A week in privacy - Themes not Dreams

Welcome to the Serious Privacy podcast, where Paul Breitbarth and Dr. K Royal discuss a week in privacy and they seem to be themes but not dreams. privacy is a work in progress. Ralph O'Brien was out this week. @trustarc 

If you have comments or questions, find us on LinkedIn and Instagram @seriousprivacy, and on BlueSky under @seriousprivacy.eu, @europaulb.seriousprivacy.eu, @heartofprivacy.bsky.app and @igrobrien.seriousprivacy.eu, and email podcast@seriousprivacy.eu. Rate and Review us!

Subscribe today HERE

Back the Board Game! 
https://www.kickstarter.com/projects/seriousprivacy/serious-privacy-the-data-game

Powered by TrustArc

From Season 6, our episodes are edited by Fey O'Brien. Our intro and exit music is Channel Intro 24 by Sascha Ende, licensed under CC BY 4.0. with the voiceover by Tim Foley.

Transcript

Copy Transcript Copied

Message 0:53

Automated transcript. For accuracy, listen to the audio.

Tim 0:53

You're listening to the award-winning Serious Privacy Podcast sponsored by TrustArc Please welcome your hosts, Paul Breitbart, Ralph O'Brien, and Dr. Kay Royal.

Paul 1:06

This is the week that we've all seen coming for a long time. During the EU State of the Union Commission President Ursula von der Leyen introduced the EU KISS Act, a social media prohibition for European minors. And of course, we will discuss it today because we have opinions. Also, a 403 million euro fine for Google, Norwegian buses calling home to China, and DPA warnings against classholes. My name is Pal Breitbart.

K 1:33

And I'm K Royal, and welcome to Serious Privacy. As y'all have already gathered by the introduction, Paul is going to make up for some lost time. I'm like, have I even seen all of those stories? I don't even think I've seen all of those stories.

Paul 1:47

Then you haven't been reading our chat, okay.

K 1:50

Unexpected question. You know what? I'm just gonna unexpectedly ask you to tell me why you were absent for three weeks.

Paul 1:57

Oh, because I didn't flex you anymore.

K 1:59

He still loves me though, so that's okay.

Paul 2:02

Oh, of course I do. No, I had my summer vacation, and usually you would take that during the summer, but because I have a lot of colleagues with kids who like to go during school holidays, I decided to go outside of school holidays because I'm not bound to them. Plus, I had a really good excuse because I was asked to speak at the Persum Dan Dagene, the privacy conference in Trondheim, Norway, in the middle of September. So I thought, why not take my vacation and travel slowly to Trondheim in two weeks and then end my vacation with the conference? So that's what I did. I spent a few weeks in in Scandinavia, first in Germany, in Hamburg, then in Copenhagen. I went to the IKEA Museum and Hotel in Elhotz in Sweden. Then I went to Lund, to Gothenburg. Wow. To Oslo, just after the king's funeral. And then I took an iTunes to Trondheim, where I also still was uh a couple of days for sightseeing and relaxing. And of course, during my whole trip, I was drafting my speech and editing my speech and rewriting my speech and also preparing all the slides for the presentation and also for the workshop that I gave the day before the conference on building a compliance program for data protection and AI. But it was really good.

K 3:22

How did that all go?

Paul 3:23

Conference was yeah, it went well. The workshop the week before, I was told that probably I would have about 11 participants. And when I arrived on the day, there were 25. Nice. So that's already always a good sign. And the the conference itself was actually a lot of fun. Uh, there was this whole opening block from 10 in the morning till 3 in the afternoon, talking about the future of privacy and digital sovereignty. So that was also my keynote, the promise of the future of privacy. And then after me, Shiranas, who we've had on the podcast, she talked about her way of doing data protection impact assessment. Then we had a Norwegian guy, Andrew Dingster, who was talking about digital sovereignty and the whole Norwegian approach to digital sovereignty, getting rid of US tech. And then Ria Mala, who was we also had on the podcast, she wrapped up the session with a very personal story, but also about how we don't need to forget why we are doing all of this to protect the rights of individuals and go back to basics and not just worry about the paperwork and being compliant on paper, but actually protecting the individual rights of people. And then we had a nice panel discussion after, which I was allowed to moderate. Yeah, it was fun. And then everything switched to Norwegian, and I had to really pay attention to get about 50% of the conversations.

K 4:48

Oh, that is awesome. You've been able to keep up with what Ralph and I have been doing.

