Is our data really protected online? What rules should we follow to avoid unpleasant surprises? How can we be sure we aren't infringing anyone's copyright, and what should we do if someone infringes ours? And who will own the rights to the “works” of artificial intelligence?
The law takes up an enormous amount of room in the online world too. We rarely think about it, yet the field is extremely important, as you'll see from the piece on GDPR and from the lines below.
Hristina Bogia holds a doctorate in law and specialized in all the important questions that technology raises for legal science. She has worked as an in-house legal counsel, a data protection specialist, a legal marketer, a journalist and a translator of legal texts. A few years ago, disillusioned with the system, she decided to change careers completely and moved into the software industry as a project manager and Scrum master.
Together, we'll look for answers to all of these questions. We'll head for the places where technology, the law and the rights of each of us intersect. We'll go over plenty of everyday advice that can help any user. And, last but not least, we'll get the perspective of a thoughtful young person with a distinctive view on a topic that is always current in Bulgaria: a court system that doesn't work.
– Hristina, as someone with experience and serious knowledge of the subject, what do you do to protect your personal data online?
– Most of my Facebook posts are visible only to my friends. I choose complex passwords, guard them carefully, don't give other apps access to my social media profiles, and use two-factor authentication. I shop carefully and don't open emails when I don't know where they come from.
Honestly, it doesn't bother me to click Agree on a cookie banner and let marketing cookies target me.
Behind them is a business that I've obviously chosen as trustworthy, since I'm on its website.
– We've all had our eyes glaze over at GDPR and cookies. What's your impression—has this regulation done its job?
– At the beginning of the regulation there are three points that define its scope and objectives. If we have to analyze whether they've been achieved, I'd say yes. But if we're looking for an answer to the question of
whether users and their data are protected online, then the answer is no.
– What is our most important personal data?
– Good question. Everyone probably has their own answer, depending on their values and priorities. For me, the most important is data about my finances, my location, the people I communicate with every day and, accordingly, the content of our communication.
In reality, I don't think it matters which data we consider most important, but whether someone else can link us to particular personal data. My Facebook username and password aren't especially important on their own, but if someone can find both and connect them, then I'll have a problem.
– What kinds of misuse should frighten us?
– Personally, any misuse frightens me. I'm demanding when it comes to my personal space and don't want it violated in any way. Most misuse, though, aims at financial gain for the perpetrator. That's why I guard my bank cards most jealously.
– Is it normal for every small website we've visited once to be subject to the same oversight as the giants?
– From a business point of view, it's a burden. From the legislator's point of view, targeted rules are hard to introduce. It's not impossible, but the EU probably judged that it wasn't practical when it comes to the rules on cookies. Perhaps I should mention here that cookies are actually regulated not by GDPR but by the e-Privacy Directive. And GDPR actually does a good job of separating small businesses from big ones. The rules on appointing a data protection officer take this into account, and the penalties are set as a percentage.
– In your view, as a lawyer, do people actually read what they agree to?
– No! But that's a problem with people, not with the law.
– So what's the solution?
– To try to raise smarter children. It sounds arrogant and conceited, but I absolutely believe it's the only possible solution to most of the problems we have as a society.
I don't think it's the right approach to spare people the reading,
after all, as you rightly point out, we're not talking about several pages of terms and conditions here, but a few lines of text.
– Is it really worth reading what cookies a website wants from us?
– Everything is worth reading, especially if we read it critically.
– Every new regulation in these areas comes with the promise of huge penalties, and then they seem to vanish. Is it something like that with GDPR too?
– Actually, there are examples of quite high penalties. They just aren't in Bulgaria. Here you can see the largest ones imposed so far—50 million euros for Google, 35 million for H&M.
Every rule is backed by some sanction, some kind of punishment. The fact that they're in the law doesn't mean the legislator's goal is to impose them.
It's simply that the easiest way to govern the masses is through fear.
People protect their wealth; for them it's a means of taking care of their families. Besides, fear-related news gets the most views, so it's no accident that this particular aspect of the regulation was publicized the most.
– 50 million for Google… And yet, why aren't penalties imposed in Bulgaria for personal data violations?
– Maybe we follow the rules?! I'm joking.
It's hard for me to answer that question, because it'll sound like criticism of my colleagues at the Commission for Personal Data Protection (CPDP), Bulgaria's data protection authority, but I know some of them personally and I know they're capable professionals. Perhaps incompetence is sometimes not a trait of an individual but of the system. A lack of resources, of qualified staff. It's true that a large share of the CPDP's proceedings concern video surveillance, and the fines imposed for 2021 came to a modest 319,000 leva (about $165,000).
– Today, some of the big questions on the subject are undoubtedly tied to the way the online giants manage and use our data. Jaron Lanier, for example, has an interesting perspective: he reminds us that if something is free, you are the product. Can the giants really be controlled?
– When it comes to controlling Facebook, I prefer to think about how I could counter the status quo rather than how to change it—when that's the more effective solution, of course. In this case, I personally bet on critical thinking. When I read something, I don't take it at face value, and I'm teaching my seven-year-old daughter the same (even though she can't read well yet).
But we all forgot about Cambridge Analytica very quickly. If I set aside my personal perspective and accept that
there's no way everyone can be taught not to believe what they read online,
I start to fear for the future of the world. And yet, even before social networks, there was social engineering and there were campaigns that determined the course of elections—as far back as the 1950s, leaders were chosen on the strength of propaganda.
