llie fel ymgyrch, yn ei ddalun yn sicr ac yn rhyw meld. That includes general questions. We'll turn now to First Minister's Questions. Question number one Ruth Davidson. Thank you, Presiding Officer. Harold Lang is 72 and he lives in Perth. This week, he went to his GP and was told that the enhanced flu vaccination that is being recommended for use this winter by the joint committee on vaccination and immunisation is not available to him so he's taken matters into his own hands by going to his local chemist to purchase it. Mr Lange asks us if boots can get enough supplies, why can't NHS Scotland? Can the First Minister answer him? The new ATIV vaccine, as I'm sure Ruth Davidson is aware, is manufactured by one supplier who had to significantly ramp up production for the whole of the UK very quickly. That supplier was unable to guarantee sufficient supply for everyone over 65 this year in time for the start of the vaccination programme. That's not something that just affects Scotland. That is an issue right across the UK. Of course, we are advised on vaccination policy by the independent expert committee on vaccination and immunisation. It was their recommendation that led to this, but let me stress that vaccine offered to 65 to 74-year-olds this winter still provides full flu protection. That is an important point of assurance to make to all people across the country. The flu campaign for this flu season will get under way on 1 October, and that will offer free flu vaccination to over 2 million people across the country. The First Minister has just repeated the explanation of events that we heard from the Public Health Minister on Tuesday, claiming that it's not been possible to buy enough of the new-enhanced ATIV vaccine in time. Therefore, as a result, it isn't possible to offer a guarantee for people like Mr Lang. However, as the First Minister knows, following last year's winter flu outbreak, this is an issue of enormous concern for people, especially elderly people and people who have chronic conditions. We're told that it's only people over the age of 75 who will get the new recommended vaccine. That means that half a million Scots aged between 65 and 75 will not. Is the First Minister personally satisfied with that? The reason why it's over 75 is because the recommendation and the advice says that it is that group that this additional vaccine is clinically appropriate for. It's that group of people where the expert advice says that the vaccine that was being used previously perhaps doesn't offer the protection that we want it to. That's why we have prioritised over 75, but let me repeat again, because I think that this is an important point of public reassurance. The vaccine that was offered to 65 to 74-year-olds this winter does provide flu protection. People with underlying health conditions, pregnant women and healthcare workers will also be offered a new vaccine that provides protection against four different strains of flu. We already offer a vaccine to all primary school children, unlike in England, so that they benefit from additional herd immunity. That vaccine contains an additional flu B strain, which is more likely to affect the working-age population. That vaccine will provide those groups with further protection against flu during this winter. The supply issues are raised because of the change in advice, the different advice that came from the JCVI. That issue of supply doesn't just affect Scotland, it affects other parts of the UK. I point to an article last week in fact in the GP magazine Pulse, which reported concerns in England over shortages of flu vaccines for GP practices. We will take all appropriate steps to make sure that people across Scotland have the protection from flu that they need to have. It is incumbent on all of us in this chamber to encourage all those who are eligible for the vaccine to take up that eligibility so that we can combat flu as much as possible. Ruth Davidson The reason that this matter is that we have seen a dramatic rise in flu deaths in this country from 71 to years ago to over 300 last year. The Minister for Public Health said on Tuesday, and the First Minister has just repeated it just now, that the reason that there is a shortage of this new vaccine this year is because the manufacturer was unable to guarantee NHS Scotland's sufficient supply. It is true that concerns about provision have been aired. However, just last week, the manufacturer of the new drug confirmed that sufficient supply of flu vaccine for this season, and it stated that the only customers who were missing out are those who ordered late. Why is it that half a million Scottish pensioners are being told that they cannot have it? The First Minister I think that Ruth Davidson is mischaracterising the position that she keeps saying. I am repeating what the Public Health Minister said. I am repeating what the Public Health Minister said, because that is the accurate information. As Ruth Davidson and the whole chamber know, I was a health secretary for a period of five years. We follow a process for procuring the flu vaccine. It is a well-tried and well-established process. Unlike in England, of course, we nationally procure the flu vaccine. In England, different GP practices are left to do it on their own. As I have said, there are concerns that have been expressed there. However, let me repeat the information, because it is important information. The group where the advice says that the protection from this additional vaccine will be greatest is the over-75s, and that is the group that has been prioritised. Other groups get flu protection from the vaccine that will be available for them. I think that there is a real need for all of us here to be responsible in the public messaging around this. It is in nobody's interests to scaremonger among the population. It is vital that we encourage people to take up the offer of vaccine, and we will do that when the campaign for this winter begins. As I said earlier, it begins on 1 October. Ruth Davidson I do not think that scaremongering is to read out what the manufacturer, Sequerys, has written in the community pharmacy news, where they expressly say that the only people who are affected are those who ordered late. First Minister, people just want this sorted. It is quite clear that something in the system has not worked this year. The SNP Government began procuring vaccines for this winter in early autumn last year, and it did so in the full knowledge that the vaccine advisory body would be meeting later that year. It met in November, and it advised that the new enhanced ATIV vaccine is the one that should be used for people over the age of 65. By that point, NHS Scotland had already placed its order for a different product. Will the First Minister make it clear that that will not happen again? Will she continue to work with the manufacturer this year to see whether more people under the age of 75, particularly more vulnerable groups, get the enhanced vaccine? Will she ensure that we have a system in place so that people such as Mr Lange are not told by their local general practitioner and left to fend for themselves? First Minister, let me give some very clear assurances. The Scottish Government, as we always have done, will continue to follow the recommendations and the advice of the joint committee on vaccination and immunisation. That is the responsible thing to do. Secondly, we will continue to have a proper procurement policy in place for the flu vaccine and, indeed, for other drugs as appropriate. The procurement policy that we have in place is a centralised national procurement policy in Scotland, which I think is considerably better than the localised arrangements that are available in other parts of the UK. Thirdly, we will ensure that different groups of the population have appropriate protection against flu. Let me repeat again, because I think that it is really important from the point of view of public confidence and assurance that we make very clear that those over 75, where the recommendation is for the ATVI vaccine, will have access to that vaccine. Vaccine offered to other groups will provide flu protection, including those in the 65 to 74-year-old age group, people with underlying health conditions, pregnant women, healthcare workers and children. That is the message that it is important that the public gets. I hope that everybody across this chamber will join with me in encouraging everybody in a group that is eligible for the flu vaccine to take up the offer of eligibility and to give themselves maximum protection against flu this winter. Why does the First Minister not agree with Adam McVeigh, the SNP leader of Edinburgh City Council, when it comes to a small tax on tourists? First Minister, Adam McVeigh is a fantastic leader of Edinburgh City Council. First of all, he has a very strong view on the introduction of a tourist tax. That view is shared by many in different parts of the country. It is not currently Scottish Government policy to have a tourist tax, but we will continue to have that discussion and we will continue to consider those matters as we approach our budget this year. I hope that we will have constructive input from Labour on that and indeed a whole range of issues as we consider our draft budget, because that would make a refreshing change from previous years when we have considered our draft budget. Adam McVeigh also says that at least £11 million of revenue could be raised in Edinburgh by the introduction of a small levy on overnight stays. And Highland Council says that a charge of £1 on beds per night in the Highlands would generate £12 million of additional annual revenue. And we know that that revenue is badly needed. Adam McVeigh told this Parliament that Edinburgh City Council spent over £1 million extra during the Edinburgh festival alone just to keep the city clean because of the influx of tourists. And there are other costs as well. Councillor Bill Lobben told this Parliament that in the Highlands, because of tourism, and I quote him, our infrastructure is deteriorating, which would lead to a negative impression that causes reputational damage. The First Minister talks of protecting Scotland's tourism industry, but why won't she act to protect Scotland's local services, those very services that our tourism industry relies on? Partly, partly thanks to the actions of this Government, Scotland has a booming tourist industry right now, with tourist numbers, tourist spend increasing year on year. I am trying to be constructive and perhaps even build some consensus around this. I think that there is a serious issue for debate and discussion here. I do not think that it is any surprise that council leaders like Adam McVeigh and others see the revenue-raising potential of a tourist tax, but equally it is no surprise that there are voices of concern within the tourist sector itself, within the hospitality