PrivacySpΞc | GDPR & Data Protection

Privacy and data protection - helping business and teams with compliance ops.

GDPR consulting - dm or connect via pinned contacts.

[PrivacySpΞc | GDPR & Data Protection @PrivacySpecX]

Process mapping & privacy advisory for compliance, for 'AI', for GDPR.

Email / [email protected]

SimpleX / https://t.co/bCPmuXyiyl

[PrivacySpΞc | GDPR & Data Protection @PrivacySpecX]

Good opportunity to also learn and check fallback configuration if your 'AI assistant' flows depend on Claude availability etc.

[PrivacySpΞc | GDPR & Data Protection @PrivacySpecX]

Good opportunity to also learn and check fallback configuration if your 'AI assistant' flows depend on Outlook etc.

[PrivacySpΞc | GDPR & Data Protection @PrivacySpecX]

@DenisLabelle Promising. And the pw is not 4

[PrivacySpΞc | GDPR & Data Protection @PrivacySpecX]

Privacy policies should do the opposite:
instructions first for the AI agent, so the user would get detailed and practical overview from the AI agent of what's going on with PII and recommend actions based on it. Versus just recommending generic legal options which have caveats and often do not apply for the user's specific situatuion.

[PrivacySpΞc | GDPR & Data Protection @PrivacySpecX]

@fileverse Yes, embedding it to a website via <iframe>, it makes mobile/tablet view. Which is ok from readability point of view.
UX/UI wise better to keep it the navigation in the bottom? 🤷‍♂️

Our planned usecase> displaying and embedding (several) fileverse docs on a website.

[PrivacySpΞc | GDPR & Data Protection @PrivacySpecX]

@FileverseWork

[PrivacySpΞc | GDPR & Data Protection @PrivacySpecX]

@vasuman Articles like this on X can probably make up ~ 80% of actionable knowledge of a university degree.

Well done.

[PrivacySpΞc | GDPR & Data Protection @PrivacySpecX]

Abstraction wise seems fit https://t.co/irvFcDN05I

[PrivacySpΞc | GDPR & Data Protection @PrivacySpecX]

TLA+ for 'Privacy Policy' 🤔

[PrivacySpΞc | GDPR & Data Protection @PrivacySpecX]

https://t.co/CTV8jXkhyn

Something in the lines of 'business requirements' for such set up

[Chris Hughes @ResilientCyber]

Agentic IAM is still one of the most pressing problems in our industry, and NIST just published their Design Tenets for Agent Identity Management Systems.

A few of the items that jumped out to me are distinct, cryptographically verifiable identities for agents that are separate from human users and service accounts, a clear chain of trust when agents act on behalf of users or organizations, least and zero standing privilege, and cryptographically signed mandate statements that define intended outcomes and constraints for agent actions.

In my opinion least and zero standing privilege is going to be the most elusive, as people and organizations lean into the utility of agents in the security vs. utility tradeoff.

It was hard enough for human users and in cloud, and it's going to be even harder to constrain autonomous agents that can drive business outcomes.

https://t.co/Ao3OmYfObM

[PrivacySpΞc | GDPR & Data Protection @PrivacySpecX]

Would make sense system and legal wise if customer facing systems have multiple roles and robust IAM (who can read/edit, confirm purchases or terminate customer relationship) per business case:

- user (human)
-- delegated AI #1 (via MCP)
-- delegated AI #2 (via 'computer control')
-- delegated human (power of attorney)

Each role has diff. account credentials, actions are logged, approval flow can be set up.

[PrivacySpΞc | GDPR & Data Protection @PrivacySpecX]

@Mr_Swiftly @getfeedbackkit lmk if you get stuck or could use 'second opinion'.

[PrivacySpΞc | GDPR & Data Protection @PrivacySpecX]

Awesome tools!

