 The problem is the input, the problem is the output, the problem is the output. We still have two minutes, so maybe it will be fixed. We'll call our superiors. However, I think we can just start, and I will start without the slides if it's okay. If you can work without the slides for the first few minutes? Well, I will just need the computer basically to look at the slides myself, so my computer will not be available anywhere if that's the only thing. So if you can put it on another computer, I will just take this off and start to present with my laptop and with all the slides on the screen for the audience, but I will explain basically the content on the slides or however. It's just going to be a speech. You'll use your slides to help you remember? Exactly. Exactly. I think that we really need a slide for the delay. We're doing our best. Okay, so let's just go ahead without the projector. So I apologize. We're having a little bit of technical difficulty with Christina's slides, but hopefully we'll get that fixed shortly. But she's going to go ahead and get started. So thank you, Christina. Yes, so hello everyone. In my defense, I do have slides, but they are here. So I will use them for the purpose of this presentation. So my challenge would be basically to attract the attention here and not on the screen. Okay, and I am however very excited to be here and to present to you some aspects regarding technology challenges for privacy the case of decentralized social media. First of all, a small disclaimer. This talk is not legal advice. It is meant to be taken generic. And it's not to be applied to a certain particular situation. If you're searching for legal advice, I strongly encourage you to go and seek it. And also it's meant to be a bridge between technical aspects and the legal community. And this means that it's sort of sacrificing a bit of legal and technical procedure in order for it to be more adjusted for both the communities, the legal community, and also the technical community. I'm sorry. Put the output to the HDMI because there is no output from your laptop there again. No, let her speak. Yeah, you can give me your... Okay. Okay. Yes, no, it's okay. Okay. So to continue, some legislation, I think everybody heard about the GDPR. It's very... We are very aware of its existence. It is meant to protect personal data. And personal data means, in the sense of the GDPR, personal identifiable data. And that means basically any data that can be used to identify an individual alone or corroborated with another type of data. And here I would like to mention, for example, name, email address, phone number, but also IP address and login IDs, images, social media posts, and so on. Then on my slide, I have a few... I have a few statistics regarding the fact that main social media platforms have increased their number of users, and we are talking about billions of people that are currently using social media. And on the other side, we have decentralized social media, which, for example, mastodon, where we have also a certain number of people, so it attracts attention, and also a significant number of dudes, which is, in fact, more than one quadrillion, five hundred sixty-two trillion, and so on. So we have a lot of personal data that is out there, and that is being given away willingly by us, consensual. And here we find ourselves in our society, basically, in a situation of being in a privacy paradox, because ourselves, we are giving away consensual, our private data, but on the other, from the other point of view, we are seeing ourselves, basically, in a situation of how to say, how to explain. Give away our data willingly, but on the other side, we find a lot of awareness campaigns and a lot of situations where we hear from everywhere that privacy is important, we should care about our privacy, and so on. But on the other side, we are giving away our data, and this creates a situation of maybe a black bloc society. It has been said that we are living in a black bloc society where hidden algorithms can make a ruined reputation decide the destiny of entrepreneurs or even devastate an entire economy. Just one second. Is everything okay? So we have some privacy design strategies and this need for privacy by design, the principle of privacy by design from the GDPR becomes more stringent in such a situation because it eliminates the aspect of us consenting to give away our private data. It's basically very important to have the people that are taking into consideration the principle of privacy by design and incorporate privacy requirements into account right from the start and throughout the system development life cycle. And this means, according to this philosophy of privacy by design, the fact that privacy should be regarded as an intrinsic software attribute. And we can identify eight main privacy strategy, privacy design strategy existence. We have basically, we should look at them basically as an ideal concept because the point is to aim to reach some of them and also neither of them in itself is ensuring compliance with privacy by design. Now, regarding these privacy design strategies, they are split into two main categories based on what they tackle. On one side they are tackle data oriented aspects and on the other side we are talking about processes inside an organization. Now, the first one is minimize. I will not actually go and discuss about each of them very in detail. I will focus just on one which is separate but just to give you a glimpse of it, the first one is minimize which means basically that the amount of personal data that is processed should be restricted to a minimal amount possible. And as main tactics recommended, we have select which means that we should select the relevant people and the relevant attribute exclude which means basically that we should exclude people or attributes from the beginning, remove data and also destroy it permanently. The second one is height and height means that any personal information should be hidden from plain view. For example, in a situation of mixed networks to hide patterns or in a situation where there is a request for the right to be forgotten, the data to be deleted but it's not really deleted it's still kept on our databases. In that situation, that data still exist and should be made unlinkable and should be made unrelatable basically. And the main tactics in this principle is dissociate encrypt and restrict access to personal information. Okay, thank you. Then from the point of view of abstract, you should limit the details in which personal data is processed which means that