[00:00] Debbie Reynolds: The personal views expressed by our podcast guests are their own and are not legal advice or official statements by their organizations.
[00:14] Hello, my name is Debbie Reynolds. They call me the Data Diva. This is the Data Diva Talks privacy podcast where we discuss data privacy issues with industry leaders around the world with information and businesses.
[00:26] Need to know. Now I have a very special guest all the way from Serbia, Anna Toskic.
[00:32] She is the executive director of Partners Serbia. Welcome.
[00:37] Ana Toskic: Thank you. Thank you for the invite.
[00:40] Debbie Reynolds: Well, I'm very thrilled for you to be here. You and I had a chat,
[00:44] actually. Damian from Germany had told me, oh my gosh, you have to talk to Anna.
[00:50] And we talked and just your point of view was so unique. And I just thought you'd be a great person to have on the podcast,
[00:58] especially because, you know, the work that you do around human rights and your views on data privacy, data protection.
[01:06] Also, a lot of people don't maybe don't know or understand privacy or data protection from your point of view in Serbia. So I would just love to find out more about you and your work and what attracted you to, you know, privacy.
[01:20] Ana Toskic: Yeah, Damien is definitely connecting right people, I have to say, mostly right women working in privacy areas. So I need to thank him publicly for that, for introducing in me to you as well, Debbie.
[01:31] Yeah, so I come from Serbia, which is the European country, but not part of the European Union, which actually impacts a lot the context of privacy and data protection in the country and in the region.
[01:46] That in my background is international law. And I worked briefly, completed my studies actually international human rights law.
[01:54] I worked on war crimes investigations.
[01:56] And I actually, once I started working for civil society here in Serbia, which was 15 years ago now, I received my first data protection training and kind of fell in love, you know, and the rest is history.
[02:09] And I kind of try to expand my work and introduce the data protection perspective in broader rule of law work that I've been doing with the organization partner Serbia. So it of course kind of expanded how the topics expanded and how the regulation actually developed.
[02:26] And for Serbia, being a part Council of Europe, for example,
[02:31] it also meant that we were aligning with Council of Europe's conventions on data protection.
[02:36] But also as we are a European Union membership path, it also meant that we are aligning with EU's regulation as well.
[02:45] So to some extent, it was kind of like a progress.
[02:49] But unfortunately for the last, I would say five or even 10 years, the country has been facing a significant democratic backslide and the backslide in the rule of law area, which kind of Impacted protection of privacy as well it turned out.
[03:04] And you know, we have a number of research and monitoring results showed is that unfortunately privacy rights are usually at the forefront when we are talking about different kind of like repressive practices of autocratic governments.
[03:19] And that's what's what we are actually living Now. We do have on the other hand laws that are but I would say pretty solid aligned with, for example GDPR. Now we're working on our AI regulation basically looking up at EU's AIF,
[03:37] but like parallel side we have this complete backslide of democratic institutions. We have processes and practices where citizens personal data have been misused on a daily basis mostly for political purposes, different types of pressures whatsoever.
[03:57] So it's like a split screen situation that you have decent laws but when it comes to their implementation we're pretty weak. And even worse,
[04:06] data has become some kind of weapon in different types of political processes.
[04:13] So not so happy story. But I'm still in love with data protection and privacy.
[04:17] Debbie Reynolds: Yeah, right now something you said is very interesting and I never thought about it that way,
[04:24] that a lot of human rights issues can be tied to privacy.
[04:31] So a lot of the types of things that people will like to keep private and don't want to have to share with other people.
[04:40] A lot of situations around the world where people are forced to share or information is used against them that sort of goes opposite of privacy. But I want you to talk a little bit about that because I feel like some people think of the human rights aspect of privacy.
[04:58] Ana Toskic: Yeah, well, I think it,
[05:01] if we talk about development of regulation, I really think the GDPR was kind of like a game changer when it comes to the level of awareness and just the space that was given to this human right basically.
