Okay, so I guess we are good to go.
So first of all, thank you very much for choosing this conference.
Thank you very much, Aurélie, for being with us today.
I have to say that Aurélie has been the first speaker that I asked to come to MatoboCamp
who directly accepted.
So I would like to thank you once more for being so, let's say, reactive, so positive
and to have the will of being with us today.
This conference is a bit different than the different one that we got over the last hours
because this conference is an interview.
So it's probably the only one in addition to the roundtable that we had yesterday with
the different Matobo experts.
So the concept of an interview, of course, is to ask some questions.
I already prepared some questions that I will ask to Aurélie today.
So those questions will be shown on the screen as you can see it right now.
Those slides are done by myself.
Okay, those are not done by Aurélie.
So that's why you will see that they are not that much beautiful.
It's just that I'm not an artist when I design the slides.
If you would like to ask any questions to Aurélie, please use chat.matobocamp.org.
And you will have the possibility to ask directly your questions to Aurélie, so I will look
at them, pick them up and ask them to Aurélie once I finish to present the different questions
that I prepared.
Once more.
Thank you.
Thank you for having me, first of all, as well, Renaud, and I'm excited about all the
conversations also taking place around GDPR compliance, PII, personal data, and privacy.
I think it's an important topic.
And so I wanted to share a bit visions of the future as well, discussions about risk.
So let's go.
Let's go.
So the topic name is how does risk for DPO differ from classical risk perception?
And the first question I would like to ask you, Aurélie, is the following one.
Could you please introduce yourself to our audience and explain what your job position
consists of?
Sure.
So introducing myself, you asked me the question where I came from.
I am Dutch, French speaking, have lived a long time in Brussels, where I did my economics,
econometric studies, and then moved to Spain.
I have been in the digital analytics sphere since around 2000, where Web Trends Log Analyzer
6 landed on my desk.
And I was asked to, well, find insights with that tool, with a lot of flash websites at
the time.
And it was also the time of ad servers.
DPO analytics came a lot later, at least for my career.
It was partially a game changer on different levels, but it also worried me in terms of
privacy and how much data we were collecting and also integrating stitching together.
And so I started looking also at privacy, certainly after we sold our startup in Belgium
called OIX2 to LBI Digitas in the UK.
And so once my children were small and I created a family, I started looking at this thing
called GDPR and following the progression of that legislation, it took five years, and
started also to understand how the lawyers were talking because I didn't have a legal
background at all.
I'm now very happy that I can actually quote certain articles of the GDPR out of my mind
directly because I use it so much.
And today I have my own consultancy and I have basically three pillars in there.
On the one hand side, I am a DPO official data protection officer for a customer data
platform called MParticle based out of New York.
On the other hand, I also teach DPO courses for different university of which the University
of Maastricht, where they also created the European Center for Privacy and Cybersecurity.
So it's not just me, it's a bunch of very smart people that all come with different
angles and we talk about digitization of our societies.
We teach in those courses and some of my colleagues from Maastricht University are this week in
Senegal to teach about GDPR.
So it's about making sure that this idea of privacy legislation enshrined within the GDPR
also influences global thinking and this is what we're seeing GDPR as a blueprint.
And my last pillar is I work for European institutions.
I worked on ethics for the European Data Protection Supervisor in their ethical advisory boards
back in 2016.
So when basically the ink was dry on the GDPR, European institutions were asking themselves
what's next.
And this is what we're seeing today with initiatives by, for example, Thierry Breton with the different
acronyms that are coming out, the Digital Services Act and other governance acts that
are currently being discussed on top of discussions about artificial intelligence.
And this while the supervisory authorities are ramping up to make sure that they can
enforce the GDPR, we're also seeing more complaints.
So these are basically the three pillars where I sit.
But my official job position as such that we're going to talk about here is as data
protection officer for a SaaS platform based out of the US.
OK, thank you very much.
I'm sorry.
There is one question that I didn't have planned, but just by the let's say the answer that
you gave to this question, make me think about.
So feel free, of course, to answer to it or not.
You mentioned web trends.
I just would like to know back in the days what happened in the way analytics solution
evolved, where you really realize that the privacy concerns started.
