How does the reminder work? Do you get a notification? And does it also work on the phone? Maybe you wanna answer that one? It's on. So for whatever resource that you wanna set a reminder on, it works slightly different depending on what app it is. If it's a mail, then it's moved to a snooze mail folder, I guess, and then it comes back into your inbox when it's the time to be reminded, I think. And for talk and files, you get a notification for when you need to be reminded. I am not entirely sure if it's available on the clients, actually, so maybe one of the engineers can. No, it is. It is? I mean, it's a push notification. It'll show up on your desktop. Oh yeah, exactly. It shows on your phone. Yeah, it's a notification, so it definitely shows up. Yeah, exactly. We have a question over there. Yeah. Just a second. Yeah, about transparency when using AI. It's a very important value for us, and I was asking if when you generate an email answer via AI, via the assistant, is it made transparent for the recipient? So is it visible like this answer is generated with help of AI or something? Why do you give me the microphone? Why do I give the hot questions to you? Yeah, that's a fascinating topic. So at the moment, it's just a normal text. We don't really mark that, but there is actually discussions in the industry how to mark automated AI generated images and texts. And if there's some kind of standard, we'll definitely support it, but I'm not really aware of anything. I mean, we could automatically add, at the end, this was generated by AI, but the user wouldn't have the opportunity to delete it, so it's not really guaranteed. But I really like the question. We should talk about that. Yeah. All right, more hard questions. So let me, Bert, there's switching mics here, but I have another one here as well. So the question I got here, why did we focus? Why did you focus on the healthy melting culture as a theme for this release? Why not? I mean, I don't know. I mean, I don't know the background of the person who asked the question, but I mean, for most of us here, I think it's pretty obvious. If you do this remote work thing that you do with NextCloud and you work many, many hours, then I think we all have these problems. And I think software, like good software should make us productive and less stressed, right? Doing more with less worry. And that's what we want on your chief. Yeah, absolutely. I mean, there are a ton of people struggling with mental health and software should help not make it worse with notifications all the time. And I think these things of setting your working hours and then do not disturb outside of the working hours is such a basic thing. And if you look, it's kind of the opposite direction of what Big Tech is doing because they're adding all kinds of spying features to the software so you know your boss can constantly look how many hours you were staring at the screen and stuff, which I think is just insane. And so we try actually to do the opposite and help your mental health rather than adding more pressure to the existing pressure. Thank you. Guys, before I put out my question to you guys, this is absolutely amazing what you did. It's mind blowing, my God, really. Fantastic. Thank you. Absolutely. Great. My question is about a feature in Deck which I've been missing for a long time and it's about revolving or repeating tasks. Is there any feature or how do you handle these things? Things you have to get your hand off yourself constantly every week or every day or every month or something like that and distribute it towards other members of the team? How do you handle that practically? So we can look into this feature request later but I want to point out that Deck is supposed to be like a simple and very lightweight tool, Kanban style to do your tasks. We're not going to build Deck into like a full-fledged project management tool for everything. And we have partners actually over there, Open Project. They have a solution which has a thousand times more features. They probably have this feature, I'm sure. And if you really want to do advanced project management, I would recommend using something like that. Deck is supposed to be like more lightweight and simple. Okay, while we are traveling with the microphone, I have one here as well. How do you manage to offer all these AI features on-premises? Sounds like a hard question to me. Big question, yeah. I mean, it's interesting. I think it's really interesting what's happening. I mean, if you just look back like a year from today, then most of us thought that these features are not even possible technically, right? It was not really there. There was this whole Chatchivity didn't exist, all this stuff didn't really exist. So just 12 months ago, we all thought that's not really possible. And then end of last year, when Chatchivity launched and all these other tools, it was like, oh, wow, this is really fascinating, but it's something only Big Tech can do because they have these gigantic server farms and there's no way an Open Source project of those communities can compete with that. And again, a few months later, actually then this whole like Open Source AI, locally AI, small models, powerful models popped up. And nowadays, there's a super active community of AI developers and freely available models, freely available training data. It's really becomes a phenomenon. And so this all becomes now possible. Obviously, we don't do this alone, right? We are standing on the shoulders of giants here. We built on top of existing models like the Falcon model or the Lama2 model and others, but it's now absolutely possible to do this local. I have to say, not everything works like super fast. There are some operations where you really have to wait for, but even that improves all the time. So if you compare what's possible today to like two, three months ago, it's already a lot faster and better. And yeah, it seems to be possible to do this stuff local and there's not a huge dependency on Big Tech here anymore. Woo-hoo. Well, my question is similar to the previous one. The self-hosted AI is actually really cool and I was excited to see that, but it had me wondering, does that change the recommended hardware specifications for self-hosting next cloud if we wanna, you know, that usable experience out of the AI? So I would say for the standard stuff, it's just as before actually, maybe even this going down with the performance improvements we did. So there's always the example with the Raspberry Pi. I mean, I personally would not really recommend to use a Raspberry Pi because it has no redundancy and other limitations, but you can run it on a Raspberry Pi. The AI stuff, of course, there's a big depends because we're using like different models for different things here. There are some things, for example, the object and face recognition, which is a relatively small model. I think this is something that is not so hard to self-host. Then there's also the translation stuff. This is also using a relatively small model which runs on cheap hardware, I would say. The full large language model, this is a bit more tricky. It runs on CPUs, so it doesn't require GPU. This was important, so it runs on normal servers, but it's possible that an answer, depending on the machine, then can take, I don't know, a minute or something. But yeah, if you add more resources, if you add another GPU, it gets faster and I'm also very confident that in the next release it will be even faster because the industry is moving on. But so the answer is depends, I guess. I don't know if what. I mean, I have something to add for that and I think as a designer, we also try to keep that in mind that it's a little bit slow, so while we're thinking about how this would work for all devices, we try to make sure that even if it's slow, you don't have to wait for a minute or two to get on with your workflow. So it was considered, I think we are limited by, and enabled and limited by what's out there in the community, but we try to factor that in when we're building something. So you can give it a try and hopefully it doesn't seem too obvious or that maybe it's not working as fast on a relatively not powerful device. All right, we go over to James. I'm just telling quick, there's a lot of questions. Please be patient, we come to all your questions. So, James. I just wanted to, quick question, but also just want to say I really appreciate the improvements in sharing in the user experience that's been a really long time pull request, so thank you so much for all the work on that. It's really great. On the repeating tasks, I know there's an open pull request right now on the tasks app for repeating tasks in development. You can look at it online, it's exciting. I was curious on these reminders and everything that people were asking about, are those exposed in the tasks app or in CalDAV or is that more just like in notifications? I think at the moment it's just of notification, but it seems like really interesting to sort of link that to all the different apps as well, but at the moment it is just notification and it works across all devices as well. All right, well, status is moving. I have a question here also, which is kind of a follow-up question with the previous I got, can I disable these AI features in NextLab Hub? What's the follow-up question there, right? Yeah, this is a question that comes up all the time and we should be more clear about that. So first of all, none of these features are enabled by default, right? So none of these AI features are there by default. They're all in separate apps and they all can be activated and deactivated as you want. They're disabled by default. But then if you decide to use something, there's still this configuration screen we show in the presentation where they can select what to use for what. So you're really, really in control and it's all opt-in basically. So nothing is happening without your approval. Status. Hello. I have a question, but first, it's wonderful what you've done. It's really amazing. I have more citizen-centric questions with trust and transparency and all the tools you have in AI. They are the broad question of compliance, like they are European ethical guidelines for AI use. I'm from a healthcare background, so there are many, many compliance steps. Do you envision, including in the Next Cloud Hub, out of the box some compliance or following guidelines regarding AI and other GDPR subjects or not? Yeah, so it's an interesting question. The thing is that, of course, by design, we try and make sure that everything can run on-premise and no data leaks, which, I mean, compliance is a really wide subject, right? And so I can't say Next Cloud solves all compliance problems because it really depends on your problem. But instead of handing over your data to another partner, keeping it under the control of your sysadmins, already removes half your compliance issues. And so that is also the approach we take with AI. So by not sending it to a third-party server but processing it on the server, that really takes away a lot of the problems. Of course, if, for example, there are requirements to ensure that the AI has no bias, et cetera, that's where, of course, also the ethical AI rating comes in because you will be able to see whether the AI that you're installing, even if it's local, actually has the training data also available so you can look for things like bias. So I think the transparency rating here is going to be important, that you check whether the AI can be optimized, the power use that you can check for bias, et cetera. But in the end, by keeping the data on the server and not sending it away, yeah, a lot of the compliance headaches, of course, go away. And we have a number of features in Next Cloud that is, for example, the privacy screen where you can see as a user where your data is physically and what are the people who have access to your data. And we have, of course, logging, the audit log, other features, so there's a whole bunch of compliance features as well, of course, all over Next Cloud to help with this. Right. Just a moment, guys. Yeah. Hello. I found Next Cloud Assistant very interesting, very impressive, but do we have any more details about the languages supported in Next Cloud Assistant and do we have any details about which models are used? I speak Arabic and it's very important to me that the Assistant supports Arabic as well as RTL languages. Thank you. Yeah, that's a great question, actually. The answer, again, is depends, because, again, we use different models for translation, even for the large language model, we have different options, so it depends. Maybe we should be a bit more clear there in the app description about what part is optimized for what language. I think that's a great point. If you personally want to know the details, you should talk to them after the presentation. Hello. Again, thanks. Love the new changes, especially around the AI. My question is also about that. So you talked about the red, orange, yellow, green ratings and how that is based on certain criteria, so I have two short questions about that. One is in the shows that we've seen of, for example, you're choosing whether you want open AI's whisper or your local whisper, stuff like that. I haven't seen that rating be there, so one thing is where, at what point of choosing or selecting a tool, will this rating be available to me? And then the other one, which is linked here, so you said yourself that a lot of companies will make the transparency kind of a moving target and they can flip it on you. Who is actually creating these ratings, validating that is rating green or yellow and will this be tested over time to see if anything changed? Yeah. So as I said earlier, the different apps, they're all opt-in in the apps page. You have the different apps and you can enable them and this is also where you can see the rating. They're like connected to the apps. Yeah, so basically the developer of the app, of the, I don't know, local translation app, for example, this is the person who then decides what rating this has. And obviously we review it according to our information. We don't have the opportunity to really look into the system. Sometimes, I don't know, it's chat GBT, it's completely transparent what's going on. But yeah, of course, we check if the rating is correct over time. But yeah, it is a screen that we didn't show in the presentation, but in the apps list, actually when you select the different things, you will see the rating and if you- The description, right? The description, yeah. If you select the chat GBT integration, you'll see that this is red and if you use the local, then you see the screen. Right, status. I have one question here. Let me allow me to squeeze one in here. Why, so I think this one is for you, Joss. Why did you develop that multi-language development option? What's wrong with PHP? I think that microservices are overrated, so. Yeah, everybody has their preferences, but I think that is pretty much the answer. Like there isn't, I don't know, people don't agree on this. I think there's nothing wrong with PHP. We're also not going to move away from PHP, but as Joss said, people have preferences and it's not even only the people. For example, the AI stuff, lots of it is written in Python, so it makes sense for us to support it fully. So it's just giving more options, but this is not going to throw away the PHP code. Talking about AI, did you give any thoughts to federated learning concepts? So you have AI running, let's say, on company one and AI running on company two, all in capsules, and so is there a possibility or did you think about or are there any concepts like federated learning which Google introduced, oh, I don't want to say Google, sorry, the G word. But so that you can take the learnings