[05:14] But with the implementation and then adoption of other laws and regulations throughout the world,
[05:20] the word compliance actually replaced the words human rights and it all started going to the compliance and checkboxes feel. But we need to get back a little bit in the history and remind ourselves that privacy is a fundamental right,
[05:36] that personal data protection is a fundamental right, that they are guaranteed by number of international treaties and conventions.
[05:44] And it is so in our constitution as well and different types of other laws. And we forgot like, you know, how these principles of basic human rights could be incorporated into different types of business operations or state practices whatsoever.
[06:02] So when I say that, you know, when we kind of like monitor and track and also provide different types of legal aid to citizens, what we learn is that if we talk about discrimination, for example,
[06:13] it's usually grounded on violation of some kind of personal data. Whether it's like health details or sexual orientation,
[06:22] political opinion whatsoever,
[06:24] you can be discriminated if someone misuses type of data.
[06:28] If you're talking about labor rights, again,
[06:31] lack of access to labor rights, employment, but also social welfare rights, and different types of rights of freedom,
[06:38] your freedom of expression could be violated as well because someone is, for example,
[06:43] surveilling you, et cetera, et cetera, freedom of assembly.
[06:47] However,
[06:48] what we also detect is that most of these violations are not reported because people usually complain about violation of these related rights.
[06:58] So we don't have a clear track record of how often actually data protection rights and privacy rights are violated.
[07:06] And that's why we say that if we really want to work on the core of human rights, we need to perceive privacy as it is, as a part of human dignity.
[07:17] Because without your private space, without your liberty to choose, you know, who owns information about you, who can enter your private space, whether it's like territorial privacy of informational privacy whatsoever,
[07:33] you cannot be a free individual.
[07:36] You can easily lose your human dignity.
[07:39] Still believe, you know, even with the AI,
[07:41] we still perceive our human,
[07:43] human dignity.
[07:45] Debbie Reynolds: I want to talk a little bit about Serbia,
[07:47] something we chatted about before that I thought was a very interesting angle, which was Serbia is part of the European. I'm sorry, it is in Europe, but it's not part of it.
[07:59] The member states. European Union.
[08:01] Ana Toskic: Union, yeah.
[08:01] Debbie Reynolds: But that creates a tension there because I feel like,
[08:06] and I just want your thoughts because I feel like we in the US have a similar thing where we don't have as strong of data protection regulation as Europe and companies very much take advantage of that.
[08:19] But how do you feel that play out in Serbia?
[08:23] Ana Toskic: Well,
[08:24] pretty much the same,
[08:26] but with this kind of like added element that we don't have institutions that would protect individuals when their rights are violated. I mean, we do have them on paper, but in practice that they are not either independent or don't have capacities.
[08:41] So this means that, for example,
[08:44] as I mentioned, we do have laws that are aligned with the EU regulations, like gdpr, like data protection law,
[08:53] but the enforcement mechanisms are lacking or the fines that are prescribed are petite. Like comparing to GDPR, our fines are around like 50, €15,000 maximum. So, you know, comparing to, you know, 4% of the annual turnover or, you know, 20 million of euros,
[09:11] it's petite.
[09:13] So they do not have,
[09:15] they do not provide incentive for data controllers or processors to align with, you know, these rules, even though the rules are there.
[09:24] Also, there's another issue,
[09:26] especially when it comes to like newest regulations related to e.g. digital platforms,
[09:32] the governance whatsoever.
[09:34] Our national authorities have not practiced their authority over Big Tech at all.
[09:41] So even though like Big Tech as well should comply with our regulations, because they're operating in Serbia and other countries in our region who are also not in the European Union,
[09:53] they do not comply with our regulations because our institutions are not performing their authorities.
[10:00] Let me give you an example.
[10:02] Two years ago, Meta started developing their AI tool and started processing personal data of users for deployment of this tool.
[10:11] The EU regulators reacted instantly because this is something that is not legal according to gdpr. There was not consent, proper level of information to data subject whatsoever.
[10:24] We have the same law prescribing the same obligations for data processors.
[10:30] So Meta seized its activities in this regard in the European Union,
[10:35] but continued to do so in our country because our Information commissioner did not react because what he said is like, I cannot issue an €800 fine to Meta to be funny for them,
[10:50] but I still think institutions should react.