Paul 4:53

Absolutely.

K 4:55

Which has been wonderful. He launched the Kickstarter for the serious privacy data game. So if you haven't seen those links on LinkedIn and Instagram, I think he even started a Facebook patch, which I thought we already had one. So I'll have to dig into that a little bit more. But if you haven't caught the links to the Kickstarter, I think he's posted the links already. And no, he's posted the stories about kicking off the Kickstarter.

Paul 5:19

Yeah, I think it's officially launches in a few weeks, right?

K 5:23

Yes, I think it does. He gave a date. I believe it's October 1st. I'm not positive I should pay attention to that a little bit more. I'm just so excited it's coming out. I can't remember the dates, right?

Paul 5:34

I've been promoting it already in Norway as well. People are excited.

K 5:38

Yep. Yeah, I think people are. I think it's I think it's really fantastic. I think he's on to something there. I did I did a solo show which wasn't supposed to be solo, wound up bees. We'll find out from people after today where they think of that.

Paul 5:55

There you are, three co-hosts, and still it's a solo episode.

K 5:58

It's a solo act. And I don't know if they left me singing in there or not. I'd have to check and see how that went. I think Ralph did add an introduction to it, so it wasn't completely solo. He was willing to jump on, but with me traveling back with mom and everything, I didn't really have free time to do a lot. So that was interesting. Let's see what else has happened. Nothing really earth-shattering, a huge bucket of news coming through all around the world about children's privacy and breach actions. Those seem to be the top two, although you can always throw AI in there, whether it's at the root of the enforcement actions or it's at the root of the child safety things. AI is always in there. Seems to be the theme for 2026, right? Is children and breaches. Not children's breaches, just children and breaches. Not breaches.

Paul 6:49

Well, also children's breaches. I'm sure there have been children's breaches as well.

K 6:53

Yes, exactly. Exactly. So it's bad when we can almost foretell what's going to be in the news before we even see the news. There's going to be a breach somewhere. There's going to be a couple of enforcement actions, and there's going to be at least three to five countries who have decided to take action all on the same topic, probably around children's safety.

Paul 7:14

Yes. Then while you're talking about that, let's start with the European Union.

Speaker 2 7:19

Yes. No social media under the age of 30. The Commission is proposing the KITS Act. We will take a gradual and differentiated approach. Each age has its own sensitivities, and therefore each will have its own tailored protection level. No personal account under the age of fifteen. That means from thirteen to under fifteen only mini accounts set up and supervised by parents or guardian with limited features and time restriction to one hour a day. And between fifteen and eighteen, safe design will be an obligation for the platforms. We are reversing the burden of proof. Now platforms will have to prove to us that they are safe. Because it is us who decide the rules, not big tech.

Paul 8:19

And that was Commission President Ursula von der Leyen during the European State of the Union or the State of the European Union last week announcing the EU Kids Act. We've long seen it coming, but apparently there is now finally a plan that has been proposed to the EU member state. And what you heard her say is not even all there is, because the legislation will also include a prohibition for the use of screens under the age of three. So no more parenting while giving your kid your phone or your iPad while you're cooking to keep your kid quiet. Between three and 13 years of age, no social media and no personal owned devices, and only access to child-friendly video sharing services through Guardian accounts for no more than one hour a day. Between 13 and 15, those mini social media accounts, again, set out only by the Guardians on the Guardian's accounts. So it is a daughter or a son's account running on the parent's account, no unwanted contacts online. So I guess there is the only possibility for the miners' account to reach out to others to connect, but not the other way around. And no more than one hour a day still. And only after 15, children are allowed to set up their own social media accounts. But even then, no addictive design, no unwanted contacts, design based on profiling that drag minors into rabbit holes of harmful content is still prohibited. And also live streaming is prohibited until children become of age. So design algorithms need to be designed that are safe for children, and accounts need to be linked to parents' accounts at least until they're 15.

K 10:03

Yes. So I think it's interesting as you talk about the addictive features. And some of the audience might be wondering what are addictive features? Doom scrolling. Doom scrolling is an addictive feature. That's the whole reason it's called Doom Scrolling, right? Reward tricks.

Paul 10:18

Filter bubble.

K 10:19

Yeah. Filter bubbles, late night push notifications, things like that. And they have to be easy to block or mute certain tools or aspects of it. So I think it's fascinating. I think it is reversing the burden of truth that you talked about. The burden of proof is, and as she discussed, putting the proof on them, not on us, to prove that it happened, I think is huge. Now, is there, and you'll have to begin because I think I read this last week, there is still a way that the parents can bypass some of the protections if it's on a Guardian account. But I don't think it's easy to it's going to be easy to find.