I mean, at which point did the solution evolve that much that it started to be a privacy
concern?
I'm sorry, I have to rephrase it.
But according to you, when are the years at which, let's say, citizens or let's say governments
started to start to care about privacy?
Because I guess that back in the day in web trends, people were not thinking it much as
a, let's say, surveillance or analytics system or anything like this, but just for them like
a software for the IT guys, let's say, but not for marketers and not maybe used in terms
of analyzing what citizens are doing.
And at what point did you realize that there is clearly a privacy concern which is rising?
That's my question.
Well, I think generally speaking, there's a difference between me and then the public
in general.
I remember back in 2000, reading newspaper articles, I think it was in New York Times
that talked about this idea that cookies could be shared between websites.
And so that profiles could be built and the fact that advertisers could target people
that are interested in, I think it was the NBA, but also read financial reports.
And so this idea of profiling was starting to kind of arise for those who are paying
attention.
This market share in advertising for digital took a long time to evolve.
And so if we're talking about the early 2000s, where also we had the dot com bust, we're
not talking about a broad range of surveillance mechanisms because basically not a lot of
people were actually online.
So that's one part.
So these issues have risen certainly for the last 20 years.
This is not new.
I think the biggest, how should I say, alarm bell that was really, I think, something important
that was not noticed a lot, but is referred to very often and more recently in the last
three years is the acquisition of DoubleClick by Google.
And I think this really had an important consequence that we see today because it's not just about
privacy.
It's certainly about the market share.
It's about antitrust legislation.
It's about competition.
And there was actually a dissenting opinion for the acquisition of DoubleClick by Google
by somebody called Pamela Harbor, which you can still find online today.
And when you read that document from 2007, so almost 15 years ago, you realize that basically
she's describing what we are witnessing today.
And so privacy is one part of this.
The GDPR is one part of this accountability.
But antitrust and competition are going to play increasing roles.
Last week, I was also at the University of Toulouse because I worked for the European
institutions and the observatory of the platform economy.
And what we are witnessing today is platformization of services where certain of the actors have
very important market share and influence other actors.
And the question is, OK, what are we going to do about that?
Because these are going to be the next challenges.
So they're not new questions.
The GDPR doesn't solve for everything, but it's a milestone in a road towards trying
to balance out the use of data, the digitalization of our societies, together with the opportunities
that are there for the businesses, but also making sure that fundamental rights are respected.
Whether that fundamental right is privacy, the right, the freedom of expression, there
are different rights also battling in this change in our society.
So it's a journey.
We are not done yet, and we'll see where we go.
OK.
Thank you very much.
I repeat it for our audience, but if some of you guys would like to ask some questions
to Aurélie, please feel free to go on chat.matumocamp.org, select the room which corresponds to this
conference and ask directly your questions to Aurélie, and I will pick them up.
This question is, let's say, one of the arts of the question of the topic today.
Could you please explain to our audience what a DPO, so I'm not going to give the definition
on purpose here, what a DPO is about?
Yes.
So a DPO is a role that has been brought to life through the GDPR and is actually described
between Article 37 and 39 of the GDPR, where Article 37 talks about when a company needs
to designate a data protection officer, then what their position is and what the tasks
of the data protection officer are.
And so in that sense, privacy questions inside companies can emanate from the technical teams,
the legal teams, the customer support teams.
And what is really interesting with the GDPR is that they created this obligation of a
centralizing role that basically takes on, I call it the hot potatoes.
So I am a hot potato taker for anything where we have questions about does this make sense?
Does this support a fundamental right to privacy or is this a problem?
So the GDPR basically defines this.
Companies have a choice to decide whether they appoint one or not.
It's finding itself also inside more legislations.
I was reading about Singapore last night and Singapore also talks about data protection
officers.
So these people are basically bridges between different departments to make sure that the
way data is being treated is as balanced as possible between opportunities for business
and fundamental rights to privacy.
The specific I think position also of a DPO is that you give recommendations, but it doesn't
always mean that the company follows it.
You're not a decision maker.
You represent the fundamental rights of data subjects and looking at the systems, the data
flows, the processes, you make recommendations with respect to how the system should work.