from different AI's and put them together somehow. It's tricky. But just the data, not the data, but just the learnings. It's tricky because if you were in one company and you're, I don't know, let's say, or BMW, right, and you're debating your strategy on how to beat, I don't know, Toyota, and then your AI is trained on the conversations. Right, yeah. So I think in, yeah, software healthcare, this could make sense indeed if you train a network that can detect, for example, on a scan, can detect cancer and then getting the data from all the hospitals to get better detection. That's very helpful, yeah. So I think this is very much up to the, yeah, that's kind of the AI models. It's kind of more an issue, I think, on the layer below us. I mean, perhaps we can look into facilitating that. Yeah, I think this is a great topic, but it's, I mean, we're providing the software fully open source with the machine learning models and all the infrastructure and you give it to you. And what you do with it is then your responsibility. If you decide to share patient data with another hospital because we have an agreement with them, I don't know. But I mean, this is, okay, then not. But I mean, this is then really the software can do whatever you want, but how you use it is your responsibility. Yeah, but we're not collecting any data. But if you want to do some research, sure. But I think this is more for the underlying models and the people working on them. I mean, of course, we try to tune the model, we select the models, but in the end, we are an interface to the models. And I think this is something that should be arranged on the level of the models. That makes sense. Okay, first, let me join the place. Really a lot of very interesting stuff we showed today. I'm also very interested in the new server app ecosystem with microservices because I think it will probably make a lot of frameworks that are written in individual languages more easily available to apps. And what I was wondering is, does this require the server to be able to manage a Docker daemon? Or does it make app deployment more complex because I can't see how it solves without one or the other? Thank you. Yeah, great question. One of the benefits of having the server apps written in PHP is that the whole deployment and updating everything is super easy. We have our app store, you go to apps page, you click on enable, it downloads it from server and packs, it puts it in the right folder and it works. That's great. But of course, if you want to have other technologies, if you want to have something, I don't know, written in Rust, that's of course more complicated, right? It's compiled first of all and maybe has dependencies and it's more complicated. There we decided to, first of all, you can configure all of that manually if you want, right? It's just you can put your go daemon anywhere. It just needs to know the endpoints in both directions and you need to have a secret in both directions that is authenticated and then it works. But this would be manual configuration. But the goal from us would be to make it like from a user perspective, as simple as with the PHP apps. And for that, we are trying to develop in a way that you have a similar list of apps. You click on, I want to have that and then it should work. It's more complicated for the packaging. Basically, we rely on Docker there. Seems to be the standard nowadays. Why not invent something else? And we try to do a little bit of magic that it can actually then on click then download the Docker image and run it and set it up properly. This is still in development, it doesn't exist yet. But this is the goal that for the normal admin, it's the same one click. Of course, this has limitations. So if you want to run this on a different machine, if you have a cluster set and other things, you probably have to configure some config files. But for the super simple setup on one machine, we're trying to get the same user experience with have a list of apps click and it's working. But this is like in development for the next release, or later. I love the integration with the diagrams. That's just amazing. But my question would be, I don't really want to learn how to write those diagrams. Does the AI already help that?  Yeah, feature request was noted from the back seats. But well, I mean, I wouldn't be terribly surprised if one of the AI models actually knows mermaid since X4 ready. It might work, actually. It might just work. It might be one of the two big language models we use might be trained on mermaid, I don't know. Yeah, we'd love to hear about it. Yeah, thanks. My question is also about hardware used for the AI features in the, as far as I know, for the all-in-one package right now, it's not possible to use GPUs because it's all based on open images. And for recognize, it's still running on CPU. Now with the new clustering features of this developed pipeline, maybe it's possible to have different containers executing the AI apps and these can access GPUs within this AIO image. So that's just one idea of how it might be possible to improve this. So that's all in heavy development. But the good news is the people who do this are actually here in the room. So maybe we can have a conversation later. All right, I think we're there, right? No more questions. Then we're going to close off the questions. Thank you, speakers. Thank you, everybody, for those wonderful questions. You can applaud for that, of course. So I'm in between food and this last final message I wanna send over. Again, the conference program can be found at our website, netcloud.com. If you go there, you can find the conference program. The official hashtag, I already mentioned that. Speak out, share the experience, use that hashtag over there, netcloud.com. Hashtag, netcloud.com. And the Wi-Fi password, of course, very vital here. Netcloud.com 2023 and the network, you'll find them as netcloud.com. All right, something else I also wanna mention here is the code of conduct. If there's anything that's bothering you or when there's something you wanna ventilate and say, go to Jan, Greta, Kate, and Anna. They're working around here. Those are the faces behind that and you can find them here on site. All right, there's also, I forgot to tell you also about the program, you can find them on those, on the tables over there, you see those little... QR codes. Sorry? The QR codes, just scan. Yeah, you can scan the QR codes so you can find information that way as well. All right. Something which is also important is, of course, pictures. We take pictures. If you do not want to have your photo taken, just go to the registration desk. They will put a dot on your badge, which kind of indicates to us that you don't wanna be photographed. So if you don't want to have that happen, please go to the registration desk and make sure you have such a dot. And the other way around, if you see somebody who has a dot and you're trying to take a picture, then please be so kind not to take pictures of people who don't want their pictures taken, especially when you share them online. That's... Nature sometimes can also do their calling right. So you need to do sometimes some stuff. We have some toilets downstairs. Those are unisex toilets. I can imagine you're looking for something a bit more private upstairs. There's on the first floor, we also have toilets and a bit more privacy perhaps as well. So if you are looking for toilets, we have plenty of options. All right. So it's very, very cool here. If you need something, you just can open a fridge, take your drinks, no need to ask. So you see a couple of fridges here with drinks in there. If you're thirsty or if you need something, just grab it, take it, no need to ask. So with that, I wish you all, well, good lunch, have a good lunch, nourish yourself and come back here because we have a very great talk coming up here from Mark Shrems at 1 p.m. So please be on time here and I will make sure, you see this little notification, I will make a lot of noise to make sure that you're back here at 1 p.m. and that we can kick it off with Mark Shrems. Thank you everybody, enjoy lunch. Computers revolutionized office productivity. Computers revolutionized office productivity. Networks made it easy to share files with each other, optimizing the flow of documents. Real productivity of teams. Bringing context to content and real-time collaboration to working together. Get work done. Computers revolutionized office productivity. Networks made it easy to share files with each other, optimizing the flow of documents. Today, NextCloud unlocks the real productivity of teams. Bringing context to content and real-time collaboration to working together. Get work done. NextCloud. Computers revolutionized office productivity. Networks made it easy to share files with each other, optimizing the flow of documents. Today, NextCloud unlocks the real productivity of teams. Bringing context to content and real-time collaboration to working together. Get work done. NextCloud. Computers revolutionized office productivity. Networks made it easy to share files with each other. Optimizing the flow of documents. Today, NextCloud unlocks the real productivity of teams. Bringing context to content and real-time collaboration to working together. Get work done. NextCloud. Computers revolutionized office productivity. Networks made it easy to share files with each other, optimizing the flow of documents. Today, NextCloud unlocks the real productivity of teams. Bringing context to content and real-time collaboration to working together. Get work done. NextCloud. Computers revolutionized office productivity. Networks with NextCloud talk. You can chat, do video calls, and collaborate around your documents. Communication is the key. Just saying. Here, by the way. You have chat rooms about topics, one-on-one chats where you can even invite external participants. And on top of that, you can group files and rooms and other resources into projects. Of course, those documents you shared can be edited together in real time. NextCloud even comes with a built-in whiteboard you can use during your calls or on your own. You can easily integrate external applications and scripts into your chat workflows. Chat messages can also be turned into tasks in-deck and from the calendar. You can easily create a talk room for a meeting. Calls can be scheduled for a specific time. This is, for example, useful for web meetings or webinars. You will never miss a call again, except when you want to miss them. With NextCloud talk, you can do video calls and screen sharing with... Computers revolutionized office productivity. Networks made it easy to share files with each other, optimizing the flow of documents. Today, NextCloud unlocks the real productivity of teams, bringing context to content, and real-time collaboration to working together. Get work done. NextCloud, meetings feel like a waste of time, especially when one colleague is talking almost constantly. Do you get stressed from all the calls and chat messages coming in? Do work and private life blur into each other? These days, we are often working hybrid or remote, so a healthy meeting culture is more important than ever. NextCloud can help with this. NextCloud talk makes it easier to be mindful of the attention of other people. You can, for example, send a chat message that won't cause everybody to get notified. You can even start a call without ringing everyone's phone. If you then have to pull in others, you could ring them specifically. During the meeting, talk shows you how long everybody has been talking. Now you can ensure everybody has a chance to share their opinion. If there are to-do items, you can put them in the chat with to-do or task in front. The talkbot will record them. At the one hour mark, pick one of the proposed times or set your own. We thought this feature was so useful. We also made it possible to set a reminder on a file and snooze emails. That way, you can stay focused on the task at hand. Say goodbye to endless meetings and hello to efficient collaboration. Create a more productive, respectful, and healthy meeting culture with Next Cloud Talk. Visit our website and follow us on social media to stay updated on the latest features and improvements. With Next Cloud Talk, you can chat and video calls and collaborate around your documents. Even is the key. Files and rooms and other resources and attachments you share can be edited together and used with a built-in whiteboard you can use during your calls or on your own. You can easily integrate external applications and scripts into your chat workflows. Chat messages can also be turned into tasks in-deck and from the calendar. You can easily create a talk room for a meeting. Calls can be scheduled for a specific time. This is, for example, useful for web meetings or webinars. You will never miss a call again, except when you want to miss them. With Next Cloud Talk, you can do video calls and screen sharing with several people at once. Raise your hand to get attention. Or on the keyboard to do so. Sometimes you just want to leave a quick voice message. And that's easy, too. If the others are on a different chat service, like Slack, Teams or IRC, no worries. Next Cloud Talk can connect to those and chat in real time. You can also chat and do video calling with the native mobile apps. You will get push notifications anytime you get a call or a chat message. This one here. On the road, you can share a location so people know when you'll be there. And to help your friends connect, you can share contact details. A project manager whose curiosity in AI-driven collaboration has led her to explore various articles on the subject. She reads that the use of AI can be risky, especially when handling sensitive company and customer data. But with Next Cloud Hub, those hindrances are no longer a concern for her. She knows that all data is strictly handled on the Next Cloud server and is not leaking or being used by another company to train their AI platforms. Let's see how these features play out in Christine's daily work. Yesterday, Christine received an email from Margo, which included a detailed document outlining observations and metrics of quality issues within the company. In that same email, Margo asks Christine to create an outline for a project aimed at addressing these challenges and to discuss this project approach in a call the next day. Her team also received that mail from Margo and members sent in suggestions. Really great to see that many ideas, but the mail thread is far too lengthy to read. Christine definitely wants to use the suggestions from her team. She asks the assistant to compile and summarize these insights from her team. Then she goes back to the document from her manager. Christine wants to tap into the collective brainpower of her team and the AI, and with the summarized insights in hand, Christine directs the assistant to create a project outline. The on-premises AI capabilities of Next Cloud Hub enable her to craft an efficient plan for Margo. The assistant completes the project outline and Christine shares it in a Next Cloud talk room with her manager. Christine asks Margo if she can record it so she can have the transcript of the conversation to share with her team and engaging meeting ensues. After the conversation, the call summary bot summarizes the meeting and shares tasks from the conversation. Christine incorporates this task list and the transcript of the conversation into the project outline for her and her team. After the meeting, Christine notices that a couple of tasks need to be delegated to Zarina from the German team. She uses the whole task list and uses Next Cloud Translate to get a German version. Now this can easily be put in a task for our German team, directly from text. Next Cloud Hub's built-in AI