Privacy Talk with Lena Ghamrawi, Chief of Staff and Policy at International Digital Accountability Council “How Does Latest Privacy Update Change Developer’s Mindset?״
By: Blockchain Project Research Study
Tags: Data, Business, Digital, Privacy, Tech

This interview is talking about mobile application privacy and gender gap at privacy and security field.

Kohei is having great time discussing with international data protection and data privacy expert Lena Ghamrawi.

This interview outline:

What is the future information management?

What is the better analysis for democratic society?

Message to the Listeners

Kohei: I see, that’s a pretty great approach. We have problems with minorities especially like a lot of the conferences, like business sorts. Most males are talking about their stories, histories, of course, it was good, but the future needs to change the dynamic.

Especially like the data model the societies, it’s not just the one thing for all, just for the multiple inclusion. So that’s an approach that is very significant to the widespread, healthier safety data societies, yeah I totally agree that you were doing.

Let’s move on to the next topic which is the more kind of practice. So you work as a lawyer, and also have policies. I think there’s some announcement as it happens especially like Apple, Google and these big companies are working on data privacy at this moment.

The thing is accountability is a very ambiguous word but I think it’s very important for all countries.

So, what do you think about the accountabilities, the importance, since Apple is announced and WWDC this year. They focus on many topics related to privacy issues. So what will be the dynamic impact to the app developers or product makers in general?

Lena: That’s a great question. I think following Apple’s announcement at the worldwide developer conference three weeks ago, it is going to significantly impact product development. I think the biggest thing is that their new iOS 14 rules are really going to push developers to practice and follow privacy by design principles.

For example, I know Apple now is requiring simpler privacy notices to increase transparency, similar to what we call like a nutrition label. Basically, you look at an app, and within a few moments you can figure out exactly what the app collects about you.

And also it’s really interesting that Apple now is requiring developers to also include information about third party codes that they embed in their app.

We can talk about SDKs in a moment but that is pretty significant, because before that, users had no idea what third party code was in a mobile app. Apple now is requiring that. I think that’s a great step in the right direction.

Apple is also now requiring changes in terms of obtaining consent for tracking controls with location requests. And a really interesting new requirement is previously apps that needed to access let’s say picture on your camera roll, they had to access the whole camera library and photo library to get that one picture, which was a bit intrusive.

However, now users have the ability to actually just select exactly what photos they want and share it with the app without having to share their whole camera roll. I thought this was exciting.

Yes, I think overall these iOS 14 changes are going to increase accountability. I think it’s really important given how complex, and how opaque, the ecosystem has been. And Apple’s announcement to developers means they now have to incorporate privacy by design, they have to think about privacy.

At the outset of their product development, as opposed to an afterthought. And I hope that by Apple announcing this that Google and other major platforms will also take steps and follow.

Kohei: Thank you, to comply with these new systems, what kind of impact for the startups, or any product makers who organized the coordination of architectures So do you think any big impact for them?

Lena: Yeah, I mean, I think now even startups have to think about privacy. And in the past it seems like startups didn’t really value privacy or understanding why they spend so much time and resources doing privacy when they look at other companies that forgo it and become profitable.

But now it’s important for them to incorporate privacy principles, it’s an option anymore. Users have become very aware of privacy, they’re demanding their rights. And also, there’s deep distrust within the digital space. And so one way for startups to restore that trust is to take users privacy seriously.

Kohei: I see, thank you for the ideas. So, you said about the software development kit as well, which is a kind of very effective tool today. The app developer can easily integrate the processes.

However, at this moment the SDK is one of the factors to collect your data unintentionally through the third party, such as the Zoom problem in March, they use it in a Facebook SDK but actually the user data has been collected on them. What do you think is most concerning with the third party SDKs, in general?

Lena: This is a great question and this is actually a topic that IDAC has done quite a bit of work on. Just to go back, one second. SDKs are pieces of code that provide a certain functionality within the app.

So for example, if an app developers, “Okay I’m building this app, and I want to have a social media login or I want the app to push notifications to users”, they’ll take a code from somewhere else and kind of embed it in the app and move on.

And it’s easy to understand why developers do this because it’s convenient. It’s fast, they don’t have to build the whole code from scratch. So it’s a very common practice.

But, in the past, developers have just added a bunch of third party SDK codes in your app, not think about it and move on now learning that a lot of these SDKs are really aggressive in the amount of information that they’re trying to collect and share.

So, the concerns here really are the fact that the user has no insight into what third party SDKs or an application. Let’s say I download Venmo, I have no idea what third party SDKs are in Venmo, and there’s no way for me to find out, it’s usually not posted in a privacy policy, not posted anywhere.

That’s one thing. Second thing that’s really concerning is besides they are inherently aggressive data collection practices, a lot of SDKs have also been acting in irresponsible ways.

One example that our team has come across now multiple times, and this is mostly in the Android context is that third party SDKs are collecting lists of all the apps you have installed on your phone.

They’ll be taking constant screenshots of all the apps that you’re installing and also uninstalling and taking all that information about you, and they can then infer a tremendous amount of information about the users.