After that, depending on who the DPO reports to, it's a risk-based analysis from the company
to say I agree or I don't agree or I come with something else in order to mitigate the
potential issue that was raised by the DPO.
Thank you.
I think the next question is really as well a curiosity question.
It's like when we hear you, we have the feeling that the data protection officer is like a
sheep with five, six legs.
Could you please tell us a bit more about the background that most of your colleagues,
let's say, or people that you are seeing on the field who are DPO like you have, or could
you as well explain to us how did you succeed to come to take this position as well?
What motivated you in taking this position?
Are you learning every day?
Are you sometimes scared or stressed of having new techie stuff to learn which are brand
new which, of course, could raise more complexity?
Maybe you may realize that, okay, I have those new information systems coming within my risk
assessment and I don't know them and I don't have the time to investigate them because
I just have one week and three and all those questions are just coming to my head and the
general one that I succeeded to draft is could you please tell us a bit more about the background
that DPO must have to embrace this position?
Yeah, and I see there's also a question about that in the chat.
Yes, that was basically the next question.
Yeah, so it's interesting to note that, for example, there's an association called the
IAPP, International Association of Privacy Professionals, and they do surveys to see
who their members are.
And I remember early on because they were like the first lawyers I started talking to
because it's like they were there, so it sounded like the best place to go.
When they surveyed their members and not all of them had been appointed, DPO, but the majority
had the legal background.
And so there were also recommendations, certainly in the early days of the GDPR by different
authorities to consider that DPO should have a legal background.
Now I do understand that, but I tend not to agree because I think that, as you said, it's
a mouton à cinq pattes, it's a sheep with five legs.
We used to say that about Web Analytics as well many years ago, so that's always funny
because those parallels that actually come back.
But as you're a bridge builder between certainly the technical teams and certainly as a DPO
for a data platform, you need to have some understanding also of technology, of data,
and also be able to interpret the law.
So my background is econometrics and statistics.
I know digital because I've basically been in there for the last 20 years and curious
about it.
And I learned the legal path and keep talking to the lawyers about the interpretation.
What does certain words mean inside certain court decisions?
And this is where I think it's also important to have like a network of individuals that
can bring their thoughts and reflections about the interpretation of legislation.
So most DPOs, I would say either they have been appointed as an additional task to their
job by bigger companies because somebody had to be the DPO because of the GDPR as of the
enforcements.
I've seen different types of DPOs.
I've seen really legal, legal people who do not touch upon digital at all and don't understand
how it works.
And these people even work at Facebook.
So it's sometimes a bit scary.
I've seen people who are very technical and very pragmatic and talk about processes.
As I've seen more junior people.
What worries me the most, I have to confess, but it's maturing is that DPOs circling in
the beginning were very young.
So it's like, oh, we have to appoint somebody, you know, to take the hot potato.
And to be honest, you get pushed around.
You get pushed around by the CTO, by, you know, you have to ask questions to understand
how the systems work.
And if you're not like, you know, persistent, and I typically use my gray hair and say,
you know, I'm really silly, I'm really stupid, but I don't understand what you guys are talking
about, then I'm not sure you're very effective as a DPO.
So it's the maturity and I think you're also the experience of different specialization
that makes for a good DPO.
But it's a new type of title.
So it still needs to evolve, but there's less lawyers in there.
The IPP did another survey and realized that this percentage of lawyers of about 80% went
back to 40.
So other types of profiles are also starting to apply to data protection officer jobs.
Often they come from privacy homes or things like that, or they just went through certain
trainings and this is what they want to do.
Okay, thank you.
I have another curiosity question, which just came to my mind, which links back to something
that you that you said some minutes ago about, okay, you provide recommendation and then
the CEO of the company or let's say the stakeholders are deciding to go either this way, either
to go another way or either to not follow those recommendations at all.
And within GDPR, what is really famous or at least how the press has spread the word
about is those 4% of turnover, let's say penalties.
If someone is not respecting, let's say GDPR, I would like to say, does it work for real
on the field?