capabilities helped Christine to tackle this challenge within her organization much more quickly and efficiently as otherwise would have been possible. And she did not have to worry about any of this data leading to a third talk. Next Cloud Hub is a project plan nor the content of the call transcript that was created by AI. Christine feels in control and she stays informed without feeling overwhelmed. Next Cloud Hub helps Christine to digest key information for this meeting and other tasks and projects. Explore how Next Cloud Hub can help you redefine your organization's collaboration, offering trustworthy AI for smart productivity and robust security. You can chat, do video calls and collaborate around your documents. Communication is the key. Just saying. This here by the way. You have chat rooms about topics, one-on-one chats where you can even invite external participants and on top of that you can group files and rooms and other resources into projects. Of course those documents you shared can be edited together in real time. Next Cloud even comes with a built-in whiteboard you can use during your calls or on your own. You can easily integrate external applications and scripts into your chat workflows. Chat messages can also be turned into tasks in deck and from the calendar. You can easily create a talk room for a meeting. Calls can be scheduled for a specific time. This is for example useful for web meetings or webinars. You will never miss a call again except when you want to miss them. With Next Cloud Talk you can do video calls and screen sharing with several people at once. Raise your hand to get attention or on the keyboard to do so. Sometimes you just want to leave a quick voice message. And that's easy too. If the others are on a different chat service like Slack, Teams or IRC no worries. Next Cloud Talk can connect to those and chat in real time. You can also chat and do video calling with Google Apps. You will get push notifications anytime you get a call or a chat message like this one here. On the road you can share a location so people know when you'll be there and to help your friends connect you can share contact details. We believe privacy is a fundamental human right and everybody should have access to secure communication free from surveillance. We are building decentralized products as an alternative to centralized platforms. People can choose what they want and where they want it. We believe in open source and open standards. Open source is the only way for users to trust their devices.  We believe accessibility is a fundamental human right and technology should be accessible to everyone. The time of our users is very important to us. We do our best to make NextCloud easy to use. We foster diversity from innovation to transparency and collaboration. Working with our communities and supporting marginalized people leads to a better result. Working together Get work done NextCloud Especially when one colleague is talking almost constantly. Do you get stressed from all the calls and chat messages coming in? Do work and private life blur into each other? These days we are often working hybrid or remote so a healthy meeting culture is more important than ever. NextCloud can help with this. NextCloud Talk makes it easier to be mindful of the attention of other people. You can, for example, send a chat message that won't cause everybody to get notified. You can even start a call without ringing everyone's phone. If you then have to pull in others you could ring them specifically. During the meeting Talk shows you how long everybody has been talking. Now you can ensure everybody has a chance to share their opinion. If there are to-do items you can put them in the chat with to-do or task in front. The talk bot will record them. At the one hour mark Talk gives you a small notification. Perhaps time to end the call? After the call you'll get a short call report including the tasks you identified. That helps you keep track of the meetings. Less notifications is nice, of course. You can disable notifications on a chat room but outside of work hours you might prefer not to get any notifications at all. That is easy. Configure your work hours and enable the automatic Do Not Disturb feature. Sometimes you do want to get notified, just not right now. You can set a reminder on a chat message so you can deal with it later. Just pick one of the proposed times or set your own. We thought this feature was so useful. We also made it possible to set a reminder on a file and snooze emails. That way you can stay focused on the task at hand. Say goodbye to endless meetings and hello to efficient collaboration. Create a more productive, respectful and healthy meeting culture with Next Cloud Talk. Visit our website and follow us on social media to stay updated on the latest features and improvements. Meet Christine, a project manager whose curiosity in AI driven collaboration has led her to explore various articles on the subject. She reads that the use of AI can be risky, especially when handling sensitive company and customer data. But with Next Cloud Hub, those hindrances are no longer a concern for her. She knows that all data is strictly handled on the Next Cloud server and is not leaking or being used by another company to train their AI platforms. Let's see how these features play out in Christine's daily work. Yesterday, Christine received an email from Margo, which included a detailed document outlining observations and metrics of quality issues within the company. In that same email, Margo asks Christine to create an outline for a project aimed at addressing these challenges and to discuss this project approach in a call the next day. Her team also received that mail from Margo and members sent in suggestions. Really great to see that many ideas, but the mail thread is far too lengthy to read. Christine definitely wants to use the suggestions from her team. She asks the assistant to compile and summarize these insights from her team. Then she goes back to the document from her manager. Christine wants to tap into the collective brainpower of her team and the AI and with the summarized insights in hand, Christine directs the assistant to create a project outline. The on-premises AI capabilities of Next Cloud Hub enable her to craft an efficient plan for Margo. The assistant completes the project outline and Christine shares it in a Next Cloud talk room with her manager. Christine asks Margo if she can record it so she can have the transcript of the conversation to share with her team and engaging meeting ensues. After the conversation, the call summary bot summarizes the meeting and shares tasks from the conversation. Christine incorporates this task list and the transcript of the conversation into the project outline for her and her team. After the meeting, Christine notices that a couple of tasks need to be delegated to Zarina from the German team. She selects the whole task list and uses Next Cloud Translate to get a German version. Now this can easily be put in a task for our German team directly from text. Next Cloud Hub's built-in AI capabilities helped Christine to tackle this challenge within her organization much more quickly and efficiently as otherwise would have been possible. And she did not have to worry about any of this data leaking to a third party, neither the translation nor the new project plan nor the content of the call transcript that was created by AI. Christine feels in control and she stays informed without feeling overwhelmed. Next Cloud Hub helps Christine to digest the information for this meeting and other tasks and projects. Explore how Next Cloud Hub can help you redefine your organization's collaboration, offering trustworthy AI for smart productivity and robust security. With Next Cloud Talk you can chat, do video calls and collaborate around your documents. Communication is the key. Just saying. It's hair, by the way. chat rooms about topics, one-on-one chats where you can even invite external participants. And on top of that you can group files and rooms and other resources into projects. Of course those documents you shared can be edited together in real time. Next Cloud even comes with a built-in whiteboard you can use during your calls or on your own. You can easily integrate external applications and scripts into your chat workflows. Chat messages can also be turned into tasks from the deck and from the calendar. You can easily create a talk room for a meeting. Calls can be scheduled for a specific time. This is, for example, useful for web meetings or webinars. You will never miss a call again except when you want to miss them. With Next Cloud Talk you can do video calls and screen-sharing with several people at once. Raise your hand to get attention or on the keyboard to do so. Sometimes you just want to leave a quick voice message. And that's easy too. If the others are on a different chat service like Slack, Teams or IRC no worries. Next Cloud Talk can connect to those and chat in real time. You can also chat and do video calling with the native mobile apps. You will get push notifications anytime you get a call or a chat message like this one here. On the road you can share a location so people know when you'll be there and to help your friends connect you can share contact details. We believe privacy is a fundamental human right and everybody should have access to secure communication free from surveillance. We are building decentralized products as an alternative to centralized platforms. People can choose what they want and where they want it. We believe in open sourcing open startups. Open source is the only way for users to trust their devices.  We believe accessibility is a fundamental human right and technology should be accessible to everyone. The time of our users is very important to us. That's why we do our best to make Next Cloud easy to use. We foster diversity from innovation to transparency and collaboration. Working with our communities to recognize people leads to a better result. First revolutionized office productivity. Networks made it easy to share files with each other optimizing the flow of documents. Today Next Cloud unlocks the real productivity of teams bringing context to content and real-time collaboration to working together. Get work done. Next Cloud. Feel like a waste of time especially when one colleague is talking almost constantly. Do you get stressed from all the calls and chat messages coming in? Do work and private life blur into each other? These days we are often working hybrid or remote, so a healthy meeting culture is more important than ever. Next Cloud can help with this. Next Cloud Talk makes it easier to be mindful of the attention of other people. You can, for example, send a chat message that won't cause everybody to get notified. You can even start a call without ringing everyone's phone. If you then have to pull in others you could ring them specifically. During the meeting talk shows you how long everybody has been talking. Now you can ensure everybody has a chance to share their opinion. If there are to-do items you can put them in the chat with to-do or task in front. The talk bot will record them.  After the call you'll get a short call report including the tasks you identified. That helps you keep track of the meetings. Less notifications is nice of course. You can disable notifications on a chat room but outside of work hours you might prefer not to get any notifications at all. That is easy. Configure your work hours and enable the automatic Do Not Disturb feature. Next you do want to get notified just not right now. You can set a reminder on a chat message so you can deal with it later. Just pick one of the proposed times or set your own. We thought this feature was so useful we also made it possible to set a reminder on a file and snooze emails. That way you can stay focused on the task at hand. Say goodbye to endless meetings and hello to efficient collaboration. Create a more productive respectful and healthy meeting culture with Next Cloud Talk. Visit our website and follow us on social media to stay updated on the latest features and improvements. Meet Christine, a project manager whose curiosity in AI driven collaboration has led her to explore various articles on the subject. She reads that the use of AI can be risky, especially when handling sensitive company and customer data. But with Next Cloud Hub those hindrances are no longer a concern for her. She knows that all data is strictly handled on the Next Cloud server and is not leaking or being used by another company to train their AI platforms. Let's see how these features play out in Christine's daily work. Yesterday Christine received an email from Margo which included a detailed document outlining observations and metrics of quality issues within the company. That same email Margo asks Christine to create an outline for a project aimed at addressing these challenges and to discuss this project approach in a call the next day. Her team also received that mail from Margo and members sent in suggestions. Really great to see that many ideas but the mail thread is far too lengthy to read. Christine definitely wants to use the suggestions from her team. She asks the assistant to compile these insights from her team. Then she goes back to the document from her manager. Christine wants to tap into the collective brain power of her team and the AI and with the summarized insights in hand Christine directs the assistant to create a project outline. The on-premises AI capabilities of Next Cloud Hub enable her to craft an efficient plan for Margo. The assistant completes the project outline and Christine shares it in a Next Cloud task room with her manager. Christine asks Margo if she can record it so she can have the transcript of the conversation to share with her team and engaging meeting ensues. After the conversation, the call summary bot summarizes the meeting and shares tasks from the conversation. Christine incorporates this task list and the transcript of the conversation into the project outline for her and her team. After the meeting, Christine notices that a couple of tasks need to be delegated to Zarina from the German team. She selects the whole task list and uses Next Cloud translate to get a German version. Now this can easily be put in a task for our German team directly from text. Next Cloud Hub's built-in AI capabilities helped Christine to tackle this challenge within her organization much more quickly and efficiently as otherwise would have been possible. And she did not have to worry about any of this data leaking to a third party, neither the translation nor the new project plan nor the content of the call transcript that was created by AI. Christine feels in control and she stays informed without feeling overwhelmed. Next Cloud Hub helps Christine to digest key information for this meeting and other tasks and projects. Explore how Next Cloud Hub can help you redefine your organization's collaboration, offering trustworthy AI for smart productivity and robust security. With Next Cloud Talk you can chat, do video calls and collaborate around your documents. Communication is the key. Just saying. This hair, by the way. You have chat rooms about topics, one-on-one chats where you can even invite external participants. And on top of that you can group files in rooms and other resources into projects. Of course those documents you share can be edited together in real time. Next Cloud even comes with a built-in whiteboard you can use during your calls or on your own. You can easily integrate external applications and scripts into your chat workflows. Chat messages can also be turned into tasks in-deck and from the calendar. You can easily create a talk room for a meeting. Calls can be scheduled for a specific time. This is, for example, useful for web meetings or webinars. You will never miss a call again except when you want to miss them. With Next Cloud Talk you can do video calls and screen sharing with several people at once. Raise your hand to get attention or on the keyboard to do so. Sometimes you just want to leave a quick voice message and that's easy too. If the others are on a different chat service like Slack, Teams or IRC no worries. Next Cloud Talk can connect to those and chat in real time. You can also chat and do video calling with the native mobile apps. You will get push notifications anytime you get a call or a chat message like this one here. On the road you can share a location so people know when you'll be there and to help your friends connect you can share contact details. We believe privacy is a fundamental human right and everybody should have access to secure communication free from surveillance. We are building decentralized products as an alternative to centralized platforms. People can choose what they want and where they want it. We believe in open source and open startups. Open source is the only way for users to trust their devices.  