- [Instructor] Most tech companies
would think that their wildest dreams
had all come true if they could bring in
$5 billion of revenue,
but to lose $5 billion because you didn't
adequately protect people's privacy,
well, that would be about your worst nightmare,
and that's something that Facebook
gets to deal with at this exact moment
because of a landmark fine for violating
the privacy requirements of the European Union's
General Data Protection Regulation, or GDPR.
Now the European Union's GDPR,
which has been enforced as of May of 2018
makes some important restrictions.
It puts limits on data,
not all data that is accessible data
that you can see online or that you can get
from people by asking them can be legally used.
For instance, you may ask for people's phone numbers
to enable two factor authentication,
but you can only use the phone number for that purpose.
You can't use it for audience targeting or segmentation.
Also, there's a dramatically changing landscape
when it comes to privacy.
The laws and regulations are evolving rapidly,
and the interpretations of these regulations.
So we're seeing how the GDPR gets interpreted
and how it plays out,
and then there's things like
the California Consumer Privacy Act,
which will be enforced in 2020,
it shares many of the same elements as the GDPR
and many states and most countries
have their own versions of privacy regulations
which, unfortunately, don't always mesh,
and so it makes working in an international environment,
which is what people on the internet do,
a little more challenging.
Now if you want to know specifically
what kind of information is considered private
by these regulations, here's an answer.
Demographic data that indicates racial or ethnic origin,
political opinions, religious or philosophical beliefs,
trade union membership, genetic data,
biometric data for the purpose of uniquely identifying
a natural person, data concerning health,
or data concerning a natural person's sex life
or sexual orientation, as well as things like
web behavior and IP addresses.
That's a huge amount of information that,
once upon a time, would have been part of
the free-for-all for internet marketing,
but now that information's restricted,
and this list, by the way,
is from Article 9 of the GDPR.
Well, what can you do?
There are a few major things that are going to help you
get started on proper privacy.
So for instance, the GDPR requires explicit
affirmative consent to gather personal data.
People have to check the box to say yes,
and it can't already be checked, it has to be blank,
and they have to check it,
and they have to give you permission
to gather personal data.
But in the process, you have to justify the collection.
You have to explain how that data is collected,
for what purposes, how it's going to be processed.
And then, really a critical one here
is that the customers control the data.
The customers can download all of the data
that you collect on them.
If they think that there's an error,
they can correct it and you have to make the revisions,
and they can ask you to completely delete
all their information from your records.
So these are the sorts of things that might fall
under common sense, you know, civil rights
or human rights on the internet,
but they're things that had to be codified in the GDPR,
and they are now part of
the legal and regulatory landscape.
Now it does bring up another question.
We have a lot of kinds of information
that are not allowed,
but how close do you have to be to those things?
We have what you might call the minimal,
or the minimalist interpretation,
and the idea here is that only variables
that directly record personal characteristics are blocked.
So you would have to have a variable
or a field that says Race of Ethnicity or Religion,
and it would have to be in answer
to that direct question.
And so the minimal version says
well, only if you ask that specific question.
The problem is that nearly all variables on everything
are correlated with these kinds of personal characteristics.
It's not difficult to infer a person's race
or religion or education or so many other things
by, for instance, the websites they visit.
And so it turns out that the minimal approach,
which only looks at direct questions
is ineffective protection,
because all of these protective categories
can be inferred through other processes.
Then there's what you might call the maximal approach,
and that is that all variables that are even correlated
with personal characteristics are blocked
and can't be used in targeting audiences and marketing.
Well, this approach basically removes all of the data,
everything is out, and the problem is that
that maximalist approach makes modeling,
that is, creating statistical models
to provide the services that your company's
designed to do, it makes that nearly impossible.
And so, again, it's not a workable solution.
So obviously, you're going to have to
find some kind of balance between those two extremes.
It's going to have to depend on, among other things,
the field that you're working in,
the kind of data that you have available to you,
and of course, your local laws and regulations.
And if you want more information
about some of these challenges
and some potential solutions,
we have another course available,
AI Accountability Essential Training,
which will be a great introduction to these topics
for anybody working in big data, data science,
machine learning, and artificial intelligence.
That way you can start doing your work,
and you can do it in a way that is productive,
that is useful, that provides something of value
for your clients and your customers
without running afoul of the laws,
the regulations, and the social practices
that you're dealing with.