[10:53] So now we have our citizens completely without any effective mechanisms when they want to protect their rights in the context of Big Tech.
[11:02] So it puts us in a situation where I think most of these companies actually perceive our region as a gray zone where everything is actually allowed,
[11:14] even though our laws don't say so.
[11:17] Debbie Reynolds: Something that you said was very interesting and I hadn't thought about it this way. I've heard people talk about regulation and enforcement together.
[11:28] And so because regulation is saying, okay,
[11:33] this is our rules, this is how we want you to follow our rules without robust enforcement,
[11:42] companies take advantage of that.
[11:45] So they were like, okay, well this region isn't going to really do anything or this fine is so small.
[11:50] I think that was one of the game changers, as you said with gdpr,
[11:55] where I felt data protection has been around for a very long time. Privacy, as you say, a lot of international conventions have been considered a fundamental right for a very long time.
[12:08] But until it became real in terms of either a fine or regulators saying that companies had to change their business practices, a lot of high level people didn't really pay attention to it.
[12:24] So I think that's one good thing from gdpr, that it really brought that issue up the chain to people higher, higher level.
[12:34] But I think,
[12:36] and I want your thoughts, I think regulation is part of it, Regulation and enforcement is part of it. But I feel like we need to find a way to do something about prevention.
[12:49] So a regulation doesn't prevent things from happening. It says okay, if something bad happens, this is what our expectation is.
[12:57] If something bad happens, here's our mechanism to address it. But especially as we're moving more into AI, where things can happen,
[13:07] bad things can happen very rapidly to someone.
[13:10] And to me, I feel like there are situations where there will be no adequate redress,
[13:16] right? If someone is harmed in some way that can't be reversed because of technology regulation,
[13:25] even though it's there,
[13:27] it can't reverse something that can't be permanent. But what are your thoughts?
[13:33] Ana Toskic: I think you're completely right, especially with the AI. And just one thought about,
[13:37] about AI. I think with like the introduction of daily use of AI,
[13:42] we got into some kind of like new social contract that no one actually asked us about.
[13:50] And the important part of that social contract is our I think blank consent on processing of our personal data.
[13:57] And what I said of like the change, the GDPR growth, I think it's all annulled with AI because at one point I get this sense that especially coming from the development,
[14:09] development ecosystem,
[14:12] that we all agree this privacy is not the fundamental right anymore, that we do not own our personal data and that we all agree that, you know,
[14:23] the data actually, you know, is being used for this greater good.
[14:27] But this greater good is something that we still don't live because we don't see the greatest world problems being solved by AI. But that's another story. So it's a new social quant that annuls what has been done about the awareness about the importance of personal data protection whatsoever.
[14:44] But what you said is correct because not issuing fines and just working on hardcore compliance and enforcement issues will not solve the issue. It's prevention and it's education.
[14:57] And it's education in its core levels, starting from kids,
[15:02] especially the AI, but also other generations.
[15:06] And what we try to focus as well is older generations of citizens who are even more prone to different types of misuses, personal data or whatsoever.
[15:16] So what we did in that regard as the organization is of course, number of trainings, number of public events whatsoever.
[15:24] But seven years ago we established this annual event called PrivacyV,
[15:30] which takes place every year in the last week of January.
[15:34] And we are marking actually the International Data Privacy Day 28th of January.
[15:39] But we take the whole week and we try to open space for different privacy related topics and we open discussions with different groups. So we have workshops for children,
[15:51] we have conversations with senior citizens, we have conversations with business community,
[15:57] we try to include authorities as well. It was much easier a couple of years before. Now we're struggling with that as well.
[16:06] But just try to have this multi stakeholder platform when we discuss what privacy means to us nowadays.
[16:13] Because all of us will actually have a completely different response to that.
[16:19] I just had a couple of days ago,
[16:21] I was at the training in central Serbia and I was with group of women coming from rural areas.
[16:29] So I was supposed to deliver data protection training for them.
[16:33] And usually I speak to lawyers, I speak to judges, speak to civil society experts whatsoever.
[16:40] And this was something completely different.
