(SILENCE)
MODERATOR: She has worked for the Dutch Data Protection Authority...
for quite some years, where she conducted investigations...
and was quite involved with drafting EDPB guidelines.
For some time already, she's working for a privacy consulting firm...
called the Privacy Company. -Without the particle.
Sorry, Privacy Company. I thought it was very presumptuous.
Recently, her picture was shown above a New York Times article...
that was earlier mentioned, How the Dutch are taming big tech.
Ladies and gentlemen, Sjoera Nas.
(APPLAUSE)
Sjoera, can I...
The digital world in the 90s, I think you started working there in the 90s.
Was it love at first sight?
Yeah, actually.
I studied history and I...
was really impressed with the invention...
of the wooden printing press...
where rebels printed their pamphlets.
And then, after I graduated, I saw the World Wide Web...
and I met somebody who worked for XS4ALL...
the first internet access provider.
But basically, we have that wooden printing press in computer form and I got hooked.
So it was love at first sight. -MODERATOR: Okay, interesting.
And do you feel that you work has gained more attention throughout the years?
A lot, yes, of course.
So I worked for XS4ALL for a while and privacy was...
we were kind of inventing it as an internet access provider...
as a commercial selling point that we wouldn't sell your data, but others would.
And after that, I moved over to an NGO...
but then an airplane, several airplanes flew into the towers in New York...
and then privacy was the hiding spot of evil for about three years.
Whenever I tried to discuss privacy and data protection rights...
I basically lost from two airplanes.
I even lost a real court case like that, I'll never forget.
XS4ALL was hosting a German radical magazine called Rad Gal...
and they had naughty instructions about derailing trains.
But it had been online for ten years...
and we were wondering why it had to be taken offline.
So we supported the customer that tried to keep this information online.
And the only thing the law from defending the Dutch government had to do...
was wave like this in front of the judge and we lost our court case.
So it has been a few tough years, but now...
if you just listened to the impressive speech from Tamar...
data protection has gained so much the upper hand...
that it's time to push back and fight for other rights...
and not give data protection the royal first place she has gained in the past few years.
MODERATOR: Thank you. Well, I give you the floor.
SJOERA NAS: Thank you.
So I'm going to talk from a data privacy and data protection perspective...
about our experience working for the Dutch government...
different central procurement offices and for the Dutch universities.
Not all of these reports are public yet. We're working on them.
But a wide range of contacts...
with mostly US-American cloud providers and one German one, SAP.
The DPIAs have gained a lot of media attention.
When we started with the publication of the first DPIA...
in, I think it was November 2018...
there was a big shockwave, because we found out...
when we did a technical inspection of Microsoft Office...
which was then still installed on your laptop.
Office Pro Plus it was called.
We found out that this machine...
was contacting the mothership in America all the time.
It's called telemetry data.
Every few minutes, it sent out a batch of information...
about what you've been doing on your local machine, and nobody knew.
This was like...
And if you used a spelling check...
which we were all accustomed to having installed on our local device...
suddenly the spelling check had moved to the cloud...
and we were talking to Microsoft in the United States...
when we were doing a spelling check.
Because a spelling check doesn't just check the word you're checking...
it checks the context as well, so your entire document flew to the United States.
We published as a result of our first DPIA...
that there were eight high data protection risks for the Dutch government...
using Microsoft.
And almost every government official in the Netherlands uses Microsoft.
So a lot of media upheaval.
And big result, Satya Nadella himself responded in the media...
that they were going to update Office Pro Plus globally.
Of course nothing was wrong, but they could improve it.
And then a year later, Microsoft announced...
globally improved new Office data protection terms...
where they copied our demands...
never use any personal data for advertising or profiling or big data analytics.
This is not a one-off exercise...
because of course big tech develops new wonderful services all the time.
So you have to keep on inspecting all the new services all the time.
Another DPIA.
And again, we sat down with Microsoft and negotiated improvements.
Well, this is my favourite headline, that we were 'cheesed off at Microsoft'.
But again, Microsoft, also with the mobile apps...
the conditions weren't perfect yet when we started our inspection.
Google, the same. Widely used in the Dutch education.
We managed to convince Google to agree to major privacy improvements...
as well as with Zoom...
they also agreed to a major overhaul of their services...
to become more GDPR compliant.
So that's how we do.
It's a combination of technical and legal inspections.
The framework agreements are a work by itself.
A lot of work to study all the different elements...
but the technical research is where we specialise.
And if you look at a contract from any cloud provider...
at the start it looks very promising.
They're a data processor that will take excellent care of your customer data.
Everything is well protected in the green locker box...
called 'content data' on my slide.
