Hi! everyone.
Everyone still awake?
Everyone got good pizza in your stomach?
All good? Okay.
Great.
So, I'm really excited to be back in my hometown,
Reunited with my teh c siu dai (milk tea less sugar), my chye tau kueh (carrot cake).
And speaking at the Mozilla Developer Roadshow,
I'm the last speaker, so I'm closing it out.
So, get as much pizza as you can get
even though I think they have all run out.
So, I'm here to talk about designing for user centered privacy.
I have been taught that
it's easier to first understand human behavior
and design something that's in line with their mental models,
so that it's easier for users to adopt things.
Trying to teach a new user to actually learn a new gesture, a new workflow
and everyone tells you that you need to build things that's intuitive,
that's easy for people.
And then you try to convince users to change their viewpoint
and change their fundamental human behavior
honestly is a near impossible task.
I've been grappling with this wicked problem
and I'm going to try a different tactic today.
So, hello, my name is Venetia Tay.
I'm the head of audience insights at Mozilla.
I'm based in San Francisco.
I'm a mixed methods researcher and a strategist
and my background is in business strategy and user research.
My role at Mozilla requires me to understand our target audience
and to actually translate their insights for teams
to help them drive decisions
from people within the marketing team
all the way to developing products.
I also sometimes work with the emerging technologies team as well,
which is why I know some of them, not everyone
and all of this is in service of Mozilla's mission
which is to keep the web open and accessible to all.
So, the wicked problem that I've been tackling for the last three years has been
how do I get everyday people to care about their safety online
and how do I get them to care about their own privacy
without using fear tactics
because that's actually really easy to scare the shit out of people.
We're not in the business of doing that.
So, today instead of talking to users and everyday people,
I want to talk to all of you.
You are makers of systems,
designers of products and designers of interfaces,
you are architects of algorithms.
I want you all to be thinking about designing for user-centred privacy.
So, the buzz word in the industry is user-centred design,
customer centricity.
If you believe in creating a customer -centred experience
you have the responsibility of keeping your user's data safe.
And why does data matter?
Well, data is the new most invaluable resource out there right now.
Even our Singapore government thinks that as well.
There is a market for user data.
A market research firm, Optimus
estimated that we will reach about 250 million by 2020.
Think about that.
That's actually a rounding error for most of big tech firms out there.
That's how much Google probably generates revenue in like 16 hours.
It's not much.
But if you think that data is the new currency
how are you and how are your companies actually managing it right now?
So, let's touch a little bit on this data privacy.
Where do we stand right now?
I do a lot of global research.
I talk to users from all over the world.
These are some of the common things that they say
especially the people who are very unfamiliar with the privacy space.
“I'm not a target. I'm so insignificant."
"I'm so small, why would anyone care about me?”
“I'm not a celebrity."
"No. No one is interested in what I do.”
“You know what? I've got nothing to hide."
"So, even if everything I had leaked out,"
"I really have nothing to hide at all.”
And perhaps on the other end
the people who are aware that companies are collecting their data,
the haphazard use of data
and the overall need to protect themselves.
This is what I've heard their excuses that they say,
“It's so much work,"
"it's so convenient if everything connected, all my data connected.”
“Privacy is just so much work,"
"like why should I even bother doing that?”
In fact, our Singapore government does actually hint at that as well.
“If I worry about every little thing. I won't be able to live my life”
like I got so many other things to worry about,
climate change,
rising taxes,
like why would I care something about privacy?
That's nothing to me.
And the other thing that people say is “you know what?"
"This is the way it works right now. We're already f*****."
"What else can we do about it?”
“Companies take our data all the time."
"I can't say no because I need to use their stuff.”
And in Asia in a very family-centred society
that can make individual privacy very very difficult.
We have a kampung mentality.
It makes personal privacy very challenging.
Like most people if you're not married,
you're probably still living with your parents right now.
That's the honest truth about Singapore
and for example, the relationships between families and friends
are very close in Indonesia
which is why we do some of our research there.
It's normal for people to share mobile phones between each other
for a short period of time.
So, again think about privacy
where you think everything's private in your phone,
and you share it with your best friend,
your family, your mom, your dad, your sister, your brother.
I remember that when I was growing up in Singapore
we used to fill out lucky draw forms
that we put down our address, our phone number, our IC number,
we drop it into like a transparent box outside NTUC
hoping to win maybe that cookery set,
hoping to get a discount in something,
we really give out all our information just for the promise of a discount
or even a promise of a prize.