[16:42] So when you talk to them like women living in small communities, villages, whatsoever, what privacy means to them, it's completely different. What we are talking on daily basis about regulations whatsoever.
[16:56] It's just having your own space,
[16:59] not having your partner controlling you, controlling, you know, your devices, or not having, you know, people knocking on your door, taking your signatures, you know, for some kind of political campaigns, without providing information to you.
[17:12] It's basically they see,
[17:15] they do see privacy as a tool to protect themselves.
[17:20] And I think for me that was like a really valuable experience. So I think that if we talk about prevention,
[17:26] we need to talk with all of these groups and just see what privacy means to them and how in their concept of privacy nowadays,
[17:37] concepts like AI and big and how they fit,
[17:43] is it another way of intrusion or is it a tool that can actually help them advance their lives whatsoever? So I believe prevention, I believe in education and I believe in education for all.
[17:55] Debbie Reynolds: I like that you brought that example up about rural areas because you're right, people experience privacy in different ways and they have different concerns that are come more top of mind based on their mode of living or how they, they interact, you know, not just even with technology,
[18:15] but just their day to day life and the people that they see and interact with and their ability to,
[18:21] to feel safe.
[18:23] And so one of the things you brought up,
[18:26] which I like when people connect privacy to liberty.
[18:31] So to me part of it is your own liberty to make decisions about yourself,
[18:37] about the things that you share and protect yourself against people who use information in a bad way.
[18:45] I want your thoughts about something now there's something happening in the US here and it brought up a question for me. But I want your thoughts here about this.
[18:55] There's a situation where grocery stores, they're enacting like digital price tags for items in a grocery store. And what they're finding is that based on like maybe the type of device that you have or the things they know about you,
[19:13] the price of the item will maybe different for you than someone else based on some other factors.
[19:19] And so some States in the US where some grocery stores have done this, they're trying to pass regulations against,
[19:27] I can't remember what they say they call it, it's like algorithmic pricing or something. So like if I wanted to buy a can of soup and you wanted to buy a can of soup, the price would be different based on factors, which is terrible.
[19:39] Right? You know, the US is kind of like that anyway, but really them putting an algorithmic thing behind it just makes it more visible,
[19:48] more trackable.
[19:49] But. And then of course certain states are like, oh, this is terrible, we should pass law.
[19:54] So this is my concern now as AI is coming out in different flavors and they're doing different things. I feel like in some ways trying to regulate AI is not the best approach.
[20:14] I almost feel like you need to regulate the data and not the tool because I feel like different tools are going to come out. People are developing things rapidly with AI, these new capabilities and there.
[20:27] But all these tools use data, right?
[20:30] So if you focus more on data,
[20:32] then these regulations won't be so come stale. This happens a lot in the U.S. like,
[20:38] I don't know, a couple years ago something happened on a tool called Snapchat.
[20:42] I've never even seen this thing. But this congressman said, oh, we need a log in Snapchat. It's like, well,
[20:51] that's not gonna Snapchat close tomorrow and create a new tool or a different name and do the same thing. So I feel like we're in this space where there is a call to regulate AI, but I feel like AI is just a flavor of technology.
[21:07] There's just gonna be other types of technology that we. If we're trying to regulate technology,
[21:14] we're missing the data part of that. But what are your thoughts?
[21:20] Ana Toskic: Exactly, Exactly. What you're describing is, yeah,
[21:24] profiling based off automatic data processing,
[21:28] you know, that can impact some of your life, including like economic,
[21:32] economic status.
[21:33] And basically it is all regulated already, at least if you're talking about pr and our law also regulates it. And I know that some laws in some of the US states also regulated.
[21:45] So it's not like the blank space. And as I mentioned with AI, we started to act like it's a blank space, like everything is allowed. And so I fully agree.
[21:56] If we would start looking at the design itself and core of the technology, which is the data,
[22:04] we would end up in more ethical and more human based and human focused tools, AI included.
[22:13] Because it's all about like, okay, how this data was collected,
[22:16] was informed about the data processing.
[22:20] Have I provided My consent, if consent was wired as a legal basis, was there another legitimate interest? Was there legitimate interest assessment performed whatsoever?
