(SILENCE)
MODERATOR: Now, let's go to the first panel.
And I would like to invite to the stage Graca Costa from the EDPS...
Estelle Massé from Access Now, and Rosa Barcelo...
lawyer at McDermott Will & Emery.
(SILENCE)
Sit wherever you like. Sorry.
Thank you.
You can take a microphone.
That one is turned on.
(SILENCE)
So this panel is about the legal aspects of securing public values online.
We have three short presentations, five to seven minutes...
and afterwards, we open the floor for discussion.
Graca, would you like to start?
(SILENCE)
GRACA COSTA: Thank you very much. Can you hear me? I think so.
So first of all, thank you for the invitation. It's a pleasure to be here.
Mr. Wiewiórowski could not be here, the European Data Protection Supervisor...
but it is indeed my pleasure to share the EPDS views with you...
on this very important topic of sharing...
and securing public values online.
I would like to start, as we all share this view...
new technologies are not a problem.
In fact, they are tools that help us to be more efficient...
that help us both private and public institutions to achieve higher efficiency...
streamline processes, improve citizens' and customers' engagement.
However, we just need to be aware of its implications.
This is the key message.
We need to know what are the processing operations...
behind the use of these tools.
And to act with caution and with clear understanding...
will allow us all to be more protected...
and not just to achieve compliance, but indeed to protect a fundamental right...
the right to data protection.
The best way to put an effective stop to any kind of excesses from big platforms...
is for us Europeans to reaffirm our values.
And we should put at the center of our discussion the digital humanism.
This form of humanism is not new...
because we are talking about digital humanism for several years now...
but what we need, is to indeed make sure that we enforce...
and that we cherish this digital humanism.
And that will require technology to be respectful...
and that we as individuals can act with dignity and autonomy.
This year, 2023, the GDPR will be celebrating the fifth anniversary...
of its entry into force.
And despite its relative young age...
we can say with certainty that it showed a degree of maturity...
that inspired other legislations all over the world.
And we see that the concept of the Brussels effect...
which in fact was developed by professor Anu Bradford...
at Columbia University...
refers precisely to this influence of the European Union in other countries...
that want to have commercial relationships with us.
And in the end, data protection was leveraged in those countries as well.
And so from Barbados to Uzbekistan...
we have more than 145 GDPR inspired legislations.
And don't take me wrong...
of course not all legislations ensure the same level of protection...
but already the fact that they have thought of introducing data protection...
in their national legislations, shows the importance of the GDPR.
And the GDPR has not only leveraged the data protection standards...
within EU as we saw...
but also organisations in the EU started to think about data protection.
And we cannot really measure the impact of the GDPR very accurately.
We know it was immense...
but it's impossible to estimate the real effect of the GDPR...
in the protection of this fundamental right, the right to data protection.
However, despite all these big achievements...
we all recognise that the GDPR did not solve all data protection issues.
And it is still an objective criticism...
for not having delivered the very high expectations it had raised.
And so five years after it's entered into force...
we can already start making some assessments.
And we see that there is an unequal burden...
shared among data protection authorities.
Because under the GDPR's One Stop Shop mechanism...
the Irish authority has the lead on most cross-boarder cases...
involving big tech companies, for example...
as many of them are indeed based in Ireland.
But this is not an issue of the Irish Data Protection Authority.
This is in fact a structural issue...
that was somehow created, without wanting to, by the GDPR.
And so we need to have a structural reply to this issue...
and not necessarily to pinpoint a particular data protection authority.
At the same time, we also notice that several procedural law differences...
are hampering cooperation between data protection authorities.
When we talk about big tech firms and the data protection issues related to them...
these are issues that are absolutely transversal.
It's not at national level they are happening.
So what we need, is also to have an international, harmonised approach...
towards these issues.
And therefore, cooperation is absolutely essential.
Also the European Data Protection Board is showing its force...
and it has been absolutely crucial...
as a body that gathers all data protection authorities...
to find consistency...
to find harmonised interpretation of data protection regulations.