I mean, this threat of, hey guys, if you don't follow my recommendation, you may be subject
to 4% of penalty of turnover of your company, or is it in fact something that the company,
they don't even care about because they think that it will never happen because they are
too powerful on the market and of course they will use some other ways of saying, okay,
you cannot put me 4% because if so, I will decide to outsource all my companies somewhere.
And finally, no one has got this 4%, let's say, penalty.
So I would probably got maybe five or six warnings before the play it and I would probably
act on the third warning or something like this.
Feel free to answer to this question and say, okay, this is confidential.
I prefer to not answer, but I'm just curious about this point.
Does it work, this 4% threat of penalty?
I think as we are beyond a couple of years of enforcement of the GDPR, I think initially
it did.
It did scare a lot of people because you have to understand that prior to the GDPR, the
data protection directive only allowed two countries to fine around half a million euros
and that was the UK and Spain.
And so I remember talking to somebody in digital analytics a couple of years back before the
GDPR and I think that person was in the Czech Republic and that person said, you know, if
anybody gets fined under the data protection directive, it's like, what is it, 500 euros?
Who cares?
It doesn't matter.
It's just doing business and as I'm based in Spain, I know that companies like Telefonica,
they basically had a budget for data protection fines under the directive.
So initially, I think it was really a good wake-up call to say, hey guys, 2% to 4% of
global turnover or 20 million euros, whichever is higher, is your financial risk.
And it did serve as a wake-up call.
That's why all these data protection officers have been appointed and things like that.
I today think this is starting to backfire.
Why am I saying that?
Well, because what basically happened to the larger players whose business model depends
on personal data is that they hired a lot of very smart privacy professionals before
the enforcement of the GDPR and clearly had a strategy of what I call lawyering up.
If I get fined, let's imagine 50 million euros by CNIL, I will go to the courts and fight
it.
And ideally, that fine will disappear, which is what happened to the 50 million euros from
CNIL.
So in that sense, it's a good thing because it woke up the markets.
It's not ideal because it doesn't align all the players into making sure that they do
the right thing because they're using the legal system to basically escalate.
Now this has a certain time and what we're seeing is that more and more of these questions
are actually now coming to the European Court of Justice.
So it's a matter of maturity where the market needs to evolve in a certain direction, where
certain new ways of thinking around data needs to take root and be accepted.
And that takes time.
We used to be in a time of let's collect everything and see what happens.
We are now in a time of let's use the data, but maybe not start deleting and not use everything
and data minimization and things like that.
So we're becoming more prudent with what we're using and asking more questions.
And as I mentioned, there are other acronyms after the GDPR, the Data Governance Act, the
Digital Services Act.
We're not done yet in terms of making sure this goes in the right direction.
So the risk of these fines is there.
It's not ideal.
And certain supervisory authorities have started to play in a very smart way with that in the
sense that their fines are not huge, but their requirements for compliance do have a significant
cost effect.
And this means that there's, for example, a ruling in Belgium where a bank needs to
pay around 200 euros in fines, which is nothing, but they need to change their systems behind.
And this is the iceberg nobody seems to see are all the powers that the supervisory authority
have to, for example, stop data flows and say, you're not allowed to pass that data
from here to there, or you need to delete everything that's there in a surgical manner.
And this is the real risk of the GDPR, are these inherent costs because we have been
used to collecting everything, and that if something goes wrong, we will have to start
cleaning up.
And that is going to be like the biggest challenge in the longer term.
Other challenges are also arising if we're thinking about it from a global perspective.
Class actions are typically not things that exist in Europe.
So class actions is when people come together and they go against a company.
The best example I've found so far is the movie Erin Brockovich, where she goes after
a chemical company.
But these are rising.
There are class actions against Salesforce and Oracle in the Netherlands.
There's a lot of discussions in Australia in terms of evolutions of class actions.
So this is another risk that is not directly, it's enshrined within the GDPR.
It's testing things out.
It will take time, but potentially it will come, that risk will come from other countries,
maybe even the US.
Okay, so here we can start to make a link with analytics, like someone alone who claimed
that someone is not using that solution properly has no, let's say, real power.