sector, within the catering sector. I have seen a letter, I think, addressed to me and to the tourism minister just this week, setting out some of those concerns. So where does that take us? That takes us to a position where a responsible Government should responsibly consider this and listen to all the arguments before we come to a decision. That is what we will do. We will do that in the run-up to our draft budget and perhaps beyond our draft budget and make sure that our decision making is properly informed by evidence. I am not sure what Richard Leonard could find to disagree with that. Perhaps Richard Leonard, as I say on this and on other things, will, for a change, ensure that the Labour party here actually makes a constructive and positive contribution to the budget process this year. We are just asking you to make your mind up on this question. This week, we have seen reports that Edinburgh City Council faces £28 million worth of cuts in the next financial year. That will mean cuts to schools, but it will also lead to cuts to tourism critical services, such as roads maintenance, such as rubbish collections, road sweeping and even public toilets. Today is World Tourism Day. Tourism in Scotland is now worth £11.2 billion. It increased by 17 per cent, so in light of that, does the First Minister seriously believe that increasing the cost of a hotel room by a couple of pounds a night is too high a price to pay for better-funded local services? Richard Leonard should maybe listen to the answers before he reads out the next scripted question. First, I thank Richard Leonard for paying such warm tribute to the success of the Scottish Government in boosting tourism in Scotland. It is down to things like road equivalent tariff, for example, helping our island communities, our infrastructure tourism fund helping communities cope with the additional demands of tourism. It is down to Scottish Government investment in tourist attractions such as the new V&A in Dundee, for example. I thank Richard Leonard for paying tribute to all that and more. However, he asked me to reach a decision. We will reach a decision, but we will do that in a proper considered way, where we listen to the views on both sides of this debate and come to an informed decision based on the evidence. Can I say to Richard Leonard that if we were to do anything other than that, if we were to rush that decision, I am pretty sure that he would be the first one standing up criticising us for not listening to all of the voices that are being raised? We will do that properly. Perhaps Richard Leonard would also recognise the fact that this year we are protecting local government budgets in real terms and protecting the people of Scotland from the austerity of Tory Governments that Richard Leonard and his party are too happy to see continue governing Scotland. We have some constituency supplementaries, the first from Edward Mountain. Thank you, Presiding Officer. The First Minister will be aware of the allegations raised by Highland doctors of a culture of bullying in NHS Highland, which they described as endemic and systemic. I met with the Cabinet Secretary for Health and Sport shortly after our appointment to raise this and other matters. I wonder if the First Minister would agree with me that we need a full independent inquiry into those serious allegations. As I can tell her, there is no confidence in an internal investigation by NHS Highland. Health Secretary spoke with the chair of NHS Highland, David Alston, this week and made crystal clear her expectation that this issue would be addressed thoroughly. We understand that the chair hopes to meet the signatories to the letter to discuss concerns as soon as possible and has encouraged other staff to come forward if they have any concerns that they wish to report. The welfare of staff in our NHS is paramount. Everything must be done to eradicate any bullying in the workplace. We have made clear to health boards that bullying and harassment are unacceptable and we expect them to ensure that any reported incidences are taken seriously and fully investigated. We are introducing legislation to establish an independent national whistleblowing officer for NHS Scotland to go live by the end of September next year. On Sunday morning, the family of Shekibayu woke up to a leaked story in a national newspaper alleging that the Lord Advocate would not bring forward any criminal charges in relation to his death in police custody. Does the First Minister agree with me that, after waiting for three years for any answers and not due to meet the Lord Advocate until next month, this leak is unacceptable and has no way to treat a grieving family? Will she carry out a full investigation into how the leak came about? Will she also apologise to Shekibayu's family for the distress that they have suffered as a result of the weekend's press story? I definitely deprecate any information. I do not know the truth or otherwise of information always that appears in the public, but I deprecate information that is in the public about matters such as this before families have the opportunity to be informed. My thoughts remain very firmly with both the family and the friends of Shekibayu at this difficult time for them. It would, of course, not be appropriate for me to comment on the specific circumstances of the case until such a time as a decision has been made by the Crown and then communicated to the family. The previous Lord Advocate, of course, made clear in 2015 that, regardless of the outcome of the investigation, as far as potential prosecution is concerned, a fatal accident inquiry would be held to provide public scrutiny into the circumstances of the incident. I personally made clear to Mr Bay's family when I met him that we, as a Government, are not ruling out anything in terms of a wider inquiry at an important and appropriate point in the future. That is something that definitely remains an option, but it is only a decision that we can take at the appropriate time. The Scottish Government is about to change procurement rules for printing services, which will effectively remove the opportunity for small local firms to get work from Scotland's public bodies. Ian Robertson, director and vice-president of Print Scotland, said that the Government strategy flies in the face of ministers' claims of wanting SMEs to be involved in public procurement. He said that, put bluntly, the Scottish print industry is in the process of being offshoreed. Does she agree with his comments? Will the First Minister intervene to stop this? And when will she instruct a review of public procurement so that small businesses in Scotland can benefit? I am aware of the concerns that are being expressed by the print industry. I know that the finance secretary has already agreed to meet with Print Scotland to discuss them. We have two frameworks in place to provide print services. We recently conducted a procurement for the single supplier publishing print design and associated services framework. The award was made in August to APS Group, which is a Scottish register company based in Leith here in Edinburgh. We have also commenced a procurement exercise to re-elect the print and associated services framework. Currently, 10 of the 12 framework suppliers are Scottish printing SMEs, but we will use recent stakeholder analysis to inform our decision on the number of suppliers to be appointed to the new print framework. We expect to issue an invitation to tender for those services in the autumn of this year. In terms of APS, it will continue to utilise its extensive supply chain. That currently includes, as I understand it, 114 SMEs, 89 of which are Scottish, including printers across the country. In terms of procurement more widely, of course, we passed the Procurement Reform Scotland Act 2014, which recognises the importance of SMEs, third sector organisations and supported businesses to the Scottish economy and includes a range of measures designed to assist them. I met the Federation of Small Businesses just yesterday, in fact, where procurement was one of the things that we discussed, and I look forward to taking a dialogue forward with them to consider how we further benefit small businesses in our economy. Thank you, Presiding Officer. A public and scientific concern about climate change is rising ever higher, and the Scottish Government's latest report card presents a mixed picture. Scotland is doing better than the UK, but that is damming with faint praise, and it is certainly not the benchmark that we should be aiming for. The report makes clear that the end of coal-fired power generation, which the Scottish energy minister at the time wanted to delay, is masking a lack of progress in other areas. It says that the strategy must now move on decisively. To take one specific, why does the First Minister believe that transport emissions have kept on rising every year for the last three years, when they should be going down? I think that it is important to look at what the Committee on Climate Change said in the report this week. It said that Scotland continues to lead the way in the UK in tackling climate change. Indeed, we continue to lead the world. We met our 2016 target, which is the third annual target to be met. Emissions are 49 per cent below the 1990 levels, which of course already exceeds our original 42 per cent reduction target by 2020. The report says that we are on track not just to meet but to outperform the new target of 56 per cent by 2020. It praised the proposals in the climate change plan and said that they were in stretching, credible and well-balanced. That is a good report card for Scotland's performance in cutting emissions and tackling climate change, and we should be proud of it. We know that we need to replicate the success in areas particularly around electricity and waste in other sectors of the economy. That is what the plan is doing. We also need to up our ambition in terms of the targets, which is why the new climate change bill targets the 90 per cent reduction for all greenhouse gases, which would ensure that we would be carbon neutral by the time that we meet that target. In terms of transport, one of the areas that the Committee on Climate Change report looked at was about transport and had lots of good things to say about the Government's work in terms of the roll-out of electric vehicle infrastructure. There is a lot to be positive about that, but we know that we have in common with other countries across the world a lot more work still to do. However, we should take comfort from the fact that we are ahead of the game in terms of the performance of other countries. We should be proud of that, but determined to build on that. That is one of the problems with this whole debate. Any Government can list a few of the good things that they are doing, a few of the positive steps that they are taking. However, if those steps are