Latest / The Yield Doctor with James Deaker / Stronger Data Controls Let Companies Move Faster

Transcript

Stronger Data Controls Let Companies Move Faster · The Yield Doctor with James Deaker

0:00
In digital media today, data is
0:03
simultaneously one of your biggest
0:05
growth opportunities and also one of
0:08
your biggest sources of anxiety. Most
0:11
executives would rather focus on
0:14
building products, shipping features, or
0:17
growing revenue than dealing with
0:20
privacy regulations, consent frameworks,
0:23
and AI governance. And so what often
0:26
happens is avoidance. We'll deal with it
0:29
later. We'll fix it when legal flags it
0:31
or we'll cross that bridge when we get
0:33
there. But the problem is that bridge is
0:37
already here. And increasingly companies
0:39
are finding out the hard way that data
0:42
practices don't just create compliance
0:45
risk, they also quietly cap growth, slow
0:49
innovation, and undermine trust. And so
0:53
today to unpack this properly, I'm
0:55
really pleased to be joined by Devon
0:57
Brewer. Devon is the founder and CEO of
1:01
Privacy Wise, where she works with
1:03
companies on a range of different
1:05
issues. She works with startups to
1:07
public firms to help them build
1:09
practical businessfriendly approaches to
1:12
privacy, data governance, and AI, not as
1:16
a box checking exercise, but as a
1:18
competitive advantage. Devon and I have
1:21
worked together over the last few months
1:24
on a new diagnostic tool in the space we
1:26
may get to later, but I want to talk to
1:28
her more broadly about the mistakes, the
1:30
mindsets, and the maturity curve that
1:33
companies go through as they try to get
1:35
data right and why this matters. Now,
1:38
Devin, I'm really glad we were able to
1:40
make this conversation happen today.
1:42
>> Hi, James. Thanks for having me.
1:44
>> It I'm really glad to have this happen.
1:47
Uh before we get into the common
1:49
pitfalls, I want to ground this in a
1:51
real world example that you sent over to
1:53
me a few weeks ago. You pointed out an
1:56
enforcement action by the California
1:58
Privacy Regulator against a marketing
2:01
company, RO Partners, for failing to
2:04
register as a data broker. Can you give
2:07
me a bit more context on what happened
2:09
there and why cases like this are such a
2:13
big deal for companies that rely on
2:15
data?
2:16
The RO partners situation is really
2:19
interesting because this time it wasn't
2:22
about a data breach or intentionally bad
2:25
behavior or the types of infractions
2:28
that you usually hear regulators going
2:30
after. This was simply about their
2:33
classification and the fact that they
2:35
didn't register as a data broker. um
2:40
California Cal Privacy. They they
2:42
determined that they were a data broker
2:45
um because they were using they were a
2:48
marketing firm using billions of data
2:50
points to build consumer profiles
2:53
covering all sorts of demographic,
2:55
socioeconomic and behavioral information
2:57
on millions of Americans primarily in
3:00
the wellness space. They marketed to uh
3:03
wellness companies and wellness brands
3:05
and they would create custom audience
3:07
segments and provide those to wellness
3:10
brands for targeted advertising as part
3:13
of their services. They packaged those
3:16
audience segments into their into their
3:18
services. And what happened was Cal
3:21
Privacy said that's a sale. Um, you've
3:26
probably heard a lot of people talk
3:27
about what is a sell or share of data
3:30
and and this is it. That was a sale. It
3:33
doesn't matter that it was bundled as
3:36
part of their services. The regulators
3:38
determined it was a sale. Therefore,
3:41
they were essentially acting as a data
3:43
broker.
