2022 Conference Programme

2022 Conference Programme & Speakers

 Conference Programme

Sunday 3 July

Time
16.00 to 17.45	Registration Divinity School
18.45	Drinks Divinity School All welcome
19.30	Dinner in the Wordsworth Room First Court. Pre-booking required as spaces are limited
21.00 to 22.30	St John’s College Bar/Buttery

Back to top

Monday 4 July

 

Time	Session
08.00 to 08.45	Breakfast in The Buttery
08.00 to 17.30	Registration in the Divinity School
09.30	Chairman’s introduction: Winds of Change Stewart Dresner, Founder and Chief Executive, Privacy Laws & Business
09.45	The rise of sectoral regulation for BigTech – What does the future hold? Claudia Berg, General Counsel, ICO, UK Iain Corby, Executive Director, The Age Verification Providers’ Association (AVPA) & Project Manager, euCONSENT, UK Julian Deckers, Legal Adviser, Litigation Chamber, Data Protection Authority, Belgium More Info - EU’s Digital Markets Act - EU’s Digital Services Act - UK’s Online Safety Bill - UK Competition and Markets Authority’s Code of Conduct - How should organisations behave in an ethical way to keep young people safe online? - Reconciling the commercial objectives of data acquisition and retention, and the legal objective of data minimisation and data protection by design - How companies are working together to achieve a credible method of age estimation and verification - Belgium’s DPA’s announced in February that the Transparency and Consent Framework (TCF), developed by IAB Europe does not comply with the GDPR - The DPA imposed a €250,000 fine on the company, and gave IAB Europe two months to present an action plan to bring its activities into compliance - What has happened since then? Cookies and Trackers: How to ensure third parties reside on your websites and apps legally Leena Kuusniemi, Founder and Legal Advisor, Leegal, Finland More Info - Personal data of users is often shared with advertising networks, social media and other third parties - But users and often even the owners of the website or app are not aware - The GDPR demands proper transparency - The challenges of mapping your online data flows, finding the right legal basis and ensuring full transparency The future of third party cookies and privacy preserving technologies William Malcolm, Director, Privacy Legal, Google, UK More Info - Google’s Privacy Sandbox for targeting based on an advertisement’s relevance - Google’s recent work with the ICO and the Competition and Markets Authority - The ICO’s welcome to Google’s revised approach to cookie consent - The new ‘reject all’ option Chair: Rob Sumroy, Partner, and Global Co-Head of Data Privacy, Slaughter and May, UK
10.50	Coffee – Sponsored by DENTONS
11.20	Privacy in the Clouds, Revisited: What we learned from analysing the contracts for 40 cloud services Christopher Millard, Professor of Privacy and Information Law, Queen Mary University of London, UK
11.55	5G: Friend or foe to privacy? Javier Fernández-Samaniego, Managing Director, Samaniego Law, Spain/USA More Info - What is 5G? - What will be the benefits for citizens and society? - Current Regulations and Policy Measures Chair: Valerie Taylor, Consultant, Privacy Laws & Business