But if you can find an online service who easily gather the list, I mean, all the people
who find this non-conventional and would like to attack the company could easily gather
all around and just in a couple of clicks could do a class action.
That's typically what you are thinking of, right?
Yeah, yeah, absolutely.
I think that's the direction this might take.
And what's interesting also is that certain venture capitalists, certainly in France,
are backing that up.
Okay.
So here on the screen, we probably have the ugliest slide of the Matthew McCamp that I
did myself.
The question is just the following, that the topic submission that you make for Matthew
McCamp is, how does risk for DPO differ from classical risk perception?
And I just would like to know, why did you decide to submit this topic?
I mean, what was the main message that you would like to give us?
Because I guess that's when you choose it, you had something in mind.
And I really would like to leave you the floor here and to have the possibility to express
everything that you had in mind for this given topic.
Sure.
So I talked a bit about risk before, this notion of fines, what is underneath the iceberg
of the fines that we don't see those hidden costs that will certainly influence the way
we treat data, whether it's personal or not.
But what I also realized, working certainly with compliance teams that go through certifications
and talk about, okay, our requirements in terms of compliance, is that when these compliance
teams talk about risk, they talk about risk specifically for the company.
And as I mentioned before, a data protection officer typically is an independent and external
advisor to a company.
And if you enshrine this within the logic of the GDPR, what the DPO does is they represents
the fundamental right to privacy of data subjects.
So when a DPO talks about risk, and when you say, hey, you know, Mr. Company, this is not
good, you should not be doing that because, because, because, then the company will take
a risk assessment of their own to decide whether yes or no, they are going to pursue or do
something else.
But the risk perception when a DPO flags something is this external vision of risk to data subjects.
Compliance people talk about risk for the company.
So these visions align to a certain point, but not totally.
And so this is something that is, I think, important to understand.
Also, from a semantic perspective, because I see that so many times, I use same words
as the security people, but we don't mean the same thing.
When I talk about risk, I talk about risk to society, to people outside of the company.
The compliance people talk about risk to the company, our financial consequences of the
choices we make.
And I think this will continue to evolve.
But what surprises me is that, first of all, the understanding of what a DPO is or is supposed
to be.
A DPO is not the same thing as Privacy Council, because a Privacy Council works for a company.
And if, for example, a supervisory authority knocks on the door of a company and talks
to the Privacy Council, the Privacy Council has obligations of confidentiality.
A DPO's role, as defined within also Article 39 of the GDPR, is actually to talk to supervisory
authorities.
So once companies also understand this, it also means that this role of DPO is challenging,
because it basically, you bring in a risk of having somebody external looking at what
you're doing and being able to talk to supervisory authorities.
So it's a challenging position to build trust.
And I think after three and a half years at M Particle, we are, this is what is existing.
This is what's there.
I typically spy on the teams and give my comments, but it took time for this trust to be built.
And as you mentioned before, Ronan, yeah, I have sleepless nights because I'm worried
about the system or because there is a team that's building something that I don't think
goes in the right direction.
But I think it's in the interest, long-term interest of companies to bring in DPO's and
build this trust to make sure that what they build today and for the future goes in line
with how privacy legislation evolves.
And so I'm always a bit worried, as I mentioned before, young DPO's, they get pushed around
and things like that.
But the presence of mind is always, I look at society, what are the consequences of what
you're doing and where could this go?
Nobody thoughts about the issues that bigger players today bring about for the democracies
of our societies or the stability.
And this is what all these DPO's need to do is to make sure that this goes basically in
the right direction.
So this is why I wanted to bring this to the table because it's, you know, the European
institutions like to talk about risk and GDPR being a risk-based assessment.
And I agree, but risk for who and for what is often the first starting point of any kind
of privacy engineering discussion, say, okay, what are we talking about?
What is the context?
And how do I see harm and how can we find balance within the data flows to make sure
that everybody that is impacted by this, not only actors like Matomo and the company using
them, but also all the data subjects behind?
Okay, thank you.
That's perfect.
It's currently 2.36.
I'm going to enter within the topic, which is about the link between DPO and Matomo.
