Latest / Identity at the Center / #264 - Privacy with Laura Gomez-Martin of RSM

Transcript

#264 - Privacy with Laura Gomez-Martin of RSM · Identity at the Center

0:05
This is identity at the center. If it has anything to do with
0:10
IAM, this is the go to podcast now your hosts Jim McDonald and
0:17
Jeff Stedman. Welcome to the Identity at the
0:23
Center podcast. I'm Jeff and that's Jim.
0:25
Hey, Jim. Hey, Jeff, how are you?
0:27
Not so bad yourself. You got a smile on your face.
0:29
What do you got for me today? Well, I've always got something
0:32
right. Something, no, nothing crazy
0:35
like I've been spending a lot of time on the ID Pro select
0:40
channel, not just today but for the past couple weeks.
0:44
What a community right? And the community kind of
0:47
manifests in several places, but on day-to-day basis is the ID
0:52
Pro select channel. So I wanted to call out a few
0:56
things that they've got going on right now it's the speaker,
1:01
public speaking workshops which their interview or having
1:06
sessions on how to become a better public speaker and their
1:09
live sessions. So you probably have missed
1:12
several already if you haven't been attending, but they are
1:15
being recorded, so they're open to any ID pro member between the
1:19
Slack channel and stuff like that.
1:21
That pays for it right there. But also just all the things
1:25
that are going on in the space, the the skills survey, which
1:30
unfortunately I feel bad we never, you know, promoted the
1:34
skills survey here on the podcast leading up.
1:36
It's supposed to end on Thursday, March 29th or I'm
1:40
sorry, February 29th. So well.
1:43
They're definitely going to be hearing that this time.
1:45
Yeah, yeah, but. But maybe it won't.
1:47
It's scheduled to end there and and Heather Flanagan posted like
1:52
it's scheduled to good till February 29th.
1:54
But the way she worded it, I was like it sounds like maybe you're
1:57
going to extend it. So I'd say if you're an ID Pro
2:00
member, get out there, check it out, check out the speaker
2:03
workshop. Of course, you know, I think the
2:07
Identiverse conference is like the home conference for ID Pro.
2:10
So hopefully folks are going to identiverse.
2:12
Yeah, I mean, we'll be there for sure.
2:14
But yeah, I I noticed the speaker workshop going on.
2:16
They're they're very good. Heather Flanagan was on one,
2:20
Sarah Ciccetti was on another one.
2:21
She hers was great. Sarah does a lot of public
2:24
speaking, so she's definitely one.
2:26
If you're interested in getting this space, I think is a good
2:28
one to kind of get into. Everyone has to find their own
2:31
voice and their own style, and if you're not used to speaking
2:34
in front of, you know, many people, whatever many means to
2:38
you, five, 505,000, there's definitely a skill to it.
2:42
It's not something that comes natural for me, for example.
2:44
So I kind of have to work at it. And even though we do, you know,
2:47
the world's famous identity center podcast with 10s of
2:50
thousands of listeners, for me it's just, hey, I'm talking to
2:53
you and I'm talking to our guests and I forget about the
2:55
rest. That's right.
2:57
Yeah. And it's gotten easier over
3:00
time. But I also just you know being
3:03
on that deproach Slack channel also hearing you know you
3:08
Heather's name Sarah's name like and I don't want to try to go
3:12
through the exhaustive list of everybody who makes this happen
3:15
right but people volunteering their time to make ID pro what
3:19
it is like major shout out to those folks and again I don't
3:24
want to like try and name each person because I'm sure I'll
3:27
leave too many folks off and and that's not a good feeling.
3:31
Pop quiz Name every single member of ID Pro Go.
3:34
Exactly. Well, I think there are like
3:36
1500 members now. Pretty impressive.
3:39
Yeah, it's great. And you're right the the Slack
3:41
channel alone is worth the price of admission.
3:43
Anything, anything I get past that I consider bonus.
3:46
But I like to I like to lurk through the Slack channels.
3:48
Every once in a while something come up and I feel like I can
3:52
provide my two cents on. But yeah, it's it's definitely
3:55
worth it. If you got questions on anything
3:56
like ID Pro, Slack is is awesome and people are very friendly.
3:59
Such a great industry to be in. I'd like to ask the questions
4:02
every once in a while. They'll, like, stir the pot.
4:04
Like, I threw a question out there about should there be, You
4:08
know, should people use their everyday accounts for
4:11
administration or should they have a secondary account for
4:14
administration? Oh man, like that's like the new
4:19
religious battle, right? It used to be like how do you
4:22
manage your your contractors and stuff like that.