Paul 10:57

No, and it also shouldn't be easy to find because children are usually more tech-savvy than their parents.

K 11:02

Right.

Paul 11:03

So this is just a legislative proposal. That's so we need to see how this will be implemented in practice. Maybe as further background, the scope of the proposal, it will apply to online social networking services, to video sharing platform services like YouTube or Vimeo, to app stores, to online gaming, to the operating systems as a whole of smart devices, to AI companions, including all the chatbots, and also to general conversational chatbots. And also explicit inclusions, exclusions, sorry, the not-for-profit online encyclopedias like Wikipedia, not-for-profit educational and scientific repositories, services and systems that are designed for educational purposes and any open source software developing and sharing platforms, unless it is an AI system in the scope of the EU AI Act. Those kinds of tooling would typically be excluded from the legislation.

K 12:01

So if PRI is a pretty massive step.

Paul 12:04

Yes, it is a pretty massive step. At the same time, I feel it's the wrong step.

K 12:09

Talk to me more about that.

Paul 12:11

Because this is again focusing on the victims, about locking down the online life of minors. There will in any any case be a transition generation that have access and then suddenly when the law enters into effect will no longer be allowed access. So that is already one concern. How are you going to deal with that? But that's only for a couple of years. It is also, I understand the philosophy behind the approach, right? To gradually introduce social media and online activities in the lives of children. But you're also interfering a lot with parental education. For example, the statements, no screens under three. What does that do in legislation? I understand that you want to encourage that, but you cannot enforce that.

K 13:05

Right.

Paul 13:05

Will you then ask police officers in the street if they see a parent giving their phone to a three-year-old or a two-year-old to keep them quiet for a moment? Would that be a conference that should be enforced? Who's going to do that? Why are you going to do that? Isn't that up to parents? But the bigger problem for me is that this is enforcing against the Rome audience. And that also ties back to what I said during the conference in Trumpheim. One of my points was that during the data protection form that led to the GDPR, the data protection authorities made a very strong push for the introduction of data protection by design and by default in our legislation. And they succeeded because it is part of the GDPR. But ever since it is hardly enforced. It is not something that they have taken an exit look at. And if you would enforce privacy by design, privacy by default, or data protection by design, data protection by default, all these kinds of laws against algorithms and profiling and behavioral targeting and all of that would not be needed because in principle that is already illegal under the TDPR. It should just be enforced more strongly. And the problem is not the miners using social media to stay in touch with their friends and to learn and to have fun. The problem is the social media companies who have made the platforms too addictive, created all the rabbit holes, created all the push notifications. So that is where the problem lies, not with the miners themselves. So now to enforce against the miners, for me is the wrong piece of legislation.

K 14:53

Yeah. I agree. And we've talked about a lot of these in the past about how, and I agree, it looks like in some part they are pushing it off to the manufacturers and the social companies by saying they can't enable certain features and getting rid of those. But you're right, where it says enforcing against the victims, that's like saying, okay, stores, you can't sell mini skirts and short shorts to female children under the age of 18, or anyone under the age of 18, right? You can't sell short shorts and mini skirts and see-through shirts to them. So is that really enforcing against the bad actors, or is it really, I hate to say it, punishing the victims, right?

Paul 15:32

Exactly. And that's the other part of my concern. There are actually quite a few good things in this whole proposal, right? When it comes about comes to the addictive design elements and similar to what we saw in the settlement, no more push notifications during the night or during the school day. Those are good things, but why limit that to children? Make a default settings and give people the option to deviate from it when they become of age.

K 15:59

Can we have them turn it off for me? I wake up in the middle of the night and I start doom scrolling and I I can't go to sleep because I'm sitting there on my phone watching video after video and hunting down these stories by chapter that you have to go download the app and then you have to pay money and then you have to get rewards points to see the rest of the chapters, and trying to get them to trigger again on Facebook is horrible.

Paul 17:10

You could always leave your phone in the fridge overnight.

K 17:14

I could. I could, but that's an odd place to choose.

Paul 17:18

Then at least you won't hear any notifications or screen lighting up even if it's in a different room. You could also put it in a vault or in a drawer.

