Hello everyone, my name is Christian. I'm greeting you from the city of Halle an der Saale in the
beautiful country of Germany and well straight to topic we are going to talk more or less exactly
about that. We or to be more specific I am seated in Germany, in Europe, in the European Union
where we are in GDPR country. So the general data protection regulation
in effect since 2018 has changed some things to be a little understated in this case and we're
looking about the public reaction. So Matomo and the masses. Do the people really care about GDPR
compliance? This is one of the big USPs, one of the big unique selling points of Matomo in general.
It's well in very big letters on the home page as well that Matomo is a data secure alternative
to Google Analytics and to other in this case not open but closed source
software. So is this even a good selling point in this case? So what do the people think about
data security, about data privacy? So to be a starter here if you can't see the infographics
that well we can provide you with the presentation afterwards. This is no problem. Anyway this is
here, sorry if I'm not having the exact words in any case, but we were asking some people or in
this case Statista. So how have the new data protection regulations, the GDPR impacted on
your sense of security? Did anything change after the GDPR came into effect?
This was asked in this case to be exactly in Sweden. So we are in northern Europe and according to the
survey 75% said well no difference in any way. So most of the people well before GDPR and after
GDPR no difference at all. 14% at least said I feel more secure now. So the GDPR at least
for around every sixth person did make a positive difference, had a positive impact.
For 4% not so much they said I feel less secure and well 7% do not know anything about it or didn't
care. But in this case so sorry in this case so the majority well didn't think there was a big
difference before and after the GDPR and at least 14-15% around about feel more secure through the
GDPR. So in this case most people had at least in Sweden it's seen as a having a positive impact.
So the GDPR as a force of good if you want to say. But how is it done on the well more
regional or state level in this case? So another survey about GDPR enforcement. So the data
protection authorities this case lack of expertise. So most public administration
is not really ready for GDPR enforcement. But one second I've got a question from Ronan. Have you
ever heard of German citizens suing any websites because of a misuse of a web analytics solution?
I will come to that in a moment. But regarding the public authorities in this case you well they
aren't seen as that fit for the digital age in this case. Mostly because we have for example in
Germany which is this case the country on the far left side. We have around 700 people in personnel
doing non-technical stuff and only about 100. So one in seven people is a technical expert.
In this case everyone else not so much. In other countries it's sometimes even more extreme.
For example UK which isn't part of the European Union anymore. But there we have 22 technical
experts regarding to 658 non-technical personnel. So this is a bit more extreme in this case. So the
public authorities are very dependent on the populace to well talk to them regarding
well data breaches. And to come into Ronan's question yeah I have heard of German citizens
suing well not the website themselves. In Germany you can't sue a website because of a data privacy
breach. You have to make an amend to the local authority in this case to the well data protection
authority. In Germany data protection is a thing for the specific German states. For example in my
case I'm living in a state of Saxony-Anhalt in Germany. And just recently I'm working as a data
protection officer as well. And just recently I've actually had a case where an online shop was sued
by a person who wasn't a client from that shop. Because the shop well did
well did had some settings that weren't exactly GDPR conform. So
it happens but you can't sue, at least in Germany, you can't sue a website directly.
But you can make an inquiry with your local data protection authority. So this has happened.
This happens sometimes a lot but not so much in Germany as it is in some other countries. For
example many complaints were made in Italy and Spain if I recall correctly. Surprisingly not so
much in Germany where as regarding stereotypes we Germans have a bit of an image
as the big complainers. But in other countries it was well far worse to be put in brackets in
this case. But to be answering that shortly, yes it happens, yes it happened. And this is not so
much the fault in this case of the web analytics solution itself but of the company who uses
this solution. For example when you normally use Google Analytics in the general setting when you
just implement Google Analytics but Matomo as well with the well default settings they aren't GDPR
compliant. You need to put them in some kind of a sandbox, the typical cookie banners in this case.
And you have to ask your customers or your users, your website users before you track anything from
them. You have to ask them if they are okay with that and you have to have an explicit yes and no
button on this cookie banner. And when you do that you're fine. When you do it not, well up until
this year maybe there wasn't a data protection authority who was complaining about it but it
happens rarely. But beginning at least in Germany beginning with next year the public authorities
declared that they would control these well for example websites or businesses or companies or
whatever. But it would control the GDPR compliancy far more thoroughly. So some things at least
will change in 2022. And this case but moving on I hope I answered your question.