In Singapore we know and we heard that
just the chance of winning a lucky draw or discount
is enough reason for many people to give up their data,
give up all their personal information.
So, now that we are in Singapore,
so specifically Singapore,
the government has outlined a SMART nation policy about five years ago.
This includes nationwide digitization
from ERP all the way to national electronic health records.
The government wants to encourage the responsible sharing of personal data
in order to generate value for our economy.
Now, the government also talks about pulling all our personal data together
so that multiple government agencies
can provide a more hassle-free
seamless online transaction experience for anyone.
If all the agencies all shared their data together, easy for you,
don't need to fill multiple forms up.
In fact, our IMDA Chief Executive Officer Tan Kiat How
has even detailed his vision
about establishing the world's first global data exchange
to then be able for more people to sell their data in a very regulated space.
So, in recent years,
actually the last two years
you've seen a number of new laws and regulations
that the Singapore government has come up with.
I believe the new Personal Data Regulation Law,
the one that you see in the graphic on the left,
this will make the days where I fill out lucky draw forms
and I put my NRIC number and I drop into a box like that
no longer exists anymore.
This law came into effect I believe September 2019, this year,
the government started a campaign to educate users
about safeguarding your NRIC number.
So, you don't give your NRIC number away to anyone,
you still keep it very close to you.
The other interesting regulation that we have
is also what sort of shorthand is the Anti-Fake News bill
that actually bars dissemination online
which deems to be against public interest.
You could be fined up to $1 million or 10 years in jail
for spreading misinformation even in your private networks,
so like in WhatsApp or Signal - whatever you have been using.
The key question is, if you ask yourself,
how exactly would the government actually access
all these private discussions on encrypted apps to police them?
You've got to kind of think about that
but given that we're in Singapore
they'll find a way, they'll find a way.
And we all know that Singapore is actually big on surveillance.
I'm sure you all know there are multiple cameras everywhere,
there are probably multiple cameras here right now
but I didn't know
I bet you didn't know that Singapore
is actually the third most surveilled city outside of China.
There's about 15.25 cameras for every 1000 people in Singapore.
But I'm not here to kind of make a statement of
where Singapore should be on the state of privacy,
just want to kind of highlight that to you.
So, another question I get from people a lot,
especially in Singapore and especially in Asia,
Why does privacy matter?
In the case of surveillance,
it means that we are a safer place because we keep tabs on terrorism.
I know that.
I grew up in a period of time where we were scared about the terrorist attacks
and having people being surveilled kind of kept us safe,
but I also could paint you a very dystopian future
that could come straight out of Black Mirror episode
which I'm sure you guys get here as well.
Governments could actually use personal identifiable information
to harm vulnerable communities
and to keep tabs on the population.
Filter bubbles, impact ideas and concepts
that people actually are exposed to
making people very very narrow minded,
very insular.
I mean look at the United States.
That's a pretty obvious example of how filter bubbles can actually work
and especially potentially very very close to our family-centred society, doxing.
In some interviews that I've done,
I heard about people losing their jobs,
being threatened in real life
because they were outed before they were ready to be outed.
So, these are very real problems that could happen.
But some of these concepts may seem foreign to us.
And another way to look at it is that,
the lack of privacy just means that I get more targeted ads,
I search online, I was looking at a pair of shoes
and for the next like, two to three weeks
that same pair of shoes follows me around the Internet.
I see it everywhere,
sometimes even after I bought it as well.
It's irritating but it's not dire.
I won't die because of a pair of shoes following me around the Internet.
So, let me paint a picture
that I think is very very relevant to the Singapore audience right now.
The first one.
In our work in India,
almost every participant we interviewed there had a VPN on their phone.
They used VPN to access websites blocked by the government
like Korean dramas.
So, they used a VPN to watch the Korean dramas
and they said that another reason why they used a VPN
is to escape music suggestion from Bollywood only music.
You are in India, you don’t have a VPN,
all you get in your streaming services are Bollywood music
and they felt that,
our users in India felt that it's their freedom
to actually receive any content that they want
and they want to be able to explore beyond that.
Another thing that I think will really hit the hearts of our Singaporeans
is that air tickets, air flights.
Have you noticed sometimes if you don't use incognito mode
or you don't use Firefox,
the more you check your prices for your airline tickets
the more it kind of increases over time,
the higher and higher it seems to get.