We believe accessibility is a fundamental human right and technology should be accessible to everyone. The time of our users is very important to us that's why we do our best to make Next Cloud easy to use. We foster diversity from innovation to transparency and collaboration. Working with our communities and supporting marginalized people leads to a better result. First revolutionized office productivity. Networks made it easy to share files with each other optimizing the flow of documents. Today Next Cloud unlocks the real productivity of teams bringing context to content and real time collaboration to working together. Get work done. Next Cloud. Feel like a waste of time especially when one colleague is talking almost constantly. Do you get stressed from all the calls and chat messages coming in? Do work and private life blur into each other? These days we are often working hybrid or remote so a healthy meeting culture is more important than ever. Next Cloud can help with this. Next Cloud talk makes it easier to be mindful of the attention of other people. You can, for example, send a chat message that won't cause everybody to get notified. You can even start a call without ringing everyone's phone. If you then have to pull in others you could ring them specifically. During the meeting talk shows you how long everybody has been talking. Now you can ensure everybody has a chance to share their opinion. If there are to do items you can put them in the chat with to do or task in front. The talk bot will record them.  Perhaps time to end the call? After the call you'll get a short call report including the tasks you identified. That helps you keep track of the meetings. Less notifications is nice, of course. You can disable notifications on a chat room but outside of work hours you might prefer not to get any notifications at all. That is easy. Configure your work hours and enable the automatic Do Not Disturb feature. Sometimes you do want to get notified, just not right now. You can set a reminder on a chat message so you can deal with it later. Just pick one of the proposed times and set your own. We thought this feature was so useful. We also made it possible to set a reminder on a file and snooze emails. That way you can stay focused on the task at hand. Say goodbye to endless meetings and hello to efficient collaboration. Well hello everyone. I hope you enjoyed your lunch. If you want to make your way towards the stage, we'll be having a little bit of a chat. It looks like three and a half minutes. If you can make your way here, that would be really appreciated. Thank you. Hello. Hi everybody. I hope you enjoyed your lunch break. I want to ask if everybody was interested in the next talk to come a bit closer to the stage. Originally someone else wanted to do this introduction of our next awesome keynote speaker is Max Schrems, really personal hero of mine for many many years and also should be your hero by the way because he is really defending our privacy rights here in Europe in a big way. Had the guts to sue like Facebook two times and won two times against it. So this is obviously quite cool and quite an achievement. It also, I have to say, is always for me always a bit weird because we have some privacy laws, we have the GDPR, we have other regulations but somehow like a single person like a law student is needed somehow to enforce our rights here because no one else, no other organization did it at the time. So I'm really happy that Max did that and obviously because we go into the third round now keeps on fighting for that to protect our data also as part of his organization none of your business which I think is super cool and deserves some support from all of us. So I'm personally really really happy to have Max here so say a big welcome to Max now. There you come in. Thanks a lot for the introduction and on the supporting part of all of this you guys already support us because we're running on Next Cloud ourselves so that's not the reason I'm usually not like promoting but thanks. Yeah, exactly. Can you turn me a little bit down if possible? It's a bit much at least from my perspective I hope it's not. I was asked to talk about the EU data transfers a very lengthy story I'm just going to start up with a recap of what happened what's the background story why we ended up with this whole endless discussion and in the end go into this new data transfer deal that was published this summer we just realized actually the keynote here was announced like the after the passing I think of the new law we just realized yesterday it wasn't technically passed yet because the EU has put it on its website but not in the official journal of the EU and that's not how law is passed so it seems actually this thing doesn't even exist yet so I was writing with someone on the commission on yesterday and they said yeah actually we still have to publish it officially so seems companies transferring stuff under a law that is not officially passed yet that's kind of the state of play and back to the intro of yes we have the GDPR yes we have all these wonderful laws but we have a huge enforcement gap so a lot of that is just on paper and in reality if you don't follow it not much happens so basically going into the data transfer discussion first I would like to explain in a very very simplified version how US surveillance law works because we oftentimes talk over there is some law there is something going on but to probably dive a little bit deeper into that and how that actually works this is actually a slide from Berlin where the disclosure has happened and when we had all these demonstrations that's almost 10 years ago more than 10 years ago and the big discussion was what are we going to do there was outrage Merkel wasn't happy that her phone was tapped and all that kind of drama but actually there was much that would have happened so we started with discussions on how we can litigate that and actually a journalist called me one night and asked me is that actually legal from a privacy perspective like for these companies to actually just give all that data to the American services and I was like usually journalists you have the same questions all over again and you answer them again this time I was like that's a really interesting question because I haven't really thought about that and if you look at it you have basically two surveillance systems which is capturing the data on the backbone of the internet that becomes less and less relevant because more and more of that data is encrypted so they can see where the data comes from where it goes to to a certain level but below the encryption level not that much anymore the second thing that they came up with was back then called prism now it's called downstream these two things are the same they just changed the name over the time and the idea here is let's get the data from the service providers because they have the keys they have access to the data so there is some way that they can get it and we just required them to give us all the information which is obviously the easiest and most convenient way for a secret service I usually joke is like it used to be that they have to tap each phone now they just have to tap basically Apple and Google and thereby have almost every phone which is much more convenient for a secret service than doing it themselves as you can see from the slides they were already pretty dated when they were published by Snowden and that's more than 10 years ago so we do know some stuff that went down 10 years ago but we all know how much technology has changed since then so it's not unlikely that much more is happening that there is new security services new operations that happen that we're simply not aware of so often times we talk about these two programs but we have to think that there is a law in the background that allows these programs that could be totally different programs by now there is no official recognition there is no official reason to say there is definitely something new or maybe they've just developed further but just to kind of think about that for a second that this is the status of probably 15 years ago and there may be much more right now in these slides it was rather interesting because you also have the different levels that of systems that talk to each other where I don't know they say some voice component goes over into this system and so on it's not very detailed but basically there's an FBI direct interception unit that does kind of the technical connection as far as we know and then the different services can provide the different services can get the data through them so basically that is kind of the NSA bubble of what they do what's really interesting is we also had the logos of the different companies on it and there is a slide that also says when which company was actually hooked up to the system on which date so we had a very good understanding of how this works and that's crucial for surveillance litigation because usually surveillance litigation is a big S conspiracy theory you just don't know in detail what they do it's all secret as a lawyer you look like a fool if you're in front of the judge and say oh they may do and uh and in this case we actually had a bit of an understanding what they really do if you look at the American law all of that happens on the Pfizer 702 that has a second kind of number in US law which is 50 US code 1881 A so you sometimes see 1881 A or Pfizer 702 in reporting it's basically the same law that law is 14 pages long and even though people say I'm not the worst lawyer the world has ever seen it takes you days to understand how these articles interrelate to each other it's the most fucked up law the world has ever seen but once you go through it you realize that there is a lot of like just back and forth blinking that doesn't make any sense if you look at the at the gist of the law what it really says you have two elements that you need you need an electronic communication service provider which is a cloud provider basically telco provider anything like that what's important is this law does not apply to any US business only to these electronic communication service providers so if you send data let's say to Lufthansa US subsidiary something like that they would probably not be an electronic communication service provider and wouldn't fall on the law so it's not like any data that goes to the US is the end of the world it's specifically kind of the big cloud providers where they actually really fall on this loss the second thing you need is foreign intelligence information and that is defined as information that relates to the conduct of the foreign affairs of the United States there's additional that's kind of the broadest definition there's a couple of things that fall under that definition long story short this is an extremely broad definition that basically means anything we're interested in globally that's the kind of plain language and that's the two things you need this electronic communication service provider informed foreign intelligence information informed foreign intelligence information you do not need a crime you do not need probable cause you do not need an individual person you go after you don't need any of these elements we typically have in criminal law or in phone tapping laws in these laws that we have the interesting thing is this would actually be illegal in the US as well under the fourth amendment the fourth amendment also says very similar to Europe that you need probable cause to phone tap and you need a judge saying yes you don't need to justify terms but for the purposes of here that's kind of what you want the problem with the fourth amendment is the fourth amendment only applies to American citizens or US persons so also permanent residents and that is historically normal like we had that in the US as well that we had citizens rights mainly because 200 years ago people didn't move much so you were usually the citizen of the country that you were in so you had citizens rights now ever since the second world war the latest we usually have human rights now it's very easy to just say you're not a citizen you don't have any rights so we moved into human rights the US is still under the old constitutional fabric that they have in the idea of citizens rights now what this law does is basically these elements here the minimization and targeting procedures separate the data stream into American data and non-American data that's fundamentally what this law does it's kind of a switch that says okay this bit is related to an American person can't touch it because this would be unconstitutional very bad this bit is not related to an American person you can go and do whatever you want to do and that is structurally what this law does they call that minimization and targeting procedures and that's kind of these filter procedures now the US says that that's all approved by the Pfizer court and that sounds like odors judicial review some court is actually looking at that what the court is looking at is the entire surveillance system for one year so it certifies basically the filtering it doesn't certify the individual data bit that goes through it and if there is actually problem cause or reason to look at it so it's basically the system that gets approved by the court not as usual that you say okay there's really that guy that really has some reason that's connected to I don't know IS or whatever and that is kind of the interesting thing that there is court approval but not individualized court approval and that usually makes it rather useless for most of the purposes who is actually making the individual targeting procedure is an NSA officer they have a targeting sheet which is basically a form where they can put in an identifier identifier is typically an IP address email address any kind of like user ID for social network stuff like that and they can type it in they need to kind of put one box where they say why they do that click the button and that targets the person and the data and then there is a big provider so we talk about a couple of hundred thousand accounts per half a year that are targeted and one account may include the data of hundreds of people because if it's the email address of one person you have all the emails that go to that person from other people as well so the numbers are actually quite vast if you think about it then there is a so called directive to the service provider which is the legal order saying you have to kind of give us access to the data then we don't know the details it could be something like an API where they can basically call the data and get it back they say