 So the next speaker we have is a speaker from the University of Bremen Dr. Sonja Mangold and Sonja will talk about Crowd-working and data privacy. So she's a lawyer but has run an empirical study on a crowd-working on 32 crowd-working platforms and the study is quite new. So we are very much interested in the results and Are very much looking forward to your presentation. So thank you very much Sonja for the presentation Thank you very much for the kind welcome. So I hope the tech technique will work He has to briefly introduce myself. I'm a lawyer and My name is Sonja Mangold. I'm a lawyer and postdoctoral researcher here in Bremen As Professor Honuf said I will focus on the important issue of Privacy protection aspects of crowd-labor markets It is undisputed in the discourse that enormous amounts of personal data are collected and processed on crowd-working platforms and we can draw parallels here to other forms of businesses With the particularity that crowd-sourcing also affects the important issue of worker protection worker data protection so why is the issue of Privacy and crowd-working so important We already have a lively debate about the consequences of crowd-work for privacy For example, the German Chancellor Angela Merkel Wants in a speech to the Federation of German trade unions last year of the risk of a quote massive digital exploitation in the internet economy We must also say that we currently Don't have Systematic research on the issue. So we don't really know how in in practice Platforms deal with privacy aspects first insights how Platforms actually deal with personal data Delivers a study that I conducted in cooperation with Professor Honuf recently For the first time we systematically explored the privacy statements of all 32 platforms that are currently active in Germany With the privacy statements the companies fulfill their legal obligations Under the EU general data protection regulation to inform about the data processing The focus of our study was inter alia on the extent and the kind of collected and processed personal data Another aspect of interest for us was whether personal data are disclosed to third parties Furthermore, we explored to what extent German platforms take active data protection measures Suggest for example the establishment of data protection officers a first finding worth mentioning is that all Investigated 32 German crowd working platforms have privacy statements. This is remarkable Because for example Studies in the FinTech sector have shown That FinTech companies Don't have in these extent privacy statements We found out that the extent of privacy statements Varied significantly The extent range from one to 35 pages Furthermore we found out that there is a great variety in clarity and comprehensibility of statements Some documents make very clear and differentiated statements about the processing of personal data From clients workers and website visitors by contrast other statements remain very vague and imprecise On this graph you can see I'm sorry The kind of personal data that are collected by the German crowd working platforms Most frequently mentioned are for example email address First name and last name and IP address you can also see on this slide that Specific data is collected from crowd workers such as for example qualification data or location data or for example Another aspect Another interesting finding was That the privacy statements provide no evidence that sensitive personal data Such as religious beliefs trade union membership or health data that are mentioned in article 9 GDPR are collected However, it must be noted that the information provided in the statements is explicitly not exhaustive so the privacy statements said That there might be other personal data that German crowd working platforms collect another interest aspect of interest for us was the challenge for Privacy in the form of sharing and transfer of personal data to other companies or state authorities Maybe you have heard from the Facebook case Recently Facebook came under fire and criticism here because of its massive automatic data transfers In our study in total 88% of the platform state that they in fact disclose personal data With consent to third parties The majority of these companies doesn't specify the recipients Mmm most frequently frequently mentioned Purposes for the disclosure our contract performance handling of payments or advertising or marketing Another interesting finding of our study was That more than one third of platforms state that person data are anonymized or pseudonymized Mmm, this result is quite good if you compare it with the privacy practices in the FinTech sector for example A study that was carried out by a professor Hornoff has shown that only 1% of FinTech companies Have taken such a data protection measures a good practice example In the crowd working field is the privacy statement of rapid user tests This statement contains strict rules about the anonymity of testers furthermore the company commits itself To hold staff training on data protection Another important lever for an effective data protection our rights For client and workers to complain to supervisory bodies To be able to exercise their rights the person's concerned must need to know them Our study showed in this regard that 50% of Platforms provide the contact details of data protection officers Furthermore 60% of companies mention rights to complain to independent state data protection authorities And only very few companies don't mention such rights So what are the conclusions that we can draw from our study? First of all one has to state that German crowd working platforms have taken positive steps to inform about their privacy practice We have also seen that they take proactive data protection measures on the other side We must say that the information provided by the platforms on the privacy practice is incomplete So to come back to the federal Chancellor's speech I mentioned in the beginning the concerns regarding the privacy problems of crowd labor markers remain So what could be from a legal political perspective? key questions and tasks in the future when we bear in mind that the legal classification of crowd workers as