4:25
So it it's in that, it's in that stack.
4:29
Yeah, I can see that very polarizing topic, everyone.
4:31
I even want to figure out like what's the right answer there.
4:34
I don't know if there is a right answer.
4:35
I think it's just what's the right answer for you, your
4:37
organization, right, that kind of thing.
4:39
Yeah. Well, hey, you mentioned that
4:41
we're going to be at a universe and one of the things that we
4:45
should mention is that we've got a 25% off discount code.
4:50
It's the best discount code that should be floating around out
4:53
there. So my pro tip would be try to
4:57
use it as soon as possible. While the pricing, I think it's
5:01
like still early bar pricing. It's definitely that's going use
5:04
it, abuse it. Yeah, stat uses that IDV 24 DASH
5:11
IDAC 25 S IDV 24 is in the year DASH IDAC as in identity the
5:19
center 25. And we're going to put the link
5:24
in the show notes, but it's events.identiverse.com/identiverse
5:29
2024 slash register blah blah blah blah blah public code.
5:33
They're going to read their thing.
5:35
I was, yeah. When I saw the code I was like
5:37
or the the URL. I'm like no, there's too much
5:40
info stuffed into that URL. And when is it we should say
5:45
about the conference? Well, when is it?
5:47
Yeah, it's May 28th through the 31st, 2024 and guess where it's
5:52
going to be? Does that rhyme with Smash
5:55
Vasis? It kind of.
5:59
It's in Las Vegas, that's what. It might sound like after you've
6:02
been there for a little while. Yeah, right.
6:03
If you. Yeah, if you don't control
6:05
yourself, maybe that's all you'll be talking.
6:09
I think one of the cool things is that by going to the
6:11
conference, you can earn up to 20 continuing education credits.
6:16
If you're at a firm like we are RSM that requires everybody to
6:20
get a certain number of continuing education credits
6:23
every year, I mean 20, so pretty good number for attending a
6:27
conference. And then so in terms of like why
6:31
to attend over four days, 70 hours of thought provoking panel
6:37
discussions, top notch keynotes and hands on master classes and
6:41
trainings connect with more than 2500 digital identity and
6:46
security peers from around the world and during the networking
6:49
receptions and fun interactive group activities like Boot Camp,
6:54
Sunrise Yoga and more. Jeff, I bugged you about this
6:57
last year. Are you going to go to the
6:59
Sunrise Yoga? I can.
7:01
I can unequivocally say hell no. And it's not what I'm about.
7:05
If there was sunrise doughnuts or sunrise chicken and waffles,
7:08
then yes. But yoga?
7:10
No, I'm not about that. Sunrise Dough?
7:13
Yeah, Sunrise Doughnuts. That sounds like a good business
7:16
name there. You go by the domain name.
7:18
Make sure you get that first. Yeah, doughnut sounds good.
7:23
And learn more about the latest innovations on the X-ray floor.
7:28
That's it. Yeah, I've said enough.
7:30
Identiverse.com, use our code. We'll have it in show notes, so
7:33
people check it out. But yeah, show support for the
7:35
show. Use it.
7:36
It stacks with the current early bird discounts, so 25% on top of
7:40
whatever's currently out there. So hopefully people enjoy that
7:43
and we'll be there. So if you say yes, come up, I'll
7:46
be handing out fist bumps of gratitude.
7:48
I had one person actually stopped me last year.
7:51
I know you get all the attention because you're usually wearing
7:53
something that draws attention. Oh, wait till you see the jacket
7:56
that I bought. I cannot wait for this.
7:58
Oh. Man, that's why I love Amazon so
8:00
much. I start going through, I'm like,
8:01
oh. It's Amazon.
8:02
OK, all bets are off now. Well, like, I mean, when you see
8:06
The Shack, you can be like, whoa.
8:10
I don't know if woe is the is what I'll say, but I'm sure
8:13
it'll be a a a reaction of some sort.
8:15
Woe is what you'll say. OK.
8:18
Well, maybe I'll see you at at another conference too, Identity
8:20
week. So we've partnered up with
8:23
Identity Week for other conferences throughout this
8:25
year. We've got Europe which is in
8:27
Amsterdam, June 11th, the 12th. America and Washington DC that's
8:31
where you and I will be at September 11th and 12th and then
8:34
in Asia, Singapore October 22nd, 23rd, we've got a code out for
8:38
that one as well. IDAC 30 get that gets you 30%
8:42
off. We'll have links in our show
8:43
notes for people to register on that and that code actually
8:45
works for all three conferences. So you don't have to be going to
8:48
the American one if you're going to Asia or Europe conferences
8:50
for Identity Week, use that code, abuse it.