But the thing what the contract won't tell you...
is what they do with the diagnostic data.
The data cloud service providers...
automatically collect and generate whenever you use their computers.
They register what you do.
And so, we have eight questions. I'm only going to talk three today.
But the first one is always: what does the GDPR even apply?
Are these diagnostic data that I tend to focus on...
are they even personal data?
Long discussion short...
we managed to convince US-American lawyers...
that the GDPR applies to directly and indirectly identifying data...
but then we're just starting the negotiations about an improved contract...
because they tend to only focus on that green locker box...
the content data on top and the data they process...
for example, when you use an email service about other natural persons.
But we tend to focus on all these other personal data they collect...
and we also want those protected in the contracts we negotiate.
Another key question is about the purposes of the processing.
So these are purposes you can encounter in any type of contract...
reprocessing for artificial intelligence, showing targeted recommendations.
I made these letters too big on purpose, because they're in your face, they're open.
You can read them in the contract, but nobody ever reads them...
and understands them, because they're so broad.
So the problem, and I have two examples from Google's general privacy statement...
it's still live today.
So this is... Google doesn't present it like 33 purposes.
Google presents it like ten purposes with a few examples.
But if you do close, close reading, you can see 33 purposes.
But then, you're not there yet...
because, for example, one of the purposes is: use cookies for many purposes.
Or, my favourite one: other purposes not covered in this privacy policy.
And you think you're there, but no...
because there's an additional privacy statement...
for the Chrome OS and the Chrome Browser, which includes:
share the location from mobile devices if you use Google Search.
Did you know that if you use a Chrome browser...
it automatically shares your location when you use Google Search?
Or: use unique identifiers for field trials.
Field trials is a nice word for A/B testing.
So when you use a Chrome browser, you're basically a guinea pig.
You're being A/B tested on the most effective design of the browser.
Does the provider... because this is key.
If you're a public institution or a university, a government...
and you engage a cloud service provider...
you want this cloud service provider to behave as a data processor.
A data processor is the one that determines...
the processor doesn't get to determine anything about what to do with your data.
You're the data controller as a government organisation.
You want to determine for what purposes this cloud service provider...
may process your personal data.
That is frequently not the case.
Cloud providers claim to act as a processor.
'We take care of your customer data in a green locker box, don't touch it.'
But they forget to tell you about all these other kinds of personal data they collect.
And even if they claim to be a processor in their contract...
that may not be true in practice.
You have to assess the factual determination of the purposes.
And whenever there is a purpose in such a processor contract...
that allows the service provider to determine these purposes...
in its own interest such as, for example, marketing or product innovation...
it factually behaves as a controller.
And most cloud providers forget to describe, what I just said...
the diagnostic and the website data.
But then, there's a problem.
Because if the provider is a third party, an independent data controller...
with the data you provided to that party...
or is a joint controller, you're both responsible...
but you don't agree to that, because on paper...
that company only acts as a data processor.
Then, we as a government do not have a legal ground for the processing.
Well, that's the fundamentals of data protection law.
You have to have a legal ground for the processing.
And another huge problem in data protection rights terms...
is that if you don't agree on the role of that service provider...
where does a customer, an end user, an employee go...
if he wants to have access to his personal data?
Then, there's no clear agreement on how to exercise those fundamental rights.
So we most recently completed a DPIA and HRIA...
on the use of Facebook pages by Dutch government organisations.
I'm going to talk you through as an example of how difficult these negotiations can be.
So these are two headlines, that the outcome of our DPIA and HRIA...
was that there were high data protection risks...
for Dutch citizens that visit government Facebook pages.
And the key findings were that there's a lack of transparency, not surprising...
about the types of personal data that Facebook collects...
about the visitors of these pages, especially with regard to cookies.
If you see, the screenshot shows you...
that Google offers you a cookie consent banner choice...
between 'only allow essential cookies' and 'allow essential and optional cookies'.
Looks good, right? They offer you a fair choice.
Only the fact is if you accept essential cookies...
you get tracking cookies, which is not the idea of what you mean...
when you say 'only allow essential cookies'.
And Facebook also has a very long, but not very clear data or privacy policy.
And we can distinguish 15 purposes for the processing...
but most of these purposes are really broad.
So it's hard for the Dutch government to explain...
what will happen to your data if you visit my government Facebook page.
And this is how I want to illustrate the risk of such third-party disclosure.
Google does not want to offer a processor contract...
to the Dutch government or any government for the use of pages.
They only want to offer a processor agreement...
for tiny end result of the use of a page...
namely the page statistics, how many visitors your page got.