But we see also that this body is sometimes involved too late...
and some other times too little.
And so if we want to have a coordinated answer...
to all the issues that we have been talking about here today...
we need definitely to involve more the European Data Protection Board.
And we've seen that when the EDPP, The European Data Protection Board...
is involved at a very early stage...
it is the right platform for cooperation.
And examples of this cooperation is the fine...
applied to WhatsApp or to Meta, and there are many other examples of course.
Again, as we've seen today, the GDPR is not the data protection single regulation.
It's part of a puzzle.
And the legal framework is much broader and it's even increasing.
I will not repeat the Acts that were several times mentioned here today.
The Digital Services Act, the Digital Markets Act...
but also the ePrivacy Directive.
We have a number of legal regulations...
that allows us to frame how processing of personal data should be.
These regulations should not be seen as ways of stopping innovation or technology...
but just a way of framing how we can use technology in a fair way...
in a more responsable way, in a more ethical way.
And therefore, we need to have a legal framework.
And why is this so important?
Because we talked also and heard today about the artificial intelligence...
and how indeed a new Pandora's box might be opened.
What we really need, is to have a legal framework...
before starting to launch a product, so that the boundaries are set.
And one of the most important lessons, recent lessons...
is definitely the Cambridge Analytica scandal...
And it show what can happen if we start cutting corners on data protection.
We need to keep in mind that we are here not protecting data...
what we are here, is to protect people, individuals.
And I see that I'm arriving to my time, so I will just end with a positive note.
We believe that we are not too late.
We are continuing to be aware of the risks...
but also ready to take action. Thank you.
MODERATOR: Estelle Massé. (APPLAUSE)
(SILENCE)
ESTELLE MASSÉ: Thank you.
Thank you for having us here, first.
I'm Estelle Massé. I work for Access Now...
which is an international NGO...
for those of you who may not know us.
And we are a member of EDRi...
the European Data Rights Network.
We're here today to discuss the public values that go through tax policy...
and how to apply it for governments, and also through cities and lands.
And we spoke a lot obviously about data protection...
because it's been the first move of EU tech regulation...
in approaching those public values, the first right move I would say.
And it's also a strange animal in the EU treaties.
It's one of the only fundamental rights that also has a separate legal basis...
in the treaty that has empowered the EU to develop a really strong framework.
So to start with the first food for thought...
of maybe if we want also to extend a legal basis...
for other fundamental rights and other social rights...
to make sure that they are as well protected in our legislation as data protection.
Maybe the article 16 that gave us the GDPR is a first pass.
But even without it, we can say that the EU has a quite impressive track record...
in legislating four fundamental rights in the digital context.
We spoke a lot about the GDPR...
but it's also true with the Net Neutrality Legislation...
the DSA, the DMA and hopefully the future AI Act that is coming.
Those legislations are rooted in implementing and advancing...
the rights protecting under the charter.
And they do have a right focus, although not all with the same degree.
And that's what I want to reflect on a little bit today...
that some of the bottlenecks that we are seeing in EU legislation...
that then translate in how the rights are being felt in practice...
comes from two issues we experience with the way regulation happened.
The first one is why the EU is a legislative superpower.
The regulatory power after the enforcement of it...
has not yet followed this superpower level.
And there is a little bit of issues that was already mentioned.
And the second part is how much the impact of big tech lobbying...
that is really felt almost on a daily basis in Brussels...
cripples down through the legislation and continues having an impact...
on the way we are building, but also implementing those legislations.
First on the slow or inconsistent enforcement of positive EU law.
You've heard from our colleague at the EDPS already...
about some of the enforcement hurdles that we face with the GDPR.
There is still a lot of value and an overall positive message and sense of:
'Europe did the right thing with the GDPR', and we definitely share this message.
But five years into the application of the law...
we're not exactly where we would have hoped we are.
And this law enforcement of the law has had impact both on the market...
and on the existence of the fundamental right in practice.