8:54
I think it's stacks probably as well with whatever discounts are
8:56
currently out there. So again, we'll have a a link in
8:59
our our show notes for both Identiverse and for Identity
9:01
Week and hopefully people are able to take advantage of those
9:05
savings. Do we have anything else that we
9:07
want to talk about before we get to our main topic of privacy?
9:11
Privacy is a fantastic topic. It has so much to do with
9:15
identity, and if you're in the space long enough, you can't
9:18
avoid it even if you wanted to. Yeah, you could try, but it's
9:22
all around us. I feel like this is an area that
9:24
we haven't talked too much about.
9:26
So I'm very excited to welcome to the show Laura Gomez, Martin
9:29
Esquire. She's the former state chief
9:31
privacy Officer for the state of Maryland.
9:33
And now she's a current colleague of ours at RSM.
9:36
So we're able to get like this super smart people, way smarter
9:39
than you and I, Jim, on the show.
9:41
Welcome to the show, Laura. Thank you, Jeff.
9:43
Thanks for having me. Thanks Jim.
9:45
It's been it's a pleasure to be here with you all.
9:48
So I think you're our first Esquire, which is a momentous
9:51
occasion for us. I don't think we've had any
9:53
other lawyers on, at least none that are at that level.
9:59
You've started off well, I I want to hear about kind of how
10:01
you started out down this path because Chief Privacy Officer is
10:05
not a historic long standing position for a lot of
10:09
organization. It's only recently when I say
10:11
recently probably within the last 10, maybe 20 years at most
10:14
where it's been an actual role with the organizations.
10:17
So I'd love to hear your story. How did you get to that state of
10:22
Chief privacy officer when you were at the state of Maryland?
10:25
And then we can kind of go from there.
10:27
Yeah, sure. So I my my journey there was was
10:31
quite long. It involves a little bit of
10:33
training and a little bit of experience too.
10:36
I was a professional student for about 9 years and between my
10:40
undergrad and graduate degrees I did an undergrad in criminal
10:45
justice, so not really related to privacy, and I wanted to go
10:50
to law school. I wasn't sure what for, so I did
10:53
a masters instead before focused on cybersecurity policy.
10:58
And then I went to law school to study intellectual property and
11:02
technology law, and I took a privacy law class and just
11:06
completely fell in love with it and figured that's what I really
11:10
wanted to do. After I graduated and passed the
11:13
bar, I ended up taking mostly what are called JD preferred
11:17
positions. JD preferred positions are
11:20
generally positions where they like that you're an attorney,
11:23
but it's not necessary for you to be an attorney.
11:27
The skill set that you bring to the table though, in terms of
11:30
negotiating, being able to read contractual language to write
11:33
contractual language is really useful.
11:36
So I ended up going into IT and cybersecurity consulting for a
11:40
while. I did cybersecurity advisory
11:43
work, and through that I I found myself as the Deputy sciselle
11:48
for the Department of Information Technology within
11:51
Maryland. And while I was there, I mostly
11:54
focused on compliance and governance work.
11:57
But unfortunately there were a few incidents that occurred
12:01
within the states that seemingly had privacy implications
12:05
associated with them. And so increasingly it was seen
12:10
as an opportunity to grow that that specific position within
12:16
privacy. Our governor at the time,
12:19
Governor Larry Hogan, found that data privacy and data protection
12:23
was really a strong component of his goals.
12:27
And so he created the state chief privacy position back in
12:31
2021. Actually at the at the tail end
12:37
of 2021. I was the first person to fill
12:40
that role. And my role there was really to
12:44
help all of the executive agencies within the state of
12:47
Maryland to set strategy and policy for them, to coordinate
12:52
with them on any incidents that occurred, to do some proactive
12:57
work in terms of setting standardized contractual clauses
13:03
and language and do reactive work.
13:05
Unfortunately if it came to that and and we were involved in any
13:09
incident. That's a really awesome story.
13:12
I love how you started out with nine years as a professional
13:15
student, but I mean, congratulations.
