Sameer Sharma, ITU 7 August, 2018 Dhaka, Bangladesh

POWERING THE Digital ECONOMY: REGULATORY APPROACHES TO SECURING CONSUMER PRIVACY, TRUST AND SECURITY   Exploring online privacy, trust and ensuring security: setting the scene (global and regional) • The importance of data in the digital ecosystem and the need for data protection, privacy laws and regulation to ensure online security and trust • The race for data and the impact on privacy, understanding how data flows • What online data protection and privacy means for consumers (individuals and businesses), for digital identity • Background to current models • Necessity of ensuring privacy, network and personal security to power the next stage of the App Economy • Ensuring privacy, trust and security across the value chain, (from networks to services, apps and devices) • Interplay with basic rights, competition law (proposed new Australian competition right related to privacy), need for safety and security • Should consumers be allowed to be anonymous online (this might be tricky to address as it will likely depend on the political and social environment of a country. The purpose is not to provide an answer but to raise the issue)

POWERING THE Digital ECONOMY: regulatory approaches to securing consumer privacy, trust and security   Understanding online (data) business models/data markets • Two-sided markets (telco, apps and data providers) • How online service (apps) providers make money? • Who owns your data? (defining SMP in this market) • Who controls your data? • What are the pressure points? • If the service is free, then you are the product o Openness and transparency on the use of the data to build trust

POWERING THE Digital ECONOMY: regulatory approaches to securing consumer privacy, trust and security   Examining exemplar models of ensuring protection, privacy and trust • Understanding the GDPR and its implications for European consumer (businesses and individuals), Implications of GDPR for countries in other regions and with a focus on Asia-Pacific and enforcement measures • EU (GDPR) versus US vs others – will European regulation be de facto global regulation • Finding other recent exemplar legal and regulatory models from the different regions • Can national regulatory models work or are regional/global models needed? • Assessing current online service providers/social media consumer protection safeguards (eg FB), does online platforms/industry self-regulation really work? What are the limits and how are these being addressed? • Who’s in charge? What is the role of the ICT regulator? Facilitation/collaboration? • What is missing? Conduct privacy impact assessment? What can be done at the policy and regulatory level?

POWERING THE Digital ECONOMY: regulatory approaches to securing consumer privacy, trust and security   Ensuring consumers’ security in the digital economy (this section will only highlight the importance of security measures to ensure trust it is not intended to go into technical details) • Security measures to ensure privacy and protect data: • Encryption – cryptography, blockchain, (see GDPR recital 83 – Encryption is advised) • What is required from whom (industry, manufacturers, providers, regulators, Gvt)

POWERING THE Digital ECONOMY: regulatory approaches to securing consumer privacy, trust and security   Good approaches to enhancing consumer trust and security through data protection • What are the key factors to promote online innovation and growth? • What must be avoided • Where can Government and regulators play an important role? A holistic cross-sectoral approach versus a sector specific one • Horizontal regulation – is there a case for dynamic digital ID to ensure trusted interactions?

Key questions for regulators, empowering the economy:   How to ensure and secure the infrastructure to supports the digital economy (data and broadband penetration, necessary upgrades (fiberoptic cables, 5G etc.), data collection, data protection) How to promote privacy and security throughout the value chains of the digital economy How to help guide companies through frameworks and the adoption of international standards in their security and privacy endeavors How to help guide ICT companies in reaching markets with different privacy and security legislation (fx EU, Australia) How to keep up with the evolving technological advances of the ICT industry – adoption of targeted strategies vs. general principles How do regulators ensure they do enough to provide a solid framework without stifling digital/data growth? How do regulators define success in terms of data protection and communicate this to the public/consumers to promote trust in the digitize economies?