Well for gathering these facts at least so not much has changed in everyday lives of the people.
Maybe that some people are complaining about having to click on so many cookie banners on websites.
At least that's what I get in Germany that people like to complain that with the GDPR everything is
far more complicated and you well at least that's what I'm saying. They are complaining about having
to make a decision. So I guess this will become a far more used to in coming years. But right now
we putting aside this nuisance in this case not much has changed. At least the public sees it that
way as well that the authorities across countries don't have much expertise in the topic.
So in essence why should the populace care about using data friendly solutions.
Right now it's a bit of a nuisance. In some countries data protection is even seen as
well kind of an hindering stone for innovation or for other things. So why should the populace care?
In this case sorry for the German speaking part in this case but I will translate.
Well one big part could be Corona pandemic in this case and the use of the
German we called home office. No offense to the Brits in this case. So the home office the remote
working situations we have at least since March 2020. Different in many countries but at least in
Germany there was a survey made by the BVDW. This is a German
association for the digital business economics. So they did a survey anyway regarding
can you imagine working in home office working remotely because of COVID or after that as well.
In this case around three quarters 75.4 percent said yeah I can imagine working from now on
remotely. 66 percent even expect their employers to have an appropriate technical as well other
kind of solution for working remotely and 58 percent even said that they want to have the explicit
possibility of working remotely. In this case in Germany we had some not laws but some
guidances that came to effect during the lockdown phases of the pandemic but they were well they
were running out during the way of the summer so they are no longer in effect in Germany. However
in neighboring Austria since April they even have home office laws so in this case remote working
laws. So very different situation depending on the country but at least the German populace wishes to
have more home office possibilities but they doubt as with the public authorities they doubt that
their employers are ready for that. So in this case the white the right survey was asking questions
is your employer well technically ready so have they the do they have the technical infrastructure
to enable you to work remotely and this case 54 percent said yes but also 45 percent said no
and regarding the mistrust of an employer this is even higher. So this for once. Also regarding
the lockdown phases maybe some of you experienced this in your countries as well when you had
lockdowns. I've here had some newspaper clippings regarding the consequences of lockdown. For
example in Cologne there even was an app developed regarding the well corona regulations chaos that
ensued because every state made more or less their own rules. There was a bit of chaos there also
regarding the so-called home schooling so the lockdown school school stuff sorry
which was also a big mess at least in Germany. So the typical joke was going on yeah what do we
expect only teachers working in school they don't have a clue about IT infrastructure.
So of course for example when in December in a hard lockdown was set in Germany and first day of
so-called home schooling was done of course every server was well stressed to the seams and broke
down. So in this case regarding corona and lockdown situation people are on one hand
a bit in mistrust regarding data protection but on the other hand see well digitalization as a
necessity at least and maybe in combination of the two and well populace will develop the
perspective that I'm working more and more in the digital realm that who
controls my employer that he's not sniffing after me that he's not trying to survey me to spy on me.
And at least in Germany I've got here some paper clippings as well regarding the well general
well the general outlook for example especially no not for example especially in regards to the
gayfam economy so Google, Amazon, Facebook, Meta, Apple, Microsoft, etc. They are well
general in mistrust I especially like that one thing that said well regarding Google Pay and Co.
They are warning once again of them so even the journalists are getting tired of well
well reporting about data protection incidents with Facebook, with Google, with everyone else.
So on the one hand people don't really like data protection because well it's
hindrance, it's nuisance, it's well stuff to do that I don't want to do. But on the other hand
we are at least when regarding Germany we are a very mistrustful folk regarding big corporations.
It has a lot to do with our history regarding kings and queens doing as they please regarding
the national socialist regime in the 1930s and 40s regarding the star sea and the German
democratic republic and the Iron Curtain stuff that happened. So we value on one hand at least
in Germany we value our privacy very high but data protection is for many seen as some kind of
nuisance so this is a bit schizophrenic in this case but that's the situation at least in Germany
where we are. And to summarize this one so remote work is more prevalent the dangers for
data privacy are more apparent. One thing that works in Germany very very good is the stuff
think about the children for example in school when you have to work with for example Zoom with
Microsoft Teams with whatever. Often it's the case that teachers as well as parents as well
as the general populace they say well if it works it works and it's free so it's okay.
