Five Things Companies Can Do

fb congress

Earlier this week I wrote a long-winded post describing steps companies can take – in light of recent concerns about companies misusing personal data – to make sure their technologies are offering us all something of value.

Here are the five things, in abbreviated form, that companies can start doing now:

  1. Privacy by Design (and security by design): Put the end user at the center of your technology’s architecture, minimize the amount of personal data you will need to provide the service, give the end-user control, and be transparent. If you concentrate on what the end user will be comfortable with and empower her with control over her data, then you are on the right track.
  2. Value Proposition: Make privacy protections and good practice a central point of differentiation. Make it core to your overall value proposition.
  3. Business Model. Re-think the business model. Propose different fee structures or revenue sharing options that give end users more control and something of value in return for handing over their data.
  4. Product Ethics: Before thinking about the legality of a new product or service, focus on it from an ethical viewpoint. Consider a products ethics committee, including bringing in an ethicist. Look not just at data use but the potential for a product or service to be misused (even if hacked) with results that are contrary to the company’s values. Remember the last thing you want is for your CEO to have to sit in front of lawmakers struggling to explain why your service was linked to a major human rights violation, political scandal, or massive leak of sensitive personal data.
  5. Data Use as a Corporate Social Responsibility: Make data use and innovation part of your company’s CSR policies where you commit to (i) not use the personal data and technology at your disposal in a way that has a negative effect on your community and stakeholders, and (ii) affirmatively use technology and innovation for the good of your community and stakeholders.

Put all together, the most important thing a company can do is to take the time to have open, internal conversations about the effects that its products and services may have on users and society. That way senior management can make informed decisions in line with the companies core values and identity. Lawyers don’t like surprises, and neither do their client.

Advertisements

I’m going to stop whining. Here are a few simple things companies can do

I just saw this interview  with Tim Cooks where he says that privacy is a fundamental right and core to the American identity. With all of my recent ranting and raging about private companies and dystopia, I could start proposing solutions or become real cynical about the Apple CEO’s words. Maybe Apple is desperate to distance itself from Facebook’s recent scandals including news that phone manufacturers reached secret deals with the social media giant to access user data.

immendorffOf course, there is also the glaringly stark contrast between the FCC now permitting American ISPs to sell user data to third parties and how the new European data law (the infamous GDPR) — not Americans’ passion for privacy rights — is the primary catalyst for the current public conversation around privacy rights in the digital era.

But instead of complaining, maybe I should look at what Apple is saying as a teachable moment. Likely Apple sees a major marketing opportunity to remind its customers (and promote the fact) that it is not in the data sharing business and that monetizing its customer’s data is contrary to its core values. At a time when companies (for example U.S. ISPs) are licking their fingers at the chance to rake in big bucks by reselling their paying customers’ data, there is a huge niche – analogous to the organic/bio foods business – for privacy-friendly products and technologies.

So taking advantage of this potentially positive turn of events, I should walk-the-walk and do what I keep saying lawyers ought to. Propose solutions! So here it goes:

For lawyers in private practice, I encourage them to continue to play a pivotal and activist role in bringing claims against and putting pressure on companies and governments that misuse our personal data or infringe on our rights. Holding them accountable does not happen by osmosis. You need lawyers leading as change agents (think about the essential role of lawyers in the Civil Rights Movement).

tshirtsNow as an in-house counsel in a tech company, I would suggest leaving your beret and Che Guevara t-shirt at home. Instead concentrate on how your company can build trust amongst its customers so that they will feel comfortable using your services, and in turn, you will feel comfortable providing them with those services. Here are some basic things, some of which I have mentioned before, that in-house lawyers can propose within their companies:

Privacy by Design (and security by design): Put the end user at the center of your technology’s architecture. Try to minimize the amount of personal data you will need to provide the service, limit what you share with third parties to only what needs to be shared, and give the end user the ability to opt-out of features that share more detailed personal data. Be transparent. If you concentrate on what the end user will be comfortable with and empower her with control over her data, then you are on the right track.

Value Proposition: As the tech giants, especially ones where consumers have little bargaining power (like ISPs, Facebook, and Google), demand more access to their users’ data, companies can use privacy protections as a strong differentiating value proposition. As mentioned above, the market opportunity is huge. For example, if European consumers are not comfortable with the ease at which their data may be swept up and monitored by American spy agencies (as revealed by Edward Snowden), why not offer European-based services that guarantee greater freedom from the intrusion of a foreign government? As with Apple, if you sell sleek, cool, and lifestyle, the minute your customers perceive that you are no longer any of those things – and btw selling customer data is creepy not cool – then game over.

