 Efallai, rwy'n mein i gyflaeniaeth, mae eich nod o'r rôl oed yn y gweithio'r wybod, a hynny'n gofio'r cynllun. Mae'n osart yn roi'r ymgylch, yn fawr bod yn yr ymddiwedd fel ydym ni'ch ymddangos iawn, ond i ni твоAD, mae hefyd yn defnyddio'r bydd. Mae'r bydd yn defnyddio'r bydd. Mae'r bydd yn defnyddio'r bydd! I was until last year, Head of Information Policy for Wales, which is indeed in charge of protection and written promotion. The reason I point this out is because, well, twofold. Firstly, we're the BBC and we like accuracy. And secondly, because I've left that behind and I'm now sort of reflecting upon that 10 years of leading that team. I've been working on big data which I shall come back to and refer to in a moment or two. But I'm soon going to be leaving the BBC and so most of what I say today is going to be my personal reflections upon this as I move out into a new era still sticking my hope in the privacy sphere. Firstly, a couple of points and I promised to David that I wouldn't spend too long in this section reflecting too much on the last session around a media response. I do think there are just two things I would say in terms of the Article 29 Working Party response as opposed to how Google is implementing it. From a media perspective, we think that there are some problems with the Article 29 Working Party and it needs sometimes the way it is implemented by Google. There is an issue around transparency and I think that continues to be an issue and it's something that actually I'll pick up on reflect on my own personal views in a moment. If the publisher doesn't know and the Article 29 Working Party suggests that in most circumstances the publisher does not need to know that the URL has been taken down, then actually how can Google be making a properly informed judgment? There may be issues that the data subject has raised which the publisher has counters to. Those facts need to be known. There isn't a balance there and this comes then to the data subject. The data subject has the right to appeal but the publisher doesn't under the Article 29 Working Party because the publisher isn't appealing under the Data Protection Act or under the directive. Again, there's an imbalance and I'd like to come back to this point about balance going forward because I do think actually we are in danger of regulating and legislating in silos and ignoring the fact that there are other silos that are significant and have impact in this area. Also I just think that I think there's a slight danger, Wilhelm suggested, there has never been a problem of censorship. Except as in the vast majority of territories the publishers are not being informed that they are being taken down, we don't know whether there's a problem of censorship because the publishers don't know that it's happened. That is in essence a societal problem that I think we need to tackle and it's back to this point. You can't have a fundamental right being judged unless you actually are balancing it. So that's the way to see a position. Now this is all down to me so when I get the rest of it wrong you can just shout at me instead. I do think I'm nervous of Data Protection Authorities being the bodies given the responsibility to make this balance. Particularly reflecting upon Freedom of Expression section 32 in the DPA and more broadly, Data Protection Authorities are there to enforce a fundamental right. They are a very important part of the mechanisms but they're there to enforce one right. How can a body that's set up to enforce a right then balance other rights that it has no responsibility for? When I said this to an audience in Brussels recently a member of Coneel said, well we deal with all sorts of industries all the time, very very important industries, we can do all sorts of balances. You deal with every industry pretty much, there are very few industries perhaps apart from chicken rearing that doesn't involve personal data. Why I came up with chicken rearing? I don't know. But I do think that there is essentially a problem here that actually I'm not sure a regulator for one right is the appropriate body to be balancing other rights. Eduardo from the second panel and I have absolute agreement here. I don't think that actually Google is a data controller. Now I take Chris's point, if it's not a data controller what is it etc. Well my answer to that is at the least when it comes to the new regulation. They've put something in that makes sense in the modern world but oh no it's a bit too late to start. So we've got a main frame idea being translated into the new regulation which will be Web 2.0 frankly. The idea that it's up to date is ridiculous. But the data controller has certain implications. How do you do a subject access request to Google? Well I suppose you type your name in. But data minimisation? I don't know about you but I don't want a search engine that does data minimisation. Surely the point is it's meant to go out and find stuff. It was data minimisation I could do that myself. So there are contradictions and we're back into this disconnect between the law and reality which has been mentioned already. Now I do actually think by the way that I was accused in that same panel of not being in favour of privacy. I've been in the BBC State of Protection Office for 10 years. I believe passionately in this stuff but I do think there has to be a balance. And I think why that balance comes will be in the pragmatic is of course we probably can't get rid of the concept of data controllers and data processors. Or introduce a third group which would seem to be the sensible thing to do in the new regulation. We'll be stuck with it but the pragmatic solutions have to reflect the real world. My other problem with the judgement and this is also true in there's a case which I don't think has been mentioned so far today. Telecarble, an Austrian case which went to the UCJ. Where what we have is what I think is a very dangerous pattern of the courts and society. I don't just blame the courts here but the courts and society affect the outsourcing judgments. We said to Google actually there's a lot of really difficult stuff to balance here. You know there's freedom of expression, there's personal rights, there's all sorts of things. You go away and do it because we haven't got time in the courts and we don't spend the money. Getting a commercial organisation however well meaning I like with him, I know with him very well. I think he does a terrific job but should he be doing this job? I question that. Telecarble has basically been told to go away and sort out IP infringement in Austria. Yeah good luck with that. But why are we doing this one because actually we don't have a mechanism to deal with it accurately ourselves. We can't get David to do it. He's got enough on his plate already. So it seems to me that as a society we're making more and more calls upon groups to do things because actually we haven't got the resource to do them ourselves and sort it out ourselves and I think that's a dangerous route to go down. So there's this balance point. I do promise I'll talk about the other internet players because I do think it's quite important. This is where this balance point I think comes back. I'll come back in a moment if I've got time to media archives but social networking, online forum, the blog post. Some of you may know a case on the freedom of information side of my former life about sugar. Sugar versus BBC which is how widely do you define German's and Martin literature? What