oh we don't see how it's technically actually implemented the law only says you have to do the technical implementation to be able to capture the data but in litigation we ask people that had the security clearances if they are sending letters back and forth between the Silicon Valley and the NSA headquarters and that's for voice over IP not overly likely that that's how it's done so we do assume that there is some kind of API for litigation so litigation wise basically the system was like that if I'm that little Austrian smiley down here I had a contract with Facebook Ireland back then we started all of this for the younger people in the audience like 12, 13 years ago Facebook was cool back then people actually used it but you have exactly the same thing with Instagram now and the likes so you have a contract with actually Facebook Ireland which is an Irish company and this Irish company then sends the data abroad to the US and they have a contract with each other and have to make sure that the data is properly kind of protected in the US otherwise they're not allowed to send the data outside of the EU now they can't really do that because if your data de facto goes on the US server it's going to be surveilled under 12 triple 3 which is in executive order not a lot that I'm not going to go into through upstream and then under FISA and have it somehow end up at the NSA so it's very hard for them to kind of write into a contract that this does not happen because that's simply US law now if you think about why they're so interested in especially Prism or their downstream as they call it that is basically one of the slides where they say that's where there is no SSL encryption anymore we can get the data right there because they have the encryption keys and that is also interesting because a lot of the American companies said oh we're just going to have encryption and they have endless lists of how their data is now secured if you look at it they always just basically talk about the transport part of it and not when it's actually there even Google said yeah there is I'm not the tech person but the A something encryption on their services was like great that's the same thing that my Android phone has but if you have the code and so they try to kind of oftentimes come up with time oh there is encryption and most of the lawyers just hear encryption are like cool encryption but don't talk when where does it actually protect anybody now if you look at the other side at the EU side of the story we basically and most people ignored that ever since 1995 when the first directive came around we had an export prohibition on data so basically the EU says you cannot export data out of the European economic area period as a default rule why is that if you have privacy rules and you just send the data to the next country that doesn't have privacy rules then your whole system doesn't make any sense because you can just move your data out of the protected area or out of the jurisdiction now there isn't a derogation for what I would call necessary transfers so if you have to book a hotel in North Korea you are absolutely fine in booking hotels in North Korea because it's really necessary to send your booking to Pyongyang if you really want to stay there obviously North Korea is probably the country that has the least protections of anything that we could think of but that's fine the GDPR accepts if you really want to go there you have to book your hotel that's fine what's the bigger issue is the outsourcing part so if you don't really need to send data abroad but it's more convenient, cheaper the business is there, whatever happens and for that there are different options to kind of extend GDPR rules to another country how that works is if you think about Switzerland it has a data protection act and we kind of accept that that data protection act is very similar to the European Union and that becomes like a big privacy bubble and we say oh you can just send the data there to the EU law Swiss people may disagree but that's kind of the fundamental idea now if you have a country like the US where there's no data protection act that can also work you can contractually kind of get there it's a bit like if you say I buy organic bananas from some country and they just follow the rules of what organic is in the EU we kind of say okay you're not from an EU country but what you do is still kind of compliant with our rules so we accept it and you can put the bananas in the supermarket that's kind of what we do with so-called standard contractual clauses so that's a contract privacy shield by any corporate rules and so on what this basically does is that an American company signs a contract saying I follow EU law and therefore they're kind of our data is protected contractually that can work sounds like a bit technical but it's from a legal perspective fine if there is a vacuum in another country if the other country just has no rules then you can have a contract over what you're going to do the US is they have these surveillance laws and you cannot contract out of them so basically you have a situation where all these contractual arrangements that all these companies are now pushing and where there's all kind of endless paperwork to sign are going to conflict with American law because if this contract or EU law says you need to have privacy an American law says you have to have surveillance at some point this is not going to work out fundamentally from a lawyer's perspective it's like two trains colliding there's too much law, too law saying the opposite thing you can technically not comply with both at the same time and what the EU is trying to is to put more text or more paper in between the two colliding trains and we can all figure out what happens with the paper it's going to be shredded and that happened at the Court of Justice twice so it's like not too hard to comprehend that if two laws simply or two jurisdictions simply say the opposite thing you cannot contract out of it like there is no way and that is fundamentally what we're doing now since 10 years is to explain that to the European Commission and failing over and over again how did that happen so we ended up at the Court of Justice the Court of Justice is kind of the Supreme Court of the European Union the highest court we have and the case law was kind of interesting because typically when you have fundamental rights we have a so-called proportionality test so they say okay there's a fundamental right the right to privacy for example and then there's a public interest let's say going against criminals there's a public interest and you have to balance these two interests somehow and we do that in a so-called proportionality test which is a four-step test that you go through the first three steps kind of make sense the four step is kind of like a political how far did that go so that's typically where we are and then there is a situation for example for data retention that the member states do over and over again where your cell phone metadata is kept for terrorist prevention which is the whole data retention for a start and spare information we usually ended up in the red zone and the Court of Justice said no you can't do that bit too much now what exists on top of that and that's legal geekism there is a violation of the essence of your fundamental right never happens it's basically if a violation is so massive that they don't even start the proportionality test anymore the only time that exists by law is in torture there's no proportionate torture it's just always banned and what was interesting both of these types of litigation the Court of Justice actually said that the surveillance in the US is so extreme that it's a violation of the essence of fundamental rights they said we're not even starting a proportionality test here anymore this is so outside we're not even going to engage in this discussion and that is very bold from the Court of Justice there is no other judgments other than these two where they have found that so far so the Court is actually quite strong on that for us it was interesting because we argued the violation of the essence when we're there because the case law basically suggested that we never thought the Court of Justice would actually say it so you would sit there in Luxembourg get the judgment you kind of divided up by the lawyers everybody reads a couple of pages and our Irish lawyer was like oh my god we found a violation of the essence which is as a lawyer like woo we found something super crazy because it never existed in case law before and we didn't think ourselves that they would say that but they did so what in the end we now need to have is that you have to if you transfer data abroad you have to have compliance with the GDPR so you have to make sure that the company abroad kind of follows the same rules it doesn't have to be exactly the same and you have to follow the Charter of Fundamental Rights which is kind of the fundamental rights document in the European Union we don't have a bill of rights or constitutional rights we have what they call the contractual rights as kind of the treaties of the European Union it's defect to the constitution we're just not allowed to call it a constitution so what happened with all of that once the first deal which was called Safe Harbor was dead the commission came around the European Commission two or three months later with this wonderful logo and said oh there's a new deal it's called the EU-US Privacy Shield and I was like which graphics person ever anyways and what was interesting was presented in the European Parliament and I asked one of the people at the commission you know how did they end up with this shitty name and the answer of the guy at the commission was like I've never heard that name before it's basically something that the commissioner made up and the PR people this deal doesn't even exist right now so they presented a wonderful deal to the public that didn't actually exist I don't have it in the slides right now but we kind of two weeks later made a freedom of information request in the US a colleague organization did that and they asked for the text of the new deal that was presented in press conferences and so on and the answer they got was that the access request is rejected because the record you requested does not exist they literally presented the deal that simply didn't exist at the time two months later there was actually then the text of the deal and we could actually read it now what was really interesting is the European commission put a lot of PR effort into that and they for example said that the US authorities assured that there's no indiscriminate or mass surveillance by national security authorities that was in all the newspapers then we now have these wonderful assurances now as a lawyer you tend to kind of retext in very much in detail and word by word and I was like assured so basically they just told us that they don't do it and that's kind of like China assured us that there is no secret concentration camps great thanks for the assurance and then the second is like indiscriminate or mass surveillance that term doesn't have a trademark or a definition so once you go into the actual deal you see how this all works out so there's an annex to this European commission decision and on page 4 of this annex you find that there is collection in bulk so we don't have mass or indiscriminate surveillance but we have bulk collection and that is used for 6 purposes that go as far as combating transnational criminal threats and again reading text in detail you don't need a crime you need a threat so if there is some Mexican dude walking along the border with a little bit of cocaine or whatever in his hand that's a threat because if he puts it through the border fence that's a transnational crime because you basically just traffic drugs that's technically enough for a bulk collection and if you then go through the exact details of all of that you realize how the press release is very different if you actually then go into it now if you go not just in what the EU published but actually the source document in the US that word bulk has a little footnote and if you follow that footnote you realize that these limitations only apply if the data is actually processed in bulk in long term if you collect all the data in bulk to then find the needle in the haystack this is not bulk collection this is basically targeted collection for the definition of all of that so if you go from press release layer to layer to layer you realize actually we have all mass surveillance but we have assurances that there isn't any and that is basically how the system works we even ask the evidence that they produced for the court they said oh we have a letter by the US they don't do it so that's the evidence we have as the European Commission and it's to me mind blowing because I mean it's like Russia saying oh we never invaded anybody here's a letter and the Russians told us so what's the problem and that is a bit how technically all of this went down there was also an issue that you couldn't go to any court in the US and they came up with a wonderful solution that there is now a privacy shield on boots person that person at the time and the system was that you would go to your local data protection authority in the EU they would forward the issue to that person they would then internally in the US try to figure out the problem and give you an answer and the wonderful thing is the deal already had the answer pre-described like literally the deal said what you're gonna get as an answer in any case and they would always tell you that the case has been investigated otherwise you wouldn't get an answer second that they either complied the situation but they don't tell you which one so either they complied from the get go or they didn't complied but they remedied the situation there's no answer that they didn't remedied the situation not possible they always remedied the situation and then they would also tell you that they neither confirmed nor deny that there was any surveillance on you and the reason for that is if they would actually tell you there was surveillance on you you would actually have a possibility to get into American courts because in the US there's a stand-in doctrine and it's really hard to get into courts for litigation the ACLU that we work with which is kind of the fundamental rights organization in the US actually litigated the US government and the the US government says you cannot prove that you were actually under surveillance because of all the different hops and networks we surveil there's always one or two that is down and your package could have gone through the one that is actually down so they started litigation I kid you not with Wikimedia to say that's Wikipedia that's one of the most visited web pages ever and the US government still argued it could be that all Wikipedia packages of the last years always went through that one hub and therefore we never captured it that was the one that actually the courts did not accept anymore but for anybody else they basically say oh you can't prove you were actually under surveillance and if they would have basically told you there then you would have a cause of action so this deal was also struck down by the Court of Justice in our second litigation what are the practical consequences and realities that all these kind of transfer deals that are not necessary were actually under threat there is no legal basis to do that anymore if you divide it up it basically means if you I don't know book a hotel or a flight in the US that's fine that's necessary no problem there was a lot of the industry the world is going to go under you can send emails to the US anymore which was other bullshit but it works for just creating drama