Olivia
Online
PrivacySpΞc | GDPR & Data Protection
@PrivacySpecX
Privacy and data protection - helping business and teams with compliance ops.
GDPR consulting - dm or connect via pinned contacts.
En la Unión Europea
Joined August 2023
62 Following
19 Followers
685 Posts
Pinned Tweet
Process mapping & privacy advisory for compliance, for 'AI', for GDPR.
Email / [email protected]
SimpleX / https://t.co/bCPmuXyiyl
Good opportunity to also learn and check fallback configuration if your 'AI assistant' flows depend on Claude availability etc.
Good opportunity to also learn and check fallback configuration if your 'AI assistant' flows depend on Outlook etc.
@DenisLabelle Promising. And the pw is not 4
Privacy policies should do the opposite:
instructions first for the AI agent, so the user would get detailed and practical overview from the AI agent of what's going on with PII and recommend actions based on it. Versus just recommending generic legal options which have caveats and often do not apply for the user's specific situatuion.
@fileverse Yes, embedding it to a website via <iframe>, it makes mobile/tablet view. Which is ok from readability point of view.
UX/UI wise better to keep it the navigation in the bottom? 🤷♂️
Our planned usecase> displaying and embedding (several) fileverse docs on a website.
@vasuman Articles like this on X can probably make up ~ 80% of actionable knowledge of a university degree.
Well done.
Abstraction wise seems fit https://t.co/irvFcDN05I
TLA+ for 'Privacy Policy' 🤔
https://t.co/CTV8jXkhyn
Something in the lines of 'business requirements' for such set up
Agentic IAM is still one of the most pressing problems in our industry, and NIST just published their Design Tenets for Agent Identity Management Systems.
A few of the items that jumped out to me are distinct, cryptographically verifiable identities for agents that are separate from human users and service accounts, a clear chain of trust when agents act on behalf of users or organizations, least and zero standing privilege, and cryptographically signed mandate statements that define intended outcomes and constraints for agent actions.
In my opinion least and zero standing privilege is going to be the most elusive, as people and organizations lean into the utility of agents in the security vs. utility tradeoff.
It was hard enough for human users and in cloud, and it's going to be even harder to constrain autonomous agents that can drive business outcomes.
https://t.co/Ao3OmYfObM
Would make sense system and legal wise if customer facing systems have multiple roles and robust IAM (who can read/edit, confirm purchases or terminate customer relationship) per business case:
- user (human)
-- delegated AI #1 (via MCP)
-- delegated AI #2 (via 'computer control')
-- delegated human (power of attorney)
Each role has diff. account credentials, actions are logged, approval flow can be set up.
Awesome tools!
What if you utilize /statecharts x https://t.co/qtoLpfbYCC (by @kepano) to
a) explain your privacy policy to end-customer customer (well, actually to customer's 'AI' assistant)
b) validate code with /statechart skill in pstack by @poteto to identify where privacy rules or engineering principles might break
Not legal advice, from practical point of view>
Privacy policy should have a broad coverage of all possible situations. As a customer or whatever status I have, I can read it (or let my 'AI bot' read it) and understand what parts of the policy are applicable to me.
More details are generally better, but the level of details is not defined or mandatory. Same as with other GDPR compliance docs like 'register of processing activities'. Some orgs have 500 processing activities in the register, others have 30. Both can be GDPR compliant.
💁♂️No practical point of naming someone in the policy. The underlying purpose of relevant clauses is publishing a contact that people can use in case they have questions or want to complain. It can also be generic customer service email or a more specific gdpr-requests@company. Impractical to add employee named email.
💁♂️About the vendor/supplier/processor categories. Category level in privacy policy is acceptable, but then asked 'hey, to who did you disclose my data to', it is sometimes practical to provide specific vendors, depending on the case and vendor.
Seen very little pushback if vendors include datacenters like AWS or Hetzner etc. Mostly vendor list is important in order to 'establish' whether data is sent overseas, 'international transfers' and if what are relevant 'data sources or recipients' who might have separate relationship with the person (think of public registers, data vendors etc).
Keeping the list on a category level also enables the privacy policy to be more accurate. You may change your suppliers, but do not have to create a new version of the policy with each change. It is not expected that a customer has to quickly see who where the suppliers in 2021 January when the customer signed-up.
For example> might not be useful disclosing Vercel or Supabase specifically in a privacy policy, but you could name Resend or Messente. Especially when you have several environments and customer data is not in all of them.
🫣read/implement the EDPB guidance with grain of salt and heavy private business filter. 2 lawyers, 3 opinions but it's actually 30 'lawyers' who have to reach an acceptable guidance for everyone.
hope it helps, keep on building🫡
Ich glaube, Frontier Labs hat sogar bestätigt, dass eine Manipulation durch den Benutzer nicht ausgeschlossen werden kann. Das Risiko einer Manipulation durch Endbenutzer oder Dritte ist also nicht gleich null. Ein akzeptabler Ansatz ist die Zugriffskontrolle hinsichtlich der Daten, die die KI einsehen und bearbeiten darf. Außerdem ist ein angemessener Rechtsschutz durch Nutzungsbedingungen unerlässlich. Die Konfiguration per Eingabeaufforderung ist nur eine von mehreren Ebenen.
A recommendation from a similar thread was inserting a honeypot field to the signup page or form.
Something that human can not see, but bots will fill with text (i.e repeat a name or whatever text entry. Backend wise if honeypot field contains text, then it's a good indication of bot action.
Future not so far was actually present day
https://t.co/VRQKEPjEzf
In a future not so far away, basically tomorrow, people can replace "You'll be hearing from my lawyer.." with "You'll be hearing from my bot!"
Right, @bot?
SMS OTP - to avoid suprise invoices (in case bot attack), first mitigations would be monitoring, catpcha and geo / IP restrictions.
If username/pw would be necessary to keep, at least consider setting up some monitoring and limits catch anomalies, for example sudden rise in OTPs. Pennies for a single OTP request but when x1000, the invoice will not be a pleasant suprise.
The motivations can be many and not under your control, so focus on logic that are applicable from single attempts to automated 'attacks'.
So social login is good option if it works for the business.
Trends for you
Most Popular Users
Elon Musk
@elonmusk
241M followers
Barack Obama
@barackobama
118.8M followers
Cristiano Ronaldo
@cristiano
114.5M followers
Donald J. Trump
@realdonaldtrump
111.9M followers
Narendra Modi
@narendramodi
107M followers
Rihanna
@rihanna
98.7M followers
NASA
@nasa
92.2M followers
Justin Bieber
@justinbieber
91.8M followers
KATY PERRY
@katyperry
90M followers
Taylor Swift
@taylorswift13
84M followers
Lady Gaga
@ladygaga
75.5M followers
Virat Kohli
@imvkohli
73.4M followers
Kim Kardashian
@kimkardashian
70.8M followers
YouTube
@youtube
68.7M followers
Neymar Jr
@neymarjr
66.4M followers
Bill Gates
@billgates
65.2M followers
Selena Gomez
@selenagomez
63.1M followers
The Ellen Show
@theellenshow
62.2M followers
CNN
@cnn
61.7M followers
X
@x
60.6M followers