That's the one hand but on the other hand the well safety of children of families
as well as the general safety is stressed very highly. So as I said a bit of a schizophrenic
situation in this case but something at least the German speaking countries have at least some kind
of well sensibility in this case. So they say we well we have to do something to keep us safe.
What? I don't know that's the general thing in this case but authorities are controlling more
often as I said in beginning in 2022 the German data protection authorities said that they
want and will control more frequently. So what can we do regarding Matomo? So what strategies
could we apply? For once we need to look more abroad. In this case we need to look at other
countries when we are living in Europe. The GDPR is often seen as some kind of nuisance at least.
Regarding international situations these countries that are on this map green they were
implementing laws in recent years that had the GDPR as a template, as an explicit template.
Some countries are not doing so well regarding data protection for example in Brazil and
also in Australia. This is well not that good of a situation but this is because there are
other laws like in the United States for example the state of California implemented a specific
law that was modeled after the GDPR. But unfortunately California is part of the United States in this
case and the United States have laws like the US Freedom Act, the US Cloud Act and other laws
that are above the Californian law and enable public administration. In this case specific
offices like the National Security Agency, the NSA and other well security organs of the state
to spy out everything that is saved on a server even if it's in Europe. The US Cloud Act which
came into effect in 2018 explicitly states that in regards of homeland security and stuff like that
that the public authorities are enabled to control every person, corporation etc.
and the stuff that they are having for example they can control everything that is saved on
any Microsoft service because Microsoft has its seat in the United States even if the server is
in Germany. The company is in the United States and that's the general problem in this case.
So on the one hand the GDPR is a template, is a model for well similar laws in the world
but on the other hand we have I don't want to call a loophole but we have another situation
where we have other countries that are well GDPR compliant without having the GDPR as a law in their
country. So on the one hand we can look into countries that are having laws specifically
made after the GDPR for for example for marketing and stuff like that so there we could market
Matomo as a good alternative. Also in these countries that are here labeled green we can
also have the GDPR as a some kind of a quality seal because Matomo is open source and everything
open source and everything else. It's a good starting point for having a well GDPR compliant
tool and these countries here Canada well for commercial organizations at least so Canada is
half and half in this case regarded safe but the states or the countries of Switzerland,
of Norway, of Iceland, of Argentina, Uruguay, New Zealand, South Korea, Japan, Israel and
well some other countries as well like the Channel Isles so these specific constituency
that are and are not part of Great Britain as well as some other parts of Black Faroe Islands
in the Northern Sea they have a specific situation regarding their legal status so they are part of
it as well and the fun stuff actually is since Brexit Great Britain officially became at least
for three years GDPR compliant again but I would call this more like a political dealing than
real well real legislation in this case but the Channel Islands in this case like the Isle of
Guernsey or the Isle of Man there are more GDPR compliant than the whole of the UK in this case
because they have a so-called adequacy decision from the European Commission so this is some kind
of well you apply for that there's some kind of application there's a multi-step and a multi-year
inspection of the laws and of the practices in the specific countries that are applying for these
adequacy decisions and for example in June 2021 South Korea was admitted after three years being
observed and well applying for the status of an adequacy decision GDPR compliant whatever you want
to call it country so these countries have laws in effect that are on the same level as the GDPR
in the European Union so in this case every company every citizen every corporation
every entity in this country have has to have well technical solutions tools software that is
in essence GDPR compliant so Matomo could look into these countries regarding getting a foothold and
they are in this case to differentiate it more clearly from tools like Google Analytics and stuff
because you could at least in these countries the blue ones are part of the European Union the green
ones are safe in this case because in this these countries you can argue with legal consequences
when you use Google Analytics in these countries and you don't do it right you can get well sued
or have to pay a fine or whatever and regarding the GDPR the fine can go up to 20 million euros
per case or risk case scenario four percent of your of your global revenue no sorry global income
so the gross income to be exact for example in 2019 Google was sentenced in France to pay a fine
of 50 million euros and just this year Amazon was in I think was Sweden Spain somewhere in the
European Union I have to look it up where exactly but Amazon had to pay a fine for some of 700
million euros because every one of these companies they were well violating data protection so in
worst case scenario Google is fined and you have to pay a fine as well because you are using Google
