Cristina DeLisle

As decentralized social media gathers more users, the privacy by design and default principles from the GDPR are in accordance to the design model it proposes. This talk is going to tackle the main advantages and challenges this approach brings, from the perspective of the data protection legislation and privacy architectural strategies.

Social media platforms have been a central feature in our generation and as we grow more toward understanding their power and taking part in their evolution, we realize the challenges they impose. One of those is how to protect personal data of users, and ensure that the processing is done in accordance with legislation such as GDPR. Decentralized social media has developed as a space where personal data ownership is a priority, coming as an alternative to centralized platforms. Not coincidentally, they are mostly open source software, as transparency and offering control of the data to the users go hand in hand with this ambition. Blockchain based social media networks, and projects built on top of the ActivityPub protocol are some of the most popular examples of alternatives which have gathered significant numbers of users or data subjects, under the GDPR. One of the main architectural strategies in building software which is privacy by default and design is data separation. It states that the processing of personal data should be performed whenever possible in a distributed manner. As the GDPR lists privacy by design and default as core principles, decentralized social networking poses a significant advantage compared to centralized solutions. One heuristic to take from this is if the future is privacy-oriented, then social media will be decentralized. This talk is going to offer an analysis of the main benefits and challenges that decentralized social medial pose, from the points of view of personal data protection legislation and privacy design patterns for software architecture.

Uniformisation at the European level of data protection legislation brought on the table a lot of diversity in implementation from the private sector. Before the GDPR, member states had a specific national approach on how to interpret the previous Data protection directive 95/46/EC. Also, lots of actors came in the spotlight: the National Supervisory Authority, different public and private entities coming from all sectors of economy. The OSS community found itself driven in this ride and even with the best intentions nobody was able to find a complete, personalized guide to implement this new ruling that in theory is so welcomed. This talk is about pointing out how the Open source ecosystem is tangential with the GDPR data protection principles. Also, it will show how are the data protection rights and responsibilities shared between the community participants and the community's infrastructure providers.

The OSS field has as core value the concept of community, which helps a project evolve and make a difference in the software world. Not surprisingly a lot of the OSS projects are around the notions of privacy, anonymity and data protection, as they reflect in general a need that the people forming OSS communities have: to keep their personal data protected and avoid monopoly of that by proprietary software. The GDPR came as an effective tool to raise awareness about the importance of personal data and brought on the table specific principles, rights, obligations, along with a lot of improvements to be made in the current status quo. This talk will analyse how the provisions of the GDPR are tangential with the OSS ecosystem. It will point out how the principles of the GDPR are connected to the OSS world, how we could analyse the model of data controller / data processor in the context of the OSS participants / infrastructure providers. Also, it will point out how the data protection rights are enforced by the OSS model, by analyzing some of the technologies that have risen from this ecosystem: wikis and zero-knowledge collaborative software.