13:18
Like that's a really great career path and it definitely
13:22
would like to ask some questions before we close out relative to
13:26
how to you know, how somebody else could kind of follow a
13:30
similar path or maybe a totally different path to get to that
13:34
that chief privacy level. Because I'm sure a lot of our
13:38
listeners are interested or know people who are interested.
13:41
But you know, I, I think you come from a unique perspective
13:45
in that having that role in the public sector.
13:49
You know, I think people are asking the question in their
13:51
mind like what is the role of the government in protecting
13:55
privacy? Yeah.
13:56
So the role of the government really is kind of twofold.
14:00
One, there's at the federal level especially, there's
14:04
certain agencies that are in charge of bringing to bear
14:07
privacy privacy litigation against companies and other
14:11
government agencies. So for example, the Federal
14:14
Trade Commission does a lot of privacy litigation mostly
14:19
against private companies but not always and protecting
14:24
consumer rights. Obviously the Consumer Financial
14:26
Protection Bureau also has some privacy requirements
14:29
specifically related to the financial industries and so on.
14:33
So I think in in terms of the one leg of government's role it,
14:38
it has a big role to play in enforcement of privacy and in
14:43
making sure privacy awareness is out there.
14:46
But on the other leg of it that government also plays a really
14:50
important role in collecting data, right.
14:53
So government offers a lot of services, some of which I call
14:58
compulsory are are they're mandated services.
15:01
So you have birth certificates, things like death certificates,
15:04
criminal justice records which you can't get out of right.
15:09
And then there's, there's optional services where if you
15:13
work, you file taxes, you may own a home and file for, you
15:19
know, some rent rebates or or other rebates that you're
15:22
eligible for. And through all of those
15:24
services and the provisioning of all of those services, the
15:27
government collects a lot of data on their constituents at
15:31
all levels, right. So local, county, state and
15:34
federal. And so the government also plays
15:38
a huge role in privacy in terms of needing to be mindful of how
15:43
much they're collecting, why they're collecting it, who
15:46
they're ultimately sharing that data with, you know, sister
15:49
agencies and and so on. 3rd party vendors if they use them
15:53
and contractors and then being mindful of how long they keep
15:58
that data as well. So I was thinking, Laura, that
16:01
there's probably then a third leg of the sole right, which is
16:05
creating new privacy legislation.
16:09
And not every governmental body seems to want to do that.
16:15
And maybe that's a good thing because we're already getting
16:17
this kind of scattered approach to privacy regulation.
16:22
I mean, everybody who's listening to the podcast
16:24
probably at some level familiar with GDPR, right?
16:29
And maybe that's because it's the most, it's been around the
16:32
longest, it's the most famous, it's the most comprehensive, but
16:36
it hasn't stopped there, right. So maybe you can help us kind of
16:40
like is there like do we want to look at this from a history
16:44
perspective or just is there a better way to understand the the
16:48
current landscape in terms of the regulatory landscape of
16:52
privacy? Yeah.
16:53
So I think Jeff mentioned it earlier, but it's privacy has
16:57
become a hotter topic as of late, but it's really kicked off
17:00
about maybe 10 or 15 years ago. Privacy used to be very industry
17:06
specific, meaning it really depended on if you were dealing
17:10
with healthcare information, federal tax information,
17:13
criminal justice records, you had to deal with very specific
17:17
and and niche type of data to be subject to a lot of privacy
17:21
regulations historically. And that's not necessarily the
17:25
case anymore, Jim. To your point, there's
17:27
regulations popping up all the time internationally and within
17:31
the states. So in terms of internationally,
17:36
of course every but most people know the GDPR pretty well, but
17:40
there are a lot of other patchwork regulations worldwide
17:47
and all of all over the continents.
17:50
So we need to be really educating ourselves and being
17:54
mindful of where businesses operate, even where their
17:58
employees are, because a lot of times these regulations tie to
18:03
the physical location of personnel, not necessarily their
18:07
citizenship or their residency. And so being mindful of that is
18:12
something that's increasingly important.
18:14
And of course, in the United States specifically, we are at
18:18
the point where right now we have about 13 states that have
18:22
privacy laws on the books already and that's an an
18:26
increase up from about 7:00 just the previous year.
18:32
So we went from 7 to 13. And then there's seventeen more
18:36
states right now that actually have privacy legislations
18:40
currently or have privacy legislations and statutes
18:44
currently going through their legislative process.
18:46
So you can imagine that that creates a huge influx of
18:50
regulations and some patchwork that needs to be accounted for,
18:55
especially if an organization or a company operates on a national
18:59
level and within various various states.
