This post explores a little experiment I ran in February using OpenAI's GPT3, Google Collab, Python and this interesting hack to summarize CJEU cases. I originally posted this on LI in February and forgot to post it here, with new updates on v3 of the same code.
Over the past year or so, I've been struggling to articulate exactly why the practice of data protection has frequently felt like a defeatist slog. A few days ago, I read an amazing piece by Zvi Mowshowitz, and it helped to define a form for all the thoughts swirling in my head.
It's really very simple: The current approach most of us have towards data protection and privacy does not motivate anyone towards positive action that meaningfully protects data or privacy. Instead, we're encouraged to spend cycles on pointless privacy theatrics, so that we can signal to others and ourselves how much we all care about privacy.
This is a broken model, and I've got some ideas for how to fix it.
Do you hate your Data Protection Officer? Do you want to make them rage quit and throw their computer out the window before moving to a tropical island far, far away from the internet? Well, then, tell them you're using ChatGPT to analyze client records. I guarantee you, in less than 10 seconds, they will look like the AI-generated image above.
After the Dutch National Cyber Security Centre published the Greenberg Traurig analysis of data transfers and the US CLOUD Act (https://lnkd.in/gmcvtCsP), we at Castlebridge HQ realized we needed to provide some practical guidance of our own on the state of hashtag#data hashtag#transfers, particularly to the hashtag#US.
This is an abridged version of what we shared with our clients today, but much of this will be relevant to any organisation facing the question of how to navigate in a hashtag#privacyabsolutist world.
Data transfers to third (or restricted) countries are a bit of a mess right now, and this has been made all the more messy by the UK trying to 'get Brexit done' by replacing EU laws and agreements with Brexity ones.
After puzzling over the question of what contract UK and EU exporters should be relying on, I decided to actually put it out on a whiteboard and share it with you. I hope this helps. Also, sorry.
Nothing focuses my rage more like a company trying to extort data subjects. Here's how we can get back at this new wave of data vampires.
At some point though, a thought came to me -- what does a good tech stack look like? What kind of benchmark or best practice should I advise clients on? How can data controllers do things in a privacy-preserving way? And so I asked Noyb, CNIL and the Austrian DSB if they would, in the interests of transparency, share their tech stacks and best practice.
It didn't go well.