Unlocking the eSignature Lawfulness for Physical Exam Consent in European Union

How to eSign a document: e-signature lawfulness for Physical Exam Consent in European Union

thank you I'm gonna warn you right now there no there no audiovisuals and part of that's because if you're looking at someone I want you to be looking at me and part of that's because after 30 years of working in technology I don't trust it but don't worry I have I have note cards and when I told the organizers this they look slightly chagrined but I said don't worry it's only for the long boring quote so I want to use and the statistics that I want to bore the audience with and that made them feel a great deal better so let me say when I heard the topic was entropy nothing came to mind faster to my mind than data because we are surrounded by data that seems to be falling out of control data being lost by corporations data being stolen from government agencies data that we are volunteering that's being collected about us billions of bytes a day that seems hopelessly out of control and just to continue the focus on entropy it seems to be getting worse so I thought what I might do this evening is talk about particularly the challenge of personal data and privacy so remember all of this data that we are talking about much of it we are volunteering we are posting those pictures of our delicious meals that we think our friends care about we are engaging in millions and millions of texts a second we are posting images and videos at a colossal rate at a rate that could not have been imagined it's become almost meaningless to talk about the volume because unless you're a computer scientists talking about things like petabytes and terabytes I just start starts to add up to the point it means nothing but it has a tremendous impact on our privacy it has a tremendous impact on this data that's being um that we are volunteering that's being collected about us in some cases it's being calculated or inferred about us are you a good credit risk should you be able to buy that car are you somebody that we want to market to these may not even be data that really exists about you but rather that are being created the New York Times reported in 2017 this begins the statistics that accompany you've never heard of not Facebook not Amazon not a company that trips off your tongue engages in 50 trillion personal data transactions a year that's buying and selling your data and mine every year it seems completely out of control and along with it our privacy there are many reasons for this but the one that I want to focus on which I think will be I hope of interest to you and I think is a tiny bit controversial is the role that consent plays in data protection and privacy today modern privacy law really came about in the 1960s and it came about from an academic study so this makes people who work in universities very happy dr. Alan Weston who was at Columbia University wrote his doctoral dissertation for which he later got funding to turn into a book this sounds familiar so far called privacy and freedom and in that book he defined privacy in a way that every country in the world now follows and that is and I quote the claim of individuals groups or institutions to determine for themselves when how and to what extent information about them is communicated to others right by the 1990s every country had followed suit in fact in the New York Times William Safire wrote accepting legitimate needs in law enforcement and public interest control of information must rest with the person himself now you might not care about Alan Weston or William Safire but the Supreme Court went along with this view as well and in 1988 and Department of Justice versus Rapporteur committee gave us the definition that we use today but the common law and the literal understandings of privacy encompass the individual's control of information concerning his or her person now just quickly unless you think this is just a u.s. phenomenon Europe and Asia and many other countries have followed suit Europe you may know enacted a new general data protection regulation it took effect May 18 months ago and that regulation although they're quick to say they've not made the mistake that the US has made and focus so much on consent they use the term 108 times it's still pretty important in California which has adopted our most recent privacy law the California consumer Privacy Act yet the law gives individuals the right to consent about uses of their data that are collected online well look this sounds like great I mean like who could be against consent in fact challenging consent seems totally counterintuitive in the world of privacy because privacy is after all so closely linked to ourselves and our autonomy but for seven quick reasons I want to outline I think it's both impractical and undesirable that we focus on consent and I think it explains why privacy law is in the dreadful state it is today okay first think of the complexity of privacy notices you see them all the time you probably ignore them that's okay almost everybody does unless you're a lawyer and get paid to read them but you go visit the doctor you get a privacy notice you log on to a website you get that little cookie privacy notice that's required by European law that's why you get it you know researchers like to count things and if you count for example PayPal's privacy notices thirty six thousand two hundred and seventy five words that's by the way longer than Hamlet iTunes Privacy Policy comes to nineteen thousand nine hundred and seventy two words just longer than Macbeth right one 2008 study calculated that to read the privacy policies of the forty or forty five most popular websites in the world would take an individual thirty full working days a year so these notices are complex because the things in Plex they are difficult to understand and we often just pass them by second they are often just inaccessible for example how many of you have phones ok everybody has a phone in this audience I'm gonna be willing to bet and every one of you could be recording right now despite that nice sign at the entrance that says please don't record did you give me a notice that I can send to that did we discuss that in other words how do you provide consent in environments in which you're in a group how about you walk down the streets of Bloomington's they're their cameras now you