3:45
And what makes this a really big deal
3:47
for a lot of companies is that many
3:49
marketing, adtech, and other datadriven
3:52
companies, they assume that they're just
3:54
acting as service providers. A lot of
3:56
companies in the B2B space deal with
3:59
large amounts of data and assume that
4:01
they're acting as service providers
4:04
um to to their clients. But regulators
4:07
are increasingly looking at what they do
4:09
with that data, how they package the
4:11
data, and how they share it, not only
4:13
with their customers, but with other
4:14
third parties, and they're saying a sale
4:17
is a sale, and you can't bypass these
4:19
requirements by packaging the
4:22
information you're you're selling as
4:24
part of your products or services.
4:26
>> When you first made me aware of it, it
4:29
it scared the hell out of me, and I'm
4:31
sure it scares that type of example. I
4:34
mean you pointing to a very isolated
4:35
example but it is indicative of a series
4:38
of concerns that I think executives need
4:40
to be aware of is in the space right
4:42
now. Uh you and I have worked together
4:45
on and off now for a number of months
4:48
but uh even though we've been meeting
4:50
regularly and building tools and
4:52
frameworks in the space I don't think I
4:54
actually know how you got into the data
4:56
and privacy and governance space or what
4:57
pulled you into this space in the first
4:59
place. It's the same cliche answer that
5:02
many privacy professionals have,
5:04
especially here in the US, and it's
5:06
GDPR. I was working as in-house counsel
5:09
at a software company here in Colorado
5:11
when GDPR passed in 2016. Um,
5:16
at that time in my role, I was already
5:18
responsible for a number of of other
5:20
compliance requirements within the
5:22
company. And so when GDPR passed, they
5:26
said, "Here, you deal with it." and it
5:28
landed on my desk just by default. Um,
5:34
what became really clear to me when when
5:36
that happened was that privacy isn't
5:38
just a legal problem. And it's actually
5:41
not even just a compliance pro problem
5:43
in terms of, you know, meeting the
5:45
requirements. It's a crossf functional
5:47
operational problem that many companies
5:50
are expecting their legal departments to
5:52
handle and solve alone. Um, I would get
5:55
pulled in after product teams had
5:57
already built features, after sales
5:59
teams had already made commitments to
6:01
customers, after engineering had
6:03
integrated new third-party services. And
6:06
my job was to make it compliant, which
6:09
really meant figuring out how to
6:11
retrofit the things we were already
6:13
doing into decisions that have already
6:16
been made and then have those fit the
6:18
privacy regulations. And that just it
6:21
just wasn't working. It was very
6:24
frustrating um because the same problems
6:26
were repeating themselves in different
6:29
ways as new regulations passed, as new
6:31
states passed regulations. Um
6:35
my product teams didn't know what
6:36
questions to ask. Engineering teams
6:39
didn't know what vendors they needed to
6:41
flag. Sales didn't know what commitments
6:43
they could make or not make that created
6:45
liability for the com the company. And
6:49
what I realized over the next several
6:52
years of learning GDPR was that the
6:55
companies who did compliance well
6:56
weren't the ones with the best lawyers
6:58
or the biggest budgets or the biggest
7:01
teams. They were the ones who had
7:02
figured out how to integrate their
7:05
compliance obligations into how they
7:07
actually operated. Um what that
7:10
generally looks like is crossf
7:11
functional collaboration across the
7:14
company. No more operating in silos. No
7:17
more just saying, "I'm marketing. I'm
7:18
going to go do my thing. I'm product.
7:20
I'm going to go do my thing." But really
7:22
making sure people were talking to each
7:24
other and so that the issues that were
7:26
coming up, whether it's, you know, data
7:28
compliance or some other kind of legal
7:30
or IP compliance, making sure those
7:33
issues were flagged early. Um, and then
7:37
the discussion could be had without
7:39
slowing growth.
7:41
>> Got it. Um, so given that you've now
7:44
worked in the space for so many years,
7:46
uh, and you've worked with many
7:47
different companies, what's the most
7:49
common single mistake that you see that
7:52
organizations make when it comes to data
7:55
and privacy?
7:56
>> They don't actually understand their own
7:58
data flows. They have a general idea.