is the definition now? The definition of the freedom of information but clearly the same phrase appears in the data protection directive and in the DPA. And when you look at nearly all of the jurisprudence there it is told, we are told to interpret it widely. And yet there's a contradiction here because we're also told to interpret the data protection widely. So we've got these two wide definitions which overlap in the middle. And I don't think we've really got our heads around this. The right to be forgotten I think does as David has suggested apply to a large number of internet players here. I don't think it's just search engines. I think the blog post is one example. I think social networks, online forums but we're not even thinking far enough ahead. I've been doing some thinking around IPTV in this last year. I'm looking at big data and internet protocol television. Once your television set isn't effectively a computer, search is not going to be something you sit and type in. You're going to talk to your television set. I mean sometimes you do that anyway but that's normally shouting. Doesn't quite the same thing. You're going to say get me the news. Who's news? What news? There will be an algorithm. It will probably be constructed by the set manufacturer. The Sound Songs News Algorithm. Will we know that actually the section from Davongadia or from the New York Post or whatever has been removed? No we don't. And I do think that although as Julia in the first second session said this is statistically insignificant. Yes it is the number of major news items that might be removed is going to be statistically insignificant. But socially I would contend it is massively significant. And I think we have to be careful about wandering along this line and again forgetting the balance. This is article 8 verses article 10 or if you want the charter 7 and 8 verses 11. And I think these are not incompatible. I think there can a balance can be made but I would contend at the moment that the two sets of arguments are being put in opposition and are not actually being balanced. I suggested something that came to this in Europe and it was suggested that somehow I haven't read the judgment. I've read the judgment. I would contest putting the word balance in a judgment does not make a judgment balanced. Now you know I freely accept that coming into a room for the lawyers that's a dangerous statement to make. But I do think actually it's important. I think there wasn't enough balance made. And I think that's because actually to be fair to the EU, the reality was that they had to make a call on that set of circumstances. Were they going to really lift up the rock of freedom expression at the same time? I don't think they'd have been finished now. So we've got over here the right to publish and we've got over here the right for the individual. Well that's fine but we're going to have to bring them together and we're going to have to do that sooner rather than later I would contend. I've already said that I think this is sort of a directive for the mainframe, the regulation Web 2.0 and I think we aren't going fast enough to look at the future. The direction of travel has been mentioned by David, the culture point. I actually am concerned about the direction of travel, not just because I think freedom expression is being underweighted in this, although I do. But I also think that it's going to create further and further problems. The harmonisation point that the regulation is pushing towards is going to make this more difficult. We already have the majority of companies or large companies in this space, the American companies, genuinely not understanding where we're coming from. These are people for whom the First Amendment is absolutely ingrained. We're going to make all those conversations significantly harder. Now that's not a problem in itself and I don't think that that should be a reason for not doing it. But actually if you start thinking in a globalised world I do think that we are in danger of having a conversation with ourselves rather than the rest of the world. You then back to what is and is not appropriate inside individual territories inside Europe. For those of you who don't know, look up the Wikipedia case in Germany. Now, I can't remember the name of the case, but effectively two people who were convicted of the murderer and actor went to Wikipedia, tried to get their names removed from the Wikipedia article about that actor. They didn't deny they'd done the murder, they didn't deny anything about it, they just said they wanted to get on with their lives. Again, a perfectly reasonable balance to be had. But actually there is an element then of rewriting history and we have as a society to work out what we want to do about this. When we come to these new media players, does a blog post, when does a blog post, trip over into what I would call the casual vacancy effect? I don't know whether you saw the dramatisation, but for those of you who didn't, one of the things was a scurrilous website but was sort of telling the truth. I get very nervous, I heard earlier today we were talking about those circumstances where defamation or inaccuracy, well actually what's one, what's the other, my background before I got into privacy was a political journalist. My exit from the BBC will be running an OB for the general election, I'm sort of being let loose with the toy cupboard again. I'm really looking forward to that. But when you try and apply those kind of absolutes that only the law can in court when you look at the full set of facts and you try and say we're going to do this on the fly, we're going to do this, we're going to outsource it to commercial companies and we're going to have, or we're going to have Porol David again at the ICO deciding whether that is or is not an accurate statement. I don't think that is appropriate and I think we've got to get that balance right. So I've only got about one minute left I think, one minute I've got. Is there a way around that, yes I think there is pragmatically. What I've been doing for the last year is preparing a thing called my BBC which is going to be going live in the autumn and is actually about personalisation, the only way you can work personalisation is by getting a large amount of data about people. You can do that, you can take people on board, I genuinely believe you can make big data privacy friendly, I think they are in the process of doing so. But we're even there, even when you do do it pragmatically, you're going to end up with some further conversations which we need to be having. What about exhaust data? What about data that you don't even know you've created just by wandering around the internet? Is that your personal data? It could describe you in certain circumstances. How do you define when it's going to be put into an anonymised form? Created data, the data that is going to be created by services for you at your request in order to supply you those services. Is that still personal data? Where does the algorithm itself become personal data? These are issues that need to be tackled and I do think that we need to look at them, but we need to look at them in terms of the balance of the privacy right which is vital, but some of the societal benefits that the individual and society can gain by having that privacy right notched down or notched up. But we need to have the conversation, we need to have it in a broad sense and we can't just have it in terms of a single judgement. Thank you.