K 17:26

Or like accidentally I drop my personal phone down behind the bed because I'm in a different bed right now until we move in and I keep hearing it buzzing and I can't find it because it fell down between. Exactly. So there are things that we could do proactively to take this, but now they're trying to get the tech companies to enforce this. And let's be fair, it's only a few tech companies, right? It's not all the tech companies. It's not all the technology out there. This is specifically social media, and there's only a handful of social media to really choose from. So how do we make that happen? What else do we have going on in the world, Pa?

Paul 18:06

We've got another Google fine. Yeah, we've got another Google fine. 403 million euro. Irish Data Protection Commission against Google. This is an own volition inquiry launched already in February 2020. Based on complaints by consumer rights organizations on Google's processing of location data. So the DPC investigated, looked at three specific features: weapon app activity, location history, location accuracy that Google processed. And there were concerns about the lawfulness and fairness of the processing of the data, the accountability obligations, especially no lawfulness, no good people basis, and also not able to demonstrate that. Also insufficient transparency for all of these, and also the retention of the location data. So this is again an important investigation. We have not seen the full report yet. That is still to be published, but it is forthcoming.

K 19:09

But that is the same type of incidents that Google was held accountable on this side of the pond for this side of the pond back around that same time frame, wasn't it? Wasn't it like 47 attorney state attorneys generals enforced against Google for location tracking, even if location was turned off on the phone? You think it was?

Paul 19:29

Yes, I think that's true. And this investigation just took a little bit longer. But it leads to a similar conclusion that Google needs to pay up. And obviously Google will appeal, and this will be one of the many cases in the Irish courts before we have a final decision. But it is again a major fine. And at the same time, for Google it's what two minutes, three minutes of turnover, and they have paid the fine. That said, they will not pay the fine until they have exhausted all legal options.

K 19:59

Yeah. For them it's just a pause to do in business.

Paul 20:03

Exactly. So the other thing of note this side of the Atlantic is that we've seen a small wave of data protection commissioners warning their constituents against the smart glasses.

K 20:15

Yes.

Paul 20:17

So there is an article in the Jersey Evening Post of 18th September, where Jersey Commissioner Paul Vane and also Guernsey Commissioner Brent Holman both warn the islanders for the considerable privacy risks that smart glasses pose. Together, they issued a statement together, by the way, with the Isle of Man. The glasses are now sold on the islands. So the public needs to be aware, they say, that as with any recording device, the user is expected to act responsibly, consider the privacy impacts of its use on other people. And those affected must also feel able to exercise their statutory rights under data protection law and feel empowered to challenge users who have not been transparent about the use of technology. And in the Jersey Parliament, there are by now voices to prohibit the use of these smart glasses. And a similar discussion is actually ongoing in the Netherlands, where also some are considering that these classes should be prohibited. Some private venues have already done so, for example, concert halls. But also the Dutch DPA issued a warning this week, especially for the publication of photos and videos that have been made with smart classes, that those cannot just be published on the internet because at that point you become a data processor and people cannot just publish because that would harm the privacy of others who may be indie images, especially if they are recognizable and thus the consent is required.

K 21:52

Aaron Powell And for private venues, it's a lot easier to address, right? And especially I did not think about concerts and dance recitals and movies and stuff. You'd be able to record the whole thing sitting there watching a movie.

Paul 22:10

That's ridiculous. Yeah, and and thus support pirating. But also airlines are acting against smart glasses. I've heard announcements from airlines already saying you are not allowed to use a smart glass or smart glasses on board because you cannot just take pictures of other travelers or crew. So it it is really becoming uh a societal issue. And I do feel luckily that in this case people somewhat are somewhat aware that this is happening.

K 22:41

Oh, I agree. And a lot of them don't. We focus on it because this is our livelihood, this is what we focus on. I hate to say that's a very circular definition, but this is what we do, right? This is our passion, this is what we love, this is the job that we're in. But that's not everybody. If we step outside our step outside our comfort zone, then I don't expect the average person on the street to have thought about these issues. I don't expect my daughter to have thought about them, and I raised her, right? I raised her was a question.

Paul 23:11

At the same time, wouldn't you just love the idea that you have glasses at a conference that tell you, oh, this person walking up to you is so and so. This is their name, this is where they're working, this is where they were before, this is when you met them before, and this is what you talked about. Just to have that memory for networking, because I often recognize a face, but then placing it in the right context and putting the name to And all the background. That's hard. And I would never buy these smart glasses. Don't worry about it. But just the idea that your glasses would be able to do that. Serious. You would not suddenly take them off if these are your only glasses, right? Because you would probably, if you have prescription glasses, you probably would also have then those as your prescription glasses. So you would not be able to take them off because you wouldn't be able to see anything anymore.