8:02
>> Yeah, they have a general idea of of um
8:06
what data they have and where it's
8:08
coming in from. But in reality, there
8:10
are so many points of entry for data,
8:13
especially for those companies now
8:16
engaging in online retail or online
8:20
advertising. Um, in addition to their
8:23
normal everyday functions, you've got
8:25
the standard employee data, HR data
8:27
coming into your company, but you've
8:29
also I work with a lot of tech
8:31
companies. you've also got a lot of
8:33
information on individuals on consumers
8:36
coming in through your website, your
8:38
applications, and sometimes even your
8:40
product itself. Um, and so in those
8:44
cases, a lot of times the the
8:47
organizations, they don't they don't
8:49
understand all the different types of
8:51
data that are coming in. They don't
8:53
understand where it's going, who's
8:55
touching it, who has access to it, how
8:58
is it reused, can it be reused, when is
9:01
it deleted, is it ever deleted. I mean,
9:04
these are a lot of questions that need
9:07
to be answered. Um,
9:10
and if companies do undertake these
9:12
exercises, which I do see some do at the
9:14
advice of consultants, like when
9:16
building a new project or something,
9:18
they will do it as a one-time project
9:20
instead of treating it as this ongoing
9:22
discipline that you really need to be on
9:24
top of. And that's why I keep going back
9:27
to it's a cross functional problem. It
9:29
needs to be across the entire
9:30
organization as a process and that's
9:33
built into how companies think about
9:35
what they're doing and how they're
9:36
moving forward. So given um just while
9:40
you've been talking I thought of a
9:41
question I actually hadn't intended to
9:43
ask you but given what you're saying
9:45
about the need to understand the flows
9:48
most lawyers or I shouldn't generalize
9:51
it many lawyers don't have technical
9:53
skills to be able to go that deep on the
9:56
data flows is that why you say it needs
9:59
to be crossunctional or do you think
10:01
that also there is a need for companies
10:04
to develop that skill set within the
10:07
league legal team so that they can go
10:09
that deep.
10:10
>> Um, two things. One is yes, that's why I
10:13
say it needs to be crossunctional. At a
10:15
minimum, it needs to be crossunctional.
10:18
Um, and two, that's why I started my
10:21
company because, um, it often does fall
10:24
on the legal teams. All of these issues
10:26
have real legal ramifications to the
10:29
organizations.
10:31
uh but the legal teams don't typically
10:33
have the technical expertise or more
10:36
importantly the bandwidth to deal with a
10:39
lot of the stuff on a day-to-day basis
10:41
like it needs to be dealt with and so
10:43
when I was leaving the corporate world
10:45
to do something on my own I thought how
10:48
can I provide value and the way I wanted
10:50
to provide value was doing just that
10:52
giving legal teams more bandwidth by
10:55
providing that operational crossf
10:57
functional piece that they could plug
10:59
into their organization and help build
11:01
this out so that everyone's
11:02
communicating more effectively.
11:04
>> Got it. So, uh I'm going to ask you a
11:07
quick, you are the expert here. I've
11:09
been dangerously close to particularly
11:11
some of my time at Yahoo when I got
11:12
close to the privacy and data governance
11:14
world, but a phrase that I hear
11:17
increasingly is that compliance
11:20
shouldn't be treated as a boxchecking
11:23
exercise.
11:24
In practice, what does that mean? If
11:27
we're talking about companies moving
11:28
from a compliance mindset to being I I
11:32
assume a more strategic data mindset,
11:34
when I hear that phrase, how how should
11:36
I think about it?
11:39
>> Yeah. I mean, box checking is what it
11:41
sounds like. You know, it's a checklist.