what is a problem is if you outsource your data to an electronic communication service provider in the US and that also includes servers in the EU so what the big company said is server in Frankfurt wonderful what they did not say is that these American laws do not have a jurisdictional limitation so they basically apply globally to any server that they have access to which is normal same thing in Austria for investigative powers wherever you have access as an authority you can get there the limits in the US is what they call possession custody control so if an American provider can say I cannot physically access the data I simply don't have the keys I gave it to someone else in Europe then they would be out and that would be a possibility that they have a sub organization in the EU that holds the data and the American boss simply doesn't have access to it that would work but when you talk to the big tech companies they're like it costs money it's complicated so that didn't really happen in reality you can still transfer data as a set to a normal company in the US that is not an electronic communication service provider now we basically filed complaints against the biggest websites of the European Union and basically country by country to actually try to enforce this a second judgment and it ended up to be 101 complaints we basically went for google analytics and facebook pixel just because it was easy to find and easy to show and went through public www to find them and because it happened to be 101 we already had our logo there as well and what was interesting is we basically when we went through the companies most of them said sorry we removed it blah blah blah because it was just a facebook pixel and really was easy enough to remove usually the second thing is that they said they did supplementary measures which is basically what was discussed the last couple of years as the big solution and then there is a what they call respace approach to just quickly debunk why that is all bullshit so the supplementary measures there was the idea and it was actually in our submission to the court of justice were the only ones to argue for that that you could find a technical solution for the problem and were like if you find a technical solution you might guess wonderful great one of the arguments for that was okay if you transfer data let's say to I don't know Australia it may go through 100 countries on the way that we really don't trust and if that is end to end encrypted fair enough you could probably work with that and say that's fine same thing as it goes just through the US and just go somewhere else and you may have proper encryption and technical solutions for that now what the industry made out of that is that they basically said oh we have technical stuff like encryption and transit and you can encrypt backups but if you boil down to like a zero-knowledge approach you're almost at no useful scenarios anymore where you can actually use that what the industry then started to say oh we're just going to have contractual stuff contractual is wonderful because you just change some text in terms of conditions and never touch anything anymore and not solve any of the problems and they basically say that they will inform you or resist or try to kind of do anything against surveillance like that prom is not working if the third country law like in the US doesn't allow that so the US already says there is a gag order you're not allowed to talk about the surveillance all of that is in secret blah blah blah so they produce pages and pages of text saying oh if possible we will inform you it's like if possible means it's not possible so you're not going to do that and what we saw is that these big tech companies just generated 30 pages 40 pages of bullshit of all the wonderful supplementary measures that they do and they were literally laughable like some of them are on website you can go through them but nothing that actually from a realistic perspective helps anybody so we went, that's the EDBB that basically confirmed that Facebook was super interesting they had stuff like we have a tech team or a legal team that actually reviews requests and was like I guess so I mean if the police asked for data it would be nice if someone reused that but the law is still you have to give it so what's the point in having that team my favorite one was actually Google they said that they put out the fence around their data center and put a sign on it that was one of the on the list of their supplementary measures I was like yeah I'm sure the NSA is going to be super impressed about that there was a lot of these supplementary measures went around all the authorities in Europe usually told the companies to fuck off with that but a lot of the big tech deciders or the people that you know then buy big products are like oh there's a long list of Microsoft for example that tell us everything's fine so let's just continue as it is and that was kind of what this it was a PR exercise largely and then the funniest one was the so called risk-based approach that is something that the lawyers pulled out of their ass it's basically that in the GDPR there are certain elements where there is a risk element where the law says dependent on the risk you have to do X typical thing is security there is never perfect security but dependent on your risk what you have blah blah blah blah technical developments you have to do what's kind of state of the art usually now they said oh we found that in three articles or four of the GDPR let's say that's a general principle of the law and we just apply risk to everything in the whole law which is just not how law works at all but that was actually put around and argued by a lot of the lawyers to say oh we should write you a piece of paper as the CEO of a company that everything is legal because we now apply a risk-based approach it's like we apply a risk-based approach to murder murder just doesn't exist because it's risk-based that's kind of the thinking behind it that was also rejected by first the Austrian authorities now by a couple of other courts now back to enforcement we tried to kind of get this through as I said we made this 101 complaints was super slow most of the DPAs didn't really want to do anything about it because most of the data protection authorities are like data transfers don't touch it problematic we don't want to kill the internet and there were some cases like in Germany or France where public tenure was a problem so that basically for government for government projects they couldn't use Microsoft anymore because they couldn't comply with the law what's really interesting what's upcoming is non-material damages so theoretically the EU passed a collective redress directive this summer where you can do collective redress meaning summer clogging like where thousands or millions of people can get together and bring a case and that could become interesting if we also have non-material damages so let's say each person whose data was transferred to a country that you don't like where your data goes to ask for 100 euros if you then have let's say I think Facebook has 200 million users if you do the math that becomes really really interesting this is starting now so we're just seeing where that goes down and if there could be more cases in that direction because that will allow people to directly do something and not depend on the authorities to do something so that's kind of on the enforcement side what's up so then after all this drama and the last couple of years the commission came around and presented another wonderful deal now so first we had safe harbor and now we have privacy shield now it's a transatlantic data privacy framework the cool kids call it apparently that's now what's all over twitter and and the story of that was there was basically one and a half years of negotiations to European commission said no deal the Americans don't move how should we ever solve the problem and then these two guys got together over a coffee and suddenly solved all the legal problems in a heartbeat and the background was that after the invasion of Ukraine the US literally apparently what I was told was coming up the next day and said we now need to show everybody that we love each other and how better to show each other that we love each other than having a wonderful conference or press conference where that dude says you can get natural gas from the US and that person says you can get our data and that seems to have been the political logic of the new deal same thing again there was no text it was on the headlines same procedure as last time and what was interesting is that they basically then produced a paper about a year later and what they do is just spam everybody with tons of paper and I talked to lawyers that give presentations and explain that this is now the wonderful new deal and everything's fine no one the fuck has read these papers none of these lawyers that sit there that I've talked to has ever read that shit in detail now I'm the unlucky person that actually read stuff in detail and so if you go through it basically what they do is that they have these commercial principles so the commercial principles tell you what the companies can do with the data and these principles are still the old safe harbor then privacy issue principles now taught principles that still be are based on the privacy laws we had in the 1990s in Europe so not GDPR the old directive and the interesting thing is the updated them now and industry organization US has shown the updates so on the core principles they added us twice in here and the footnote on the first two pages second and third page no change at all and the last page they added that there could be other enforcement than the other two than the authorities that right now exist they are not foreseen it's just like an option to do that in the future that's the big upgrade to the new core principles now if you compare these core principles with the GDPR in the you usually need consent or another legal basis there are six different legal basis in the American system you only need to have an up doubt if you share the data with someone else or if you change the purpose of the processing now here basically they have to ask you for example for a consent and say do you want that or not in the US system that's usually a sub sub sub process so someone far down chain and down in the processing chain some company that you've never heard you just know kind of the front the front page of something and they have I don't know 20 companies in the US that do some shit this sub sub sub company has to offer an opt out on their website for these two purposes no one in the world ever knows that their data goes to that company no one ever checks that no one ever goes to the website and then clicks the opt out so basically what that means is you can do whatever the fuck you want to do with data and still be certified as fully compliant with EU law which is amazing because even on the commercial side we allow these companies to do much more with data than our own same thing is usually we need data to be necessary there it only has to be relevant which is a legal difference but it basically means as long as there are some relevance for what you're doing you can use the data necessary really needs you absolutely need the data which allows you suddenly to kind of store as double the amount that you would be allowed to store otherwise typically in the EU you have full access you would get access to all your data there is very limited access to all of that and dot dot dot there's a hundred other of these now on the government surveillance side there is now a new executive order quickly what is an executive order we all know that trump had his wonderful sharpie and put stuff up in the cameras and said oh I signed something that is an executive order and an executive order is an internal an internal rule by the government that is not a law so it's like your boss telling you do A not B that's not a law your customers cannot sue you over it no one else can sue you it's an internal order and that is the same thing with an executive order so they have rules on saying do this on surveillance don't do the other on surveillance but if they break it as a person that whose data got illegally surveilled you have no right to actually go against it it's basically your boss said something you didn't do it but that's an internal problem nothing that you can rely on and that is an executive order the reason why the US uses that a lot now is because their executive order is very broken they can't even pass the budget anymore so it's very hard to pass any law so they try to kind of manage the whole country with these executive orders but for the purposes of surveillance not really helpful because you don't have any rights under it now they said oh there's this wonderful new executive order that is now signed by Biden what they did not say is the new executive order is 14086 that actually there was a PPD 28 which is also an executive order from Obama that literally had now the commission runs around again saying oh there is this executive order with all these limitations and so wonderful and all great and all new the reality is you find almost all these limitations in the old PPD 28 that was already at the court of justice and the court of justice already said that's not enough so it's reformulated same shit and we run it through the court another time around there are some differences so the there's largely the same limitations they're slightly clearer languages in the new executive order but there's for example also additional reasons for mass surveillance so for example for health crisis that's what they added after corona or for climate change so they can now I don't I have no fucking clue what how they surveilled people and then help climate change I don't know but maybe everybody found on the left found that cool I don't know but that's now in so it's not that there is more protections there's also parts where there's actually more surveillance in it and the commission usually runs around and say oh it's better it's I think generally a bit in the right direction but it's like if the court of justice had put up a fence and the fence is now two millimeters instead of one millimeter yeah it's higher but it doesn't really fend off anybody and that is kind of what they did what was really interesting is they now added the word proportionate to US law and that would be a huge game changer and that was the main thing that they put out in the press releases and the problem with that is the following and unfortunately we had to convert the presentation so you don't see the full effect of this imagine the lower thing is not there for theatric reasons and what they basically said in America and the European system is that FISA and prism surveillance is a violation of the essence of your fundamental rights so it's not even proportionate at the same time the US says to continue this violation this processing of data this surveillance not going to change any of it but it's also now going to be proportionate and this you cannot square like this is technically not you cannot technically square it and the solution that they did is that they basically just said there is an American definition of proportionality which is just going to be shifted so far over that we can agree on the word we both agree on the word proportionality but then the definition is going to be different this is now the latest solution to the problem and it works well because the European Commission can say oh they now have a proportionate surveillance system and the US can say yeah sure proportionate but just our proportionate so everybody can walk off and everybody can be happily ever after and we can go back to the Court of Justice