[22:31] And do I have a right to object and you know, not to? And this is especially important in situations where what you described is some kind of like commercial engagement, where it is really problematic.
[22:44] On the other hand, I do have possibility to choose the service provider. But if we actually import this kind of logic into the public service area,
[22:55] even more problematic. And I think what we have now is introducing algorithms and AI in different types of public services in different states and administrations worldwide.
[23:06] And actually we have this automatic data processing that actually creates decisions, issues about human rights and freedoms.
[23:15] If I want, for example, to challenge this decision that was partly or wholly created by an algorithm,
[23:23] what am I appealing to?
[23:24] Which vital procedure when there's like a black box behind it?
[23:29] So which laws were applied? Because, you know, as a citizen we do have this right to appeal different types of administrative or judicial decisions. And we know what we are actually feeling, the implementation of a specific law, evidence whatsoever.
[23:43] So what are we appealing and what are we complaining about when there's a decision that was made through algorithms? And we actually have that in Serbia, what I described of this parallel process of advancing regulations, but decline of institutions is actually boosted and complemented and made more complicated with development of technologies.
[24:06] Because what happens is technology is being available not only to citizens, but also to governments.
[24:13] And when you have governments that are autocratic or non democratic governments,
[24:18] they will use technologies to hands autocracies or repression or control over citizens.
[24:25] Of course the technology can be used in a really human focused way and advance a lot of processes and advance the efficiency of our public administrations, improve the access to some rights whatsoever.
[24:37] But in some countries,
[24:39] and as I said this happens here in Serbia, technologies are being misused to strengthen this control. We have this system called social Card, which was introduced into our social welfare.
[24:51] And it actually introduces the algorithm that collects and processes data from different public databases.
[25:00] When someone applies for social welfare court,
[25:04] this data about them is being collected. The algorithm processes the data. And then the algorithm,
[25:10] what the law says is actually proposing to this, the decision to the social welfare worker.
[25:16] This decision could be amended by the person, but almost never is being amended because they need to justify,
[25:23] you know, if they want to make a different decision.
[25:26] So people are being excluded from the social welfare system.
[25:30] Just in the first like four years of implementation,
[25:34] it's like 60,000 of people were excluded from the social welfare system, which is around 15% of total beneficiaries.
[25:42] The idea was to Prevent fraud.
[25:45] But now we have people being excluded from the system based on the decisions made by the algorithm or supported by the algorithm.
[25:55] And what happens of course is that what happened in some other more democratic countries,
[26:01] some communities are affected more than others.
[26:05] For example Roma community,
[26:07] which is like minority community here.
[26:10] So most of the people excluded from the system are coming from Roma community which is like marginalized on different levels.
[26:16] So yeah, there's a lot of potential.
[26:18] But also like the impact it could have could be pretty, pretty problematic when it comes to, you know, discrimination,
[26:26] exclusion from different public services,
[26:29] practicing of different rights whatsoever.
[26:32] And again, the core of the problem is in data. We challenged this program in Serbia when the law was adopted. We asked for the data protection impact assessment that there was one produced but was not fulfilling the legal requirements.
[26:46] But the system was anyhow put in place.
[26:49] And now with this deficiency, which could have been,
[26:52] you know, sold in the design,
[26:55] we have the program that is actually causing more trouble than the benefits.
[26:59] Debbie Reynolds: Very interesting. Now when you said this, a light bulb went off in my head and this is something I think about a lot.
[27:07] So I'll give an example about something we have here like red light cameras.
[27:12] So like certain,
[27:15] I find in certain communities seem to have more cameras in their area than other areas. And so let's say if someone looks at the statistic they may say, well this other area,
[27:28] people are more law abiding in this area than this, this other area.
[27:33] But one area has more cameras and other one doesn't. And so part of it in my view is that some people are able to be less captured in digital systems than others.
[27:48] Right.
[27:49] And it to me it tends to be connected to like economic social media.
[27:53] Right. So where marginalized communities I feel have less authority to fight against some of this stuff where people who are higher up on the social scale can avoid being tracked or traced or having their data in digital systems or have decisions made about them in digital systems.