So I really would like to know if web analytics tracking tools like Matomo, so let's say web
analytics in general, okay, could say Google Analytics, IT, Internet, whatever, are taken
seriously by DPO.
So I will say like information system who could contain personal data, or are they considered
as optional information system to look at?
Precise a little bit more about my question is that within the scope of a DPO, you probably
got the CRM, which contains far more personal data than the web analytics system, newsletter
databases, you probably have other information system out there, just emails, for example,
and just would like to know where are in the scope of the DPO mind, the location of web
analytics system.
Okay, so typically when we talk about the obligations of a DPO, it sits within roles
of the company.
So what kind of role does that company play?
It is a data controller for its own marketing operations, and then it might be a data processor
for other things, it depends on what the company does.
So in that sense, typically, I think systems, but I might be wrong, like Matomo, Digital
Analytics, DMPs, CDPs play a role for marketing operations, ideally more, honestly, I would
like to see a bit more, but apparently this is still like the big game here.
And unfortunately, there are a plethora of tools being used by marketing departments.
And these tools also change every two, three years.
And in that sense, I think certainly DPOs that are not technical minded, have issues
understanding how all these systems interact.
What is clear is that since certainly the GDPR, as these systems act as data processors
for marketing, I think the minimal requirements are typically around this idea of having a
contract or a data protection agreement, and making sure that these international data
flows work well.
It also depends, I mean, Matomo is a very specific tool in the sense that it's not a
SaaS solution, and in that sense, it also depends whether there's an appetite from the
company to actually invest resources and making sure that they can set this up and have this
up and running inside their systems.
So I think for DPOs, if I had to answer this question from that specific angle, do they
care?
If they understand what's going on in marketing and start digging a bit, probably yes.
Does it facilitate, do certain stances with respect to privacy facilitates the audit and
the audit passing by a privacy office of a tool like Matomo, certainly, but it's not
the only aspect.
So how much does this weigh in the risk exercise of the company is a big question.
Does that answer your question kind of?
Yeah, yeah, absolutely.
Absolutely.
I have many others in mind.
I'm just trying to look at the time and think about the number of slides that we have left
and as well leaving some space for the audience to ask some questions.
That's answering a question, but it's raising so many in my head that it's a challenge.
Next question is about this one.
I think it's really linked to the answer that you already provided us, which is, do DPOs
make a difference between proprietary software and free software because us, let's say within
the Matomo community, make clearly a difference between the two, but I really, in fact, it's
really linked with what you just said with data flows, but I really would like you to
answer to this one.
Do they make a difference between proprietary software and free software?
Well, I think our last interaction on Twitter clearly shows that certain DPOs like me think
in terms of SaaS and then it's like, all right, free software, that's totally different ballgame
because what I mentioned before was like, what would your DPO ask from any SaaS tool
is I want a data protection agreement and I want to make sure that there are standard
contractual clauses to make sure that my international data transfer are as local as possible.
Use in free software, self-hosted, where you want.
So a standard contractual clause doesn't make sense and a DPA doesn't really make sense
anymore either because there's no intermediary.
The question I think that will start to arise, however, here and it's also the case for SaaS,
but privacy by design functionalities, what is needed and this is also what I've done
most over the last certainly 18 months for complex systems is as this is a system that
helps the data controller, what does that system need to do to assure that it supports
the compliance obligations of the data controller, so the matter more customers.
A typical example would be certainly also following Apple's ATT consent status.
Does it actually upload the lawful basis for processing and the fact that yes or no, we
agreed we didn't agree those terrible banners for a privacy and things like that.
Does it define purpose?
Do we know what that specific data point is about and certainly if we want to do more
with that data, can we use these fields to pass them on?
I think these are kind of the conversations that need to happen today focusing on privacy
by design because also Matomo doesn't exist in a vacuum, it is part of something that
is then doing something else and so these conversations about what do I need inside
my tool to make sure that I interface correctly with how data subjects exercise their choices
and also making sure that through the pipeline of the data these choices are respected and
if at the same time data subjects exercise their rights which is kind of the big one
in the GDPR, it's not new but it's bigger, I also have the capabilities of doing that.
I think this is the big challenge for most companies, SaaS or free software is to start
looking at what does privacy by design mean and what do I need to do for my customers.