On the market, it has delayed an important expected effect of the GDPR...
which was: a potent sector shift away from data harvesting practices...
and toward a more privacy-friendly approach.
Very much though, we still see that the prevailing business model...
of the big tech companies remains centred around data collection and exploitation.
And the shift obviously is not going to happen overnight...
but for that shift to happen, we would need strong strategic enforcement of the law...
to send clear signals that those practices are not acceptable.
Because this is not yet happening, we have some actors...
that are choosing to not comply with the entirety of the GDPR...
and sometimes negate some of our rights.
Because they conduct a sort of risk-based approach analysis internally of:
which measures should I comply with in order to avoid a fine...
or which measures are likely to avoid some scrutiny?
And this is a problem for denying us access to key rights...
and for data security in general.
And those are important lessons for the DMA and the DSA...
that are soon to enter into application, that an enforcement message stands early...
is really important for the market and for ensuring that the objective...
for which the law had been created, are delivered.
This also doesn't mean that we're too late for the GDPR and I'll come back to that.
I'll move to the second hurdle on how we get there...
and the impact that is a bit more invisible of lobbying...
even after a legislation has been adopted.
And you've heard me use the phrase risk-based approach.
If you're a native speaker in Brussels' bubble jargon...
you've heard that word a lot of times.
From my own personal experience, the first time I heard it...
it was about ten years ago in discussing the GDPR.
And initially, this vocabulary was here to be made...
to make sure that there was enough flexibility for companies...
in order to apply the law...
but also make some determination on how to put a product on the market or not.
Why not? That doesn't sound too bad.
But when you start putting this approach in every single legislation...
that are fundamentally about rights, that are about technology...
and you put in the hand of private actors...
the right to determine which risk they can take...
in relation to our fundamental rights and our public values...
that becomes far more problematic.
Often, those flexibilities are presented to us as a way also to ensure...
that there is enough room for newcomers to innovate...
that the rules are not too stringent and that we can ensure competition.
This is a really important point again, because we talked quite a lot today...
about the monopoly that big tech companies have...
and the structural power and market power that come with it.
So obviously, ensuring that the rules we have with a lot others to come in...
is important.
What is interesting to see though, is that this risk-based approach...
is not lobbied or advocated by SMEs...
but by big tech companies speaking on their behalf.
So some if it is genuine, but a lot of it is also astroturfing...
and understanding that this is a policy objective of the EU...
that is taken on by foreign companies...
that are just trying to assert their monopoly once again.
Because the reality is that a lot of vagueness and flexibility...
that come with a legislation that embodies risk-based approach...
create difficulties for compliance for SMEs afterwards.
It's a lot of measures that you have to analyse...
it's a lot of new systems that you have to put in place.
And when you're a big tech company with deep pocket resources, you can do that.
If you're a small business that is starting...
and trying to operate across the internal market...
this is an additional compliance cost that your competitor...
I just put forward for you...
under the argument that those flexibilities would actually help you.
So we need to be careful of what those jargon words mean in practice...
and how they would translate both for fundamental rights and for the market.
If we see that for people's rights...
when we look at the risk-based approach and what it means for us...
is that we're told: don't worry anyway...
because we have the charter and they cannot violate it.
And no matter what, as soon as there is a risk, safeguard will be put in place.
But we need to acknowledge that when a company assesses risks...
it doesn't assess the risk for our fundamental rights.
It again assesses the risk.
How much money may I lose? How much sanction may I have?
MODERATOR: Estelle, we have one minute left.
ESTELLE MASSÉ: I'm going to conclude with the point that...
this risk-based approach is creating a scenario...
whereby tech companies are able to reinforce their power...
and shift the approach that the EU has chosen to have...
and still managed to defend in its legislation.
But it's slowly and surely building and over ten years...
where we started with GDPR where there is a little bit of risk-based in it...
but it's fundamentally still rights-based...
and now the AI Act that is fully risk-based from the get-go.