11:43
It's box check box checking. It's
11:44
paperwork. And people hate it. It's
11:48
bureaucratic. People think of it as
11:49
something that slows growth. And so the
11:53
principle I try to follow and the way I
11:55
try to implement compliance and
11:57
especially data governance across
11:59
organizations is to move away from a
12:01
here's a list of the requirements and
12:03
here's a a list of what you do and let's
12:05
check the boxes but to see how you can
12:09
meet the organization where they're at
12:12
and use the tools, processes, meetings
12:15
that already exist to cover off on those
12:18
compliances so that it's not becoming a
12:20
box checking ad um exercise and also
12:25
because then it's more connected within
12:27
the business. Um when it's embedded into
12:30
how everything's done and how decisions
12:33
are made, everything changes because
12:35
it's not about having rules for the sake
12:38
of rules. It starts about being about
12:40
clarity. It provides individuals within
12:43
the organization a bigger stake in
12:46
protecting the organization from
12:48
anything going wrong. Um it enables
12:50
people to have conversations earlier and
12:53
sooner. You know, even just at the water
12:55
cooler, um hey, I'm working on this and
12:58
then all of a sudden you have a a brief
13:00
chat and it brings up issues that you
13:02
realize you have to talk about in the
13:04
future um and start planning around. And
13:06
so when everyone in the organization,
13:10
not just leadership, has a real picture
13:12
of the risk, the consequences, the
13:14
trade-offs, the mitigations, and when
13:17
they're all on the same team trying to
13:21
achieve the same goal, it becomes
13:25
crossfunctional organizations become
13:27
able to make decisions faster, smarter,
13:30
um, with more confidence. And so that's
13:32
why I say it can a and enable growth
13:34
instead of slow growth because it really
13:36
makes you able to move faster.
13:39
>> Okay. So, so on that same theme that if
13:42
if a company's not sort of just checking
13:44
the box, if they're trying to
13:45
continuously improve and continuously
13:48
try to understand all of the risks,
13:51
there must be some kind of maturity
13:53
curve for companies where there are some
13:55
that are sort of just starting out.
13:57
They're early stage. They don't have the
13:59
right practices in place. they get more
14:01
mature, how should I think about um what
14:05
companies need to do as they start to
14:07
scale their business and and where do
14:10
they get stuck on that maturity matrix?
14:14
>> Yeah, it all comes down to silos,
14:16
operational silos. uh if you have
14:20
product team A working on their product
14:22
and product team B working on their
14:24
product plus legal plus accounting plus
14:27
finance all the things that you know
14:29
come into play interconnected in an
14:32
organization marketing on top of it
14:34
sales on top of it if you have everyone
14:37
operating in a silo and they're not
14:39
talking to each other things are going
14:41
to go wrong and so what what I see with
14:45
immature organizations
14:47
is, you know, teams that don't even know
14:49
who the legal department is, teams that
14:52
don't even know who to ask. Um, teams
14:54
where they've never connected and never
14:56
really had those communications. Um, and
15:00
those bridges being built to understand
15:02
that that this is one company that needs
15:05
to all work together. And so the more
15:07
the more silos within a company, the the
15:10
less mature the data governance is going
15:12
to be. Let let me push you a little bit
15:14
more on this because it must be about
15:16
more than just the silos. There must be
15:19
also a capability that needs to get
15:22
developed in key functions. So I'm
15:24
assuming you can't just hire the one
15:26
privacy lawyer or the one data lawyer.
15:29
You can't just have one data scientist
15:31
to pull the data. How should companies
15:34
think about where they need to
15:36
prioritize their hiring and how big
15:39
these teams need to get? Have you any
15:40
thoughts there?
15:42
And that really depends on the
15:43
organization. Um, you can do a lot with
15:46
a small team. What I tend to find works
15:49
the best in organizations of any size
15:51
before you go to hiring specific
15:54
individuals because again that can make
15:56
things even more siloed um is building
15:59
those crossunctional teams. And so what
16:01
we've built at different organizations
16:03
is things like um data governance
16:06
champions committee where every
16:08
department sends one person over for a
16:11
meeting once a month um led by who's
16:14
ever in charge of data governance
16:15
compliance whether it's legal whether
16:18
it's a compliance team whoever it is and
16:20
you know they talk about here's the
16:22
issues here's what we see you know
16:24
here's what came up this month as an
16:26
issue um and here's what's coming on the
16:29
future and do you have any questions and
16:31
does anything you're working on in your
16:33
day-to-day um come up as a flag of
16:36
something we should be thinking about?