12.25	Parallel Session 1: Canada leads on applying privacy law to cannabis sales Michael McEvoy, Information and Privacy Commissioner for British Columbia, Canada Chair: Stewart Dresner, Chief Executive, PL&B More Info - Legalisation of recreational cannabis, now a mainstream product - Guidance on the main privacy issues related to the sale of recreational cannabis - Impact across Canada - Retailers' privacy management programs - Educating consumers about their privacy rights Parallel Session 2: Winning tips on using competitions and prize draws to incentivise gathering personal data Jeremy Stern, Chief Executive, PromoVeritas, UK Petra Green, Head of Legal, PromoVeritas, UK Chair: Linda Thielová, Head of Privacy, OneTrust, UK More Info - Competitions and prize draws as a successful method to building databases - Balancing fair collection and commercial needs - Tensions with other laws in the UK, the EU and globally - Running it Right and famous Promotional disasters – the inside story and how to Run it Right
13.00	Lunch – Sponsored by META
14.00	How the European Data Protection Board works to achieve Member States’ consistency in interpreting and enforcing the GDPR Gwendal Le Grand, Head of Activity for Enforcement Support and Coordination, European Data Protection Board, Brussels A national regulator’s perspective: Enforcement actions of the CNIL on EU/US data transfers, including cloud service providers Emilie Brunet, Legal Advisor, International Service, CNIL, France Advantages (and disadvantages) of having your European HQ in Ireland from the data protection law enforcement perspective Paul Lavery, Partner, Head of Technology & Innovation Group, McCann Fitzgerald, Ireland Chair: Laura Linkomies, Editor, Privacy Laws & Business More Info - Changes to EDPB working methods and its enforcement priorities - France’s DPA stance on Google Analytics - DPC enforcement culture and other factors to consider
15.30	Tea – Sponsored by DENTONS
16.00	Parallel Session 1: Free will, nudging and the law Adriana Nugter, Founder, Nugter, Belgium Stephen Bonner, Executive Director, Regulatory Futures and Innovation, ICO, UK Chair: Valerie Taylor, Consultant, PL&B More Info - The GDPR is based on processing of data and consent of the individual - This approach is not sufficient in a world of massive data collection from users via their mere presence on the internet - The collected data are fed into algorithms that subsequently will steer/nudge the online behaviour of users/consumers - This nudging, in fact, takes away the free will consumers are supposed to exercise when entering into a contract, buying a service or a product on line Parallel Session 2: The EU Data Act: Gateway to Innovation? Linda Thielová, Head of Privacy, OneTrust, UK Chair: Richard Cumbley, Partner, Linklaters, UK More Info - Current status of the EU Data Act - Mapping the risks and opportunities for businesses - Concerns in relation to data sharing and contractual limitations - Fairness issues that may impact the real-life scope of data sharing
16.45	Working with European privacy laws: Tencent’s views as owner of WeChat and many online services Timothy Ma, Head of International Privacy, Tencent, Hong Kong Chair: Lore Leitner, Partner, Goodwin Procter, UK More Info - How privacy fits in with Tencent’s wider mission and strategic planning - Tencent’s approach to managing international risk - Tencent’s privacy program and organizational structure - Tencent’s policy and practices on privacy and how the company deals with different global privacy laws, for example, the balance between centralisation and autonomy for investee subsidiaries in different countries - How Tencent is devoting resources and attention to privacy law compliance now and in the future
17.30	Close
18.00	Social Programme Guided tours of Cambridge or St. John’s College Gardens or The Old Library, St. John’s College
18.45	Drinks, Chapel Court – Sponsored by SLAUGHTER & MAY
19.30	Dinner in the Hall – Sponsored by META The Aquila Singers, St John’s College, Cambridge Director: Joanna Forbes L’Estrange Accompanist: Alexander L’Estrange