And so this is a really strong signal...
that we now need the regulators to step in...
to reverse that tendency and to address the shift of power...
that this risk-based approach has created.
And for the regulator to be strong, we need to have resources...
so that they take on those companies that are sometimes richer than them.
We need to ensure the independence...
so that it can act without the fear or interference of pressure...
in particular in Ireland or Luxembourg where the big tech companies are set.
And we also need to make sure that lawmakers...
when they look for a centralised approach for enforcement...
like we see on the DSA or the DMA...
they also don't shift the lobbying from the capitals to Brussels again...
because the lobbying will continue happening...
so we need to protect ourselves.
Lobbying is not just a threat when you legislate the law...
and Brussels has been able to resist the most stringent impact...
but it still continues when it's being regulated...
and impacts how the rights and objectives are being delivered.
So we need to stay vigilant throughout the whole pass.
But I'm also optimistic that we can fix it. Thank you.
MODERATOR: Thank you.
(APPLAUSE)
Rosa.
ROSA: Okay, thank you.
Thank you, Shai. And thank you, Dutch government, Alexandra...
for the invitation to be here and to be with these co-panelists.
So my name is Rosa, I'm a data protection lawyer.
I work for a law firm, McDermott Will & Emery...
and I have been doing privacy...
in my whole life before...
in European institutions...
where I met Sjoera.
So my comments today, I don't represent the client that pay for these comments.
This is my personal view, it's based on my experience...
for whatever is worth it.
So in preparing this small input, I have been thinking about...
so we have the GDPR. What has gone good?
Is there something that has gone not so good and take it from there?
My first impression is...
I see the glass quite full on the GDPR...
and we have mentioned DMA, DSA, now the AI is coming.
So I tend to be positive.
In terms of rights, I think we have a very strong data protection framework.
Now, this is number one and I think that we shouldn't stay here.
I completely see it in the same way.
Second is, we have quite a lot of challenges still...
challenges and opportunities.
Because it's also an opportunity for companies and for individuals.
And I was trying to think: where are the aspects...
just to give a flavour where it seems that things need improvement.
One that comes to mind to me immediately and in my daily work, is transparency.
Sjoera has made this point before.
Transparency, tellling people what data is used for...
for which purposes, where does it travel, underpins the other rights.
If you have no idea that data about you is being processed...
you might not even have a concern.
So this communication...
I think that it is a scope for improvement and I see it in my work.
Now, when you... An example.
I wanted to give you an example before I forget, is...
recently, a company comes and tells: 'Hey, Rosa', this is a multinational.
'We have a few employees who want to know where their data is located.'
So you know, we use service providers, some of which have been mentioned today.
Some others know there are many, I don't want to mention any...
but the typical payroll, you need a service provider, training...
performance reviews, communication, email.
So each of these providers has an MSA, Master Service Agreement...
and a DPA with us.
Now, each one of them, this is the general counsel, tells me...
Well, each one of them, I see in the counter, they use sub-processors.
So good luck to go to the, let's say, five, ten...
to go and see where the data is located.
So it's quite complex.
And the processing, Sjoera mentioned...
sometimes you say you did the DPIA for the Dutch government.
Well, not all the companies can go and spend the money to do a DPIA...
and decide: okay, this telemetry data is there. Well, I didn't know.
So all of that boils down that, yes, there is an issue that needs to be improved.
When I look at how to improve it, I think: do we need more laws?
I think the laws we have, the GDPR, is quite thorough about...
that notification is needed, what we need to tell.
So laws are there. We need to comply them.
I think: do we need any more tweaking laws?
And the other day I was looking...
well, for example, the GDPR has something that has not been used.
It could be used, it's Article 12, 7 and 8.
It empowers the Commission through delegated acts to come up with symbols.
And, could be, I'm not sure, a kind of symbol that will help people...
to understand which type of data.
I imagine the same, and when you look at food, there are symbols.
I don't know. It's nothing.
Maybe more enforcement?