[28:17] But you know, and I see what you said about the social car, we're seeing that play out in different communities here in the US where marginalized communities in these types of implementations are more impacted negatively because they simply have more data in the system than other communities.
[28:38] What do you think?
[28:39] Ana Toskic: Completely agree. Like most of the like surveillance projects were actually initially introduced or even tested. Marginalized communities being them like people in the need of social welfare and support, support or asylum seekers,
[28:56] which happens in for example migration camps in Greece or used for border control,
[29:02] et cetera, et cetera.
[29:04] Because of what you said, like marginalized people do have more data in the system, that's one thing. The other thing,
[29:12] when you're in this position that your life is actually depending on some kind of service or some kind of support whatsoever. And usually we're talking about these situations.
[29:22] I think your data and your privacy is the thing that you probably give up easier or in the first instance because you're not aware about consequences that actually this can have.
[29:37] So giving up on data and it's actually on the other hand,
[29:42] misuse of this marginalized position.
[29:46] And I think the other side, whoever the other side is, is aware of this, you know, and, you know, intentionally misuses this lack of capacity, awareness,
[29:57] empowerment of these individuals. And this is, you know, to go back to our initial presumption that, you know,
[30:04] preserving your privacy is actually really empowering,
[30:08] you know, and it's a social thing,
[30:11] it's generational things,
[30:14] cultural thing.
[30:15] It depends on number of, number of factors. I mean, you probably have these discussions I do with all the members of my family, like what was privacy for my grandma and what is for me and what is for my kid is completely different and it's progressing and I think that's great.
[30:31] Debbie Reynolds: I agree.
[30:32] Well, Anna, if it were the world according to you and we did everything you said, what would be your wish for privacy or data protection anywhere in the world, whether that be human behavior, technology or regulation?
[30:46] Ana Toskic: Well, I would say back to the roots.
[30:49] The civilization did not just show up in, you know, 2022 with the LLMs or you know, we had the world, we had, you know, some human rights protection systems before with all their qualities and flaws.
[31:04] But I think we need to like level of like global society, go back to this roads which is like privacy is the fundamental rights and let's approach privacy and data protection as fundamental right.
[31:16] We did not accept this social contract. We want to be part of this discussion and all of us, including those marginalized ones that we mentioned,
[31:24] want to be part of this discussion and we want to consider all the benefits, but also all the risks. I'm not saying that this is the issue that we solve all the world's problems, but I think it would bring us a couple of steps back, provide us some space to think about what we actually agreed to and you know,
[31:44] also give us space to work on the global society's development on a more ethical and manner that is focused on human.
[31:54] I'm actually running for the Serbia information commissioner that covers data protection as well because I still believe that, you know, all of us actually should and could contribute to advancement of the fields that we have expertise in.
[32:09] And this is actually my kind of invitation to everyone, every expert there in the field,
[32:15] every enthusiast,
[32:16] to find the space where they see they can make an impact and work within the space. So we actually spread this awareness and kind of empower more people.
[32:27] Debbie Reynolds: I love that you added that. It's true. Instead of just waving our fists at the sky, we have to find a way to contribute and to make a difference. So I'm glad that you're doing this, and I wish you,
[32:38] you know, all the best. I think you're. You have the right heart in it, and I feel like people who have their heart in it do the best work and the more most transformational work in this space.
[32:51] Ana Toskic: Thank you, Nadim. Yeah.
[32:53] Debbie Reynolds: Well, thank you again for being on the show. This is amazing.
[32:56] Well, keep me posted on how things are going, and I'm really thrilled to be able to share this episode with the audience because I think,
[33:04] you know, you definitely have the right ideas, and people need to understand how privacy and data protection play out in different regions.
[33:13] Ana Toskic: Thanks. And thank you for doing, you know, everything that you're doing for privacy culture.
[33:18] Debbie Reynolds: Aw, thank you. That's so sweet. That's so sweet. It's my pleasure. It's my pleasure. All right, we'll talk to you soon. Thank you so much.
[33:27] Ana Toskic: Thank you.