You mentioned other tools out there, other French tools, they take different stances
than others.
So you could imagine for example a tool saying I do not forward this data if there is no
consent.
Is that the choice of the tool to say that or is it up to the customer?
So these kind of discussions and stances are taking place depending on the risk appetite
of the company, how their contracts are being set up and things like that but these are
kind of the conversations that a tool also needs to decide to say okay where do I position
myself, do I want to be extremely strict in terms of privacy or do I prefer not to cut
myself off from other business opportunities leaving more responsibility to my customers.
These are more ethical discussions to be had but they need to take place.
Thank you very much.
I'm looking at how many okay I just have one question left which is great because we have
five minutes left.
What are the risks of personal data infringement for an entity?
Did I write this question?
I cannot even understand it myself.
What are the risks for an entity?
Do you understand this question because I don't understand it myself?
I should have proofread it without the risk of personal infringement for an entity.
We talked a bit about the notion of risk and the underlying bits of the iceberg with respect
to certain data subject rights.
Well yeah I think I don't know I had something in mind when I wrote it and I didn't proofread
this question.
I just would like to be sure that the audience got the opportunity to ask questions so I
will let the chat go on for the next 30 seconds so I can see that we have different people
in the chat.
We have Marcus, we have Silva, we have many other people.
If you have any questions please feel free to ask one or either already do you have any
questions that you expected me to ask you or that you would like the audience to ask
you about specific things?
No not specifically I think we ran through.
We got one?
Yeah.
Oh great.
Advice for people who are willing to pursue a career as DPO.
It depends a bit on your background I think.
There are more and more job offers out there but they often require some form of either
a certification or experience.
So there are certifications out there.
The IAPP has a couple of them and they often find themselves inside the job offers that
I read.
As I mentioned also I teach at Maastricht University they do DPO certifications.
I'm hiring as well so I'm looking for people so if you're interested I'm happy to have
the chats.
I think more job offers for DPO's but it's about getting your foot in the door and start
building some form of a knowledge around the topic as well.
If you're a lawyer it actually helps so I'm happy to help as well.
Okay I cannot see any any questions left.
There's another one actually.
Personal responsibility.
Oh yeah sorry.
It's a very good question that was often debated and actually if you look at the GDPR there
is another role which is the role of representative and a representative you have to look it up
in the GDPR.
I don't remember the article but is the person that's going to represent a company if they
don't have a foothold basically inside a certain country.
There's more discussions about legal responsibility for representatives than for DPO's and I think
it would be also counterproductive to talk about potential responsibility for DPO's because
I've seen the conversations about representatives and people are just walking away they say
I don't want that liability I don't want it but I don't think that as such DPO's have
some form of a responsibility or liability but on the other hand they are responsible
in front of the supervisory authorities to answer any kinds of questions.
This is still in discussion and in making I think if we're talking about some form of
a responsibility or certainly liability there is conversations about more civil liability
for decision makers so CEOs and things like that or criminal liability I think the conversation
will go there not DPO's because that would be kind of shooting this objective in the
foot but we'll see.
Perfect, Antoine thank you very much Aurélie for being with us today to spend some time
just to let you know that the room with all the different questions will be on until the
end of the event so let's say this evening so if you have some free time left feel free
to have a look at it maybe some new questions will come if you don't have time which I totally
understand of course feel free to leave it and I will send you the questions by email
if I got them. For the audience I remember that the speaker was Aurélie Pauls and that
you can easily find her on a very famous search engine because she's kind of the expert in
the world dealing with privacy concerns. Thank you very much Aurélie, thank you for everything.
Thank you for having me, thank you for listening and if there are any questions this is also
how we all learn please feel free keep in touch and have a good conference and thank
you for having me.
Thank you, next conference will be in nine minutes from now there is only one on the
schedule that I can see this one will be made by Katie Nubay and myself even if I will have
just the minor roles in it it's about using MatMo to collect data on intervention engagement
within the research tree also it's a use case from a client of mine so the clients will
talk about this project and I will come within the conference and explain how we deal with
the project management part we've met. See you soon.