K 24:04

Oh, this is crazy. Okay, we're gonna start the serious privacy drinking game. Every time we say smart or meta, y'all have to take a drink. And I didn't bring a drink in here with me, which mine is power aid or water.

Paul 24:17

It can be a sip of coffee.

K 24:19

I'm only halfway joking.

Paul 24:20

Let's say I'm just on water right now.

K 24:22

I'm only halfway joking. I forgot to bring something to drink in here with me. Go figure. But it's been good. We do have a few other things that are happening in the world. Paul probably has a few other stories teed up, but let me just pull up some of the ones that I've got today. Data breach at a fintech firm called Revolut exposes personal and financial information of high net worth individuals. That's a British fintech firm. OpenAI, they found at least six more instances of AI models going rogue due to misalignment. Is that what we're calling them now? Misalignment? Okay. I like that. HBO Max.

Paul 24:59

Apparently we do.

K 25:00

We do, right? Reddit account compromise to deliver click fix malware. So if you use Max's Reddit account, be careful with that. Let's see. More about a gentic AI agents behind the RubyGems cyber attack uploaded hundreds of malicious packages to RubyGems. So pay attention to that. The WeChat zero click attack enables account and device takeover without user interaction. All right, people. I'm getting so every every story that's in here. Do I have a single story that's not AI or agentic AI or a smart? No.

Paul 25:39

I have one that's not AI.

K 25:40

Oh, go for it.

Paul 25:42

I have a lovely technology. I have a lovely technology article.

K 25:46

Nice. What do we have?

Paul 25:47

Because Norwegian researchers started testing a Chinese bulk bus. And these are just city buses that are being used in Oslo, but also in in other cities around Europe. They're produced by a company called Utol. And they wanted to know what kind of connections these buses would have back to China because they were produced in China. The results are shocking, or maybe not. In any case, the the bus was tested and they found that the bus could be reached by its maker through software updates, including for battery and power systems and other Chinese controlled vehicles. About the connections logged went to Chinese servers, even though European customers are being told all of their data is being processed in Europe. In this case, it was for a car called a Neo ES8, and the car carries cameras, microphones, location tracking, always on modems. Most traffic is encrypted, but not everything. It is going to China, both from buses and from cars, even if it's as they did as they test it, even if the bus is driven into a mine where there is no cell phone reception, still then the bus tries to call home, according to the researchers.

K 27:09

Let me guess. I know you said camera signal, but they have cameras mounted in these cars and buses, probably.

Paul 27:15

No, they have cameras. They have cameras and microphones and everything. Am I surprised? No, I'm not surprised. Do I think that American cars and European cars would do the same? Yes, I do. They probably will. And actually during the conference, there was a presentation from a Swedish truck manufacturer, and they were also talking about all the kinds of sensors that are on the bus. And it made me wonder. These buses, and a lot of these sensors make sense, and a lot of this technology makes sense. But a bus is typically purchased by an employer. What are the rights of the employee? Because they cannot just consent because it's an employee, an employment relationship. Right. The manufacturer says, oh yeah, but we are not, uh we are not a controller. We consider ourselves a processor on behalf of the company. But even then, they build all the technology they create. So at best, in my view, they would be a joint controller and not a processor. But what about the role of the individual in all these employment situations? The same with company cars. So maybe we should have a separate discussion on that at some point to see what that would be like. Because again, this is a whole new world of legal discussions and considerations that maybe not everybody has thought true.

K 28:37

Yeah. Lord have mercy.

Paul 28:40

Yeah, just with the mention, because you never know who's listening, that we have just submitted the proposal to join IAPP Canada next year as speakers. So we're very hopeful that our proposal will be accepted, or at least that would be really nice. And if we do, then we have something really nice for you in store in the next slide.

K 29:01

That would be awesome.

Paul 29:02

So, yes, on that note, let's wrap up this week's episode.

K 29:06

Love it. All right. Bye y'all.

Tim 29:10

Until next week. Now that was serious privacy. Please subscribe on your favorite podcast app and leave us a review. You can find us on LinkedIn, Instagram, and Blue Sky at Sirious Privacy. Feel free to drop us a question or a comment. We'd love to hear from you.