For example, if, let’s say an SDK took a snapshot of someone’s all the apps someone has. And let’s say that person has like the Bible app, maybe like a fertility tracker app, maybe like a CNN app.

You can then infer a lot about that person, you can know what their religious beliefs are, what their political leanings are or any religious or financial situation.

By having all that information, these third party SDKs can take that create and generate user profiles that are then used for tracking and advertising. So it’s pretty invasive and creepy and again there’s just no way for users to know that’s happening because that happens very quietly in the background and there’s no way for users to stop it.

And, hypothetically, let’s say a user does find out that the vital app that they downloaded has a bad SDK, the only way to stop it is to just uninstall the app. It’s not fair that the users have the responsibility of making sure this doesn’t happen. Their responsibility really falls on these SDKs and the app developers to make sure they don’t do this kind of behavior.

I think my advice to any app developers out there is, you know, carefully review what SDK is you’re putting into your app. Make sure they’re only collecting what you have to collect. Otherwise, don’t use them.

Kohei: From a user’s point, we have a touch point through the privacy policies, what the company is and providing the details and the consent with your data. So, is there any alternative to know about the specific data processing from the data controllers?

Lena: Yeah, so, like you said, right now, data users only can rely on a privacy policy. And from what we’ve seen a lot of privacy policies don’t disclose what third party SDKs they have embedded.

But, like I previously mentioned, Apple with the new iOS 14 requirement is not going to actually ask developers to include information about what third party code, they use, which is exciting. It’s a step in the right direction. It doesn’t necessarily mean that users could do anything about it, but at least now they know.

Kohei: That sounds amazing. So, in your sense, Apple and Google are working on COVID-19 applications architectures as well, which is very helpful for the local solidity, is just adopting the chosen, Japanese government is also chosen with their system.

Are there any concerns, this COVID-19 apps in the SDKs collecting the data without any consent from the users in any place?

Lena: And that’s a great question. IDAC did do the COVID-19 app study recently. And we did find that out of the 108 mobile apps, eight or nine were inserting SDKs that we thought were problematic.

So, because COVID-19 apps collect very sensitive information about users, we do think that the level of care is heightened there. So we don’t believe that these developers should be embedding advertising SDKs, for example, and we saw a few COVID apps that had advertising SDKs in them.

And we actually worked with the app developers to inform them that this is probably not the best practice because typically if you have an advertising SDK in your app it means that the app is serving ads, and then making money off of users data.

COVID-19 app is not a place to be monetizing user sensitive information. So, that was the extent of what we saw. Otherwise, it looks like most COVID-19 developers are taking great care to only use SDKs that they actually need to help make the app function. That was the good news.

Kohei: I see, From the user side of what they need to be paid attention when they are downloaded and they use it just for the privacy policy or just to like the requirements for the government or any other data controller, is to make a transparency to illustrations in advance, or anyway face that?

Lena: Yeah, I think with COVID-19 apps in particular, user trust is so important. So I do think that these companies, and the government’s deploying these apps should definitely be very transparent about their practices. In our survey of the hundred and eight apps, we saw that most of them were, but others were not very transparent.

In terms of what the users could do. I think it’s mostly, you know, look at the privacy policy I think that’s really the extent of it so if users don’t feel confident in the these apps, they’re not going to use them, and it’s going to make the COVID-19 tech efforts is not as effective, and not as widely adopted. I think it is a shame because I do think that these apps could really help.

Kohei: I see, great point. So, finally, please give some message to Asian, and other Japanese companies or corporations, working on mobile apps because they use Facebook, Google SDK, as well. There are many concerns that will happen in the future. Please give them a message to them.

Lena: I think this is probably a message for all app developers not just in Asian countries, but I do think carefully reviewing what third party code you’re using is really important.

Understanding how it works. So don’t take shortcuts, take the time to understand how these third party SDKs and other codes, integrate into your app, and what information is collecting.

Next is to be very transparent about your practices in your Privacy Policy. Make it simple and clear for users to understand. Next one is around permissions.

Permissions are an interesting space. I do think that app developers should only make app requests permissions that are absolutely needed for the app to function.

A lot of times, the app developers request all types of permissions, which then ends up resulting in the app collecting more information that’s needed, and again without real users, being aware, so be very careful and only tailor your request for permissions for things that the app needs.

And then lastly, going along with the permissions, really only collect the information that’s needed. In the past, a lot of developers collected as much information as they could, because that was the model everybody was going off of.

Now I think it’s switching and it’s more gearing towards data minimization. We only collect what you need to provide your services to users.

Those are main points they’re both to Asian companies but also just to any companies that are thinking about deploying apps.

Kohei: That’s great advice. So Lena, thank you for having a talk today. It’s a very great interview. So for all the listeners it will be very exciting to have a great time seeing the inside. So thank you for this time so let’s move on to data collaboration.

I guess this is privacy policy without upgrading, so of course we have to catch up on the health of the data economy so thank you for coming in today.

Lena: Thank you so much for having me, Kohei. I really appreciate it.

Thank you for reading daily Collabogate overview and please contact me if you want to be writer of research blogging.

Looking for Collaborator to start working with global network! Please register below the link for business collaboration together.