outweighed by the harm that is being done elsewhere, then the problem still grows. While public transport is expensive in many places unavailable, urban space is dominated by cars and the aviation industry is given a free pass, transport emissions will keep going up, and the same contradictions are there in energy as well. Scotland is doing well on renewables, but this week the Greens were, I think, the only political party not jumping for joy at the discovery of even more fossil fuel reserves. When will the Scottish Government understand that if they keep telling total, BP and the rest of the lethal fossil fuel industry to keep on drilling, Scotland's reputation as a climate change leader will be a sham? Scotland's reputation as a climate change leader is well earned and thoroughly justified. It is something that we should be recognised internationally by the United Nations and many others. Let me unpack some parts of Patrick Harvie's question. He talked about aviation getting a free pass. Unlike many other countries, Scotland includes emissions from aviation and shipping in the calculation of our targets, not a free pass. He talks about transport. Let me just read from the Committee on Climate Change report. Since the draft climate change plan, the Scottish Government has made commitments to continue to invest in the Charge Place Scotland network until August 2019 and provide further loan funding for electric vehicles until 2020. The energy strategy commits to additional policy measures, including expanding electric charging infrastructure and further funding for charging points. The committee itself pointed to the real progress that Scotland is making here in terms of our responsibility to reduce emissions from transport. In terms of oil and energy more generally, our energy strategy commits us to some of the most stretching targets anywhere in the world. In terms of electricity generated, we meet well over half now of our electricity demand from renewable sources in the last year. We saw renewable power generation up by 27 per cent just in the last year alone. It is right that a Green Party continues to push the Government to do it further. Once in a while, a Green Party would want to take some pride from the fact that it is in a country that is recognised internationally as a world leader, and it might make a bit of a change occasionally for Patrick Harvie to do that. Some further supplementaries. The first is from Ian Gray. Thank you. A report published this week by Children in Scotland, the National Autistic Society Scotland and Scottish Autism, shows that many autistic young people face unlawful exclusion from school on a regular basis. That is a disgraceful situation. What action will the Scottish Government take to correct it? I agree with Ian Gray that for autistic children to be unlawfully excluded from school is unacceptable and to use his terminology that is disgraceful if that happens to a single child, that child is being let down. We have a range of policies, as Ian Gray will know, given that he is a Labour spokesperson in education around inclusion in education and being able to support children to be taught in mainstream education. Of course, we are taking a range of actions around direct funding to schools that allow schools themselves to put in place particular measures to support those children who need support. I am sure that the education secretary would be very happy to meet with Ian Gray to discuss the range of additional measures that we can take to address something that I think all of us agree that we do not want to see happen in our schools. Tom Arthur. Our police officers represent the very best of Scotland, working tirelessly all year round to keep us safe. Does the First Minister agree that, given their hard work and dedication, Scotland's police officers deserve a significant pay rise? Does she therefore welcome yesterday's announcement of the best pay deal for officers in the past 20 years? Yes, I do. I warmly welcome the fact that we have this week been able to agree a pay rise for our police officers that the Scottish Police Federation has described as the best pay rise for 20 years. I think that that is something that should be welcomed right across the chamber at 6.5 per cent over a 31-month period. Of course, that is in addition to the pay deal that we have agreed with NHS staff of 9 per cent over the next three years. It does underline how much we value the contribution of our public sector workers, and I am very pleased that we are in the position of agreeing that this week. It stands, of course, in marked contrast to the position elsewhere in the UK, where the head of the Met Police in London described the UK Government's pay offer to police officers as a punch on the nose. I am delighted that we value our police officers, and that pay deal recognises that. Colin Smyth Last week, we learned that ScotRail's performance was at a record low in punctuality, the worst since 2005. This week, ScotRail's own figures showed that performance has deteriorated so badly that it would have been in breach of its franchise agreement had the transport secretary not secretly reduced its target without telling Parliament. Does the First Minister agree that the way to make our trains run on time and ensure that they are not overcrowded and not ripping off commuters is not to fiddle the performance figures to cover up failing performance, but to have a railway system that starts to put passengers ahead of profits? First, in terms of the performance benchmarks, that is allowed under the terms of the franchise agreement. The railways act allows for ministers to exercise discretion where there is a particular issue, in this case particular issues caused by severe hot weather in the early part of the summer. Let's turn to ScotRail's performance. Nearly 90 out of 100 trains arrive within the recognised punctuality measure. The latest figure shows that ScotRail's public performance measure is better than the GB average, but here is the key point, because we are heavily investing to improve our railways to make sure that there is more capacity in our railways, that there are more modern trains on our railways, but here is the thing. If you look at the period in the latest Office of Road and Rail report, more than half of all the cancellations and delays are caused not by issues that are the responsibility of ScotRail but by issues that are the responsibility of Network Rail. Why am I mentioning that? Because this Parliament is not responsible for Network Rail. We are the ones arguing for it to be devolved, Labour are the ones still standing in the way of that. It comes back to this age-old issue for Labour. If they want to will the ends of something in performance, they really have to help us get the means to do it. I look forward to the support coming from Labour for the devolution of Network Rail as soon as possible. Rona Mackay Thank you, Presiding Officer. It emerged yesterday that the UK Government has quietly appointed a minister for the protection of food supplies the first time that has happened since World War 2. Does the First Minister agree that when you are contemplating rationing it is time to stop Brexit madness? Rona Mackay That is news that would have made most people across the UK really stop in their tracks. The Tory stewardship of Brexit and the UK as a whole is now proving so catastrophic that they have had to appoint a minister for food supplies, which is the first time that there has been such a post held since World War 2. How has it come to this situation? It is shameful and should be a source of shame for a long time to come to every single member of the Conservative Party. I certainly hope that it does not come to food rationing in this country. I certainly agree with the question that things are becoming so shambolic that it is time to draw a halt to this Brexit catastrophe. However, if there ever comes a day when there is food rationing in this country because of a Tory Brexit, perhaps the first people who should be bearing the burden of that are Boris Johnson, Jacob Rees-Mogg, David Davis and Michael Gove—all of those people who perpetrated a dishonesty on the people of this country. Let's see how they enjoy their Brexit bonanza. 4. Stuart McMillan Thank you, Presiding Officer, to ask the First Minister what action the Scottish Government is taking to improve recycling rates and the quality of recycling. Statistics were published earlier this week that showed that, for the first time, we now recycle a greater proportion of our household waste in Scotland than we send to landfill. That is a fantastic achievement. Figures earlier this year highlighted that we now recycle more than 60 per cent of waste from all sources. Although those are significant milestones, we know that there is more to do on household recycling. In particular, Zero Waste Scotland is working closely with local authorities to support them in improving their recycling services, including encouraging them to adopt the Scottish household recycling charter. We also believe that our commitment to establish a deposit return scheme for Scotland will not only increase the amount that we recycle, but will also improve the quality of recycling. Stuart McMillan I thank the First Minister for that reply. Recent figures released by SEPA show that, in 2017, 57.2 per cent of Inverclyde's household waste was recycled. That is up 3.8 per cent from 2016. This week is Recycle Week 2018. Therefore, does the First Minister agree with me that, while this is an excellent achievement, the Inverclyde Council's decision to remove its kerbside glass collection service this year could result in reduced recycling locally? It could also damage the good work that it has been doing. The First Minister I certainly agree that Inverclyde's progress is an excellent achievement, but I also agree that it is vital to sustain that progress both nationally and locally. A range of measures are needed, including effective collection services. I mentioned the Scottish household recycling charter. That, which is agreed with COSLA, includes glass collection, and we are encouraging all councils to adopt and implement it. I hope that Inverclyde Council will do so. We have a range of initiatives at the national level to reduce waste and boost recycling. As I said earlier, those include proposals for a deposit return scheme and action to reduce food waste and support for circular economy projects. I would certainly encourage Inverclyde Council and all local authorities to ensure that they have necessary measures in place to build on and accelerate progress on that really important issue. Maurice Golden I declare an interest with respect to my work around the circular economy. In 2010, the SNP said that Scotland would be recycling 50 per cent of household waste by 2013. It is now five years later and that target has not been met. When will it be? We are now