employees is unclear and The applicability of employee data protection law is uncertain One might consider and I want to put this in the following discussion to develop new regulatory Models beyond the traditional employee data protection. So thank you very much for your attention Okay, so the floors open again for questions Thank you for your interesting contribution. I have two questions actually the first sample the definition of German crowd working platform, is it German companies established in Germany or is it Crowd working platforms active. I mean, what exactly was the sample? Because sometimes I'm afraid that we are not aware which platforms are active on on the territories and then secondly But that's I don't know whether you studied it Because you you mentioned that data could be shared with public authorities And that that was one of the well issues you had look at Is a here in Germany does it already exist or other plans or whatever? Where the the state authorities the public authorities do impose? That data are shared for instance income data and I do refer here to France where recently they introduced an obligation that platforms have to inform income transfers to Platform users so that they get a grip on the income people get from from platforms The same is being applied in Belgium in a slightly different way It's more inviting platforms to share data and if they do so they get some fiscal advantages And especially the users get fiscal advantages social fiscal advantages, but also the platforms they get less taxes They are exempted from social protection And they try to invite and convince platforms to step into that data sharing With I don't know whether that's something which is or is simply on a voluntary basis where one is sharing data with public authorities But then I would like to know for what purposes they would do that To your first question we explored the platforms that are currently active in in Germany. We referred to a study carried out by Professor Limeister and others And this study showed that 32 platforms are currently active in Germany. So have their seed and are active here and The second question you mentioned. I don't really know if we have in Germany new regulations on data transfer to State authorities to my knowledge We don't have such regulations But in general our study has shown that Crowdworking platforms often mentioned that in the context of fraud for example Data are transferred to public authorities. So this would be one example from the practice Also last question because At least in the discipline where I do come from some social law Platforms are very often labeled as a kind of threats to Systems to social systems to labor law protection. They are the big evil thing where you cannot govern which you cannot control and so on and so forth and there is indeed a major danger that hidden economy and hidden income may grow due to the presence of platforms on the other hand one of the advantages is that Much of the payments are done electronically. You can trace it down. You can track it down much more than for instance on construction sites where Money is being paid on the table and so on and where it's much more hard to track down hidden hidden activities But that of course presupposes that you kindly or less kindly invite platforms that they have to transfer Data especially income data And some countries already imposed or experimenting with it, but I do know that as soon as you start to talk about it Within a second, especially lawyers, they will say this is completely impossible because of data protection and Privacy protection and you you cannot impose upon platforms that they have to share data Because it's too sensitive and so on and so forth And I don't know whether to what extent you as a lawyer within this project You have been touching upon upon this issue because I see also potential of controlling much more income transfer than before If at least you follow some logics and with respect of privacy But it's not because you transfer some data that it's immediately in breaching a protection of privacy Yes, I think there might be or should be Justifications for transfer of data in these consolation you mentioned, but I don't know the German discussion I think I I didn't I haven't read something about these so much about these debate with regarding especially the privacy aspects in in general, yes, I would absolutely agree that there should be mechanism as you mentioned it and I don't know really if the data protection law is a barrier or something like that in this regard Maybe directly following up on that. I Guess that the point is also an economic one because I mean even if there would be a regulation Saying that, you know, you're not supposed to do that in general, right? That would be the rule Then you get a Consent by your crowd worker and you ask them whether they provide consent or not So if they do you're allowed to transfer it, right? You write it in the statement and the question for the crowd worker is I mean, can he be part of the platform? Yes, if you assigns the consent if he doesn't sign, he's just out of the game So and I think a lot of companies I talked to that's exactly what they tell me, right? I mean they say like the general data protection regulation Doesn't matter for them, right? I mean, they just have a consent agreement Customer sign it. I mean, what can they do? And I mean we we have the debate about ratings before, right? I mean if you have a big rating, do you easily switch to the next platform? Not at all, right? I mean you just stick there and And then you sign the consent form, right? And then you can transfer data wherever you want It's it's not good, but I think it's it's how it's currently working, right? But at least from the practice we notice in Belgium, I mean we introduced this system Where we try to convince platforms and platform workers to be open on income transfers and as a kind of return the first the first Tier of the income up to 6,250 euro a year is being exempted from taxes and surrogate That's a kind of trade-off So if you participate in that sharing of information, we exempt you from paying taxes and contributions and They hoped that most of the platforms would