– Even so, is there a way for such big companies to be regulated?
– I'm not sure it would be helpful to impose strict control. And where does that leave freedom of speech?
– Not long ago I heard the sensible argument that this would rather be censorship of censorship.
Does copyright matter online today? It seems that back when creators sold their content offline, people paid more attention to it…
– It matters, but it's harder to protect. If we turn to the principle that demand determines supply: if we were all conscientious and wanted to support the musicians, writers, directors and actors we like so much by buying their products, would there be so many pirate platforms?
I was maybe 12 when my father explained to me that he bought CDs by his favorite artists to contribute to the well-being of the people who had created them. I learned a lot from that.
– What trouble can we get into if we decide to use someone else's photo?
– If we misuse someone's copyright, we'll be committing a violation under the Copyright Act and will have to pay the author a fee. If we decide to use someone else's personal photo, that may amount to damages under the Obligations and Contracts Act, and we may owe compensation. All of this assuming someone can be bothered to go to court.
– Do these rules blur in times when no one can keep track of everything shared on social networks?
– Of course, the scale of social networks makes tracking very difficult. But I wouldn't say the rules are blurring; they are what they are. They just aren't enforced.
– Can someone be sued over an opinion on the internet?
– They can be sued for defamation. Regardless of whether it was spread through the internet or some other way. The web is just a medium. We, the people, are what matters.
– If we encounter hatred and abuse online, how can we stand up for our rights?
– Several nongovernmental organizations have developed projects on hate speech. Here are a few links.
But, as with any other crime, anyone can write a report to the pretrial authorities—the prosecutor's office—and it will have a legal basis to open an investigation. The report must be signed, an electronic signature will do, but the important thing is that it can't be anonymous.
On the one hand, this is limiting for victims, because they're often hesitant to stand up for their rights; on the other, when you claim someone has committed a crime, it's right that you put your name to it, otherwise you leave room for abuse.
– Like many other fields, does the law need to change very seriously to keep up with the times?
– It doesn't need to change very seriously. But
it does need to reflect social reality, as we're taught in the first year of law school.
In other countries that happens faster than it does here.
– In what direction should these changes go?
– I think GDPR is a good example. The problem we have with this act in Bulgaria stems from its nature, not its content. Here we're used to opening a law and finding written in it, “When person X performs action Y, such-and-such must happen.” I don't think that's right; it's an approach that tries to combat the pervasive incompetence of the Bulgarian administration. GDPR, by contrast, expects you to have common sense: it gives you a framework, and you have to judge what to do and bear responsibility for your actions.
When did you last meet someone who takes responsibility for what they do?
It happens to me less and less.
– What could bring the law closer to people, who after all deal with it every day, yet today see it as scholasticism, as long and incomprehensible explanations?
– Education. Secondary education. My ethics and law classes in high school were a waste of time. They tested us on where the treaties founding the EU were signed;
no one thought to hand each of us a copy of the constitution and tell us about the basic principles
that our legal system rests on.
– Algorithms are already creating art. Is there a legal logic to who the author of that art actually is?
– There is—whoever owns the robot owns the result. I understand the moral dilemma about the value of the idea at the heart of the final work, but in the case of DALL-E there's no particular legal complexity.
– Why do you think law is still the most sought-after major at many universities, including Sofia University?
– Is it really still the most sought-after major? Apart from the blame lying with parents born in the 1970s who still live with the conviction that a law degree is elite, no other reason comes to mind.
– And so we arrive here. As someone who has walked a similar path, albeit in a different field… The law is clearly a soft spot for you; you've devoted a lot of time and effort to it, but then you switch to a completely different career. Why?
– Twelve years, dozens of exams and a dissertation several hundred pages long. It was a painful breakup. Because I wasn't paid well. Because I was terribly bored sitting behind a computer; I needed to communicate with people. Because I didn't see the point in what I was doing.
– So it disappointed you?
– It disappointed me, yes. When you study for so long, you think it will pay off economically. I naively believed my pay would be proportional to the effort I'd put in. Well, it wasn't. And I was among the well-paid lawyers; I have colleagues who started as civil servants on about 700 leva a month. That's what my rent is. And my time is far more valuable, especially when I put my daughter on the scales.
– I understand you very well.
In recent years we've talked so much about judicial reform; this system keeps getting reformed, and it keeps being incomprehensible, distant and ineffective for a huge part of society. Why do you think that is?
– Seven years ago I wanted to become a judge. I clearly remember going to the exams for magistrates. I hadn't prepared, because I had a small baby; I just wanted to see how the exam went so I could sit it the following year.
I was sitting in the hall at Sofia University, worrying that I'd left my child. They handed out the cases. That's what the exam consists of—solving a realistic case. Even though I hadn't prepared, over the years I'd solved quite a few of them and knew the finer points. At that moment, though, I saw the situation more realistically, and when I realized I couldn't solve the case because it was based on interpretive rulings of the Supreme Court of Cassation, Bulgaria's highest court for civil and criminal cases, I started to think.
We are a continental legal system. The law ought to carry the main weight for the court, but at the same time the interpretive practice of the Supreme Court (much like precedent) matters a great deal to a judge.
I'm a freshly graduated student; I haven't practiced. The internships during your studies are a formality and pointless.
I'm sitting in the big hall, and they're asking me not what I think, but what a Supreme Court judge thinks.
The exam isn't designed to sift out intelligent people, but to find the people who know the status quo. So what change are we expecting? After all, reform is made by people…