Business Model. Re-think the business model. Propose different fee structures or revenue sharing options that give end users more control and something of value in return for handing over their data. For example, offer customers discounted fees (like Amazon does with the Kindle) if they allow the company to monetize their data. Alternatively, how about a giving a piece of the revenue to the customer when the company makes money off her data? I worked for a WiFi sharing start-up where, keeping true to the company’s value of sharing, we shared revenues with users who shared back. If my ISP is making money off my data, then why not demand something in return?

fb congress

Product Ethics: Before thinking about the legality of a new product or service, focus on it from an ethical viewpoint. Many companies now have data governance committees, but consider a broader products ethics committee made up of a cross section of the company. Look not just at data use but the potential for a product or service to be misused (even if hacked) with results that are contrary to the company’s values. If you build products that resell or rely on processing large volumes of personal data, put an ethicist on staff. Remember no matter who your CEO is or how much of a celebrity he may be, the last thing you want is for him to have to sit in front of lawmakers struggling to explain why your service was linked to a major human rights violation, political scandal, or massive leak of sensitive personal data.

Data Use as a Corporate Social Responsibility: Include data use and innovation in your company’s CSR policies. Call it your Innovation for Good Policy where you commit to (i) not use the personal data and technology at your disposal in a way that has a negative effect on your community and stakeholders, and (ii) affirmatively use technology and innovation for the good of your community and stakeholders. For example, at my current company, Amadeus, I am very proud to have been involved in two CSR initiatives with UNICEF where we used technology and aggregated travel data to help suffering children and to predict the spread of diseases like Ebola and Zika.

Put all together, the most important thing a company can do is to take the time to have open, internal conversations about the effects that its products and services may have on users and society. That way senior management can make informed decisions in line with the companies core values and identity. Lawyers don’t like surprises, and neither do their clients.

Brave New World, Inc.

Minority Report

Earlier this week, Rana Foroohar wrote in the Financial Times that “Companies are the cops in our modern-day dystopia”:

The mass surveillance and technology depicted in the [2002 movie Minority Report] — location-based personalised advertising, facial recognition, newspapers that updated themselves — are ubiquitous today. The only thing director Steven Spielberg got wrong was the need for psychics. Instead, law enforcement can turn to data and technologies provided by companies like Google, Facebook, Amazon and intelligence group Palantir.

The dystopian perspective on these capabilities is worth remembering at a time when the private sector is being pulled ever more deeply into the business of crime fighting and intelligence gathering. Last week, the American Civil Liberties Union and several other rights groups called on Amazon to stop selling its Orwellian-sounding Rekognition image processing system to law enforcement officials, saying it was “primed for abuse in the hands of government”.

the-wire-lester

I have written a few posts already about the potential for governments and private companies to use new technologies such as cryptocurrencies, biometrics and data mining to engage in activities that we would normally associate with the fictional totalitarian regimes of George Orwell or Aldous Huxley. With regards to state actors, like China, using biometrics for crime prevention, I wrote:

But still, if we move to a system of Big Brother with ubiquitous cameras capturing our facial images 24/7 and the system is only 80% accurate, that leads to arguably an unbearably high threshold for potential abuse. Democracies are supposed to accept some criminals getting away with crime in exchange for the innocent not being locked up. It’s the authoritarian regimes who place law and order above the protection of the innocent.

Between companies, governments and new technologies, the potential for opportunities, efficiencies and abuse are endless. It is a Brave New World.

And with regards to cryptocurrencies, I wrote:

Although neither George Orwell or Aldous Huxley’s dystopian futures predicted a world governed by corporations as opposed to authoritarian governments, it may be more plausible to imagine a world where corporations control the money supply, not with coins and bills but cryptocurrencies. In fact, the fad amongst many technologists today is to encourage the disintermediation (or deregulation) of money by moving to Blockchain-based cryptocurrencies like Bitcoin. But instead of removing the middleman, we are more likely – contrary to the idealists’ ambitions — to open the door to empower big tech companies like Amazon, Facebook and Google to tokenize their platforms, replacing one currency regulator with corporate ones.

But private companies are able to do so much more with the data that we so generously (and often naively) hand them. The possibilities for abuse seem endless. To a large degree, the new GDPR mitigates this risk by giving the consumer visibility about and control over how her data is being used, and hopefully building trust between consumers and their service providers.  As stated here before, more important than complying with strict new laws, “to be commercially viable, these technologies need to gain consumers’ confidence and trust. Otherwise consumers will not be comfortable sharing their data and will simply not use the service.”

But what happens if consumers are not given the opportunity to intelligently grant consent or agree to use a service that shares their data? The first GDPR complaints have been filed precisely on these grounds:

Across four complaints, related to Facebook, Instagram, WhatsApp and Google’s Android operating system, European consumer rights organisation Noyb argues that the companies have forced users into agreeing to new terms of service, in breach of the requirement in the law that such consent should be freely given.

Continue reading “Brave New World, Inc.”

Someone Got a Privacy Lawyer (or Didn’t)

LATIMES GDPR

This morning, on the day the GDPR came into effect, I tried to access the Los Angeles Times – one of the US’s leading newspapers – but found myself redirected to this landing page. Apparently, the LA Times is not prepared for the new law. At least they had the sense and seriousness to stop European access. Four percent global worldwide annual revenue or €20 million (whichever is higher) in fines for non-compliance is no joking matter.