16:38
And so it's it's those types of things,
16:40
champions committees, um regular
16:43
meetings with leadership where someone
16:45
on the team knows what questions to be
16:47
asking and what what should be talked
16:49
about, training programs, all those kind
16:51
of things. That's really what companies
16:54
need to invest in upfront before they
16:56
bring in a specific person.
16:58
>> Got it. Uh I want to get to a question
17:00
informed by some of the work that we've
17:02
been doing together when companies come
17:05
to you and say we think we're doing okay
17:08
on our data. Uh what are the areas that
17:11
most often diverge from reality or at
17:15
least their perception where perception
17:17
and reality most often diverge in terms
17:19
of their understanding of their data
17:20
organization?
17:22
>> Um consistency and scalability.
17:26
They have policies. They've bought
17:28
tools. They've put up cookie banners.
17:31
They're doing the things. And that is
17:33
real effort. It doesn't It's not
17:35
nothing. But it's the consistency and
17:38
scalability. You can't just throw up a
17:40
cookie banner and then never look at it
17:43
again. You have to make sure it's
17:44
working. um you have to make sure it's
17:47
working properly and you have to
17:49
understand what data is coming in and
17:51
that the technical requirements behind
17:55
those things they change more than you
17:57
would think with you know different um
18:02
engagements with different marketing
18:03
firms and different ways of collecting
18:05
advertising. People are dropping pixels
18:07
or cookies, you know, onto websites and
18:10
then suddenly you're collecting
18:12
different things than you said you were
18:13
at the outset. Um,
18:16
same thing with uh products. Uh, you
18:19
know, some of my clients make real
18:22
products that that are sold to consumers
18:24
um that collect data and you know, it it
18:28
starts out as product A and it's great
18:30
and then someone on the product team has
18:32
an idea and a little subset of a team
18:35
flies off to go explore that idea. And
18:37
as they're building that idea, they
18:39
start using all the data that the
18:41
company already has because it's their
18:43
data. So why shouldn't they be able to
18:45
use it? But did the company get the
18:47
proper consent?
18:49
A lot of times those questions people
18:51
move without asking those questions. Uh
18:54
and again making sure that everyone
18:57
within the organization is on the same
18:59
page asking the same questions,
19:01
understanding the same amounts of risk
19:03
can stop some of these problems before
19:04
they start. And so again,
19:08
companies treat it like a check the box
19:10
exercise. Companies treat it like a
19:12
oneanddone exercise, but data ecosystems
19:15
don't stand still. Products evolve,
19:18
teams change, new vendors get added, new
19:20
use cases emerge every single day. So
19:22
without consistent, regular
19:24
crossunctional communication,
19:27
the changes happen in silos and
19:29
companies aren't able to scale
19:31
accordingly.
19:32
>> Okay. So, one of the reasons that we
19:35
worked together to build the edge
19:37
diagnostic tool along with Greg McDonald
19:40
over at Chelsea is to give teams a fast
19:44
structured way to assess where they
19:46
stand across consent, collection,
19:49
governance, monetization.
19:52
From your perspective, why is a
19:54
diagnostic approach like this more
19:57
effective than jumping straight to say
19:59
policies, tools, doing repeated audits
20:04
>> because a lot of times people have the
20:07
idea of there's a problem and I'm just
20:09
going to buy something to fix it. Let's
20:12
throw money at the problem and buy a
20:14
solution, buy a tool and fix it. But in
20:16
reality,
20:18
there's a lot more to consider. there's
20:20
risk questions to consider. Maybe you're
20:22
throwing a lot of money at a very
20:24
lowrisk problem. Um,
20:27
a diagnostic flips that order. Instead
20:29
of starting with what should we buy or
20:32
what should we do, um, it starts with
20:34
what is actually happening today within
20:37
our organization,
20:39
where are we intending to go in the
20:40
future and then you can truly start
20:43
looking at what what you might need to
20:45
do for a solution.