recycling more than 60 per cent of waste from all sources. As I said earlier, for the first time ever, we are recycling a greater proportion of our household waste than we send to landfill. That, I think, is good progress. I think that all of us should be encouraging not just councils but individuals across the country to make sure that we continue that progress. However, the figures out this week—whatever way you want to look at it—are good news and demonstrate the progress that has been made with the range of investments that the Scottish Government is making. Brian Whittle To ask the First Minister what the Scottish Government's response is to the report that obesity is set to overtake smoking as the biggest cause of preventable cancers in women. I know that Cancer Research UK has done fantastic work in helping to raise awareness of the links between obesity and cancer. As our recent diet and healthy weight delivery plan pointed out, obesity is linked to around 2,200 cases of cancer a year in Scotland. We all recognise that there is no simple single solution, which is why our healthy weight plan sets out over 60 actions, and our recent active Scotland plan sets out 90 actions to help wellbeing. One of those actions is that we will consult shortly in steps to restrict the promotion and marketing of junk food where it is sold to the public, such as multi-bias in supermarkets. Brian Whittle I thank the First Minister for her response since she says that obesity is a health issue that has so many other repercussions in the preventable health agenda, not just in preventing cancers. There are type 2 diabetes, musculoskeletal conditions, heart disease and stroke, not to mention the effect on mental health. That is why I was encouraged by the Scottish Government's announcement last year to deliver a good food nation bill. It would have given us the opportunity to look at the obesity-adgenic environment around schools, look at delivering a censored self-procurement contract that supported our farmers by procuring locally high-quality produce for our school meals instead of some of the high levels of cheaper imported processed food that the current system allows. It would have allowed us to properly make the link between education and health. I ask the First Minister to tell the chamber why the Scottish Government missed this opportunity by scrapping the good food nation bill and what will the Scottish Government now put in its place to help to deliver a healthier Scotland? The issue was debated in Parliament the week before last. The Government made clear then, and I will make clear again today, that we are committed to legislating around our good food nation agenda. We will set out plans for that in due course. The other thing that we are determined to do, of course, is to take forward those areas that do not necessarily require legislation. Some of what Brian Whittle has talked about there would not necessarily require waiting for Parliament to legislate. The strategies that I have talked about, particularly around our diet and healthy weight delivery plan, will help us to take forward that agenda. It is an area where there will undoubtedly be issues where there is disagreement among parties and members in this chamber, but I think that there will be a great deal of consensus as well. I look forward to taking forward that agenda, which will have legislation as part of it over the remainder of this Parliament. It will benefit people right across the country, particularly the younger generation, where, as we saw in the Scottish household survey this week, we are already seeing very welcome signs of improvement around obesity, drinking among younger people and, of course, consumption of healthy foods. There is a lot to be positive about and a lot to build on. The First Minister will be aware that there are many causes of obesity, including some outlined by Brian Whittle in ways to prevent it, including increasing breastfeeding rates, which has not been mentioned. Is she aware that a major cause of obesity for a significant number of Scottish women is undiagnosed, untreated or poorly treated thyroid disorders, and therefore does the First Minister agree that it is unacceptable for any Scottish NHS board to refuse patients, particularly those under the care of an endocrinologist, their prescriptions for lyothyrenine medication, as is happening currently? Will she ask the health secretary to intervene to ensure that my constituents and other thyroid sufferers are not stopped by any health board from receiving their life-saving medication, which also has an important impact on reducing obesity for a great many women? Can I say first of all that I agree with the general thrust of Aileen Smith's question? I certainly recognise the links often between obesity and thyroid problems. Sometimes they will be undiagnosed thyroid problems and I certainly agree that people should have access to the medication and the treatment that they need. I get the sense that there is a particular constituency case lying behind Aileen Smith's question, which I do not know the detail of, and I do not think that the health secretary knows the detail of it either. If Aileen Smith wants to provide us with that detail, I will certainly ask the health secretary to look into it and get back to her with further detail as soon as possible. To ask the First Minister, in light of the Committee on Climate Change's recent report, what new action the Scottish Government plans to reduce CO2 emissions. The committee's report shows that Scotland met its last three annual targets and continues to outperform the UK in reducing emissions. The report also finds that our climate change plan provides an ambitious and credible package of measures for continuing to meet the targets set by the Parliament's 2009 act. Of course, the Parliament is now considering whether those targets should be increased through the new climate change bill. We have proposed that the targets should be set to the maximum level of ambition that is credible at this stage. Of course, we will look again at the climate change plan as soon as the new legislation has been finalised and we will consider the committee's recommendations carefully in the meantime. Claudia Beamish I thank the First Minister for that answer, but we previously heard the First Minister place a great deal of weight on the advice of the Committee on Climate Change. The report highlights a lack of action in agriculture and transport. What will the Scottish Government do specifically to support people working in those industries to contribute to emissions reductions in a fair and sustainable way? We have also heard the First Minister state that Scotland should contribute fair shares in her speech to the UN climate change conference in Bonn last year. Does she therefore agree with Scottish and now UK Labour that Scotland should have a target of net zero emissions by 2050 at the latest and more robust interim targets to lead us there so that we can actually continue to be a global leader? The First Minister Claudia Beamish asked me about transport. I have already answered in terms of transport to Patrick Harvie. I will not repeat all of that, but the progress and further plans that the Scottish Government has around transport are recognised in the report of the Committee on Climate Change. She also asked me about agriculture. Emissions in agriculture are actually down 14 per cent since the 1990 baseline. Scottish farmers do a lot to contribute to the emissions reductions in electricity generation and land use and forestry sectors, and the climate change plan includes a range of measures to further encourage farmers and the benefits of low-carbon farming. We intend to fully explore the potential for those voluntary measures before considering any change in approach. In terms of targets, though, it is interesting that Claudia Beamish cites UK Labour. I listened carefully to Jeremy Corbyn yesterday. He said that he wanted to commit to saying that imitation is the finest form of flattery. Certainly, in Jeremy Corbyn's speech, there was plenty that the Scottish Government has already done that they are glad to see following in our wake. However, climate change is an interesting example here, because he committed Labour yesterday to support a 60 per cent reduction in emissions by 2030. A 60 per cent reduction by 2030 sounds good, except that we have already got proposals in the new climate change bill before this Parliament that commit to a 66 per cent reduction in emissions by 2030. We are ahead of other countries. We are proposing the most stringent and ambitious statutory climate change targets anywhere in the world, and I look forward to having Claudia Beamish's support. In light of transport emissions rising every year since 2010, the Committee on Climate Change has confirmed that transport is Scotland's biggest sectoral challenge. In particular, aviation emissions have doubled since 1990, and airports are recording record figures in terms of passenger numbers. How can she justify a £250 million tax break to the aviation industry through the scrapping of APD? We need to have good connectivity, including to our island communities, which often involves air transport. However, we have to make sure that proper account is taken of aviation emissions, which is why it is so important that we include aviation emissions and the calculations of our targets—something that not all countries do. It is also important that we have a balanced transport system. As the Committee on Climate Change recognises, we are investing and have ambitious plans in terms of the electrification of the transport network. We will continue to take forward those plans to make sure that there are good connections across Scotland and between Scotland and other countries. However, as we do that, we are fulfilling our international obligations—moral obligations—to reduce emissions and tackle climate change, and we continue to be a world leader in doing so. The First Minister's Questions will move on shortly to a member's business, but until then, we will have a short suspension just to allow the gallery to change and to allow new guests to arrive.


Hello, I'm Teresa Stevens, one of your Navy's ombudsman at large, and I'm Mike Stevens, the Master Chief Petty Officer of the Navy. We wanted to take a moment to thank our ombudsman and Navy families for your steadfast support of our sailors. The reality is that when someone joins the Navy, it is so much more than an individual commitment. It is a commitment the entire family makes. Teresa and I recently visited Japan, South Korea, Singapore, Guam, and Hawaii and witnessed firsthand your commitment to the well-being of our sailors. Being overseas is tough duty, and the support our ombudsman provide our Navy families is unmatched. Again, to our ombudsman and our Navy families, who selflessly serve and support our sailors, we thank you.