step into this logic and approach and that kind of But many do but especially smaller platforms and very often non economically or Non-profit with a profit goal or profit objective and so on but the big players I mean the let's say the multinational Platforms like like Uber and delivery. They kindly thanked the Belgian authorities and I said they do not participate in this kind of initiative Because they want to protect the privacy of their other People working for them and so on so then now there's a of course a discussion going on how to deal with this is a I mean they still hope to have them convinced but Apparently it's not so I mean it's also a power game Of course a Belgium is a small little nation It's not because We asked them to do so that they will that they will do it rightly I mean I've seen some other examples Like in Denmark where they showed more their feet and said if you don't apply the rules You can leave even to the bigger ones and that apparently work more than then Things like in Belgium where they kindly built in some incentives and Smaller platforms they do so because they need it I mean they have to but the bigger ones they don't they don't I mean they play a kind of power game Maybe with regard to the bigger platforms, maybe something positive for my impression Concerning privacy aspects The the big players such as for example a quick worker have a better Privacy statement. So in this regard, maybe they have other Lawyers or something like that, but to my impression the privacy statements of the bigger platforms where more detailed more More clear and so on and so But this is not a contradiction to that what you said Yeah, thank you very much for the presentation You showed a very interesting slide about the different types of information that is collected by these platforms So I was wondering I think you don't have investigated that yet But I asked myself is all this information really necessary for actually running such a platform So I was wondering what came to my mind. Maybe it would be possible to to design some work of Reference workflow that's behind these platforms and actually look at this workflow and ask What type of information is really? Required to do so and maybe you will have some variation for this workflow, but Actually, it's no not all question But something that came to my mind because I initially thought is this really collected this data because it's necessary For running the workflow, or is it really just collected for the mother things which do not Yeah, affect the functioning of the platforms it would are there any Ideas or intentions to go into this kind of direction? Yes, I think you you mentioned the Slide about the collection of personal data the overview So we decided Not to differentiate between a website visitors the collection of data from website visitors workers and clients because as I've already mentioned only I think a half or a third of platforms make these differentiations so we that's why we made the the slide or had these These whole overview and not a difference made didn't make a difference, but This is what you you mentioned or what you meant or I Hope I have Answered your question. I would like To see the The the actual actual connection between these different topics that might be the content of Information taken by the platform and the possibility of digital exploitation because many of those Actually are nothing but an electronic personal file and Well, yes, of course, you should not put that out on the next Newspaper but apart from that that is not that much possibility of exploitation given by such type of data so if we consider that there is the possibility of digital Exploitation that would Probably not Relate so much to the type of data that people actually are asked but what during their digital work is automatically Surveys on them and that seems to Provide much better possibilities for exploitation So if it comes to data protection, you should not forget that all these platforms during their digital mechanisms Sample a lot of data that might be much closer to what is finally the possibility for exploitation Yes, I think The Angela Merkel was referring to the internet economy as a Totality not and she didn't she wasn't so specific as you were now but the context of course is these danger or risk of the surveillance of Crowdworking of the crowd working process and that we don't really know what kind of data are collected and processed In this phase or in this regard Thank you very much for the nice talk I'm wondering if you are only Considering the data that the user needs to give while creating the profile or Also, you are considering the personal information that they have to give while working on a task because Worker are complaining that the during doing the task They are asked from requesters for personal information and this is an issue for workers. Have you Study that part or consider that or no our study was based on the Analysis of the privacy statements. So we don't really know what happens if a person Registers at on a platform. So this maybe would be an important aspect for further studies or for further research to explore what What happens after the the registration or the of the worker after the contracts Concluded so so there is no rule for request or not to asking such cool and such info for such information Or is it already? Yes? I think you you need more systematic research more Maybe expert interviews or something like that other methods than the privacy statements Because the statements are not complete as I've mentioned in this regard. So Yeah, one thing that shouldn't be recorded, but what we intend as a second Step of the research project is to register at the platform and to see which data They are actually collecting on us and then see whether that matches with the data protection regulation statements And then we see actually whether they collect more data than what they are claiming They are collecting in their privacy statements. So that's actually the second step. We want to do in the next weeks As probably a very naive and simple question I mean, do you know when you see such a statement whether it's it complies with the law or not? Yes, I I try to I