20:48
every next step will become more
20:49
effective because your policies will be
20:52
grounded in how data actually flows. The
20:55
tools that you select will match instead
20:58
of just trying to fit a problem that you
21:01
you don't actually have or that doesn't
21:04
match your structure. Um and audits
21:06
become validation exercises instead of
21:08
painful discoveries.
21:10
>> Yeah, I 100% agree with that. Um, so a
21:15
lot of executives hear privacy and they
21:18
understandably think costs and
21:21
constraints. Can you give an example of
21:24
how stronger data practices can actually
21:27
enable growth rather than slow it down?
21:31
>> Yeah, stronger data practices allow
21:33
organizations to simply make decisions
21:37
much faster. That's it. No one is
21:39
guessing. teams aren't defaulting to no.
21:43
The legal department isn't saying no for
21:45
everything because they're all afraid.
21:47
You can move forward with confidence
21:49
when you understand what you have. And I
21:52
saw very clear examples of this at some
21:56
bigger um SAS companies, some bigger
21:59
platform companies where they make a
22:01
platform that engages with consumers
22:02
every day. And when the teams are
22:05
aligned and they understand the risk
22:08
levels, where the risk lies and what
22:10
they can and cannot do, and when they
22:12
feel like they have the support of
22:14
leadership and the support of legal and
22:18
the support of marketing and everyone
22:19
behind them when it comes to the
22:21
product. um they're not they're not only
22:24
not afraid to share information and be
22:27
excited about what they're working on,
22:28
but they're also not afraid to move
22:30
forward because they know they've got a
22:32
team behind them, an organization behind
22:34
them that's all operating on the same
22:36
principles, and it's going to mitigate
22:39
the risks even more. And so, I've seen
22:41
it really allow product launches to go
22:43
faster, allow sales uh deals to close
22:47
faster. Um everything moves faster when
22:50
everyone's on the same page
22:52
>> because they have the confidence that
22:53
they the guard rails they know they can
22:55
operate within that they can operate
22:57
quickly within those guards. Yeah.
23:00
>> As as you look over the next few years
23:03
ahead with AI evolving regulation
23:07
increased scrutiny. What do you think
23:10
companies will look back on and say we
23:13
underestimated that?
23:16
I think they're going to look back and
23:18
say they underestimated how foundational
23:20
a strong data governance program was
23:23
from the outset. Not privacy, not AI,
23:27
but data governance from the beginning.
23:29
And that goes back to knowing and
23:31
understanding your data flows, what
23:33
you're collecting and why, how is it
23:35
coming in, do you actually need it? What
23:38
are you doing with it? What can you do
23:41
with it? All of those questions. I think
23:43
a lot of companies weren't really asking
23:47
those questions.
23:49
I think data maps and data inventories
23:51
are a relatively newer concept that you
23:55
know came into play with uh information
23:58
security obviously first of all keeping
24:01
that information secure but the linkages
24:04
between them where it's flowing and how
24:06
it's flowing that really came into play
24:08
with privacy
24:10
and now with AI governance and you just
24:12
can't you just can't separate it out.
24:15
>> Got it. This has been incredibly
24:19
helpful. Thank you. Thank you so much
24:21
for taking the time to share your
24:23
perspective with me and with the
24:24
audience. If people want to learn more
24:28
about your work and what you're doing at
24:29
Privacy Wise, what is the best way for
24:32
them to contact you?
24:33
>> Yeah, they can find me or Privacy Wise
24:36
on LinkedIn. Um, and we also have our
24:40
website privacywise.te.
24:43
>> Excellent. Thank you. I am James Deika.
24:46
I am the yield doctor. Thank you for
24:48
watching.