19:03
So there are thankfully some central tenants and some central
19:06
best practices that are found throughout all of those laws.
19:11
But there are nuances here and there, and those are those are
19:14
the pieces you really want to be paying attention to closely as
19:19
you move forward. Yeah, it's so complex.
19:21
And you know, what I'd like to eventually get to is like what
19:27
advice would you have for I am practitioners like Jeff and I
19:32
and the most solutions of this podcast, Frankly, people who are
19:36
trying to take this complex, I think use the great work like
19:41
Patchwork or it's like a quilt of different regulations all
19:45
over the the world and mentioned national companies.
19:48
What about international companies or you know, so now
19:52
they've got GDPR and potentially all these state regulations and
19:57
maybe there are other privacy regulations outside of the US
20:01
that affect them. What is your advice?
20:04
I guess I'm presupposing in my mind that what you're going to
20:07
say is like. Take the the most restrictive
20:11
from anywhere that you operate and like, try to live by that.
20:14
But I think in a lot of ways that could be like really
20:17
difficult to do and it's like, OK that that sounds like a good
20:21
approach, but is it realistic? Yeah.
20:23
So I think my my main advice would be you never want to move
20:28
so fast that you are moving faster than than these laws.
20:33
And because they are coming up all the time, you do want to
20:36
make sure that, yeah, you operate of course to sustain a
20:41
business, but you want to be mindful that these laws exist
20:45
and you don't want to run afoul of them.
20:46
Especially let it laws like the GDPR in Europe where there's
20:52
been multiple suits already against companies.
20:56
You want to be protecting yourself as much as possible,
21:00
mindful of of the restrictions and the consent orders that you
21:03
need to put in place and get from proper permission from your
21:07
customers. But the main thing is you always
21:10
want to do right by the your customers and the people you
21:13
serve. And so really in terms of advice
21:17
for, for companies dealing with that global privacy regulation,
21:21
it's being aware of what your operations are.
21:27
And I'll say this, even business to business operations require
21:33
some knowledge and some implementation of privacy
21:36
standards. Because even if you're selling
21:39
to other businesses and other corporations, you have employees
21:44
and you have their personal identifiable information.
21:48
And so you may share, for instance, when you're hiring
21:52
somebody, you may share their resume, you may share their
21:55
backgrounds for background investigation purposes, drug
22:00
screening and so on with third party vendors.
22:03
And so even though they are not a customer of your organization,
22:09
they are still somebody you need to be mindful of in terms of
22:12
privacy practices. So that's where I try to
22:16
highlight that you need to be not only thinking of your
22:19
operations, but also where your employees are, where they're
22:22
located and and keep that in mind as you move forward.
22:26
In terms of privacy, there are a lot of organizations who on the
22:30
surface may think, well, I don't really handle any PII data.
22:36
You know I sell gadgets and and gizmos, I don't know what that
22:39
has to do with with anything and but that's not true privacy.
22:44
Privacy matters to to all companies.
22:47
You know, one thing I've I've seen identity practitioners not
22:51
be confident in answering is questions around data residency.
22:57
And So what I mean by that is, OK, we're implementing a work
23:02
day solution. Do we need to have a work day in
23:05
each one of the locations? Because the this data about
23:09
employees can't leave the boundaries of, you know, the EU
23:14
or maybe China or something like that.
23:17
And So what kind of advice, what would you give when it comes to
23:21
that? Sure.
23:22
So I'm going to give a very Esquire type of answer here Jim,
23:26
but the answer is it depends. And the the reality is some of
23:32
these regulations on the service require things like the
23:38
prohibition of cross-border data transfers and so on or require
23:44
certain data hosting locations. And then aside from the
23:47
regulations, there's also contractual regulations.
23:51
So you may enter into third party agreements or vendor
23:55
contracts where whoever you're partnering with or whoever
24:00
you're using services from requires you to limit where that
24:05
data can go and who that data can be shared with.
24:08
And that's also another thing to keep in mind as you enter
24:11
contractual arrangements with other vendors and companies is
24:16
what requirements, what privacy requirements do they have and
24:20
does that flow to you by virtue of partnering with them as a
24:25
result? It seems like there's a lot of
24:28
companies that make their privacy policies intentionally
24:31
long and complex. I think back to like, Euless,
24:34
everyone's favorite thing, right?
24:36
Scroll. Scroll.
24:37
Scroll, accept. Right.
24:39
Did I read it? No.