with that slide and the judges are probably going to be like in which fucking film am I in but that is basically what what they're doing now then they were unhappy the Court of Justice about this Ombudsperson and I actually brought some stuff for you here I usually forget to bring it they basically now replace the Ombudsperson with a CELPO I forgot what the acronym is for but it's basically another dude that does the same thing there should be no animation that we don't have and gives you exactly the same answer and the funny thing is as with the old answer is exactly the same one that I mentioned before you can get that back now if you're unhappy with that you can go to the Court which is a second instance it's not a real Court and it is actually also an executive body that they just called Court and it's amazing because the US has a definition of what a Court is and you need a law to establish a Court it's not a Court it's what you can call an independent tribunal something like that but the EU insisted it has to be called Court so this thing now got a new name it's now a Court but it does exactly the same exercise that you have before a second time around and you will get exactly the same answer a second time around but therefore you have an appeal and someone asked what are you going to write in your appeal because in the first instance this system here you don't know anything why you got that answer you never heard you have no reason to say this decision is wrong because you were absolutely excluded from the procedure you just filed something with your DPA and five months later you get this or ten months later and they said oh if you appeal you don't have to argue your appeal you just have to write I appeal because you cannot argue your appeal because you don't know anything about the procedure so it's the most puppet thing the world has ever seen and because we thought it's funny we basically took that exact wording and put it on a stamp so if you want to have your judgment anytime soon you can get the stamps here you can have the first instance and the second instance this is your judicial approval and your kind of judicial redress anybody that wants stamps here the lawyers love it I don't know if the tech people love it that much but the lawyers find this the most amazing thing ever okay and then there's a lot of technical shit with all of that for example this whole new deal only applies for data that was transferred from the EU to the US under one of these deals after July of this year now that means if you process data or transfer data before that date you would actually have to get it back to the European Union and then send it to the US a second time around to actually even fall under the definition of the time application of this whole deal so technically I don't know my Facebook Instagram data would have to be removed and then send it back to the EU then send back to the US so that you fall under the definition of this executive order because the executive order does not apply to anything that happened before this summer so a lot of that stuff is in reality just laughable and you just wonder how you can ever get there now what's the short-term solution my problem is usually with NOIB we do a lot we have more than 800 cases and usually we explain to people that's how you fix the privacy problem and everything is fine we don't have a fix for it we can't change US law, we can't change European law but if we think about solutions a little bit the short-term is this is going to be ping-pong, get back to the court of justice and probably be destroyed again in two years and then we are back at square one and we do the whole exercise another time around long-term what could be the solutions so I think what we need to talk about in the long run and there is a part of the executive order that has that in it is kind of what they call a no spy agreement so if we now have a globalized internet country only protects their own people your data is typically not protected 99% of the time when it's somewhere not in your own country which is typically where your data is in most of the situations that we have today so one option is that at least among the democratic countries in the world we come around with a kind of no spy agreement where we say okay we have baseline guarantees, they're all the same and it's independent of citizenship would be very logical and actually the executive order has an element of that in it because it says it only applies to the EU if the EU also gives these rights to Americans which fair enough I think that's a fair proposition but if you do that both ways at a certain point you would end up at a no spy situation where basically countries grant these rights to each other and that could allow data transfers again the reality is right now in the US that's politically almost impossible if you talk with anybody in Washington they say if I grant rights to foreigners I get voted out of office I get voted into office if I take away rights from foreigners that's how politics works this could only work if the industry is really pushing for it to say okay if we need to process data and we need to do our shit we need to solve this legal problem here and that is basically how such an agreement could come around let's say in 20 years I think that could be an option now the cheapest option would be that the US would just put 20 judges there then we wouldn't have to worry about all that stuff we wouldn't have to pay lawyers for all this kind of crazy stuff but that says as I said politically also unlikely to happen in the meantime what's going to happen more I guess is that we have the segregation where basically data is just held in the European Union and we have some data holder here that is not directly accessible from the US not a big fan of that I'm personally more of a globalist where we just should have free data flows and proper regulations but for the time being that's probably what we're going to see more for companies that actually want to comply with all of that so not the perfect solution but at least the in-between solution and we will see last sentence on that data much more because right now this is a conflict of law debate about privacy but we will have similar conflict of law debates in other areas typical example is freedom of speech in Austria and Germany or as in France the denial of the Holocaust is a crime that's not going to change anytime soon in the US that's freedom of speech how as a company do you comply with both rules at the same time so you will have more and more and more of that because the different countries try to regulate the internet more we see new laws passed every year on the internet and there is no jurisdictional rules on that so we will see these conflicts we're probably the first ones here with the privacy debate but we will see similar conflicts in many other areas of the law so we will have more and more of a discussion of which jurisdiction is your data in what is the one that you want to comply with or not and you will not be able to comply with 200 because I mean you probably don't want to comply with certain rules of this world so I hope that was useful I know it was a bit deep dive legal stuff but it may be useful to get a bit of background of these issues and thanks a lot and I think we have some time for discussion now as well and I was told they need a couple of minutes to put chairs up and so on so for the time that we need for that if you have any questions we can do that right now as I understood thanks thanks a lot and if anybody is interested here and I added some legal conference I mean lawyers are usually very dull and I'm the one person not wearing like a suit but they came up with like all these stamps like as if they have been on a club or something it was really amazing well thank you very much that was super enlightening I would say especially I'm from Canada as a North American we kind of look at EU privacy laws I think kind of as a target and yet there are a few issues out there one question I have while we're collecting questions from the audience given that you're an expert in EU law as it relates to US law I'm curious how you feel about that's not even solved yet you've been working on it for quite a long time yet we have more than a few countries all over the world so how do you see these efforts that you're doing especially with maybe being an example for other countries in the world and how do we deal with all the permutations yeah so a couple of questions there at the same time so we have a huge enforcement issue in the European Union and that's especially with the data protection authorities and as a lawyer it's a weird bubble you're in like typically if someone parks in the wrong spot they get a ticket goodbye if you are in the legal bubble for GDPR you're at conferences where like yeah you know it would be really interesting if we would do something about that I literally had that with a head of a DPA that told me wouldn't it be funny if we would actually enforce all of that over dinner and I was like that's like the drug police say wouldn't it be funny if we would do something about fucking crack and this is a bubble of where even as a lawyer you're sometimes wondering which bubble you're in so that's I think the first part secondly what we see is we have I think about 70 countries globally that follow more or less the European system cannot be one of them so even the US is kind of squeezed in like Mexico is basically following a similar GDPR type of law Canada does Canada also has an adequacy decision for that so I think in the long run this typical system that we have is going to spread out in more countries globally and will become the standard what's going to be a huge problem is divergence different countries different laws biggest issue right now the US itself because the 50 different states started to have privacy laws so there is now a privacy law in I think Illinois for biometrics but only for biometrics then there is one for that and this is going to be unmanageable at some point so we'll at some point have to come to an international consensus on how we do deal with that and the effect I think the European system is very logical structured and more or less a system that is similar to that would probably work in the long run however each country is free to decide what they do so that will be interesting how all of that moves along and how that interconnects and I think what's really important is to have a systematic approach because this is technically not feasible you can't comply like write code for 50 different jurisdictions and still keep that separate and follow all of these rules it's just I think for economic reasons not really sensible and the biggest issue then is that we actually I should move over to get this okay yeah and the biggest issue is that we also get that enforced in the end because that's our big concern in Europe like five years after the GDPR they now started having a couple of bigger fines and the DPA is basically put out one big fine every two or three months to say oh we did something look at it but in our case we have more than 800 cases and at certain jurisdictions 99% of the complaints are simply not dealt with so you have a fundamental right to privacy you claim it and then 99% of the time they tell you not for you and I sometimes joke it's like a right to vote but 99% of the time there's no voting booth then you don't really have a right to vote and that is where we see that the culture hasn't changed with the GDPR so the legislator said big fines big enforcement heavy serious that was more than 90% in the European Parliament so it's interesting because of very strong political backing all the member states voted for it other than Austria my home country because we thought it's not strict enough for whatever reason and but everybody backed it but now the executive is simply not enforcing it and that is that is an interesting political situation where democracy doesn't work that well anymore if there's a political consensus and then the authorities just don't do it I hope that's somehow useful we now got the chairs it's amazing choose your favorite do we have any audience questions do we have a microphone that we can sure yes hi you spoke on the separation between data of US citizens and non US citizens how does that work if that data is mixed so let's say I have a conversation with a friend that is a US citizen is the NSA allowed to listen to half the conversation so basically whenever there is any American involved it kind of falls under all of these rules the world's litigation on that because they were technically partly not able to properly do that and that is then litigated in the US so if it's like oh this tiny little bit of an American conversation was in the system that's a case other people in the system not a case because you don't have rights under the fourth amendment all right thank you if I remember correctly the GDPR says that you should not collect more data than absolutely necessary to fulfill the purpose now I'm wondering with Sim Altman I think some people know about him and he's really big in this new thing called World App where you can create like an authentication system called proof of personhood so you only sign up and then you know it's a proof of person but why do all these platforms need to know that I am me actually and this would be like the lowest level of actual necessary data why go anywhere beyond that typically you can litigate that if you have cases like that the other concept that goes in is privacy by design it's kind of to already build a system to have minimum information I had a very simplified again I'm not a tech person I had four years of programming in high school and the there are situations like that that we for example have in Austria at least with EID which is its own issue but for example it allows to show that you're above 18 or not if a company needs to know you're above 18 because you buy tobacco or whatever they don't need to know your ID your name your birth date and so on they just need to know above 18 or not and that can be solutions where that technically is doable and that can also be litigated because you have to ask why is the system designed to give I don't know 20 fields if you only just need a binary yes or no and that would be the proper design then so I could sue the company for your collecting more data than you actually need typically you could if you have a good case on that and you have to show that in the individual case that was not necessary how easy is that not overly easy to give you an example the litigation the shrimps to litigation in Ireland cost 10 million euros what and I was personally liable if I would have lost the next thing I check this there is no enforcement agreement between Ireland and Austria so I was like I'm just not going to have a summer house I guess but that's the reality that also the the court system and the political system and all of that in certain member states is extremely shitty in Ireland to bring a case generally you have to calculate about 100,000 euros and we got from winning at 1.3 million back for our legal fees because the whole legal system is so slow and so complicated that you just need a lot of hours by lawyers to kind of be put in to give an example in Austria and appeal cost 30 euros and so you have like extreme differences and that's to a large extent what we do at NOIB is to try to find these differences and use them because they basically go to Ireland because they know it's almost impossible to litigate they know they don't pay taxes there so they basically choose a jurisdiction as a company like we can choose a jurisdiction as citizens let's bring it in a country that's where the legal system actually works and that is also possible the