WEBVTT 00:00:09.539 --> 00:00:14.079 Welcome back to the NicFab podcast dedicated to legal prompting. 00:00:14.199 --> 00:00:17.600 I am Nicola Fabiano and this is the third episode. 00:00:18.299 --> 00:00:25.500 Last time, we saw how to analyze a supervisory authority's decision using a structured prompt. 00:00:26.360 --> 00:00:28.040 Today, we take the next step. 00:00:28.040 --> 00:00:34.540 We move from analyzing someone else's document to producing one of our own. 00:00:35.099 --> 00:00:37.240 We are talking about privacy notices. 00:00:38.020 --> 00:00:41.259 The problem write a privacy notice for my website. 00:00:41.939 --> 00:00:45.099 How many have already asked the model to do that? 00:00:45.619 --> 00:00:48.159 The result looks like a privacy notice. 00:00:48.860 --> 00:00:54.700 It has the right headings, cites the right articles and uses the right tone. 00:00:54.700 --> 00:00:57.220 But there is nothing inside. 00:00:58.020 --> 00:01:00.259 The processing activities are generic. 00:01:01.000 --> 00:01:03.240 The legal basis are boilerplate. 00:01:03.959 --> 00:01:08.480 The retention periods, when they are there at all, are made up. 00:01:09.000 --> 00:01:10.279 The point is simple. 00:01:11.059 --> 00:01:14.480 The model does not know what you do with personal data. 00:01:14.980 --> 00:01:17.099 It cannot know. You know. 00:01:17.540 --> 00:01:19.440 So what is it good for? 00:01:19.440 --> 00:01:25.339 Three specific operations and I will show you each one with the relevant prompts. 00:01:25.980 --> 00:01:28.919 First operation. Checking completeness. 00:01:29.099 --> 00:01:31.779 You already have a privacy notice. 00:01:32.500 --> 00:01:34.400 Maybe a consultant wrote it. 00:01:35.019 --> 00:01:37.000 Maybe you inherited it. 00:01:37.580 --> 00:01:40.559 You want to know if anything is missing. 00:01:41.440 --> 00:01:43.900 This is a perfect task for the model. 00:01:43.900 --> 00:01:48.879 Comparing a text against a list of requirements. 00:01:49.559 --> 00:01:57.360 The prompt. Act as a DPO with experience in GDPR compliance audits. 00:01:58.040 --> 00:02:05.199 I am providing you with a privacy notice issued under article 13 of the GDPR. 00:02:06.019 --> 00:02:12.740 Verify whether it contains all elements required by paragraphs 1 and 2. 00:02:12.740 --> 00:02:19.119 For each element, indicate present, absent or incomplete. 00:02:20.100 --> 00:02:23.559 If incomplete, explain what is missing. 00:02:24.800 --> 00:02:27.500 Present the result in tabular format. 00:02:28.600 --> 00:02:32.660 Paste the text and you get a requirements map. 00:02:33.320 --> 00:02:38.699 But be careful. The model sees form, not substance. 00:02:39.699 --> 00:02:44.660 Data will be retained for as long as strictly necessary. 00:02:45.500 --> 00:02:48.160 The model marks it as present. 00:02:48.860 --> 00:02:51.360 In reality, it says nothing. 00:02:51.940 --> 00:02:57.000 So the table is a starting point, not a green light. 00:02:57.360 --> 00:03:00.660 Second operation. Simplifying the language. 00:03:01.639 --> 00:03:05.220 Article 12 of the GDPR is clear. 00:03:05.220 --> 00:03:10.320 Simple language, concise form, intelligible content. 00:03:10.720 --> 00:03:15.220 But how many privacy notices actually meet that standard? 00:03:15.839 --> 00:03:22.479 Very few. And when they do not, the notice itself becomes a transparency problem. 00:03:23.179 --> 00:03:31.639 The prompt. Rewrite this paragraph of a privacy notice in clear language suitable for a non-expert user. 00:03:32.639 --> 00:03:34.619 Maintain legal accuracy. 00:03:35.600 --> 00:03:40.779 Where technical terms are needed, add an explanation in parentheses. 