In this presentation, we will enter a journal entry related to the payment of payroll taxes. Before this point, we have recorded payroll taxes for both the employee and employer portion. Now we're going to work on the payment of those payroll taxes. The recording of the employee and employer portion of payroll taxes came from the register as well as a worksheet for the employer portion. In other words, we have four employees here, four employees represented by this set of numbers. If we sum those up then, this $487.19 is the regular pay for the four employees. We took from that the OASTI Social Security, the H.I., the Medicare, the FIT, Federal Income Tax, Group Insurance, Union dues, 401k plan to get to the net pay. This information was used in order to create the journal entry related to the employee payroll. Then we used this worksheet in order to create the journal entry for the employer portion of the taxes, including their portion, our portion, as the employer of OASTI Social Security, H.I., Medicare, FUTA, Federal Unemployment Tax, and SUTA, State Unemployment Tax. Then if we look at the results then on our trial balance, which is always nice to have a trial balance when recording journal entries, we'll see that we have the FUTA, OASTI, here, 606310, this is the FICA, OASTI Social Security, and then the FICA for the H.I., Medicare, the FUTA, Federal Unemployment Tax, the SUTA, State Unemployment, and the FIT, Federal Income Tax. These then are what we're going to pay now. These are liabilities. They include both the employer and employee portion of the taxes. In other words, this Social Security Medicare includes the tax both from what we took out of the employee wages and what we owe for the employer half as well. The FUTA and SUTA, the FUTA will be an employer tax and the SUTA for our case will be an employer tax. The FIT, Federal Income Tax for employees is just an employee tax. So that's going to be here. We're not paying any FIT. It's all coming out of the check of the employee. So if we build this journal entry then, what we're doing in essence is we're just saying, hey, these are the things we owe. We're going to make payment for them. Note that if we made payment in practice, we would probably have to group the payment in terms of federal taxes and state taxes. Probably we're going to group then the OASDI and the Social Security or the HI, meaning the Social Security Medicare would both be going to the Fed, which we made group in one payment. We may have a separate payment for FUTA and a separate payment for SUTA because it's going to the state. And so just note that the groupings of the payments as to how we're going to write the checks and the groupings of the payment could differ. But the point is that after we have these liabilities, we will be making the payment in the future. We're going to record the journal entry related to making the payment, which will be similar to any type of payable accounts such as the accounts payable, meaning the liability goes up and now we're paying it and the liability goes down as well as cash goes down. So to create this, we're just going to say, okay, we had account 215 for OASDI, credit of 6061.10. We need to make it go down to zero because we're going to pay it off. So we're going to debit it to the opposite thing to it, 6061.10. Same thing for HI, we have and then if we post that as we go, apparently we're going to post that as we go, it goes down to zero. That's what we want to happen. So we're going to make all these go down to zero. Then the HI and the Medicare, same thing. We're going to say it has a credit here, we're going to debit it doing the opposite thing to it. And if we post that as we go, it's going to make it go down to zero. That's what we want. Then we've got the FUTA has a credit in it. So we're going to debit it for that same amount. Then if we post it, it's going to go down to zero. And then we have the SUTA, which again, it's going to be debited for that same amount. Then if we post it, it's going to go down to zero. And then we have the FIT, which is going to be, it's a credit here. So we're going to debit it for the same amount. And then if we post it, it's going to go down to zero. Then if we add all these up, it should add up to what we're going to pay, which will be the check here. So that's going to be the credit. So what are we going to actually pay? If we have pull out the whole calculator here, 6063.1 plus 14417.98 for Medicare plus 12538 for FUTA plus 867.56 for SUTA and 899.13 for FIT. That gives us 9373.15. And something must have gone wrong there. Let's try that one more time. We're going to say 6063.1 plus the 14417.98 plus the 12538 plus the 867.56 and the 8599.13 gives us 1773.15. That's how much we're actually going to pay. So that'll come out of cash. Cash is a debit. We're going to make it go down by doing the opposite thing to it, a credit, bringing the balance down to 554, 660, and 74 cents. Now, if we see the whole thing, then here's our journal entry at the end. What happened here is the cash went down and the liabilities have now gone down because we've paid them off in a similar fashion as any payable type of account, similar to how accounts payable would be. Note two, no effect on net income. Just like when we pay off accounts payable, we haven't incurred the expense at the point in time that we paid the cash. We incurred the expense prior when people worked and when we recorded the journal entry at that point. So when we pay off the payable, no effect on these accounts down here. These are all liabilities accounts and an asset account, no revenue or expense accounts. If we look at the GL, it could be useful to look at the GL to see how this all ties together. So here's our journal entry. We posted the FICA OASDI here. Before we did that, we had 6063 in it. That was the employee portion of FICA Social Security and the employee employer portion, bringing us to 606310. Then we paid it off. That's going to be how this payable account should look and how most payable accounts should look if it's a nice even payable, meaning the liability goes up. So it's going to be the employee and employer portion every time. And then at some point later, a little bit later, when we make the payment, it goes back down to zero. And then if we do the same for H.I. or Medicare, same thing. It was at 104798, we paid 1014, 104798, bringing it down to zero. So same pattern. It's going to go up by the employee portion, up by the employee portion, and then we pay it goes down to zero. FUTA, we have the FUTA over here. It was at 12538, then we paid 12538, goes back down to zero. Note there's only one portion, only the employee or portion, and then we paid off the employee or portion. There's no matching there. We can see that in the GL. And then if we go to the FIT, so we have the FIT here. And it started at, it was at 80559913. It's going, we paid it, then it goes down to zero. Note again, there's only one entry here. And the reason there's one entry isn't because, is because it's an employee portion, meaning this is not an employee or tax. It only comes out of the employee paycheck. So this is an employee tax that we paid off no matching here. Then we have the FUTA, which is the state unemployment tax. And that's going to be, it was at 86756. We brought it down to zero. We're paying off the FUTA. Again, typically in our problem, it's only a employee or tax. It could have an employee portion depending on the state, but that'll depend on the state. We're going to mirror here, in essence, the employee or function of it. And many times it'll, it'll mirror kind of the FUTA and the SUTA will be similar in, in the way it's constructed oftentimes, depending on the state. The end.


I'm Ayanna Arangiran from St. Pabla Third Ward of St. Pabla Philippine Stake of the Church of Jesus Christ of Latter-day Saints. This is the restoration of the fullness of the Gospel of Jesus Christ, a bicentennial proclamation to the world from the First Presidency and Council of the Twelve Apostles of the Church of Jesus Christ of Latter-day Saints. We solemnly proclaim that God loves His children in every nation of the world.  By the power of the Father, Jesus rose again and gained the victory over death. He is our Savior, our exemplar and our Redeemer. 200 years ago, on a beautiful spring morning in 1820, young Joseph Smith, seeking to know which church to join, went into the woods to pray near his home in Upstate New York, USA. He had questions regarding the salvation of his soul and trusted that God would erect him. In humility, we declare that in answer to his prayer, God the Father and his Son Jesus Christ appeared to Joseph and inaugurated the restitution of all things as per told in the Bible. In this vision, he learned that following the death of the original Apostles, Christ's New Testament Church was lost from fear. Joseph would be instrumental in its return. We affirm that under the direction of the Father and the Son, heavenly messengers came to instruct Joseph and re-establish the Church of Jesus Christ. The resurrected John the Baptist restored the authority to baptize by immersion for the remission of sins. Three of the original 12 apostles, Peter, James and John, restored the apostleship and keys of priesthood authority. Others came as well, including Elijah, who restored the authority to join families together forever in eternal relationships that transcend death. We further witness that Joseph Smith was given the gift and power of God to translate an Asian record, the Book of Mormon, another Testament of Jesus Christ. Pages of the sacred text include an account of the personal ministry of Jesus Christ among people in the western hemisphere soon after his resurrection. It teaches of life's purpose and explains the doctrine of Christ, which is central to that purpose. As a companion scripture to the Bible, the Book of Mormon testifies that all human beings are sons and daughters of a loving Father in heaven, that he has a divine plan for our lives and that his son, Jesus Christ, speaks today as well as in days of old. We declare that the Church of Jesus Christ of Latter-day Saints, organized on April 6, 1830, is Christ's New Testament Church restored. This church is anchored in the perfect life of his Chief Cornerstone, Jesus Christ, and in his infinite atonement and literal resurrection. Jesus Christ has once again called apostles and has given them priesthood authority. He invites all of us to come into him and his church to receive the Holy Ghost, the ordinances of the salvation, and to gain and journey in joy. 200 years have now elapsed since this restoration was initiated by God the Father and his beloved Son, Jesus Christ. Millions throughout the world have embraced the knowledge of these prophesied events. We gladly declare that the promised restoration goes forward through continuing revelation. The earth will never again be the same as God will gather together in one, all things in Christ. With reverence and gratitude, we as his apostles invite all to know as we do that the heavens are open. We affirm that God is making known his will for his beloved sons and daughters. We testify that those who prayerfully study the message of the restoration and act in faith will be blessed to gain their own witness of its affinity and of its purpose to prepare the world for the promised second coming of our Lord and Savior, Jesus Christ. I would like to share my testimony of the restoration of the fullness of the Gospel of Jesus Christ. I know that Joseph Smith is the prophet of restoration and that he is truly called of God. I know that Heavenly Father and Jesus Christ helped Joseph Smith and guided him through the Spirit to restore the Gospel. I know that the Book of Mormon is true and that it contains the Word of God. And I would like to leave these things in the name of Jesus Christ, amen.