If I have a client, he's not going to be very happy...
to say that we need more enforcement, but could be another something.
More guidance?
The European Data Protection Board has guidance already.
I think it's pretty good. Could be more, could be done?
So I'm afraid that this is a problem...
but there are some areas to think about how to improve it.
But it is a problem.
Now, number two. Do I have time still? -MODERATOR: Two minutes.
That's bad, because I think that number two is maybe more relevant.
So number two, it's something that happens now every very often.
So you get a client which is going to use a new service provider...
like the ones Sjoera has mentioned.
And they tell you: Hey, have a look at the contract.
And I see something like, it will say, I think Sjoera has mentioned it in some.
We may analyse your content using machine learning...
to develop and improve the services. We will do that.
And that's good in a way.
It's good, because I think most clients will want to have better services.
And if version two can be better...
I think it's a very allowable purpose and yes, it's good.
So from a company side... But the company will say:
Hey, are you going to use the data of all of our employees for this purpose?
I am the data controller as a company...
and yet, you will use it to improve your services.
So here, I think that we are in an environment where there is certain...
A, uncertainty.
Sjoera said it. What you are doing...
are you a data controller for which you are responsible?
Yet, you don't have maybe direct links with all these employees.
Or are you a data processor acting on my behalf?
Sjoera said that she managed the Dutch government...
to have DPAs with various explicit and specific purposes.
This is great and this was done.
But it's something that we find all the time.
To me, doing the machine learning, AI, to improve the services, again, is good.
But I think that there is a need for the provider...
to, A, inform the client, B, to give the client some leeway.
Do you want it, yes or no, to have the saying?
Does the client or does the end user want that?
In some cases, it's going to be a final end user.
I think about ChatGPT.
If you have tried it, it does say quite clearly:
we are going to use the responses to improve the algorithm.
And it gives a right to opt out from this.
So here it is. And then also the possibility for a client to say:
yes, I might want it, but pseudonymise or anonymise the data.
And then, yes, please improve it.
So these three or four requirements...
I think that they are not happening yet or not as much as one will want to.
And if you think, how do we go from here?
Again, I don't think there is a need for more laws.
I think that what we have is good enough.
Guidance from the EDP Board? Yes, please.
This, I think has not happened yet, is key.
So machine learning, AI, from a data privacy perspective...
both for end users being ChatGPT final customer...
or for a company using it...
like it could be one of the service providers that have been mentioned.
But in both cases, it's the same.
Using data from individuals to perfect a major aid.
So I think in addition to guidance, I also see...
I think you both mentioned it and also Sjoera...
is a certain level of EDP Board could be coordinated enforcement.
It already existed under the GDPR...
so the ability for the Board to say: this is a priority.
And then, each DPA goes back home and says...
at national level, this is a priority and we will action it in a way...
that is coordinated and the same in Europe...
because ChatGPT is the same in all countries.
And, for example, now we see different ways of enforcing...
what is the same service and you will prefer it to be one.
So at the end, just one thought on data privacy...
when you look at the framework, to me, there is a weak spot...
I completely concur with all of you and with Sjoera previously...
that is the enforcement.
Here, there is something that needs to be... to make it effective.
MODERATOR: Thank you very much.
(APPLAUSE)
Now, let's open the floor to discussion.
I already see two questions online...
but I also wonder whether the public has any questions for our panelists.
So the two online questions are:
what should be changed or added to the GDPR...
for it to be ready for the innovations and developments we are discussing today?
That's the first one. Let's deal with that first.
That's enforcement for you, you just said. -ROSA BARCELO: Correct.
MODERATOR: Graca and Estelle?
GRACA COSTA: Well, I think that indeed effective enforcement is very important.
We need to have an enforcement that really tackles the source spots...
and addresses the infringements that put in peril our values and our democracy.
MODERATOR: And may I ask, the source spot...
is this One Stop Shop that makes it possible?
GRACA COSTA: Well, it has not been the best path...
so it is indeed a small stone on the path that we need to overcome.