 

Back to top

Tuesday 5 July

 

Time	Session
08.00 to 08.45	Breakfast in The Buttery
08.00 to 17.30	Registration in the Divinity School
09.00	Manipulative design and out of control data sharing: How to create more consumer friendly services? Finn Myrstad, Head of Digital Services Section, Norwegian Consumer Council, Norway Chair: Stewart Dresner, Chief Executive, Privacy Laws & Business More Info - Adtech and issues related to tracking and advertising - Dark Patterns and manipulative designs - Potential impact of the EU’s Digital Markets Act and other policy initiatives on enforcement
09.30	How Asia Pacific DPAs share information on tech and regulatory trends Junichi Ishii, Director for International Affairs, Personal Information Protection Commission, Japan Lee Ti-Ting, Assistant Commissioner, Personal Data Protection Commission, Singapore Chair: Michael McEvoy, Chair, Asia Pacific Privacy Authorities (APPA) Governance Committee, and Information and Privacy Commissioner for British Columbia, Canada More Info - Unique features of the Asia Pacific region - Overview of the Asia Privacy Authorities Forum - The PDPC and privacy law in Singapore - The PPC and privacy law in Japan - Cross border data flows in the Asia Pacific - APEC rules - US-Mexico-Canada trade agreement - Data Free Flow with Trust - ASEAN cross border data flows and model contract clauses
10.15	Beyond adequacy: Recent developments and future prospects in the EU’s approach to international transfers Anne Schilmöller, Policy Officer, International Data Flows and Protection, Directorate-General for Justice & Consumers, European Commission, Brussels Chair: Simon Elliott, Partner, Dentons, UK More Info - Overview of the EU Commission's International Transfer Agenda - Update on the latest developments on the EU's adequacy workplan and future plans - Overview of key international data transfer mechanism developments - Discussion of developing key international data transfer "pinch points" including EU-US Trans-Atlantic Data Privacy Framework; the future of UK adequacy; and EU Standard Contractual Clauses
11.00	Coffee – Sponsored by DENTONS
11.30	UK privacy post-Brexit: What’s changed and what’s to come? Peter Church, Counsel, Linklaters, UK Mairead O’Reilly, Senior Data Privacy Lawyer, ICO, UK Elisabeth Stafford, Data Protection Reform Team, Department for Digital, Culture, Media and Sport (DCMS), UK Chair: Georgina Kon, TMT Partner, Linklaters, UK More Info - How data protection reform fits in with the government’s national data strategy - Main changes - The ICO’s perspective - Impact on business and individuals
13.00	Lunch – Sponsored by META
14.00	Winds blowing in the same direction: Effective enforcement via DPA and consumer action Wojciech Wiewiórowski, European Data Protection Supervisor Chair: Stewart Dresner, Chief Executive, Privacy Laws & Business
14.45	Parallel Session 1: Developing Codes of Conduct under the GDPR Dr Gerald Trieb, Partner, Knyrim Trieb Attorneys at Law, Austria Antoine Bon, Legal Adviser, Secretariat, Data Protection Authority, Belgium Chair: Chris Taylor, Head of Assurance(Supervision), ICO, UK More Info - Advantages of co-regulation via codes of conduct - Negotiating with Austria’s DPA on adopting an authorised Code of Conduct on the processing of smart meter data - Establishing and accrediting monitoring bodies - The international Cloud Code of Conduct negotiated with, and approved by, Belgium’s DPA and given a positive Opinion by the European Data Protection Board - ICO experience of Codes of Conduct, other assurance initiatives and ongoing discussions between the ICO and European Economic Area based national DPAs Parallel Session 2: Data protection developmentsin the Middle East Dino Wilkinson, Partner, Clyde & Co, UAE Chair: Helena Wootton, Data Lawyer, PL&B More Info - The evolution of data protection laws in the Middle East - Where we are today - Future challenges and opportunities
15.40	Tea – Sponsored by DENTONS
16.00	I’m GDPR compliant: How do I manage US/GDPR privacy risks given the changing landscape? Robert Blamires, Partner, Latham & Watkins, USA Clay Northouse, Partner, Latham & Watkins, USA Fiona Maclean, Partner, Latham & Watkins, UK Chair: Gail Crawford, Partner, Latham & Watkins, UK More Info - An overview of the current and upcoming US state and federal privacy laws - What are the biggest risk areas? – sensitive data, advertising, profiling, and selling - How far does GDPR compliance get you and where are the gaps? - How to close the gaps and approaches to compliance? - Practical tips on managing GDPR and US risk side by side - Comparison of US and EU regulatory enforcement actions
16.45	Verifying identity in a remote world: Building ethical and privacy focused AI Ruhul Amin, Co-Founder and Chief Architect, Onfido, UK Michelle Levin, Global Privacy Director, Onfido, UK Rachael Annear, Counsel, Freshfields Bruckhaus Deringer, UK Chair: Giles Pratt, Partner, Freshfields Bruckhaus Deringer, UK More Info - How Onfido uses biometrics for identity verification, including through machine learning and the development of a risk engine - Embedding Privacy by Design - Managing privacy risks through software developer kits and API functionality - How Onfido took advantage of the ICO regulatory sandbox
17.30	Close
18.00	Social Programme Punting on the River Cam, River Court
18.45	Drinks, Lower River Court – Sponsored by LINKLATERS
19.30	Dinner in the Hall – Sponsored by META

 

Back to top

Wednesday 6 July

 

