This document provides an overview of Aurelie Pols and her work in data governance and privacy engineering. It discusses her background, including her roles as DPO for mParticle, Chief Visionary Officer of Competing on Privacy, and professor roles teaching ethics and privacy. The document also outlines some of her ideas on developing interoperable accountability for data use, challenges around consent and purpose specification, and preparing organizations for future privacy regulations like the GDPR and CCPA.

1. A LOOK INTO THE FUTURE
OF (DATA) GOVERNANCE
Aurélie Pols – Digital data all-rounder (who doesn’t code yet works with
data engineers, lawyers and policy makers)

2. #CH2019@aureliepols
Data Governance & Privacy Engineer
Data is the New infrastructure – Privacy is the New Green – Trust is the New Currency
Dutch nationality, French mother tongue, works in English, lives in Spain
AURELIE POLS,
DATA GOVERNANCE
& PRIVACY ENGINEER
• DPO for mParticle (Customer Data platform) – contractor (USA, New York)
• Chief Visionary Officer – Competing on Privacy; Founder – Aurélie Pols and Associates
• Professor of Ethics & Privacy in Big Data & Business Analytics Master – Instituto de Empresa (IE), Madrid (ES);
guest professor DPO certification courses Maastricht University, faculty of law (NL) & Solvay Business School Brussels (B)
• Board Member European Center On Privacy and Security, Maastricht University (NL)
• Ethics Advisory Group (EAG) – European Data Protection Supervisor (EDPS) Towards a digital ethics
• Former Vice-chair P7002 – Data Privacy Process – IEEE
• Speaker/writer/consiglieri: Mobile World Congress, SWSX, Strata (+ Hadoop World), IAPP, Piwik, AT Internet, industry
associations, AdTech & MarTech vendors, …
2003:
OX2 Co-founder
Webanalytics.be
2008:
Sold to Digitas LBi
(Publicis)
2

3. #CH2019@aureliepols

4. 4

5. #CH2019@aureliepols 5

6. #CH2019@aureliepols

7. #CH2019@aureliepols
Idea 1:
If there is no
interoperable
accountability
chain, the
logical next step
is to hedge risk
for your own
tribe
interoperable
accountability chain
= standards, best
practices, codes of
conduct, etc.
Hint: think DNT and
then look up CCPA

8. #CH2019@aureliepols

9. #CH2019@aureliepols
What are we solving for again?

10. #CH2019@aureliepols

11. #CH2019@aureliepols
Digital stacks?

12. #CH2019@aureliepols Source: https://iapp.org/media/pdf/resource_center/giovanni_manifesto.pdf

13. #CH2019@aureliepols
A story of peanut butter
1. Marginal utility is always decreasing!
2. First mover advantage vs. customer expectations
Ø user expectations evolve (eg. creepy flights)
Ø Competing on Privacy? (and data quality!)

14. #CH2019@aureliepols
Risk of fines? Think again
“From a data protection perspective, interesting and proactive
principles such as Privacy by Design and Accountability will never have
any effectiveness until appropriate and proportioned incentives will be
deployed.
At the same time, the noncompliance should be less convenient not
only due to the proportion of pecuniary sanctions […]
But also thanks to measures more scary for players-data-eaters, like the
block, stop and freeze of data processing”
Rocco Panetta

15. #CH2019@aureliepols
Towards a new “humanism”?
Notions of “data ownership” and legitimization of a
market for data risks a further commoditization of the self
and atomization of society.
Privacy could become privatized, with only the powerful
able to protect their secrets.
Business models should serve the social compact, not
replace it.
The right to human dignity demands limits to the degree
to which an individual can be scanned, monitored and
monetized – irrespective of any claims to putative
”Consent”.
Giovanni Buttarelli
(as brought by Christian D’Chunha)

16. #CH2019@aureliepols
Interlocking liabilities & obligations
People
Company
(Telco,
Bank,
Insurance..)
Company
(Agency,
consultancy,
vendor, ...)
• Aligning contract obligations
• (+ enforcement?)
• Providing
• Security
• Privacy features
• Privacy engineering
Privacy
policies
Consent
MSA
SOW
T&C

17. Governance today?

18. #CH2019@aureliepols
Trying not to talk of Brexit and yet

19. Digital
Governance
before GDPR?
It’s not PII – Personally
Identifiable Data – hence Privacy
legislation does not apply

20. Digital Data Governance
tomorrow?

21. #CH2019@aureliepols
Macro vision of purpose & consent
Database = Purpose
If (records = personal data) &
(lawfulness of processing = consent)
then Consent not null
21
If
(lawfulness of processing = legitimate interest),
then
(consent field = description of legitimate interest)
Attributes of the database?
• Purpose
• Lawfulness of processing: one of the options of article 6.1 (a) to (f)

22. #CH2019@aureliepols
Infamous art. 30: Records of processing activities
22
• Purpose classification • Consent trails and traceability
(including reverse engineering
between parties/legal entities)

23. #CH2019@aureliepols
I’m not here to define Privacy
Analytics Privacy (& Data Protection)
23

24. Preparing for the future: Role Playing under the GDPR (and now CCPA)
24

25. Data is the new infrastructure
Privacy is the new green
Trust is the new currency
The road to responsible data “uses” is open, which do you choose?