What if you utilize /statecharts x https://t.co/qtoLpfbYCC (by @kepano) to

a) explain your privacy policy to end-customer customer (well, actually to customer's 'AI' assistant)

b) validate code with /statechart skill in pstack by @poteto to identify where privacy rules or engineering principles might break

[PrivacySpΞc | GDPR & Data Protection @PrivacySpecX]

Not legal advice, from practical point of view>
Privacy policy should have a broad coverage of all possible situations. As a customer or whatever status I have, I can read it (or let my 'AI bot' read it) and understand what parts of the policy are applicable to me.

More details are generally better, but the level of details is not defined or mandatory. Same as with other GDPR compliance docs like 'register of processing activities'. Some orgs have 500 processing activities in the register, others have 30. Both can be GDPR compliant.

💁‍♂️No practical point of naming someone in the policy. The underlying purpose of relevant clauses is publishing a contact that people can use in case they have questions or want to complain. It can also be generic customer service email or a more specific gdpr-requests@company. Impractical to add employee named email.

💁‍♂️About the vendor/supplier/processor categories. Category level in privacy policy is acceptable, but then asked 'hey, to who did you disclose my data to', it is sometimes practical to provide specific vendors, depending on the case and vendor.

Seen very little pushback if vendors include datacenters like AWS or Hetzner etc. Mostly vendor list is important in order to 'establish' whether data is sent overseas, 'international transfers' and if what are relevant 'data sources or recipients' who might have separate relationship with the person (think of public registers, data vendors etc).

Keeping the list on a category level also enables the privacy policy to be more accurate. You may change your suppliers, but do not have to create a new version of the policy with each change. It is not expected that a customer has to quickly see who where the suppliers in 2021 January when the customer signed-up.

For example> might not be useful disclosing Vercel or Supabase specifically in a privacy policy, but you could name Resend or Messente. Especially when you have several environments and customer data is not in all of them.

🫣read/implement the EDPB guidance with grain of salt and heavy private business filter. 2 lawyers, 3 opinions but it's actually 30 'lawyers' who have to reach an acceptable guidance for everyone.

hope it helps, keep on building🫡

[PrivacySpΞc | GDPR & Data Protection @PrivacySpecX]

Ich glaube, Frontier Labs hat sogar bestätigt, dass eine Manipulation durch den Benutzer nicht ausgeschlossen werden kann. Das Risiko einer Manipulation durch Endbenutzer oder Dritte ist also nicht gleich null. Ein akzeptabler Ansatz ist die Zugriffskontrolle hinsichtlich der Daten, die die KI einsehen und bearbeiten darf. Außerdem ist ein angemessener Rechtsschutz durch Nutzungsbedingungen unerlässlich. Die Konfiguration per Eingabeaufforderung ist nur eine von mehreren Ebenen.

[PrivacySpΞc | GDPR & Data Protection @PrivacySpecX]

A recommendation from a similar thread was inserting a honeypot field to the signup page or form.

Something that human can not see, but bots will fill with text (i.e repeat a name or whatever text entry. Backend wise if honeypot field contains text, then it's a good indication of bot action.

[PrivacySpΞc | GDPR & Data Protection @PrivacySpecX]

@philwinkle @Muse well this escalated quickly.. was already happening

[PrivacySpΞc | GDPR & Data Protection @PrivacySpecX]

Future not so far was actually present day

https://t.co/VRQKEPjEzf

[PrivacySpΞc | GDPR & Data Protection @PrivacySpecX]

In a future not so far away, basically tomorrow, people can replace "You'll be hearing from my lawyer.." with "You'll be hearing from my bot!"

Right, @bot?

[PrivacySpΞc | GDPR & Data Protection @PrivacySpecX]

@sjorsfestt @CJavierSaldana What if.. .eth layer, via Metamask approval?

[PrivacySpΞc | GDPR & Data Protection @PrivacySpecX]

SMS OTP - to avoid suprise invoices (in case bot attack), first mitigations would be monitoring, catpcha and geo / IP restrictions.

If username/pw would be necessary to keep, at least consider setting up some monitoring and limits catch anomalies, for example sudden rise in OTPs. Pennies for a single OTP request but when x1000, the invoice will not be a pleasant suprise.

The motivations can be many and not under your control, so focus on logic that are applicable from single attempts to automated 'attacks'.

So social login is good option if it works for the business.