So, did the LA Times have a privacy lawyer who said they weren’t ready, or a lawyer smart enough to know that until they got that privacy lawyer, they wouldn’t be ready? Or, did they simply make a business decision that their European market wasn’t big enough to justify the costs of compliance?

UPDATE:

ChicagoT

It looks like the La Times isn’t the only one.  The Chicago Tribune has the exact same landing page, so it appears that all of the publications managed by tronc, inc. are following the same protocol.

GDPR: You’re Now the Most Popular Kid at School

TCsHave you noticed that you’re now receiving dozens of emails from all sorts of services that you forget you ever used? Everyone is suddenly sending you requests to accept their new privacy terms. Yes, that’s the imminent arrival of the EU’s new General Data Protection Regulation, due out in stores on May 25, 2018, talking to you. So if you’re feeling like the prettiest one at the dance or the most popular kid at school, then you have the GDPR to thank (along with its threat of massive fines).

Personally, I am taking advantage of the opportunity to clean house by NOT accepting the terms of all of those services I am no longer interested in using.

Note: The above image compares the length of end user terms of various social media platforms. From left to right: illegible company, Google, Tinder, Twitter, Facebook, Snapchat, and Instagram. I found the image a few weeks back on Twitter but unfortunately cannot attribute the image to the original tweet or its owner.  

What it Takes to Be an Effective In-House Lawyer

Talk for IE 2018

This week I gave a presentation about the life of an in-house lawyer in a global company to a group of masters students from the IE Law School . I spoke to them from the Amadeus headquarters where I work about our unique legal department and about what I believe it takes to be an effective in-house lawyer. Here’s my list:

What it takes

At law firms you have an arms-length relationship with your clients who you do not see on a regular basis. In-house, you live with your clients. You see them in the cafeteria, on the elevator, at the water cooler and at company events. They are your colleagues and peers. And more importantly, if they don’t succeed, you don’t succeed. To that end, as in-house counsel, you need to see the big picture, know when the deal is “good enough”. Most companies cannot wait for perfect.

Of course, you cannot be effective if you don’t have a general counsel who empowers you. Fortunately for me, our GC expects his lawyers to do all of these things. And you simply cannot be an effective lawyer, in-house or otherwise, if you haven’t gained your client’s trust, a subject that I hope to explore in greater depth in future posts.

A special thanks to Rocio Rico and Chiara Ausenda from the IE Law School management team for bringing their students over.

The Cryptocurrency Swindle

Arcade tokenThe more I hear Blockchain evangelists preach about tokenization and how cryptocurrencies will democratize technology, the more I am convinced that cryptocurrencies are one big swindle. I have already discussed this more in depth here, but allow me to add a few more points.

As mentioned, the reasons for tokenizing Blockchains would be:

  • To incentivize developers/computer owners (aka, miners) to verify transactions on the Blockchain and support and maintain the platform
  • Financing of start-ups (ICOs)
  • To bring more transactions to a platform
  • To engage in unregulated transactions (ie, black money)
  • Speculation

With the exception of engaging in unregulated transactions, there already exist well established and extremely successful and effective means for meeting those objectives. Yet the crypto-pushers – other than rolling off catchy soundbites about democratization and oppressive regulators – haven’t made a compelling case why tokenization is so central to the success of Blockchain-based technologies.

So what makes a Blockchain start-up so uniquely different from any other tech venture? Weren’t Facebook, Google, Microsoft, and Apple all built from scratch without the need for raising capital through tokens or paying their developers in tokens? Why shouldn’t companies financing through cryptocurrencies be required to disclose to investors and consumers the same amount of information they would if they were issuing other types of securities? What is the benefit to investors, consumers and society from having less access to information or fewer legal protections against fraud?

And what is so democratic about paying your labor force in kind from the company store? That reeks of crypto-feudalism. It’s like a drug lord paying his corner dealers in product. The dealers can then decide whether to resell their cut of the product or to use it themselves. In fact, that is exactly how so many dealers become junkies or enter the game. So why not pay them with money they can freely exchange? And if the solution is to have one or two major cryptocurrencies, then how is that so different from just using US dollars or Euro? Or are the crypto-pushers too naïve to see that the most likely result of a successful cryptocurrency economy is that corporations end up issuing their own coins and control money supply? Instead of democratization and disintermediation, you are left with a Brave New Crypto World?FB Money

This is all reminiscent of the Web 2.0 bubble when VCs and entrepreneurs were trying to make a quick billion by selling user generated infrastructure. The idea was that if you had a big enough user base – to whom you gave stuff to for free in order to build your network – a big company would buy your user base even though your network was not profitable. The exit strategy was the entire business model. Now it seems like the crypto-pushers are looking to raise a quick million without having to build a sustainable or even convincing business model, while hoping they can get the open source developer community to finance, build and maintain their infrastructure, if not for free, with an I-owe-you executable at the company store.

It’s a shame because if you ask me, tokenization is a major distraction from the real value of Blockchain-based technologies. The major challenge for Blockchain is not how to tokenize or make bank, but how to find scalable use cases for a technology whose main value at the end of the day is the not very sexy back office task of processing and recording transactions.