Okay, great. Welcome everyone to the second edition of the data governance meetup. Today we have a talk and a birds with feather session. In the talk, we have Tophik Ali, who is a principal cyber security engineer, and he's gonna talk about data governance on unstructured data. Tophik, on to you. Thanks, Ajit. Good afternoon, everyone, and even more to all of you. This is a quick word on me. This is what I am. I have over a decade of experience in the field of cyber security, and I'm very passionate about delaying offensive and defensive practices, which include security by design, privacy by design, threat modeling, et cetera. I'm a very active member in a community called Null, which I'm not sure if you guys know well, and our recent project was jobs.null.community, which powers free recruitment for employees and job seekers both, and you can always find me on LinkedIn and Twitter. My DMs and messages are always open, so if any questions, please feel free to drop a line. So before I get into the presentation, I have some ground rules. If you have any questions, please feel free to raise them while in the middle of the conversation. If I don't see a raised hand, feel free to leave a message in the chat and I will have a look at it. Everything that I talk here is purely out of experience and something that we've learned or I have learned over practicing different streams like privacy by design and security by design. So that's pretty much it. So let's quickly jump in, right? Now, what are the key takeaways that I'm expecting that our audience will benefit at the end of this is, A, we will talk about a lot of unstructured data and what are the privacy implications around it? We will also talk about privacy by design blind spots and I will give you a number of examples how these areas are often missed when you're coming up with a data governance framework, especially when you're talking about privacy by design. Agile practices for implementing privacy controls. I will talk about this as we move through the slides. A lot of stuff I will talk about will also be out of experience and you may not find them on the slide, but I think wherever it is important, I have made my best effort to put them onto the slide, but if not, we can always also have a chat maybe offline later. So before we begin into the unstructured data world, this is a very high level definition of what data governance is all about. This is for audience that is largely into governance, privacy and compliance and similar practices. So what is data governance? It's essentially a set of principles and practices that ensure high quality through the complete life cycle of your data. Now, if your data sits in one particular system or in one particular database or one particular location, it's fairly, fairly easy to come up with a data governance framework and then you implement rules that make sure that achieve the purpose of why do you have a data governance framework set up in your organization? But the real problem then starts when you don't know where your data sits, you don't know what is the structure of that data. And as a result, you cannot implement uniform set of rules to make sure that you have data or privacy by design implementations for systems within your organization. Again, this is a very high level data governance framework that generally is followed if an organization has a data governance function, you answer typical questions like why, who, what, when, et cetera, et cetera. Lastly, to be able to answer, A, why do you need some data? Who's going to have access to that data? When will they access to that data? And what are the means for accessing that data? But let's break this complex diagram into some very, very simple examples. So that takes me to all the blind spots. And again, I think a lot of this that I'm going to talk about is something that we've developed over years of experience. When I started the journey into helping different teams within the organization that I work for privacy by design, especially when the GDPR was very, very rampant and we operate in European geographies where GDPR seems to be mandatory. It was a fun exercise to start with, to see every single system that stores customer data or any information that is deemed as private. In doing so, like I said, when I started, that if the, it's very easy to identify data that sits in a structured manner because then you can implement uniform controls, the real challenge was unstructured data. And I'm going to give you some examples in a bit. The other blind spot that I discovered during this process was inventory of systems that actually store process and transmit data. And once you have a look at these examples, you will realize that these are systems that we don't even consider when you talk about data governance or data privacy or privacy by design related stuff. I will touch upon some examples on masking, tokenization, anonymizing or encrypting the data. If I were to summarize all the blind spots that we've come across through our practice of privacy by design is you cannot protect something that you don't exist, right? I mean, it's a very, you know, it's common sense that if you are responsible for protecting an organization from external threats, you cannot protect that organization if you don't know what is the exposure of that organization on the internet. So, I mean, that's just my way of, you know, summarizing the different blind spots that we have. Is that clear so far? Any questions? Am I going too fast or too so? Please let me know. I can accordingly tone up, tone down. Rajatthai, can you guys hear me? Okay, excellent. So, let's move on, right? Let's move on and talk about what unstructured data is. A very simple definition is that if it does not have a predefined data model or a schema, for me, it's an unstructured data and I'm sure that, you know, it's a general definition for any kind of unstructured data. Now, some examples are sensitive data that is exchanged over emails, documents, text files. It could be anything, right? It depends on what is your function in that given organization. For example, if you are somebody who supports a product and you often deal with a lot of customer, you know, questions, then you are exchanging a lot of data over emails and documents and, you know, it's very difficult to put a structure around it. Sensitive data stored on public S3 buckets. You can find several, several examples on the internet of how people have managed to find sensitive data about a given organization on, you know, in a public S3 bucket, which does not have any, you know, correct ACS configured analysis is accessible to anyone. Data shared on social media, though, this is very interesting, right? Now, a lot of my examples in this presentation are relevant to, you know, my organization. The reason I say that is because, for example, you know, let's talk about data shared on social media. Now these days, we often exchange a lot of information with our suppliers. So for example, you know, if you want to tweet to your electricity provider, then you, you know, go ahead and tweet and in doing so, you might end up giving a lot of information to them, which is something that, you know, in principle you should avoid. If you're tagging your friends, if you're tagging, you know, images which may have, you know, location information on them, et cetera. All of this is basically, you know, data shared on social media. Data shared indirectly with suppliers or partners. Now, while you may know that your organization is sharing information directly because there is some form of a legal, you know, binding between you and your supplier, but what about the data that you share indirectly? What that means is that you start with a certain initiative, saying, saying that this is what the data that is going to be consumed as a part of my product life cycle. But in doing so, other information as well, which makes your data more and more richer, you know, from a privacy point of view. You know, Facebook is a classic example of this, that it's not just you who give information to Facebook, but it is also all the people who advertise their products on Facebook. Facebook is giving them your information. As a result, you see a lot of tailored experience in terms of pointed ads, you know, that come up on your Facebook pages. So let's, you know, break this down. Now, if you think that your data is only stored within an RDBMS, think twice, right?  In my experience, it often happens that developers are never exposed to the entire life cycle of the product. What that means is that as a developer, if I'm writing code for a certain product, I have no visibility as to how these are exposed to the internet. What kind of logging is configured for these applications? What are the kind of analytical trackers that are implemented? You know, what kind of other activities are carried out, you know, by my business that works on these kind of products. So as a result, because the developer visibility is minimized and is not, it leads to blind spots in a lot of areas and we are going to talk about some of them.  Query strings, there are some very interesting examples that I will give to you in a bit. Data analytics systems, I'm not quite sure of, you know, how many people in the audience are versed with, you know, full blown data analytics systems that can actually record an entire user session in their browsers and give opportunity to your businesses to be able to replay that entire session and come back and give you a more tailored feedback or an experience. I mean, this area in my experience has been a big, big privacy nightmare if not implemented correctly. Again, something that the developers are often blindsided is, you know, the kind of logs that gets stored within web servers, proxies, load balancers, errors, web application firewalls, et cetera, et cetera. So everything that I'm going to talk from now is going to be related to this slide and the way I've structured is that I've come up with a case study and this case study is something that we will keep often referring to throughout the presentation and please feel free to raise questions if you have any doubts or you want to add something in. So this is what my case study looks like, right? It says the business requirement is very simple. I need to design an API as a developer that will return all the attributes that I have about a given user after successful authentication. Now, consider a system like Facebook again, where once you authenticate Facebook, you always have these websites that power login by Facebook, login by Google, et cetera. When you click on login with Facebook, it basically returns a very specific data set and it asks you for your approval before it is shared with the actual vendor or the actual website that you're using login with Facebook as. Now, the other requirement that I have is there could be N number of partners that could consume this API and each partner needs access to different attributes within that data set. So for example, if I store 100 attributes about a given user when they register on my website, partner one needs access to only five, partner two needs access to six and so on and so forth, right? So this is what the business requirement is and let's look at possible solutions of how you could design an API like that, right? So the first one is let's say that I create one API that sends all the user details upon successful authentication and every partner can choose whatever field they want. Now, what I mean here is that if I have 100 attributes about a given user and I would successfully login and in my head, because there is an NDA or a non-disclosure agreement signed with the vendor, I have no problem giving them all the 100 attributes, but the vendor will in turn end up using only those that are required by them. Now, when you're doing something like this, right? Those important one being that time to market. If you tell your business that I have an API that you can actually consume and give it to all the people that you work with or all the partners or suppliers or vendors you can quickly work with, my time to market is extremely less. I have less over it and quicker turnaround. So even if I have to make the slightest modification, I just make it in one place and it's applicable to everybody. Now, the biggest challenge in doing this is it's not data privacy friendly. Let me give you an example, right? So for example, you have one vendor that only needs five fields from the response of your API, but because you're giving them all 100, there is nothing that stops the vendor from iterating through