But not for the underlying processing when you with your IP adress...
and your interest and your real name, because we're talking Facebook...
are visiting this government page.
Then, in fact, the government is actually handing over your personal data...
to something that can be compared to an event hall.
So it's a lovely hall and the owner offers the space for free...
but requires all visitors to register with their real identity...
and as much information about their friends and interests as possible.
And the government is not in a position as a user of this free service...
to impose any requirement on the data collection and processing.
And based on the Facebook privacy statement...
this event hall owner can exchange visitor data with all of its unnamed partners...
unknown advertisers and other unnamed trusted parties.
And then it's even worse, because as a government you want...
to promote certain content and you expect your page visitors to receive that content.
That's why you opened this page...
and you want to be on the platform where the people are, I perfectly understand.
But in fact, there's no guarantee at all...
that the people on Facebook will get to see your content.
Because basically, they have to walk up eight stairs...
and first pass all the snack food cars...
and walk up eight stairs to your fantastic content.
We also performed this Human Rights Impact Assessment...
to look at more ethical aspects and not limited to data protection.
And we found four risks, human rights risks...
because basically, they all come down to a lack of algorithmic transparency.
There is no way you're ever going to get any overview, insights or controls...
as a government organisation...
over the way Facebook deploys its algorithms...
to show you the content you are trying to present as a government.
And this leads to a lot of negative human rights aspects.
The good news, though, is that with most US cloud providers so far...
and there's a long list and we're still negotiating...
with some of the names I mentioned in my first slide...
we did succeed in creating major improvements.
For example, almost all US cloud providers...
have now agreed to a processor contract with strict purpose limitations.
Basically, it all boils down to three purposes that are logical and understandable...
technically provide a service, keep it up to date and bug free...
and including of course providing support and a secure service, secure the data.
In this contract, we also authorised these parties...
to some limited further processing...
as an independent data controller for authorised purposes...
such as sending invoices.
Of course, we cannot ask these cloud providers...
to become a data processor for all of our data.
They need to be able to send us invoices.
Otherwise, we could tell them:
No, you are not allowed to process our personal data to send us invoices.
Most providers have created some type of diagnostic data viewer tools...
or they've developed elaborate forms for employees...
to ask for access to their own diagnostic data.
One of the major improvements with Microsoft was, for example...
that we said: okay, these telemetry data, are they really strictly necessary?
This ET Phone Home data stream that went from all these devices to the USA...
or can we do without?
And they offered new switches, group policy objectives in Microsoft...
to diminish the telemetry data...
to the absolute strictly necessary bit without any content data.
And a lot of public documentation, because we think it makes it more auditable...
if they are forced to publish what they collect.
And if you then organise an audit, which the Dutch government does...
then you can compare the public documentation...
with what you find in their systems.
And last but not least...
almost every US cloud provider I've been talking to for the last five years...
has now opened up sort of European subsidiaries...
or is creating an entire new company in Europe...
to separate itself from US law enforcement access.
My last slide is about some recommendations...
to better secure public values.
First of all, governments have a huge responsibility...
more even than enterprises, to ensure compliance with public values.
And I would prefer if European procurement offices...
would bundle their forces in a kind of a European coalition.
Why? Because it's not a one-off process.
Currently, we're conducting...
almost two repeat technical investigations per year...
just on Microsoft for the Dutch government.
But there are so many big tech cloud providers...
and all of their new services need to be inspected and verified.
So it would be much better if more governments took up this task...
and we joined each other.
And that collaboration would be much easier...
if governments would oblige all publicly funded organisations...
to publish their DPIAs and Human Rights Impact Assessment.
This is something governments can oblige their own government organisations...
without European rule making.
Though it would be very welcome if there was European support...
for such initiatives as well.
And data protection authorities could focus more on missing...
on the lack of DPIAs where they should've been conducted.
Now, we often see enforcement on for example, reported data breaches...
that the data protection authority then starts to investigate if it was well fixed.
But instead, they should focus on the breaches that were not notified...
on the DPIAs that were incorrectly not performed.
That would encourage more governments to conduct DPIAs in time.
And I hesitate to say after Tamar's speech...
but I still have somewhat more faith in competition authorities...
though I realise it's market authority and not public values oriented...
not public goods oriented.
But I am super hopeful about a new court case...
at the European Court of Justice from the German Cartel Competition Office...
against Facebook about abusing its ability to ask for consent from users.
If you have near monopolistic market power...
your question for consent becomes a lot more difficult...
to obtain freely given consent.
So I see that the advocate general of the European Court of Justice...
acknowledges this potential abuse of power of invasive privacy...
imposing invasive privacy terms because of your market power.