But effective enforcement is not just about the One Stop Shop mechanism.
We need it to be also proportionate, we need to indeed have a good balance...
between the right to data protection and also other fundamental rights.
And also to make it dissuasive, visible.
It's important, it's not just about applying fines.
Applying fines is the very last stage.
MODERATOR: Be present from the beginning.
Precisely. I think it is more efficient if it is that way.
Thank you. Estelle.
ESTELLE MASSÉ: I'll start with this point and then I'll come to the innovation point.
Completely agreed that enforcement needs to be dissuasive...
and also in proportionate and really to be effective also.
The fines are one of the sanctions, but often not the one...
that we as data subjects seek the most, because...
there is almost 3 billion worth of fines that have been issued for the GDPR...
probably by May 22 we're going to reach the 3 billion...
with the upcoming one on Meta.
But the numer of times with this fine...
where there was also a deletion ordered issue...
where you know a company has been fined like...
you shouldn't have user data, here is a fine, pay that fine...
but you continue having the data...
that you were not supposed to have in the first place.
And that's not okay.
So using all the sanctions available. So there is no need to change the GDPR.
There are mechanisms available under it...
but we need to make them used and efficient.
And when it comes to the second part of that question...
of whether we need to change the GDPR for innovation...
the innovation that we're discussing today, a lot of discussion around algorithms...
they already existed at the time of the GDPR...
and they were quite well thought through in the process.
And this is a legislation, again, that puts the baseline of protection...
that needs to exist and is really fit for purpose.
Where we may need to have some reflection...
is how we can use the AI Act to maybe complement a little bit what exists.
The way the ePrivacy also is supposed to come here...
complementing in the communications area.
And so when we talk about AI, for instance, it's not just about personal privacy...
but sometimes it's also about our collective and societal privacy.
It's my information that is going to be used...
and that someone cannot go to school or access alone.
So maybe create additional protection in this future legislation.
MODERATOR: Are you saying that the fact there's a very small DPA in Dublin...
that is supervising so many companies...
is that a problem as such?
Do you think that? That's a question to all of you.
ESTELLE MASSÉ: As part of the One Stop Shop, I think...
the over-reliance on what is called the lead authority...
that happens to be Ireland in a lot of the big tech cases...
because it's where they're headquartered.
I think it has created both a disproportionate burden on Ireland...
and also difficulties in enforcement in the sense that...
there is not always agreement on how cases should be dealt with...
or we also as citizens don't have the same rights to be heard...
under Irish procedures.
Now, that doesn't mean that the whole system doesn't have value...
and it was created also as a way for people to have a recourse mandate close to them.
But the reality is that we have created a One Stop Shop for companies...
where they only speak to one regulator.
But me as a citizen, I file my complaint in my home country, in France...
which then goes to Ireland and then often goes to EDPB.
And while all of this happened, I get silence...
while the company has one regulator.
So I have a three stop shop and mostly silence...
and the company has One Stop Shop.
So definitely, as many of you know, there is an enforcement reform...
happening over the GDPR part, and I don't think it means...
that the One Stop Shop has to be scrapped...
but we need to go further into the detail of everywhere in the GDPR that says...
shall cooperate, needs to cooperate, have to cooperate.
What does it mean and make it happen in practice...
so that the regulator that I went to for my representation...
being the Dutch, being the French, whoever...
really has a say and it's not left to a single regulator.
One, it's unfair burden...
and then also just the pressure that this regulator may get as a result is...
MODERATOR: Clear.
Graca and Rosa, do you have a comment on that?
GRACA COSTA: Well, indeed we need to have also a consistent approach...
and the fact that we have different data protection authorities...
that might have different answers to the data controllers...
does not really help in terms of a consistent enforcement action.
So the more we can find a solution...
to have transversal, but consistent approaches to deal with big tech firms...
the better.
And there we go again to the cooperation part.