your database and storing all those 100 attributes about those users. What they do with that is completely a different discussion, but this is a potential area of concern if you are somebody who's very privacy-minded organization. The other way to solve this problem is you could create multiple versions of the same API for each partner and send them only what they have signed up for. Now this is a very good approach, right? Because even if I have 100 attributes and let's say that one partner needs five, I only send them five. If the second partner needs six, I only send them six, which means that I have full control over what I can share with each of these vendors. Now the biggest problem with this approach is time to market, which means that if your business follows a lot of agile practices and they onboard new vendors on your platform very frequently, then this is going to be time consuming because with every new partner that they onboard, you have to create a new version of that API and then map the fields that are required. Of course, this also means it's a bigger overwrite and turn around times and something that your business may not necessarily appreciate. Now, considering the different technologies that are available in the market, the third approach could be that you create one APIs but you create multiple views on top of it for each partner. Now I'm not sure how many people are developers in the audience, but if you know technologies like GraphQL or if you know Facebook's Graph API, this is exactly what they do. They create one API and they create multiple views on top of it and then depending on what the partner ID is, you only send them the data that is required. Now, I'm not sure if you guys are well-bust with the whole Cambridge Analytica and the Facebook scandal where Facebook has this approach to all their APIs. They create, they have one version of the API and they build multiple views on top of it and then they allow Cambridge Analytica to pull a lot of information about Facebook users which they would potentially not really give access to other people. What are the pros in this process? It's very efficient process, it's very scalable and it's also very data privacy friendly. Come on, because you're giving only access to the data that is required. The only challenge in this is and that is something that you learn out of the Facebook and the Cambridge Analytica scandal is governance and oversight. What this means is that there is no way for you to not know what data is accessed by a given vendor. If you have the right checks and balances in place where you're reviewing the responses that are sent to individual partners on periodic basis. Right, so as a result, the cons are governance and oversight. But hey, governance and oversight are fairly easier problems to solve when you know that the underlying platform that you have built is full proof or you know for sure that it does the job that it was designed for, which is allowing you to create views and only exchanging that information that is required. So this is the first blind spot which we have often come across that you design APIs but these APIs are sending information back which is not intended for sharing or was not a part of your agreement with the vendor or whatever your agreement with the vendor or supplier was. Any questions on this one? Okay, all right, no questions. I mean, this is personally my favorite one. Let's talk about this, right? So there are a lot of functionalities in your applications which require you to deep link. Let me give you example. If you see here, you have a service online in which if you go back and click, I forgot my password. They email you the password link on your email with a token. And then when you click on that link, sorry, sorry guys. My bad, sorry, I just happened to click in the wrong place, right? Now, when you click on that link, sorry. When you click on that link, it takes you to the password reset page. Now, if you carefully see here, there is, sorry. There is a code which is nothing but a password reset token. If this token is valid, then it'll allow you to reset the password. So this is our typically password reset functionalities are designed. You send an email to your customer. Your customer will click on the link, you land on the page. If the token is valid, you will be able to allow the user to reset the password. Now, what happens actually at the back, right? And something this is often areas where developers don't realize the privacy implications. Now, the browser security model simply states that anything that you send in the query stream, A will always be visible and B will always be logged by a web server, right? So let's say, for example, you have two parameters that take a username and a password. And if you ever do a get with that request, whatever is the fragment of that URL will eventually get recorded as a part of your web server logs, which means that whoever has access to your web server logs could also potentially have access to the password reset codes. Now, if you look at two important problems with this approach, is that whenever, sorry. When the page loads, the entire link along with the code will be submitted to any trackers that are implemented on the page. Now, what does this mean? What this means actually is if your organization or if you're building a product that is having this requirement where you want to track user experience and you want to see how many users actually use the password reset functionality for whatever reasons, right? Or you built a tracker that is there on the page. Every time somebody visits, it collects certain information that is available in your DOM and submits it to the tracker. Now, this tracker that you have may not necessarily be designed by you. A most common example and most widely used marketing trackers on the internet are through Google Analytics or through DoubleClick or to Kretto. There are a lot of ton of these providers on the internet. These trackers also have the ability to inject JavaScript into your browser if that's what you've designed them for. And again, an area where you have to be very, very cautious about what they are capable of injecting back into your pages. Now, the other common area that I've seen often, you know, is an oversight is if on this page, when you click on the Save button, whatever is in your browser URL actually gets submitted as a referrer to the next page, right? Again, if I were to explain this in detail, you have a link to the left, which allows you to reset the password. When you click on it, you get to the page on the right. And when you click on the Save button, whatever is the page that you go next, this link automatically becomes the referrer. Now, from a privacy point of view, there are a number of things that could potentially go wrong here. Let's say that your password is said functionality was not implemented correctly, right? Which means that once the user clicks on the link, you don't expire the token or the code in this case. The other mistake could be that if your business is very keen and they are very keen in terms of making sure that the users have the best of experience, these codes, they live for longer than 24 hours, which means that I request for a password reset and I will continue to keep the link active for the next 24 hours, right? Even if the user has clicked on the link and that link is having a data that is then submitted to a tracker. And anybody who has access to their tracker will potentially have access to your code links as well, right? So as a developer or as an organization, anything that leaves your vicinity or your boundary of systems is out of your control. What happens to that data is something that is very difficult to govern. And as a result, it becomes very difficult to implement privacy-related design controls on such pages. Now, the blank is that the data that is sent in the query string will always be present in the web server locked or leaked by a reference and submitted to trackers implemented on the page if the request, of course, is visible in clear text. I am not sure of how many developers are well versed with systems like AppDynamics or Quantum Matrix or Full Story or IBM Daily, for example. Now, these are systems that allow you to implement some kind of tracking onto your web page that allows them to record the entire user session. They then convert this session into some sort of an HTTP request and then they post this information to the backend. Now, from a business point of view, they never want to lose an ounce of business just because the user had an unintended or unexpected experience on that page. Let me give you a very simple example. It's very common in an airline industry or for that case, even on any e-commerce platform that if a user puts something into the cart and if they go all the way to the payment page and for whatever reason they are not able to make a payment successful, your business would definitely want to know this. The reason they want to know this is because they don't want to lose their revenue on that user. Now, somebody on the business side when they identify these kind of events, they will try and tailor an experience in a way so that next time when the user goes back or logs in again to the application, they will continue the journey from where they stopped. This kind of systems are very, very useful and powerful but at the same time, they are a massive privacy nightmare. Now, I've taken this video. This app called as Full Story that has a similar pattern so this will just give you some sort of feedback or just give you a look and feel of what these kind of systems are. What you see to the left is a simple page in which a tool like Full Story is implemented and you will see that as the user enters information on the left how they get recorded as an HTTP session to the right. Now, you will see here to the left, there's a lot of information that's available and given or supplied by the user and to the right you will see that as and when this user actually modifies any information, this app at the back of this API implemented on your website is actually collecting all of this information in real time. I've also given a link in case if anyone wants to go back and have a look at it later on but these systems from our privacy point of view are a big nightmare if not implemented correctly and you can see here that it not only does passwords but it's also collecting your card numbers and bunch of other things as well and they are getting almost recorded in real time. Now, why are we discussing these systems is because of this. Now, I will allow you to read these links after the session but at a very high level, I can tell you what these issues have been and I have my team back at work we've tested a similar system and we've come across some very interesting observations. So I think both these incidents were very good examples of how unintended data can get captured by the actual vendor or the owner of the website. So in this case, let's say it's either Facebook or Flipkart or Amazon or whoever it is and then what do they do with this data at the back? Now, while all of these systems, they have one thing in common where they actively talk about a lot of privacy controls that are there in their application but at the end of the day, you can only trust them for what they say. And from my experience, what I've realized is that yes, it's good to trust and have these kind of implementation done but it's also very important to verify what the claim has been made here and verification could be as simple as you set up your app integrate this tracker and then you do an assessment or a review from both the sides while you're actively submitting the data from the app, you see what's happening on the other side and then you find ways and means of compromising that piece of information or trying to get unauthorized access to that information and that's how you will be able to tell yourself how foolproof this technology is or how foolproof that solution is. But I would highly encourage you guys to read these articles because they give some very interesting insight on how different organizations have implemented it. I think the first example, if I recall well, is related to Air Canada where they had a similar feature technology implemented in their app and then a privacy researcher identified gaping holes in the way it was implemented. This wired article talks about how organizations like Google and Apple are working very closely with their developers to ensure that if there are any such technologies implemented within the app, then they