National Privacy Conference 2024: bright spots and success stories

By Henk Boeke 

New chairman

In the packed Glazen Zaal in The Hague, with armed military police at the door, the National Privacy Conference 2024 started with the introduction of Privacy First's new chairman. Outgoing chairman Paul Korremans passed the baton to Sander Klous, professor Big Data Ecosystems for Business and Society at the University of Amsterdam and partner at KPMG.

Presentations

Five top experts shed their light on the topic of education and privacy. Below is a brief summary of their presentations.

Katja Mur (Personal Data Authority) outlined a number of positive developments, including the Children's AP initiative, the creation of a national FG register, and SIVON and SURF's standardised agreements to take a lot of work off the hands of schools and higher education institutions.

That children's AP in particular caught our attention. Because - especially also in education - so much sensitive data on children is recorded, such as data on the home situation (including poverty data), medical data, behavioural data and learning outcomes. Which can have far-reaching consequences. (See, for example: A brawl in the sandbox can haunt you until HBO, which was flagged by the website Parents Online back in 2004). We will continue to follow this initiative for a children's AP closely.

Sjoera Nas (Privacy Company) spoke enthusiastically and passionately about the successes she and her organisation have now had in pressuring tech giants like Microsoft and Google to really take privacy seriously. In which her organisation does not shy away from unconventional means. Also noteworthy: at the hands of Nas, Zoom is now the most privacy-friendly video conferencing tool.

As for those unconventional means: Nas spoke compellingly about her DPIAs in education, which can also be applied as an enforcement tool. You can immediately use the problems you find to put pressure on suppliers. ("And if you don't do anything about it, we'll go public with it.") Google and Microsoft have since succumbed to that. And Zoom responded faster than light to Nas' improvement suggestions.

Also nice: the trick of feeding data slurpers with nonsense data, so that you can prove that they did not provide all your data, if you asked to see it.

José van Dijck (Utrecht University professor) focused on privacy in higher education. Among other things, in response to the problems that arose during the corona period with digital surveillance in online exams, and the recent problems with the mass implementation of ChatGPT/GPT3 in all kinds of systems, ranging from learning accelerators to chat applications.

All this has led to a fruitful discussion on 'public values in education' (autonomy, justice and humanity), and to the so-called Values Guide From SURF and Kennisnet.

Van Dijck also advocated the use of open-source software, and developing technology in-house (by universities), to become less dependent on providers such as Google and Microsoft. Although she acknowledged that those companies do provide very good products. Which it remains to be seen whether you can reach that level yourself, if you are going to develop them in-house. Universities also have problems with the use of open source software, because it causes huge capacity problems.

Larissa Zegveld and Sabrina van Miltenburg (2x Kennisnet) discussed digital security in primary education, where again the Values Guide proved to play an important role. Among other things, as a useful tool for developers.

In addition, they showed how indispensable digital literacy education is: the average student does not turn his hand to fooling the algorithms of TikTok and Instagram, but has no clue about the dangers of facial recognition, which was used at all kinds of holiday parks last summer.

Education in digital literacy is needed to teach citizens, starting with students in primary education, how to participate and have their say in the digital world as well as in the physical world. The security component has now been completed (see: digital-safe-education.co.uk); the privacy section is still in the works.

Dutch Privacy Awards 2024

The nominees presented themselves with catchy videos. These were the final winners:

Privacy Simulation was winner in the category Raising awareness. 'Privacy Simulation' is a game format that teaches your colleagues how to appropriately handle individuals' information in a fun way. They learn how an organisation can guard against data breaches and recognise crisis situations.

The jury formulated the importance of 'raising awareness' as follows: "Many people who do not work with privacy on a daily basis tend to associate privacy with complicated rules. The familiar ostrich behaviour is then not far away. But in practice, privacy people the key link in adequate handling of personal data." And on Privacy Simulation: "The winner is a game that playfully and interactively raises awareness about privacy in organisations and links that to two levels of knowledge. The game offers ample opportunities to add content from within your own organisation and work with maturity levels [...] There is no automatic click-through of questions here, as in a standard e-learning, but real interaction and a beautiful interface."

Jet-Stream was winner in the category Technology. 'Jet-stream' is a streaming service that has made privacy protection a revenue model. Advertisers do not get any personal data from viewers, only anonymised data and data about the context of the stream watched. No cookies are even used.

Intriguing! Because how do you ensure, without cookies, that a user can pick up a stream where he left off, if he temporarily paused it? A technical alternative for this would really be world news. But enquiries with the creators revealed that without cookies, there are no corresponding functionalities either. After a pause, the stream simply starts again from scratch. (After which the user can rewind by hand.) In other words: that privacy is just a choice. With all its consequences.

Public Transport Groningen Drenthe was winner in the category Application. In collaboration with 'Roseman Labs', 'Publiek Vervoer Groningen Drenthe' worked to find the best available privacy protection for analysing the travel behaviour of people with a WMO indication, without access to their personal data. With the aim of getting those people from WMO transport into public transport. But for that, you need data...

The jury said, "Especially in the complex world of healthcare and government collaborations, a demand and hunger arises to share as much personal data as possible, not infrequently sharing too much, with all its consequences. [...] 'Patient and client centric', should be the credo here too. The patient and his direct care institution should have and maintain full control over data flows. [...] In a collaboration with 22 municipalities, Public Transport Groningen Drenthe has found a mode to track behaviour of travellers with a WMO indication, without disclosing their personal data. In doing so, Public Transport Groningen Drenthe has taken the lead and set the example to find the best available privacy protection for analysing travel behaviour of WMO registered travellers."

Oasys Now received the Incentive Award. 'Oasys Now' has developed a privacy-friendly platform on which patients worldwide can more safely and quickly participate in clinical trials.

The jury said, "Oasys Now puts the confidentiality of patient data first. Patients decide what they share, entering their profile on Oasys Now's platform. This platform has been developed so that patients worldwide can more securely and quickly see what clinical trials available for their condition."

One more point to note is that 'Oasys Now' claims that patients own their own (medical) data. That sounds attractive, but it also has a downside. Because while medics have professional secrecy, private individuals do not. As a result, the risks are much higher when those data are in the possession of the patient, than when they are in the possession of the treating doctor. But for the initiative in itself, to be able to participate in privacy-friendly clinical trials, of course that doesn't matter.

A short version of this report was also previously published at PONT Data & Privacy: National Privacy Conference 2024: bright spots and success stories - Data&Privacyweb (privacy-web.co.uk).