What is needed, in fact, is that we increase the level of cooperation...
not only at the procedural levels, because sometimes national...
So the EU member states have the entire definition of administrative rules...
and, for example, to be very concrete, the final decision in a complaint case...
differs from member state to member state.
So the stage where it is considered a final decision...
is not always the same in all member states and that can pose difficulties.
MODERATOR: So we should work together way better?
GRACA COSTA: Definitely, to have a consistent approach...
and to improve our cooperation.
And last but not least, perhaps what we should also aim at, is to empower citizens.
They are in the first line to be on the driver's seat to protect themselves.
That doesn't mean that they should have the burden...
of protecting themselves against.
It's not a David against Goliath battle, but we need them to be aware of the risks.
We need them to participate in their own protection.
And that will only be achieved with education, with empowerment...
and in that field we have not yet achieved a very high level...
of critical mass of awareness raising.
MODERATOR: Clear, thank you. Rosa. It's not on.
ROSA BARCELO: This technology.
So I was thinking, I think that this is a question that can be...
divided into two sub-questions.
One is the cooperation of the data protection authorities...
before there is an ongoing case, so absence of ongoing cases.
I think there, the European authorities have started to cooperate together.
So, for example, there was this initiative on cloud, looking at cloud.
And now there is a new one on data protection officers.
They are all looking whether data protection officers in each country...
have acted independently, in order to harmonise the understanding.
I think here, you can do much more with the existing tool, with the existing GDPR.
There cannot be done much more on machine learning, AI.
It could be used, it could be a tool, a magnificent tool.
So that is ready to be exploited. So that's one.
Second, I follow and feel convinced...
about the fact that when there are existing cases...
indeed, the GDPR does not have enough granularity...
to establish how the cooperation should be doing.
So in this regard, the Commission seems to be now...
already I see they launch a consultation...
so we are told that the legislation will be presented very soon.
So hopefully this will be the solution.
MODERATOR: Thank you. There's a question from the online audience.
Should we, besides the GDPR, have regulations for other public values too?
As Tamar Sharon suggested, should we, for example, guarantee publicness?
So actually the question is: are the GDPR, the DSA, the DMA...
the Data Act, the AI Act, is it enough to secure public values online?
Estelle.
ESTELLE MASSÉ: I don't pretend I have an answer to that...
but maybe I can share some of the reflections we have with my colleagues...
as we were embarking after the GDPR...
in the area of legislation that was happening, and thinking...
how do we make sure that we protect freedom of expression online...
when there is not a freedom of expression in a legal basis under the treaty?
And how do we make sure we protect the right to non-discrimination...
in the AI Act, when it's a right under the charter...
but we don't have in all EU countries non-discrimination regulatory authorities.
It's not necessarily an expertise that our regulators have...
or even we don't have a non-discrimination full framework in place...
in the tech context in Europe.
So we do have this question of...
maybe we don't need a GDPR for every fundamental right.
Maybe we do, I don't know that.
But we do have a very strong data protection lens I think...
as it was mentioned before on our tech regulation in Europe...
which I see positive in the sense that it anchors in the charter...
and in fundamental rights...
but we need to not exclude the other rights that come with it...
and where those limitations come.
Because sometimes it can create also tension with other rights.
In particular, if we look at the conversation of the DMA...
some of the remedies that were discussed when the law was being negotiated...
was that in order for Amazon's competitor to be able to challenge the marketplace...
let's open the database to everybody.
And then came the question: Wait, but I gave my data to one company.
How does it go to everybody? -MODERATOR: Privacy is in the way there.
Or when there is a merger, when Google bought Fitbit...
our point to the European Commission is: I didn't give my data to Google...
so I would like all of this information to be deleted.
But this was part of what Google bought.
But we had no way to say no, because it doesn't apply in the selling.
So I think we have missing gaps that we need to be thinking of...
when we do the sectoral legislation after.
I don't know if we need more legislation on every fundamental right...
but we do need a more coherent approach...
that comes to complete the data protection one.