Time	Session
08.00 to 08.45	Breakfast in The Buttery
08.00 to 14.00	Registration in the Divinity School
09.00	How the ICO helps influence the tech winds of change Stephen Bonner, Executive Director, Regulatory Futures and Innovation, ICO, UK Stephen Almond, Director of Technology and Innovation, ICO, UK Chair: Stewart Dresner, Chief Executive, Privacy Laws & Business More Info - The ICO’s work with global innovators - Synergy with policy makers, DPAs and other regulators - Addressing privacy risks in new products and services before harm occurs - Providing regulatory clarity to help accelerate the introduction of future technologies
09.45	Corporate data scraping: Countering attacks with privacy and other laws Jessica Romero, Director and Associate General Counsel, Platform Enforcement & Litigation, Meta, USA Borja Sainz de Aja, Partner and Head of Litigation of the Digital Group, Uría Menéndez, Spain Chair: Stewart Dresner, Chief Executive, Privacy Laws & Business More Info - Types of scraping with an impact on many industries - How scraping is different from data breaches - Developing prevention resources - Enforcement via different laws - Benefits of industry-wide cooperation
10.45	Coffee – Sponsored by DENTONS
11.10	Demystifying Ransomware: A call to action for DPOs Christian Heggen, Strategic Threat Advisor, CrowdStrike, UK Mark Keddie, Global Director of Privacy, Veritas Technologies, UK Antonis Patrikios, Partner, Dentons, UK Chair: Helena Wootton, Data Lawyer, Privacy Laws & Business More Info - Developing trends in ramsomware - how to face up effectively to this threat - How to decide whether to notify Data Protection Authorities - Action points on preventing and defending against ransomware attacks - Helping you decide on whether or not to pay a ransom - The risk of suffering another ransomware attack
12.05	US Privacy class actions and emerging trends in the EU Ian Garrard, Managing Director, Innsworth Advisors, UK Serrin Turner, Partner, Latham & Watkins, USA James Lloyd, Partner, Latham & Watkins, UK Chair: Jennifer Archie, Partner, Latham & Watkins, USA More Info - The anatomy of a US class action - US case law and enforcement action trends in the privacy context - How EU collective litigation mechanisms compare - Will we see class actions on the same scale in the EU? - How to run a class action defence - What can you do to minimize risk?
13.00	Lunch – Sponsored by META
14.00	Parallel Session 1: Privacy Invasion as a weapon against women Claudia Berg, General Counsel, ICO, UK More Info - Whilst women are not the only victims of privacy invasion (online or otherwise) they are predominantly the victims, for example, revenge porn - This session is not aimed at women, but at everyone because it affects all of us and everyone should be part of the debate Parallel Session 2: Making a success of a complex international data project involving AI and Machine Learning – Tips and Lessons Learned East Rafi Azim-Khan, Partner & Head of Data Privacy, Pillsbury Law, UK More Info - The legal complications around consent, legitimate interest, contractual arrangements with data processors, data sharing and interpreting a host of different data laws and countries which do not have such laws - Practical issues, such as testing software tools and the need for lawyers to work with project managers and people with other essential skill sets in many different countries
16.00	Close and Tea

 

Back to top

Social Programme

Day	Time
Sunday	18.00	Organ Recital St. John’s College Chapel
	18.30	Choral Evensong The choir of St John’s College at St. John’s College Chapel
	18.45	Drinks Divinity School All welcome
	19.30	Dinner in the Wordsworth Room First Court. Pre-booking required as spaces are limited
	21.00 to 22.30	St John’s College Bar
Monday	18.00 to 18.45	Cambridge Guided Walk A qualified guide from See Cambridge Differently will lead participants to some of the historic highlights of Cambridge close to St John’s College. Limited to 20 people. Please add your name to the list at the conference registration desk
		Or
	18.00 to 18.45	Guided Walk St John’s College Gardens Limited to 20 people. Please add your name to the list at the conference registration desk.
		Or
	18.00 to 18.45	Guided tour of The Old Library, St. John’s College Limited to 20 people. Please add your name to the list at the conference registration desk
	18.45	Drinks - Sponsored by Slaughter and May Chapel Court
	19.30	Dinner in The Hall
	21.00 to 00.00	St John’s College Bar/Buttery
Tuesday	18.00 to 18.45	Punting on the River Cam Lower River Court Free chauffeured punts on a first come first served basis.
	18.30	Choral Evensong with the Choirs of King’s College and St. John’s College, St. John’s College, Chapel The choir of St John’s College at St. John’s College Chapel
	18.45	Drinks - Sponsored by Linklaters Lower River Court
	19.30	Dinner in The Hall
	21.00 to 00.00	St John’s College Bar

Back to top

Conference Speakers

Data Protection Authorities and Policy Makers

• Stephen Almond, Director of Technology and Innovation, ICO, UK
• Claudia Berg, General Counsel, ICO, UK
• Antoine Bon, Legal Advisor, Data Protection Authority, Belgium
• Stephen Bonner, Executive Director, Regulatory Futures and Innovation, ICO, UK
• Emilie Brunet, Legal Advisor, International Service, CNIL, France
• Julian Deckers, Legal Adviser, Data Protection Authority, Belgium
• Junichi Ishii, Director for International Affairs, Personal Information Protection Commission, Japan
• Ti-Ting Lee, Assistant Commissioner, Personal Data Protection Commission, Singapore
• Gwendal Le Grand, Head of activity for enforcement support and coordination, European Data Protection Board
• Michael McEvoy, Information and Privacy Commissioner for British Columbia, Canada
• Mairead O’Reilly, Senior Data Privacy Lawyer, ICO, UK
• Anne Schilmoller, Policy Officer, International Data Flows and Protection, Directorate-General for Justice & Consumers, European Commission
• Elisabeth Stafford, Data Protection Reform Team, Department for Digital, Culture, Media and Sport (DCMS), UK
• Chris Taylor, Head of Assurance (Supervision), ICO, UK
• Wojciech Wiewiorwski, European Data Protection Supervisor, European Data Protection Supervisor