consent to that how do we manage consent in a world in which data is being inferred about you or collected as as part of a group a third reason is that consent is proven incredibly ineffective mainly because people just ignore it and I love this quote that's why I carry it with me the Federal Trade Commission Chairman Jon Leibowitz back in 2009 and remember the FTC is the United States largest privacy regulator they're the people who make the rest of us put notices and give consent he said we all agree that consumers don't read privacy policies little troubling from the guy who's done more than anyone else on earth to make us have them in fact his predecessor FTC chairman Timothy Morris commented at the end of 2001 about a new law that required more notices and consent opportunities in the financial services market and a chairman mirror said this acres of trees dyed to produce a blizzard of barely comprehensible privacy notices indeed this is a statute that only lawyers could love until they found out it applied to them too okay fourth what we often find out is that the consent we're giving is entirely illusory we have no choice try to update your iPhone right there's a new software it comes out every couple of weeks if you don't update it quickly you're prompted to update it then it starts blocking it then it starts saying we're gonna update it for you automatically then the phone stops working the first thing it does when you go to update it is it said here are the seventy four screens of our privacy policy you can download it you can email it you can agree to it but you cannot not agree to it and that's ilusory consent that's meaningless that may make lawyers feel better in fact Apple makes it pop up twice consent yes and then it says do you really consent right the alternative being would you like us to turn your very expensive phone into a brick which is the alternative if you say no okay fifth there's a huge burden on individuals of all of these consent opportunities and what consent is often talked about as a right sometimes even a human right it's realistically much more of a duty it's much more of a burden on individuals and remember when you make that choice it has the legal effect of shifting the liability from the from the the data processor to you right it's just like when you drive in the garage and you take that ticket and on the back of it it says we have no liability for anything we can crush and mount your car we can throw it out the the edge of the garage we're not liable for anything that that may look like a right to you like you got the right to consent to that by driving in the garage but realistically it was the imposition of a burden on you and on me and that burden is really quite significant at times because of the legal significance that can attach to those six choice often serves as an enormous disservice both to individuals and society think about press coverage right do we really want up the president to have a right to privacy right now that only his consent will allow coverage of what he's been up to fraud prevention crime detection do we want to wait till the criminals consent so that we can use their data so what we do in these cases is we override the consent we acknowledge the consent doesn't work research something close to my heart often depends on being able to use past data often in an anonymized fashion without going back and getting individual consent but finally and most importantly the real challenge about consent is it leads to lousy privacy protection it's not the same thing clicking I agree to I get privacy now you agree to terms that often eliminate your privacy you agree to broad terms that appear to have no limit we're being asked to do things that we could never be asked to do in other consumer protection settings right imagine a consumer protection law that said well you can always ask the consumer if it's okay to defraud them we don't allow that we set rules and then we hold people to it we don't allow you to consent them away its own tempted to end there but I won't I have four more things I want to say very quickly and that's because I want to say something positive I don't just want to be a drain on your otherwise stimulating evening so what my we do that would look differently right so one thing would be less focus on consent and more on stewardship of data if you collect my data if you use my data and something goes wrong that causes harm you should be liable for it you can't shift that liability by asking me to consent to take it myself you would be the steward for my data and that's the way we treat other things that's the way a lawyer is who acts on the best behalf of his or her client that's the way a banker is that's the way a doctor behaves why wouldn't we say if you're using my most personal information you should be held to the same requirements you should be a steward you should be acting in trust of the person whose data you're using second we might think more about what are the things we agree that can be done with data in normal circumstances and what shouldn't be done with it stalking is out fraud is out well but something should be in you know bill collection fraud detection maybe even research if you want to keep the vice president for research happy there's some things we might be able to slide over into the generally permitted category so long as you use good security and not have to burden people by telling them the bleeding obvious like if I if you give me your credit card I'm gonna use it to charge you money third we might think more about redress because no matter what happens something's gonna go wrong that's the one thing we know that's the one certainty in a world of entropy and right now we are often left in the cold when something does go wrong in fact we often learn about it from the newspaper and finally when we do ask for consent let's make it meaningful timely and effective and since I've criticized iPhone I'm gonna say something nice about them now you know that just in time message did you know this app was using your location data right now that's kind of a useful prompt it gives you a chance to say no I'm gonna go in and shut that off I don't like that but using consent in all of these other settings has the unintended effect of making us tend to ignore it when we could make meaningful effective choices that would protect our privacy thank you very much you