have to fully declare and they have to follow some accessibility rules and guidelines to be able to make sure the user is aware of what data is captured from their screens. Moving on, this is one area which is where developers are often blindsided for example, they come up with designs of get posts, request or any restful API for that case but whenever they try sending the data in the query string they don't know that it is potentially getting logged everywhere where the SSL is intercepted or offloaded. What that means is that you have perimeter technologies. For example, if you talk about F5 or Akamai or any other web application, Firewall service provider or vendor in the market, you need to offload your SSL onto those devices so that they can carefully examine the request for any potential anomalies and if everything seems good then they forward this request back to the actual origin server. In doing so, if you pass anything that is potentially sensitive then you will end up showing all of that information in the log for those kind of devices and I've listed some more technologies like for example, very big organizations which give access to their employees for internet implementing proxies, they often SSL intercept your traffic that way they know everything that is going in and out of the system so again, if you're passing anything that is sensitive in nature you only think twice because you know that it is going to eventually get logged. Getting logged is one part. The problem is that if any of these implementations have any sort of authentication or authorization issues then it becomes a big nightmare because now you can actually take that request, extract that request from your proxy and actually replay it on behalf of the user. Similarly, you have load 7, layer 7 or application load balances these days with all advent of cloud web application Firewalls. These are very interesting devices. If your organization and if your product that is consumed by different people on the internet is under any kind of attack and if you have an application Firewall then you will always be able to see what the attacker is actually doing. You will be able to go through the packets you will be able to know what the attack is and thereby you will be able to answer questions like when the attack started or what was the vulnerability that was being exploited what was accessed, what was exfiltrated or what was touched upon. These are the kind of questions that you will always be able to answer with the application Firewall like devices. Others are of course market capturing devices if your user or your customer base is compromised through phishing campaigns they are actually submitting their credentials to the people, the adversary here in this case but if you consider an example like the British Airways hack that happened a couple of months ago where somebody injected a malicious JavaScript on the page itself and it was only on the payment page and what that script essentially did was that it logged every single keystroke of the user.  These kind of attacks were also very popular by the name of the whole crew that was behind this were termed as mage cards and I think they compromised a number of e-commerce websites through vulnerabilities like cross-site and thereby injecting transcripts that allow you to harvest a lot of information as the user types this data onto these websites. Before I get to masking, tokenizing and anonymizing any questions so far? Any questions? Okay, all right. Let's have a quick deep dive into masking, tokenizing, anonymizing, encrypting. Now I think from a data privacy point of view I think these are very, very important terms and I can tell you this sort of experience. So let's say that your organization wants to host a hackathon and as a part of that hackathon they want to share some sort of data with the people who participate in the hackathon and the goal is for them to be able to come up with a creative app or a creative service or a creative feature on your product that can then be, you know, I would say then they will be able to, you know, either, what's the word? They can generate revenue out of these kind of features and analytics that they capture from the website and other similar situations could be that you have a data science team that is responsible for using different kind of machine learning algorithms to be able to give insights to your business teams to be able to make educated decisions of, you know, forecasted sales or forecasted inventory or, you know, if they potentially opt for a certain kind of service, what's the cost benefit that they would potentially get? Now these are some very, you know, various use cases. The mistake, the most common mistakes that I've seen in my experience is that they very easily interchange the definition of masking, tokenizing or anonymizing or encrypting the data. So for example, a lot, I often talk to a lot of developers and for them, encryption often seems to be, you know, the silver bullet that will solve all the problems but that's not potentially true. Encryption does not solve all the problems, right? And most importantly, encryption may not even be the requirement for that particular use case but you're just trying to over engineer something and as a result make it complicated. Similarly, I've often seen people exchanging definitions of masking and tokenizing. I will give you some examples as we move along in the slides, right? Now the most common errors that I've witnessed from data masking point of view is first is consistency. Now what consistency means is that let's say that you have a website and you also have a mobile app. In your mobile app, you decide not to mask a certain piece of data or let's say, let me take a step back. You have one API that is also consumed on the web as well as on the app side. You decide to mask certain sensitive information like for example, if the website allows you to store credit card information, the website only shows the last four digits of the credit card number. Whereas if you go back to your mobile app on your mobile app for whatever reason either you don't mask or you decide to mask the first four characters instead of the last four, right? And these inconsistencies can introduce a lot of problem. The reason I say that is because let's say for example, on Amazon you've seen, yes, I think I should be done in another five minutes. Okay, so let's say for example, Amazon allows you to see the last four digits of your credit card number and Apple back in the day used to use the same last four digits to verify a customer. So you can understand that something that is sensitive for Amazon is not necessarily sensitive for Apple. And as a result, this inconsistent masking then creates a lot of other privacy issues maybe outside of a product or even within your product. Patents, you want to use different character sets. So try to mask them on the client side. So when somebody does a right click and inspect element or a view source you can actually see what the real text is. Unmask data that is data in log transactions. For example, in PCI, it asks you to log certain kind of financial transactions for audit purposes. And if the data is available in clear text there's another issue from a privacy point of view. Now I have given some links which are very useful that we've used back into the place that I work where depending on whatever the technology stack is that will always have options for doing masking or implement custom field for my test or encrypt the columns that you consider them as sensitive. Tokenization, I would always question that whenever there is a business requirement that asks you to capture some sensitive information from an analytics point of view these are genuine requirements for you to capture the data your approach should be very simple that when you want to rebuild the data set you should always tokenize it and when you only care about the data structure you anonymize it. So for example, I spoke about the hackathon event and let's say in the hackathon event you don't need to tokenize it you don't need to encrypt that information because it's pointless but then you can anonymize it which means that you can replace a password number with a similar formatted string you could replace a pan card number with a similar formatted string or we've adopted these two simple rules where if you want to rebuild the database we tokenize it, if you don't care and if you care about the data structure of the attribute then you only simply anonymize it. Last but not the least data encryption we've spoken about this, this is basically data in transit data at rest so whatever you do essentially goes inside backups, data stores data warehouse, data lakes etc etc the most common mistakes that I've often seen developers do is they're actually trying to encrypt they're actually encoding some piece of data and calling it encryption they choose the incorrect cryptography type so instead of using asymmetric they end up using symmetric and whenever they're expected to use symmetric they end up using asymmetric and these do have privacy implications I've also seen with my experience that a lot of times because all of this knowledge is always known on the internet, developers will end up writing their own encryption routine which is something that I would never, never encourage any developer to do because encryption algorithms have complex mathematical properties that they meet in terms of trying to protect the integrity of the data and as a result they become a standard so if you ever come up with something that does not meet the same level of standard it's not worth spending your time on it the other bit from a privacy part of you that I've often seen as a challenge is you can't have 100% security and have 100% privacy and have absolutely no convenience so it's always a balanced call between what is right, what is wrong and which is where you can draw a ground or a middle line saying this is where you would want to stop and not normalizing it and other stay with the denormalized part so this is my last slide hopefully yes Avin I want you guys to look at a very high level process that we think works very well for us so for example to the left you are seeing an autonomous team which is basically having representations from different parts of your organization all of these people come together and they carry out an activity that we call as data cataloging or data classification which means you've identified the data that is important from a privacy point of view and then you've also classified the data and then eventually you feed all of this back into data governance framework and you will see that the lines are both ways, arrows are both ways which means that this is a bi-directional process and then you see continuous assurance at the top which essentially means that while all of this is always going to be a moving target continuous assurance is just like a feedback loop that you often are doing the right audits or you're trying to raise or identify different blind spots through the life of the data itself lessons learned this is really really my last slide catalog all your data it's very important you cannot protect anything that you don't know discover privacy related data in your existing systems this is a very very important activity and there are a lot of tools available on the internet something that I personally is necessary to be able to identify systems data don't store the data that you don't need once you've cataloged all your data and once you've created a framework define technical controls to protect sensitive data and the continuous assurance that you show here is basically summarized in this line which is build measure, learn, feedback and loop and from in a privacy world it's very very important that you trust but at the same time you also verify and the only way to verify is to have continuous assurance alright guys so that's pretty much it that I had to share with you guys today


This study used RAPD and SSR loci to investigate genetic relationships in a group of 22 raspberry accessions, finding high genetic variability and clearly delineating genetic relationships through cluster analysis. The highest genetic similarity was found between two polish cultivars, while jewel varied the most from all accessions. RAPD and SSR markers were confirmed useful for discriminating among closely related raspberries and determining genetic variability among cultivars, which may aid breeders in planning their breeding strategy. This article was authored by Magdalena Simla, a god attack, Adam Kula, and others.