Companies

• Ruhul Amin, Co-Founder and Chief Architect, Onfido, UK
• Ian Garrard, Managing Director, Innsworth Advisors, UK
• Petra Green, Head of Legal, PromoVeritas, UK
• Christian Heggen, Strategic Threat Advisor, CrowdStrike, UK
• Mark Keddie, Global Director of Privacy, Veritas Technologies, UK
• Michelle Levin, Global Privacy Director, Onfido, UK
• Timothy Ma, Head of International Privacy and Data Protection, Tencent, Hong Kong
• William Malcolm, Director, Privacy Legal, Google, UK
• Adriana Nugter, Founder and Principal Consultant, Nugter Ltd., Belgium
• Jessica Romero, Director and Associate General Counsel, Platform Enforcement & Litigation, Meta, USA
• Jeremy Stern, Chief Executive, PromoVeritas, UK
• Linda Thielová, Head of Privacy, OneTrust, UK

Law Firms

• Rachael Annear, Counsel, Freshfields Bruckhaus Deringer, UK
• Jennifer Archie, Partner, Latham & Watkins, USA
• Rafi Azim-Khan, Partner & Head of Data Privacy, Pillsbury Law, UK
• Robert Blamires, Partner, Latham & Watkins, USA
• Peter Church, Counsel, Linklaters, UK
• Gail Crawford, Partner, Latham & Watkins, UK
• Richard Cumbley, TMT Partner, Global Head of TMT/IP, Linklaters, UK
• Simon Elliott, Partner, Dentons, UK
• Javier Fernández-Samaniego, Managing Director, Samaniego Law, Spain / USA
• James Lloyd, Partner, Latham & Watkins, UK
• Georgina Kon, TMT Partner, Linklaters, UK
• Leena Kuusniemi, Founder and Legal Advisor, Leegal Ltd, Finland
• Paul Lavery, Partner, Head of Technology & Innovation Group, McCann Fitzgerald, Ireland
• Lore Leitner, Partner, Goodwin Procter, UK
• Fiona Maclean, Partner, Latham & Watkins, UK
• Clay Northouse, Partner, Latham & Watkins, USA
• Antonis Patrikios, Partner, Dentons, UK
• Giles Pratt, Partner, Freshfields Bruckhaus Deringer, UK
• Borja Sainz de Aja, Partner and Head of Litigation of the Digital Group, Uría Menéndez, Spain
• Rob Sumroy, Partner, and Global Co-Head of Data Privacy, Slaughter and May, UK
• Dr Gerald Trieb, Partner, Knyrim Trieb Attorneys at Law, Austria
• Serrin Turner, Partner, Latham & Watkins, USA
• Dino Wilkinson, Partner, Clyde & Co, UAE

Academics and Interest Groups

• Iain Corby, Executive Director, The Age Verification Providers’ Association (AVPA) & Project Manager, euCONSENT, UK
• Christopher Millard, Professor of Privacy and Information Law, Centre for Commercial Law Studies Queen Mary University of London, UK
• Finn Myrstad, Head of Digital Services Section, Norwegian Consumer Council, Norway

Privacy Laws & Business

• Stewart Dresner, Founder & Chief Executive
• Laura Linkomies, Editor
• Valerie Taylor, Consultant
• Helena Wootton, Correspondent & Data Lawyer

Back to top

Conference Themes

This conference will identify the forces at play and help you to take them into account in your risk assessment of how your organisation should act.

How will the regulators redress the balance against companies with investigations and sanctions?

How will the European Union continue to exercise its global ambition as the “gold standard” in privacy and digital services? To what extent are the European Economic Area (EEA) Member States’ Data Protection Authorities working in a well coordinated way?

Will the United Kingdom government’s drive to take its own path enable it to keep its valuable EU “adequacy” status? Will the UK’s legislative innovations become one of the Winds of Change in the EEA?

To what extent will collective action play a part in constraining organisations’ behaviour?

How does an organisation get direction from top management to balance commercial gains against winning its users’ trust and keeping it? How can an organisation most effectively gain and secure its reputation for fairness?

How should companies use data protection law as one of its criteria for choosing its cloud services? How should companies ethically harness Artificial Intelligence and machine learning? How can individuals exercise free will if companies use manipulative design techniques?

Several countries in the Americas and in Europe have relaxed their laws on the sale and consumption of recreational cannabis – a transition from a criminal to a health issue. What is the impact on the collection and processing of such sensitive personal data?

The adoption of data protection laws in some countries in Asia and the Middle East means that these laws are changing from a rights to a transactional basis. This is a shift to a data protection law as an economic enabler, a safe venue for the processing of personal data. Some countries may be weak on principles but strong on regulatory enforcement.

Back to top