personal data should be processed at the highest level of aggregation and with the latest level of detail necessary for the purposes of the processing. And as main tactics, they are basically recommending to summarize details into a more general attribute and also to group basically to abstract information at the level of a group of people instead of processing it at the level of a single person. Another one which is more related to processes is inform which means that data subjects they should be informed about the processing of their personal data in a timely and plain language manner. And as main tactics, we have supply, make information available basically. We have notify, for example, notify about the breach occurring. We have explain in a concise and plain language manner. And also we have another strategy which is control which means that we should provide the means necessary in order to tackle the consent of the person. And as main tactics, we have ask for consent that means that the consent should be explicit, freely given and offered in an informed manner. We should give the user a real choice. We should offer means to review and update personal information. And we should also retract for the possibility to retract consent. Another two, enforce and demonstrate the aspect of enforcement. We should establish privacy policies inside our organizations. And as main tactics, we have create, maintain and update these privacy policies and also demonstrate which means basically that we should be taken accountable to prove compliance with privacy regulations as a main tactics, the recommendation would be to audit, to record, to report to privacy authorities. Then we have finally separate. The separate aspect means that as a best practice we should distribute or isolate any processing of personal data, storage, collection, operations performed. And as main tactics, we have isolate. Isolation means that we should process personal data in separate databases or apps independently without access or correlation between parts. And also a second one which is very relevant for this talk is distribute. That means that we should partition personal data so that more access is required in order to process it. And we should distribute the processing of personal data over different physical locations with no control from one single entity. And we should use the equipment of the data subject himself and versus as opposed to central components. And basically we should use decentralized over centralized as a best practice. Now, if we think about the current state, the status quo, how social media looks like and if we think about the ideal social network from the perspective of these eight principles we see that there's a long way to go. So basically there's a lot of room for improvement. However, the point being is that if there is such an ideal social network, the social network would be decentralized. And user will store basically their personal information on their own devices and share them in a peer-to-peer fashion. A decentralized system basically, if we go more deep into the matter we discover that it's not just peer-to-peer and it's a distributed system where multiple authorities control different components and there is basically no single authority that is fully trusted by others. And we have a large variety of designs starting from the peer-to-peer fashion and ad hoc mesh and so on until we go to, for example, more complex structures which are federated super node networks. Regarding federated systems, as a characteristics of these systems we have the provider nodes which act as an authority and they are being trusted basically by other users. Each provider is responsible for its own users. Between providers there is collaboration in order to provide a service. There is no single provider that has authority over the rest. The infrastructure is usually independent and the providers act as a super node in terms of routing. And as a backside, the provider itself because the responsibility falls upon himself actually the main target for attacks related to security and the provider has the potential to violate the privacy of the nodes based on design choices on the platform. As main benefits of decentralized social media we have the aspect of surveillance, the fact that it's more challenging to take place. There is no entity in control so obviously it's easier to avoid such a situation. Because of the diversity location this can overpass censorship, political censorship. We are talking about, because of this model about distributed trust which means that the network can be built in such a way that part of the nodes are trustworthy and in this context the security of the network is preserved and from this benefit for example blockchains are taking advantage a lot of this feature. We have integrity which means that the model is more robust versus an attack that is meant to take down the entire network because of being decentralized. From the point of view of confidentiality the framework could act as a field for third parties and also from the point of view of serenity from the user the user is more in control of the personal data and it avoids the uneven balance of power between centralized operators and users because in the end in a centralized network we are seeing ourselves in an uneven balance of power where we have the operator which sees everything on the platform and we have the small user that uses that platform but in the decentralized model this balance of power shifts and it's more even. As challenges of decentralization we have in fact surprised the GDPR framework which is pretty much meant to if you read the GDPR you will see that it's more meant to discuss about centralized cloud-based internet so it's more talks for the situation of having a company or an organization or an individual and the relationship with their cloud provider. It talks about a data controller and a data processor. It does not refer directly to the situations when we have peer-to-peer networks so this framework itself is let's say not very clear from the perspective of the law and also we have difficulties applying some aspects, the right to be forgotten for example how do we apply it to blockchains or how do we apply data minimization to such big databases and on the other side we can notice also some trade-offs that are happening because in a situation of centralization versus decentralization in fact the trade-off is trust versus transparency. Trust in the central provider in the case of centralization and in the case of decentralization we are giving away transparency