other way around so that's what we call strategic litigation it's very complicated and especially in the EU it's very complicated because you have all the different languages, legal systems and so on it's immense and we're just scratching the surface but there's a lot of efficiency in it because we run on donations like everything we do is donated money and I have the feeling if someone donates as money that I'd rather put it somewhere where I get a lot from 30 euros than it's its own story I could do a whole day on that now I think we'll take one more question but we do have to set up for the panel discussion and I think these topics will really just continue during that discussion so I think we'll bring the mic over here Hi Max first of all thanks for everything you did for us that's really absolutely fantastic I'm also in the I'm also a certified board commissioner of the European association of data protection commissioners in the working healthcare area what you just said triggered something in me well actually what you said the US authorities are not allowed to spy on US citizens so coming from legal point of view wouldn't it be just simply the solution to add one US citizen to your database and then sue them in the US that's exactly where these target minimization procedures come in so they have to have a procedure to separate them in the database or in the data stream in reality and that is partly why the system works they have thought about that that's the whole part of this thing that they have to get certified to show to the court that they do exactly this thing right not much more but that's the one thing but nice try okay you've chosen your favorite chair do you want to try the others I think we'll enjoy our other panelists to come join us Catherine Fritsch is going to join us also I think choose your favorite chair and Daphne Muller will also join us what's my favorite chair here hello hey there first of all can we get a round of applause for our panelists and also Max thanks for everything you visited in the last 40 minutes that was really fascinating I'm hoping that we can in this panel session use the expertise of our three panelists and kind of blend them together see the areas that they overlap maybe we can explore the areas where they don't and the idea is to use our theme transparency and together to kind of use that to navigate these topics some of you will be experts in certain topics that we talk about maybe there are questions we can't answer and I think that's really okay the idea is to blend our ideas together ask the tough questions and see where we end up now I think Catherine it's worth having an introduction to present you you are here today thank you for joining us and you're also doing a keynote tomorrow so thank you for that as well Catherine is a technology and climate researcher a consultant as well senior program manager at the green web foundation which we'll hear much more about tomorrow a chair of epicenter works an Austrian digital rights organization doing I would imagine really amazing work so thank you for that co-founder and also co-led an institute for digital culture co-initiator of feminist futures doing important work there as well and nominated for the Forbes 30 under 30 list which is extremely prestigious so thank you for being here we really appreciate it thanks for the invitation Daphna Muller is also here we're lucky to be friends which is great and Daphna is part of the next cloud team as well and we're very lucky to have her as manager of alliances and ecosystem and support she's doing amazing work with our team so thank you Daphna you are also a researcher on the future of technology its impacts on society and the industry the technology industry with a special focus on privacy so extremely important work as well you've had several publications in that area which is really amazing also Daphna is a speaker at TEDx if you look up her talk it is very enlightening so I would definitely recommend you have a look there it's about data privacy and platform capitalism and how those two collide so all of you thank you for being here now I think I have a few rules I think the rules would be no topic is off the books but we all have our interests and also our expertise but feel free to dive in wherever you'd like the idea is to be less structured and more weave our way through the conversation and ask the hard questions so if you want to speak feel free to indicate to me or just go for it if it feels natural and I would encourage everyone on our instance if you want to have some discussions there maybe we said something interesting please continue to have that chat on the next cloud instance for the conference we would encourage that now I wanted to start with trust, transparency and togetherness which is our theme and I wanted to use artificial intelligence kind of as a jumping off point just to ask some hard questions because I think artificial intelligence is an area where all of these questions are coming up we're asking questions like environmental impact privacy clearly is an implication that we've been talking about but I think when I say trust, transparency and together in that area I'm curious from the three of you what immediately comes to mind or to heart even what passionately just kind of comes up in you so Katrin maybe we can start with you you mean about the keywords transparency and together well from an kind of climate few transparency has become a really big topic with tech particularly when we look at CO2 emissions of AI for example and how to report those so this is a really big area that is still kind of under researched and where I see a lot of potential that's coming to mind to transparency however I also observe that transparency definitely is not enough I would also encourage to for example ask questions around democracy or equity in tech that is just some other kind of perspectives that like transparency is a part of it but it's not only transparency that's going to make technology more equitable so I think when it comes to questions of trust it's also basically thinking who trusts into technology who can afford to trust into current technologies and we've seen in the history of technology specifically also if we look at AI that there has been a lot of discrimination a lot of favouring of certain people and a lot of pushing away of marginalised people so I think also when it comes to trust I'm curious about asking who trusts into whom and from whom And do you feel like that trust is a bit of a privilege that it's not afforded to everyone? Definitely, yes, that's my question Any ideas on what we can do about that I guess Well, that's where transparency obviously comes in but also the question around accountability so who is held accountable for example for data breaches privacy violations etc and then also really looking into the bigger system so you were talking about the US quite a lot so if the democratic system is kind of falling apart then obviously this is also a big issue so that's been one of the themes that kind of reoccurred in my work throughout the last years was really to ask I'm more coming from the digital human rights field I worked a lot with NetsPolitik.org and really to ground these conversations also into bigger conversations around democracy and justice that's part of my work and we can explore that more Max, trust, transparency together, does that bring up any anger or maybe passion in you? I have to say sorry right away I'm typing my notes down on my phone because I had that sometimes so people were like he's texting while he's on the stage I'm not I'm just remembering that's usually my biggest issue so for me I'm taking very much like my privacy hat here I'm probably the wrong person for the big stories sometimes but I think transparency always triggers me a lot in the sense of that that's kind of a wishful solution to a lot of issues it's like put a bigger sticker on it and that's what we see at least in the privacy bubble is like the transparency usually boils down to just have a longer policy that says we may do even more stuff with your data but it doesn't really solve the problem my favorite example is in it's kind of what the US calls notice and choice principles there's a big notice and then your choice is take it or fuck off and my favorite example is in California there's usually a law that you have to put anything that has cancerous material in it have a big sticker on it and there's even a sticker on Disneyland in California apparently I found the picture once but that doesn't really solve it so transparency is really interesting to see what's going on but typically only like real experts of people that I really have the time have the time to really go through that transparency and make use of it the bigger issue is how do we then solve it so transparency for me is always a bit of a trigger word of like have solution potentially and I think trusting together and as I would just say two things in combination what's at least from a privacy perspective really interesting is we need to be able to share data with other people we need to have a trust part or also the togetherness part because there is often times an answer especially in the tech community is how can we just segregate it wall it off have a technical solution to it and that partly makes a lot of sense but partly we also want to share with other people we need to have a contract somewhere interact with other people and that is usually in a developed society only possible if you have good trust you can say I can give you my most secret stuff and that's a very high level of solving issues but that is probably what in the long run we want to have not easy and not simple but we usually for example mostly trust banks that they don't run away with our money tomorrow maybe in two months but there is a certain level where our interaction only works on trust and I think that is interesting how we can develop that further and that can partly also be technical that basically for example I can see proof actually happening in a way that they promise because I have some code that shows that to me that is the end of what I am going to say on that hope that is useful one of the challenges I have with trust is that we give a simplified example of trusting if I am trying to have a conversation with you we trust each other and that is okay but the reality is the trust as you explored goes through many many many entities how do you trust the entire thing well that is a challenge I think however we usually overcame that in let's say developed societies largely so I usually make an example if I go and I see a train back to Vienna I do not trust that it runs on time if it is in Japan but I do trust that it doesn't derail instantly and I have enough trust that some engineers somewhere in some role manage that without me ever checking it and I think we do that in most stuff like no one checked if this place is built up to the building code but we kind of trust it doesn't fall on our heads even though there is a lot of concrete above us we usually do have that trust in a lot of areas I think in a tech bubble we have a way a long way to go there partly but in most other areas of the law we manage that trust and there is with new technology that was always an issue like if you look at the history of law whenever a new technology came around there was first distrust and also misuse some problems and things that didn't work at the beginning but usually the more that matures the more the trust is building up gradually and we have to say with a lot of these discussions we are having we are at the fucking beginning like it's like industrial revolution ten years in and you know yeah we had some workers lost but no one trusted them either now a hundred years later we have some feeling that usually you get your paycheck at the end of the month that built up and I think we have to be a bit like positive on that as well even though we usually deal with all the shit that doesn't work but you have to remember where you are on that timeline that you're still at the very beginning definitely any thoughts on trust, transparency and togetherness I think products developed by the computer science industry most users will have absolutely no reason to trust most of them there's just no discussion about it I was attracted to open source and next cloud because I was wondering what it would be like to be surrounded in an environment where people actually have values because that doesn't exist elsewhere no so why should we trust it I don't know not whether you think no but I think maybe that's something that's unique in the open source communities that we exist in is you have to build trust often these are complete strangers that you're working with on things you're passionate about and it takes a while to build up that trust and like I have friends I've worked with but I don't even know their names that's surprisingly okay just to put it in we have all our legal shit in the next cloud and we had a discussion at the beginning can we trust that open source thing that no one of us has read every line either and in reality as a user you just trust that some of you guys have checked on each other and it somehow works PS sometimes it doesn't this is not a live bug report exactly, but that is largely what you do as a user as well because these are people that are well-intentioned that did the best that they could and if there's a mistake because it's open source someone else would find out that's exactly that trust model you have and no one has checked that from our side either I mean we do have a second wall around it to be honest but that is like the level where we felt okay that works for us, that's okay but that's trust we have in your daily work as well because if you guys would distrust each other nothing of that would ever happen and there has to be all that trust in a way deep it's important to take moments to really take it in you know Katrin I feel like you've been writing notes I see so would you like to jump in? No I was just thinking it's a bit like infrastructural like once it doesn't work you actually realize oh damn it doesn't work so it's like kind of invisible but then when it breaks like you trust into like you trust like a train system for example you kind of trust it but then once it doesn't work that's actually when we realize how important it is and a lot of it is extremely cultural I mean I studied in the US twice and part of it is that I love the US to death it's kind of my to me kind of the second place where I feel home but there is a very different culture in trusting for example and even within the US I was first in south of Florida where everybody is Republican and everybody goes to church and everybody is Baptist but in that bubble they trust each other as well because the fabric is then church and religion and so on and while we usually have more trust in government more trust in regulation, more trust in okay I can go in somewhere it's not going to fall apart that trust you don't have that much a typical example is when you repair a car in the US no one ever checked if that repair guy knows what they are doing and you need to go through I don't know 100 certifications and 5 years of training to be able to do something on your car but in the US I needed all these different platforms to figure out can I actually trust that guy to repair my car that it doesn't fall apart because there is no tiff, there is no any kind of like approval and transaction wise it's easier for me to just go to any place and know that the guy that's there actually knows what they're doing and I think that is interesting how we organize trust in societies, how we have that also in certain areas and other areas not and I think that probably plays out in a lot of that stuff in real