you are using an illegal software and at least regarding to Germany we have the we have the
local authorities as I said the data protection in Germany is part as a matter for the states
so not the federal government is doing the data protection but every state has a specific office
and the states officials are meeting at least once a year for so-called federal data protection
meetings and at least in September 2020 the conference data protection conference in Germany
they said that American specifically US American companies are not legal in Germany
they explicitly mentioned Microsoft 365 and just in February this year the data protection
authority in the state of Berlin said that for example Cisco WebEx was illegal so in this case
Cisco WebEx was mentioned specifically but among others like zoom as well this case the state of
Baden-Württemberg which is in the south west one of the richest richest states in Germany
they well more or less outlawed zoom in 2020 in March 2020 then zoom did some paperwork and the
outlawing was well was reversed and just a well general warning label that every United States
company has in Germany was applied but in any case the at least the public authorities have a very
very very or putting very strict eye on every United States based company on this case on every
non-EU based company okay so and regarding once again the well this case companies but also part
they are part of the general populace so they should count that well as well this case French
companies were asked so what are the implications of the GDPR according to well French data driven
and non-data driven companies so in essence the light blue ones are regarding data driven
companies the dark blue ones are non-data driven companies so in general IT digital internet
based companies on one hand and more or less traditional companies on the other hand
and in general the traditional companies see the GDPR more as a constraint
whereas the data driven companies so the more or less IT based companies see the GDPR well in
this case as a guideline to improve marketing strategies as well as an opportunity for customer
relationship some also see it as a constraint but in this case more data driven companies see
the GDPR as a general good thing for well developing their marketing strategies as well
as the customer relationship so they see it as an opportunity so in this case to make the best out
of the law this best case scenario even to make it as a part of an USP in this case the unique
selling point could be we are GDPR compliant we value your privacy something that Matomo already
does so nothing new for you guys at least but something that also many companies see so in this
case the public opinion at least in well IT centric industries is more pro GDPR than contra GDPR
because the sorry because the companies are already working with data they are
fluent in this field etc so a company could in best case scenario could use the GDPR and GDPR
compliant tools in this case as an advantage in contrast to their opposition to the
to the other parts of the branch sorry I don't have the right words right now
and one company that does it is actually my my own company but I'll come to that in a minute
but data-driven companies are for example these ones some of them you have heard some maybe not
Trello maybe you heard of them they are part of Atlassian now so they are Australia based
and others like monday.com like Dropbox, Asana, Evernote they are US based the ones on the bottom
Meister and Meister task they are an Austrian based company so they are on the standard
settings GDPR friendly because they must be they have to be it's law so for example these are some
but when you look at other companies that are mostly in the well communications sector
some of them are very very good regarding GDPR compliance for example when you look at
messengers like Signal like Threema also open source stuff like Jitsi or right now we are using
big blue button these are okay but some have a bit of well mixed image in this case when you look at
image in this case when you look at zoom they are a big winner of the pandemic you have to admit that
at least and many many that are using zoom they think well it's such a great service it's reliant
it's blah blah blah whereas zoom is actually a very data hungry service also a very dirty service
as well there is a website called website carbon.com where you can put in domains and they will well
count how much co2 how much gram co2 does it cost in well energy in an energy production when you
want to look up that site and for example i once tested that one with with my own site we came
around 0.69 gram per website use where zoom has around eight or nine gram so tenfold
the stuff so in this case when you use an external service in this case when
us based also you have to have taken to account the environmental friendliness so how
i don't have the word right now sorry but well how good for the environment how reliable how
sorry how sustainable how sustainable is the service as well this is one thing that
that comes more into effect right now for example when you look at for as for future and other
movements so in this case matomo can make points as well regarding well you can install matomo on
your own service so you can decide how environmentally friendly it will become but also how
regional the service will be you don't have to communicate all the time with the united states
or other countries where the servers are so you can decide in this case also another thing that's
the service on the right bottom that's cisco webex or the old logo of cisco webex and for example
cisco has a seal made that at least was one time i did a seminar for a federal agency and i also
warned about matomo sorry i warned about cisco and stuff cisco webex and stuff not matomo