because the interactions happening on the network they are becoming more visible on the network in order for the decentralized system to exist and there is no content transparency but there is a protocol transparency so by transparency I'm not talking about the content itself because from the point of view of the content especially if we think about encryption mechanisms we are more okay the content that we post on social media which is decentralized, it's more protected but from the point of view of the metadata there are radical transparency at the level of the protocol or the metadata so this is problematic from this point of view so when we talk about the trade-off of transparency we are referring more about not content transparency but more protocol and metadata transparency which needs to be working somebody was telling me that metadata is for a decentralized system like the oil is for an engine to function so in order for it to function we do need to have access to this and we do need to build this trust between nodes now a very interesting example is the example of the Fediverse where we can find present on the platform and as actors present we have users lots of data subjects we have instance administrators they are the ones that maybe they are processors or the controllers from the perspective of the GDPR or they are programmers or protocol designers for example in this case we are talking about activity pop being the protocol and from the point of view of the instance admins because they are the ones that are processing or they are controlling information in the sense of the framework of the GDPR are we talking about a data processor or a data controller and I asked this question and the conclusion that I reached is that it's a personal conclusion it's the fact that if you are just a simple admin who just installs for example Mastodon or Pluroman has no idea how they are working you should be treated as a processor from the perspective of the GDPR for example but if you are someone who writes a Fediverse instance for example that collects all the data in order to do analytics and add tech in that situation you should be seen as a controller in the sense of the GDPR however the framework that the GDPR is proposing is a framework that is not very specifically applied to this situation so it's just an interpretation at this point now in terms of what we should do further in order to ameliorate to make this situation better from the point of view of the legislators legislators should align legislation with tech particularities and also they should keep up basically with the tech innovation because I'm not sure exactly if this might be a reason the GDPR started to be a thing and people started to discuss about it around 2012 in that situation decentralized social media was very at the beginning so maybe they did not took into consideration this particular situation this particular framework however things are moving and in the future I do expect that we will have clear answers about how to tackle this aspect and we will not remain with questions unanswered basically and also from the point of view of technology because we also have some issues from this point of view technology should align to large principle of privacy by design because decentralization alone with all those principles that I was stating in my talk decentralization alone is not enough to be a better alternative to centralized systems privacy wise it needs to be doubled by other privacy strategies because if you have a system which is decentralized that doesn't mean that you are compliant with privacy by design alone it does not get you to compliance however if there exists such a thing as a social media network which is ideal and incorporates all eight principles that network definitely should be decentralized so that was it we still have five minutes for questions and feel free to contact me I will however post the slides after this talk and thank you very much for attending it let's give one extra applause for persevering and giving an amazing talk during the most distracting circumstances does anyone have any questions? so on that you said that essentially decentralized social media doesn't isn't covered by the GDPR because it only focuses on controllers and processors which is of course correct but I would argue well there's also joint controllership we just don't know what it means yet and how to interpret it exactly and on the other hand if you look at like the ECJ decisions that are coming out we're actually getting to a point where it's pretty clear that all of that is covered and they are actually all just joint controllers which doesn't make it any better because then you just get into the whole discussion around what contracts do you need to put in place but I would say it's very much covered it's just really hard to implement the GDPR properly in that kind of context that's one comment I would have, not really a question the other thing, blockchains and right to be forgotten isn't the reason for the right to be forgotten sorry, for the right to be forgotten to be hard in that context that you actually, not you but controllers actually overstretch the consent as legal basis and don't rely on contracts for example sufficiently enough well according to the GDPR it's not just the consent the reason why we are processing personal data but it is basically a best practice because if we would have an informed free given consent then it would be very nice to process personal data based on that consent or that contract because in the end the contract is giving consent but it's not, it's just treated separated from this point of view I would say that we also have legitimate interest and usually technologies that do not answer do not enter in situations of having a contract or having consent freely given then we also have legitimate interest it's a trap basically a technical trap let's call it like that but it's something that definitely can have an answer from the point of view of the law because the law however needs to be interpreted and applied to specific situations thanks for your talk did you have a look at Secure Scuttlebot where you own your own data in a social network and if yes, what do you think about it? I do not hear the question did you have a look at Secure Scuttlebot where you own your social media data and what do you think about it if you took a look at this? I did not, I heard about it but I did not look at it I think we're out of time let's give it another round of applause, thank you no, it's okay do not no, I'm not eating good yeah, it was a pleasure