MODERATOR: Great, thank you. Graca.
GRACA COSTA: Well, I must say that...
my first master's was on the implications of data protection in the right to identity.
How we could change our way of behaving if someone was observing or surveilling us.
So data protection has the versatility of being a very interesting right...
that touches upon many other fundamental rights.
In fact, we've seen that in countries where democracies are less strong...
the right to data protection is also less strong.
So there is this direct link, for example, in ensuring the right to data protection...
and having a healthy democracy.
Therefore, there is this emphasis on the right to data protection...
because indeed, it's not an umbrella right...
but it is a right that touches upon the right to freedom of expression...
and many other rights.
And the funny aspect is that we should not neglect other fundamental rights.
In fact, we need to make this balance exercise when they are in conflict.
But by ensuring that there is compliance with data protection regulations...
we are already protecting other fundamental rights.
Nevertheless...
any lawmaker needs to have this very difficult exercise of foresight...
to see what the reality is going to present us...
and to be two steps ahead and try to regulate something that is not yet in place.
And artificial intelligence is a good example of that.
Generative AI is a good example of that.
How to do it?
Well, it requires imagination, it requires an effort, some work.
And in fact, at the EPDS, we are even making an exercise...
on a nearly basis to identify certain trends, certain technologies...
that might create more risks to data subjects...
and that are worthy of a certain monitoring...
so that we can be also prepared to regulate and give guidance if need be.
So lawmakers in particular need to be a step ahead...
and to have this foresight exercise...
to be able to create the legal framework for certain realities...
that will highly impact data subjects' rights.
Thank you. The last, Rosa.
Actually, I don't have an answer.
So just to say that I have been very interested...
in hearing the presentation of professor Sharon.
It has a bit taken me by surprise.
And I thought that I would want to read again the presentation...
or what is behind, because I thought it was very interesting.
So I am still digesting the current legal framework.
So thinking that is not enough...
it will be something I would like to know more about.
So we need to continue this conversation about what is...
how are laws that we have for almost five years, in ten days already, the GDPR...
and then the other laws have taken effect a bit shorter, DMA, DSA, AI.
Not even here, yeah.
But we have to very, very, very closely monitor everything is what I'm hearing.
Thank you. Is there a question? Yeah? Okay.
MAN: Thank you.
Earlier on, the minister asked for EU countries, for member states...
to each do a GDPR or a Human Rights Assessment on several platforms.
Would governments acting in a coordinated way help this forward?
MODERATOR: Estelle. -ESTELLE: Thank you.
Yes, absolutely. EU governments have the responsibility to lead by example...
and showing the value and the objective of those legislations...
and doing DPIA and Human Rights Impact Assessment.
And thinking of their own impact and their own use of data...
is an extremely important exercise.
I think the complexity of that has been explained also in the keynotes.
But none of those regulations happened without the member states...
and none of the reality behind it happened without the member states.
So we need to make sure that the Brussels effect...
doesn't stop at the Brussels effect.
And Brussels is nothing without the member states.
So yes, we need you all.
GRACA COSTA: And as controllers, governments also have responsibilities.
Not just as lawmakers and enforcers, but also as data controllers.
In fact, when we think about the risks that big tech firms have...
regarding these huge amounts of data...
the governments also have very big, large-scale...
sometimes including the entire population.
And because of that, there are higher risks...
and therefore higher responsibilities to protect.
And the key answer here is of course, when possible, minimisation...
but when not, I think the protection and the transparency...
as Sjoera was saying, to share a DPIA is not a sign of weakness.
In my view, it's a sign of strength.
MODERATOR: Governments should act.
GRACA COSTA: Governments should also act upon the information...
that is being delivered to them through these DPIAs.
But to be very honest...
I was the first one applauding the attitude of publishing a DPIA.
It's not very common, so it is a first step that is very welcomed...
and that shows a great vision in fact.
MODERATOR: Thank you.
I think it's time for a well-deserved break after this panel, these keynotes.