So, there's also research papers out there that says that,
if you're using a Mac you could potentially see higher ticket prices
than if you're using Windows.
The assumption is that because you have a Mac you have more money.
So, if you have more money you can pay for higher prices.
Another story that will strike fear in people's hearts is
insurance premiums might go up.
So, for example, if you were Googling what does this mole actually mean,
if your insurance company actually had access to that,
they could think that mole could be cancerous.
I'm going to start raising that person's insurance premiums
and they might charge you higher premiums as a result of that,
just for something that you searched.
So, anything weird that you might have searched
they could use it against you.
And lastly,
I know I see out here mostly men,
so you may not really engage with this example
but period trackers,
trackers that actually track women's menstrual apps,
women actually often track when it happens,
what they were doing, how they were feeling at that point in time.
This is very sensitive health information data.
They could be leaked, could even be sold to your employer.
So, can you imagine if you're trying to get pregnant
your company could actually fire you in advance
because they don't want to pay for your maternity leave.
And these are really real problems.
All the examples I listed out here
are things that actually do happen around the world
and not only in Singapore,
this is what happens.
So, what could you do?
I did mention at the start of my talk
that I'm here to have you guys come on board.
At Mozilla we recommend a lean data policy.
What does that mean?
We all know that data is the new currency.
Most people know that companies are collecting their data.
Most people don't know when,
they don't know what,
they don't know why,
and they don't know what it's used for.
So, the truth is some data collection is necessary
to make a smooth seamless experience for your user,
but make sure that every piece of data that you collect
provides direct user benefit.
As I mentioned, data is the new currency,
so as a developer
I want you to think about when, what, why,
and what could it be used for.
Think about it.
Like can your ‘work’ still function
if a user refrains from providing you with that one piece of information.
If you can, you don't need it.
And if you are going to collect data,
we encourage you to collect data in the open,
operate in good faith and be open by default.
At Mozilla we talk about no surprises.
Be transparent.
Disclose the benefits to the user.
We talk about user control.
So, the user is in control of their data
and their online experience.
We talk about limited data collection.
Only collect what you need.
De-identify whenever you can.
And after you're done with it, delete everything that you have.
And we live this policy within Mozilla.
So, you can actually go to our Wiki
and check out our Firefox data collection policy
it's something we really believe in as well.
So, quick quiz.
This is a popular Singapore website.
I've kind of shaded out the name of the website
just not to put them in a bad light or on the tough spot.
So, can anyone tell me how this experience could be improved?
It's hard to see it?
Oh! Should make it bigger.
So, I'll give you.
So, in providing convenience for the customer,
they allow the customer to either log in by Google or log in with Facebook.
And because of that you actually end up asking more data than you really need
because you're actually giving data to the third party
like Google and Facebook as well,
in order to improve the experience
they should actually have an option for you to check out as a guest
and you don't have to then kind of link all your shopping on this website
to the backend of another third party website.
So, this is one thing you could do to improve apart from just the UX.
So, key takeaways.
Think about framework for privacy standards in design
and all of you here are designers
even though you may not have the word ‘design’ in your title,
developers are designers too.
Number One
Adopt a lean data policy.
Map out what you need and why you need it.
Number Two
Communicate the effects and impacts.
You know, demonstrate the benefits and the risks
both internally to your internal stakeholders
as well as to consumers.
Number Three
Build a trusted relationship.
Ask for active consent,
provide straightforward privacy settings
and easy opt-outs.
Don't hide the opt-out section somewhere in the middle or at the bottom.
Make sure it's obvious for the users and give the users control.
And lastly
Respect the individual.
When possible share out and report what you use and why you used it.
So, before you request for a user’s data
ask yourself these four things.
Number One
Would you ask for that piece of data
if that person was sitting next to you in real life?
Chances are I would say
about 50% of people will actually scale back on that.
Number Two
Have I actively informed the user about what I'm collecting
and why I'm collecting it?
Number Three
Can I map out what I'm using the data for
and why I am collecting the piece of data?
And lastly, this is the one that kind of trumps all.
The last question.
Is it creepy?
If you feel it's creepy don't do it.
So, in short, you have the responsibility to keep your data users safe.
So, even if you don't want
even if you yourself aren't interested in data privacy
for your own personal benefit
and your own personal individual benefit
think about your users and help keep them safe.
Thank you.
[Applause]