And I'm curious about the outcome.
My last two points are, I think I agree with Tamar...
that data protection shouldn't be the only glasses we're using...
to look at this problem.
We should combine forces with competition authority...
and the future AI office or AI agency...
and create one central regulator...
for, let's say, 100 very large online platforms and service providers...
and approach the societal risks from these very large platforms and providers...
through the scope of all these different expertises...
and combine the best of all these new EU laws.
And finally, we shouldn't just put all of our efforts in making big tech comply.
We should also start to develop our own open source, EU-based...
EU-native alternatives to encourage competition and vendor lock-in.
Because realistically, we were faced with a ban on Google...
on the use of Google by public schools in the Netherlands two years ago.
What is the alternative for schools that can no longer use Google Workspace?
Well, Microsoft Office. And then it becomes quiet for a very long time.
What other alternatives do these schools or these government organisations have?
Thank you.
(APPLAUSE)
MODERATOR: Thank you.
Thank you, Sjoera. There's a question.
Is your way of working open source...
so that others in other countries can use it too, for different digital services?
Is your way of working open source...
so that others in other countries can use it too, for different digital services?
So first of all, I want to say thank you for asking me about open source...
because we do publish all of our DPIAs and HRIAs.
And it's not me publishing, because I'm a consultant, I'm hired.
But I'm super proud of the Dutch government...
that they have the guts to publish these reports...
even when these reports say high risks.
And then everybody is in a panic, because what can we do with high risks?
MODERATOR: Is it just a matter of guts doing it or not doing it?
SJOERA NAS: It's guts, because it affects...
The problem is, we have a data protection authority in the Netherlands...
that can enforce in the Netherlands.
So if as a government organisation or any other organisation for that matter...
you publish a DPIA and you acknowledge: okay, we have a problem.
Then the Data Protection Authority can actually start to enforce with you...
for having a product that's not compliant.
So it's guts and it's strategy of course...
because once you publish these reports in English...
you get an international dialogue.
And you tell these cloud providers...
look, we're going to publish this report in English with eight high risks...
the whole world is going to read this, the people that matter.
And at least in Europe, that's 450 million potential users...
that should not use your services if you're not GDPR compliant, right?
So the internal market works in our advantage.
But it's also risky, so it's also a gutsy strategy.
And the more governments support this Dutch approach, the better it is.
Because then, if for example, the Italian government...
publishes a DPIA on a service from one cloud provider...
we can just copy those findings and not repeat the same process all over.
MODERATOR: Okay. There are two more questions.
Let's go to those questions. The first one is...
do you feel it is possible to make safeguarding public values...
a driver for consumers, so that consumers will choose a service...
that secures public values over a service that does not...
that they find that attractive as a consumer?
Sometimes consumers vote with their feet.
We've seen when WhatsApp changed its terms and conditions...
a lot of users suddenly moved over to alternative messaging apps.
We've seen with changes in the policy of Twitter...
that a lot of people left Twitter and started looking for alternatives.
Putting the burden on the consumer is not my idea of a fair deal though.
So my idea is to improve the world through legislation.
And, for example, in schools, children don't have a choice, right?
They are faced like Tamar's kids...
they just start to use Google Workspace in school...
and you don't have a vote and you can't refuse.
As a government official, you can't say:
Well, I rather not work with Microsoft, I rather work with something else.
Because then, you're out of a job. -MODERATOR: There's no free consent?
SJOERA NAS: No, exactly.
But also we should prevent putting consumers in a situation...
where they have to make such choices. -MODERATOR: Thank you.
Then, another question from Marjolein van Tricht.
How much faith do you have in European-based open source alternatives?
SJOERA NAS: How much what? -MODERATOR: Faith do you have...
I had a very Dutch pronunciation, I'm sorry for that.
SJOERA NAS: How much faith I have in European open source alternatives?
So far, they are not very visible or as good as big tech.
This is called the network effect.
Of course these huge cloud providers have a major advantage...
in having billions of users...
and, for example, staff of 200,000 or 300,000 engineers...
working on improving the product.
Who can compete with that on a voluntary basis, right?
So one possible solution could be structural investment from governments...
and giving the right example by investing in, for example...
school alternatives for a video service.
A government can easily fund just such a small alternative...
for the current practive where everything is marketed, our childrens' data.
And the schools' offer their lessons on a US-American platform...
where their copyright is sold away.
So that kind of faith requires funding, basically.
MODERATOR: Great, thank you. Are there any questions from here?
No? Okay.
Thank you for your keynote speech, Sjoera.
(APPLAUSE)
(SILENCE)