examine this as a lawyer. I have take took a closer look at this question and to my impression the Decisive point here is the time for the Collection of the data because the obligation According to the EU general data protection regulation to inform About the the collection process refers to the time when the the collection starts and when the This time I think The privacy statements they they comply with the law in in this regard because We we didn't We don't know what what is what happens after the registration for example, there should be new Information obligations, but in a first step, I would say They comply with this obligation to inform about the collection process When they are incomplete So despite this fact just a comment This would be nice to have a sort of a benchmark clear benchmark So privacy statements comply with the law if these conditions are met and then the second question is of course interesting Do they do what they say? That's that's that's a very interesting pair of questions. I think I would also have a Question to Sonya and maybe also to Paul what you mentioned before was that the larger companies are not that eager to transfer data to the authorities and As an economist, I always think about prices, right? So I thought about well, I mean Foreign companies can probably be not Be taken care of that easily, right? I mean they're abroad I mean you can tackle them down in some way, but it's not as easy as FF the company right in your country, right? And then the thing is I mean why would you actually transfer the data, right? what your people are doing because and you're really what they're actually doing right and Then it might turn out. Well, they're working a lot and they don't pay taxes for that, right and At the time when you're not complying and you're not telling anyone what they're actually doing at the platform You can decrease wages Because you know, you don't pay the Add-on of whatever social security taxes and so on and you have a big incentive actually not to reveal it and So do you both think that this is actually taking place and in this sense? I would say well actually technology would help us a lot, right? I mean we would like to have to transfer because you could actually protect workers Yeah, by using the technology and by transferring data, right? Well as to the first part it's indeed a concern that When you have legislation which is nationally designed and nationally being controlled and Most of the action is taking place abroad Overseas US for instance or China or whatever I mean and the question is what is then you overseas is it the I mean what is it? Is it where the server is is it where the I don't mind that that's indeed I mean to control and to to align and to make sure that they are in line with your legislation if you have strong fierce legislation It's not easy Secondly what I noticed but I mean this is not scientifically of course being documented, but Well, I've been traveling around at least in many of the European Union countries lately and especially Smaller nations. I mean you have many of them in the European Union It's not easy for them to try to impose some tax law or social law on Companies which maybe have a budget which is far bigger than the national budgets Very often the countries are done indirectly threatened that there are some interesting business opportunities But of course if you make life too difficult to us There are plenty of other little countries who may have interest of and so on So this is a game which I think is being played not only about platforms They'd simply paid by by multinationals Overall, so that's that's a bit reality. I think bigger countries have less of that kind of problem But they may then have another issue that That Let's say a country like Ireland was known that for some reasons for some stock reasons tax reasons They were quite lenient to to a very not too harsh approach and so on and so forth. I don't have to explain more I think and you know that much of the GDP income is it's going back to the US and coming from Ireland As to the second Question I don't have hard data on on it, but I think that indeed that if the data are not being shared or not being Given to the state and why would they have because if they don't consider themselves to be an employer If they weren't employed they had to by by law, but if you don't consider yourself to be an employer But simply a kind of intermediary Why would you would you give that and then the danger exists? Of course when I have do some little jobs on the platform Why should I? Unveil my income to the state now this may sound shocking to some of you But I think in most of the well most of most European citizens and well depending a little bit of the state where they are I mean if you can try it not to unveil your income you You would try to do it and I already have heard that countries like Having kind of minimum thresholds for tax reasons or for social reasons Exempting payment if you are less than that minimum threshold that by accident many people earn up to that minimum threshold But not never Beyond it, which I think can be an indication that So yes, I think that's the danger that therefore I think hidden economy may rise again and Why would they share data? Well if you compel them they have to And but I'm I also noticed that some states even there's do not dare to compel To make laws to have those data shared I mean if you compare the Belgium with a French approach a French approach is compelling We will see whether it will work But they are a bigger nation of course the Belgian approach is trying to convince Which is a different approach and well, we'll see how it will work out Yes, I to add to this maybe I think it's also in question how effective would be such Supervision or so the question what kind of regulatory models could be useful to to Provide solutions for these problems So should incentives an incentive-based Regulation is it may be better than a compulsory regulation or more effective maybe Or not, okay. Are there any more questions? If not, we have a ten minutes longer break, I think everyone would appreciate that and we can have Coffee and snacks outside and drinks and we meet again at the quarter past four