00:03:41.240 --> 00:03:45.240 The tone should be professional, not bureaucratic. 00:03:45.580 --> 00:03:51.899 This works particularly well on legal basis and international transfers. 00:03:52.639 --> 00:03:55.380 But always review the result carefully. 00:03:55.380 --> 00:04:01.779 The model in making the text more readable might cut something important. 00:04:02.460 --> 00:04:11.979 For example, it might simplify legitimate interest without mentioning the balancing test against the data subject's rights. 00:04:12.479 --> 00:04:14.839 And that is not a minor detail. 00:04:15.500 --> 00:04:18.799 Third operation. Adapting to different contexts. 00:04:19.100 --> 00:04:22.640 You have a solid privacy notice for your website. 00:04:22.640 --> 00:04:25.799 Now you need one for employees. 00:04:26.559 --> 00:04:27.660 Or for an app. 00:04:28.480 --> 00:04:29.940 Or for a new service. 00:04:30.640 --> 00:04:36.640 The model can help, but you must provide the specific information yourself. 00:04:37.399 --> 00:04:43.100 The prompt. I am providing you with the privacy notice for our website. 00:04:43.339 --> 00:04:46.839 I need to produce a version for employees. 00:05:15.339 --> 00:05:16.779 The processing activities are 00:05:16.839 --> 00:05:23.820 Notice. I have provided the processing activities, providers, and retention periods. 00:05:24.399 --> 00:05:27.059 I did not ask the model to guess them. 00:05:27.579 --> 00:05:31.640 If you do not provide this data, it will make them up. 00:05:32.179 --> 00:05:39.119 And a privacy notice with made-up processing activities is worse than having none at all. 00:05:39.239 --> 00:05:40.279 The three premises. 00:05:41.019 --> 00:05:44.799 As always, the three premises from the first episode. 00:05:44.799 --> 00:05:46.760 Human oversight. 00:05:47.579 --> 00:05:54.480 A privacy notice drafted or reviewed with AI must be read in full before publication. 00:05:55.480 --> 00:05:59.440 The signature is the controllers, not the models. 00:06:00.660 --> 00:06:01.600 Regulatory framework. 00:06:02.519 --> 00:06:07.519 In the employee prompt, you shared providers and internal processes. 00:06:08.519 --> 00:06:14.359 If the model is cloud-based, that data is being transmitted to a third party. 00:06:15.459 --> 00:06:19.420 Verify the data processing agreement with the provider first. 00:06:20.040 --> 00:06:20.779 Infrastructure. 00:06:21.859 --> 00:06:26.920 If you process special categories of data, consider a local model. 00:06:27.600 --> 00:06:31.899 The structure of your processing activities is valuable information. 00:06:31.899 --> 00:06:37.119 It does not necessarily need to end up on someone else's server. 00:06:37.559 --> 00:06:38.839 My closing remarks. 00:06:39.779 --> 00:06:41.839 Check. Simplify. Adapt. 00:06:42.500 --> 00:06:46.160 Three operations where AI genuinely helps. 00:06:46.799 --> 00:06:52.700 If you drive them with real data and verify the output yourself. 00:06:53.019 --> 00:06:57.519 This is legal prompting applied to privacy notices. 00:06:57.519 --> 00:07:01.519 Not a shortcut, but a method. 00:07:02.500 --> 00:07:07.679 The model assists, but professional judgment remains yours. 00:07:08.480 --> 00:07:11.940 Next time, we will talk about RAG. 00:07:12.920 --> 00:07:14.980 Retrieval Augmented Generation. 00:07:16.000 --> 00:07:16.859 What it is. 00:07:17.519 --> 00:07:21.140 Why it can be very useful in the legal field. 00:07:21.140 --> 00:07:27.299 And why, if poorly configured, it becomes a serious risk. 00:07:28.519 --> 00:07:32.859 Subscribe to the newsletter at nickfab.eu. 00:07:33.920 --> 00:07:35.299 Thank you for listening. 00:07:35.600 --> 00:07:37.459 Until the next episode.