matomo is all right and fine but webex i warned about them because well they are us based
but then the federal agency told me no no no but it's all right we haven't
this case we have we have a seal made by the german bundesamt für sicherheit in
der informationstechnik or transcendent federal agency for safety in the digital infrastructure
but the well the bad point is that this seal i looked up they have this seal but well it's
not something that the federal agency itself makes but you more or less can ask your tax advisor to
uh give it to you because they are well they um they make an audit at at your company and
they say well everything seems fine and now i will get my payment so many many marketing
jargon going on here but that could be something as well all these companies have sometimes very
sometimes very flimsy excuses where they say but we are gdp are compliant we are safe we are looking
out after human rights and stuff like that and here's our seal of approval for from the federal
government and stuff like that so something that you could acquire very easily with matomo as well
so to put yourself on at least the same level of trust that these companies say that they have or
say that they are okay and other companies as well regarding data drivenness when you look at
microsoft 365 or google workspace they are in general not gdpr compliant but when you look at
other companies like next cloud that is a german-based company and cloud service i guess
some of you may have heard of it or own cloud that wasn't uh is what was a part of next cloud
this is with all open source it was next cloud is essentially a fork of own cloud like with
open office and libre library office also another company der seminar that is my own for full
enclosure we are working with some api with some api from next cloud we are also working with a
big blue button for our video conferencing and at least we ourselves are marketing
the use of open source products we also use matomo for our statistics and we market that as well we
are using for example an app called tomorrow that is essentially green and sustainable banking in
this case and we position ourselves with that so when we for example are looking at our campus
our campus this is some kind of an office cloud like with microsoft 365 we say in german that you
can work there collaboratively and also secure in the cloud because we are using an open source
solution we are in we are based in germany and stuff like that also with a talk plus that
essentially is big blue button but well we market it in another way also with other products we have
in this case our media library and everything in this case we will say it's well regional based
so the service on germany companies in germany we are sustainable because we look that we only
have the energy sources well one case regional but also we only use well eco energy for this is
this is one big big stepping stone that our partners our it partners our infrastructure partners
have to make that they can guarantee and also then that they can prove that they
use the data centers that they power the data centers only with sustainable energy also regarding
security because we are based in gdpr country also with the data protection as well that we have
well the regarded that we have some dean or eso norms the iso 27000 and one is for example one
regarding data security data privacy in this case stuff like that for well this case one specific
company with the er seminar we even market more or less we market the gdpr as a unique selling
point of our company and we specifically target in this case for example lawyers or doctors or
other in germany you wouldn't you would call it a professional secret carrier so the most nearest
translation would be you are secret keepers based on your job when you are a lawyer you
are forbidden in germany you are forbidden to use messengers like whatsapp or skype etc
you have to use secure messengers in this case like threema or like signal or the messengers
like with elements which are you which are using the matrix standard stuff like that
lawyers in germany have normally at least legally have to use it as well
so this could be a good entry point for matomo as well that you can contact or that you can market
yourself for example for companies or for public authorities public authorities have to have even
more scrutiny rules to follow regarding data protection okay but what we take from here is
well remote work is more prevalent the dangers for data privacy are more apparent and well
fact how do we approach the matter so in this case we can do it regarding the gdpr compliance
that we put the gdpr as well the biggest selling point for matomo also that companies can check
for themselves what matomo collects from data and also that they when they used not an on-premise
but download variant of matomo that they have total control over their data
okay and with more or less good landing in this case sorry
i'm at the end of my talk and well if we have still time left for q&a please everyone shoot
in any case i thank you very much and well stay good stay healthy and much success in every part
of your life okay but if there are any q&a stuff going on any questions please
please okay i guess that was silence also no question from silver so i guess we're through
in this case yes there are no further questions in the chat so i'd simply invite people to continue
the conversation there if some other question related to christians.com or something like that
related to christian's topic comes up thank you for your talk it was very interesting
uh well thank you as well for having me here all right so good luck everyone
and if there are any questions you can contact me anytime just google my name you can find me
all right so have a nice day everyone bye thank you