examples of of big data was uh look at Google. Google was able to predict the flu and uh Google was predicting the flu based on the on the research the search uh the keywords used in in their research and then so that was very exciting. Look, all of this in emphasis on on searches for the flu. And then two weeks later, the half of the country has the flu. Uh that's it. Big data is the savior. We're going to avoid uh uh flu epidemics. And then after thinking a little bit more, they found out that well, but that does not apply necessarily because you can have the flu in Asia and and the Europeans be concerned because the they they are paranoid and they say, "Oh my god, all these people who travel, we're going to get the flu
So what should we do?" And that doesn't mean that they are going to to catch it and um and all the other uh twist that makes that the data was not that reliable. So there can be errors. So uh what what does society do right now in in this connection? I want to bring you some some uh some guidance or some attempt at guidance. Uh one comes from the the White House. The White House has been very interested in big data and so in 2014 and 2015 has produced a number of reports there. They are pretty thick and um but quite interesting to read. Uh same thing at the level of the the Federal Trade Commission. The Federal Trade Commission has produced uh um preliminary preliminary reports and then a final report in January of 2016
Uh the FTC report outlines dangers and we have talked about uh some of them. Oops, sorry. Uh some of these dangers. Uh another source that uh could be of very important interest to you is the uh data science association that has a code of professional conduct. And in particular, if you look at rule number eight, you have a number of the um items that I have discussed earlier uh about uh what you can do to avoid uh or reduce the the mistakes or the errors or the discrimination uh evaluate the quality of the data, taking reasonable measures to protect the clients from um decision based on weak evidence and so on. I'm not going to read the list. You will have a copy. You can refer back to it
But I think it's a good list of of uh uh you know things to to think about to make sure that the work you do is is ethical and um and uh for for a good purpose and uh also things to think about uh policy consideration. Uh so it's another way to translate the the code of conduct um what uh how and to question also what you do um you know how accurate is the data I'm been using and am I jumping to conclusion here or there that that also should be helpful and finally the last two slides are providing you a checklist so that's a summary of what we've seen and and how to translate the the legal principle pulse that that are unavoidable because they they are there into day-to-day decisions that you can make in in your work. So there are there are two two checklists one here and then the second uh is is here and uh you can keep that and on this happy note I will just stop here and hopefully we can have a discussion and uh there are questions Thank you for the presentation. Um, given that many sets of disclosures and other consent agreements are quite long, how do you get users and just people in general to read them? Serious question. Um, these disclosures are really not for users. they they are more for lawyers or for government organizations or for litigants. So uh we have to make them because if we don't make them we get slapped including because of the the laws that are mentioned. So what what we do uh to communicate with the with the real people is often we we have summaries
So, so when when I do my my work, when I work on these disclosures, that's something I do on a on a regular basis. We we have the the long version, but we also have the the five line summary or seven line summary that give them a little bit of the the cliff notes of of what is happening. So, that that's one way to communicate. Uh, another way to communicate is to um the it's called just in time disclosure. So when when you disclose when when you're going to do something you're collecting information adding a a small sentence uh this information is going to be used for this purpose and that's also a way to to bring attention to them. So you it's uh it's it's not easy, but that's that's one piece of work that I love doing with with people like you and and and the marketing folks and so on. It's how how to communicate I our world which is regulated and as I said if we don't do it our clients get in trouble and then and then the reality of of making sure that to the extent possible users are are um are um informed of of what is happening but it it's not it's not easy and and often you know I fight with in particular with the marketing uh people because you're taking my real estate and I need every single piece of that screen. But we we we end up agreeing
But uh as you know, it's it's a place where where you guys can can be creative and uh and give us give us more suggestions. I see a question there. One of your slides you had consent and choice as a requirement for gathering data. Mhm. Uh does it apply to recording conversations without consent? Woo. Uh, this is a huge one. Okay. Um, the the notion of consent is uh applies to to many many many situations
And so it it it goes uh you know when when you have a a website and and you want to have the uh you're collecting information on the website or when you have an app and you're collecting information on the app. The recording of telephone conversation is is one of the most highly regulated um activity. I would say it has its own laws and so uh to uh simplify as much as I can there are about 10 states where it is required to obtain the consent of both parties to the conversation. So, so if you call me and I'm going to record you or the conversation or or I am an employee. I'm I'm an employee of uh Neiman Marcus and then you're going to call me. Neiman Marcus has to make sure that I know as an employee that my conversation is recorded and that you as the customer calling me know that the conversation is recorded. And so that's why when you call whatever you know the call center at PG&E because your your your gas bill is too high they say uh this call may be recorded for training purposes and so on. So they they are required to do that in particular in California
California is a state that requires permission on on both sides. The reason I'm asking is I'm aware of seven states including Texas where there is no requirement for modification Yeah, there are states where the there is uh only one way notification. Yeah. How would that violate the federalification? Let's bring Michael to the question. Oh, you know, he spoke on the mic and Okay. Anyway, I think we're uh we're running running out of time, so we're going to wrap up. Let's thank our speaker once more. Thank you
Uh and conversation is welcome uh after the talk and there is a handout and in the next talk