24:40
And you know, there's stories right?
24:41
Of hey, if you find this text, you got like a huge discount or
24:44
free car, or you sold your soul to somebody.
24:48
Why is that? I mean, it feels like it's so
24:50
filled with regal speak. And you're, you're a lawyer, so
24:56
I'm gonna put those to you. It's like, why can't these be?
25:00
I, I guess more readable. It's almost like they don't want
25:03
you to read them. Am I crazy for trying to be a
25:06
normal human being and read something that I hope that I can
25:08
understand? Or is there a reason why they
25:10
have to be as complex? I guess What would you like to
25:12
see in the space? Yeah, so I would love to see
25:16
shorter, more user friendly, maybe even graphical consent and
25:24
permissions. Something that's in plain
25:27
language and uses plain language policies or plain English
25:31
policies. However, you know a a central
25:36
tenant of privacy really is to get a user's informed consent
25:41
and obviously adjust to your point when these privacy
25:44
policies are long and lengthy and they don't really encourage
25:49
or empower somebody to read through the whole thing, how
25:52
much informed consent can you be giving in that case?
25:56
But many companies unfortunately create these lengthier, more
26:02
vague policies and in an effort to really accommodate to future
26:07
use of the data that they're collecting.
26:10
And what I mean by that is if they were too prescriptive and
26:14
concise in their privacy language and limiting and
26:19
listing out, for instance, we're only sharing it with these
26:23
specific three partners and we're only doing it for very
26:28
specific ADC type of purposes. It limits their ability to
26:34
perhaps find a different partnership next year that they
26:38
can use that data for. And so because of that, these
26:43
lengthier policies end up using very big language.
26:47
For instance, we can use your data for research purposes, but
26:52
it doesn't actually tell you what type of research purposes
26:55
or who they're going to be sharing that with.
26:58
It will say that they are able to share it with third party
27:02
vendors or third party service providers, but it doesn't
27:05
necessarily spell out who and that's that's vague enough so
27:10
that it can can accommodate any new partnerships they have, any
27:13
new ways that they can leverage that data and you know cross
27:17
sell it or use it for other marketing purposes and so on.
27:21
And so there's really a balance to strike between getting the
27:25
information and being able to use that information as a
27:30
company, but also being careful to be mindful of the customers
27:37
you're serving and what their agreement probably was when they
27:43
signed on to that permission. I want to go back to something
27:46
you mentioned about informed consent.
27:49
If I came to a lawyer and I this is not legal advice, don't come
27:52
to identity. It's not.
27:53
For legal advice. First of all, we put that out
27:55
there. But if I came to somebody and
27:57
said look, they threw 45 pages of legalese at me and I and all
28:03
I wanted to do was share a photo with my grandma or something
28:07
like that. Would I have a case that says
28:10
you guys made it? Like the the the company made it
28:12
too obtuse for me to be able to understand as a normal language?
28:16
Would I have a case to say that's not really informed
28:18
consent? It's a bunch of legal jargon
28:21
thrown at me to protect all the different use cases and the way
28:26
you described it. Very simple, right?
28:28
Why didn't you just write that rather than 45 pages of legal?
28:32
Would I have a case to say that's not really informed
28:34
consent? Because no normal person who
28:37
isn't a trade lawyer is going to be able to decipher what all
28:41
these clauses and statements and if then statements that come
28:44
through it right, That may be either.
28:45
Yeah. So I hate to speculate on
28:48
somebody. I don't.
28:49
Want to get you in trouble Again, this is not legal advice.
28:52
I'm just like, it seems crazy to me.
28:54
It's like, oh, you know, you're expected to be able to
28:57
understand all this, but I don't know if that's necessarily a
29:00
fair ask from the company who's presenting you all this
29:03
information. Right.
29:04
Yeah. Well, I'll say this, I don't
29:07
think I as an attorney you would say, I don't think I have know
29:11
enough about the facts to speak on the legality of somebody
29:14
standing on that. But I think but companies do
29:17
have to strike the right balance.
29:20
And as privacy becomes a hotter topic, you know, in the last
29:24
couple of years and and into the next few years and hopefully
29:28
decades to come, I believe privacy.
29:32
I believe companies that emphasize privacy will say that
29:35
and focus on treating their customers ethically will be
29:41
rewarded with higher customer retention and satisfaction
29:45
moving forward. So being mindful, doing right by
29:49
your customers I think will go a long way.
29:53
I I feel like Jeff, one of the your famous lines is if you're
29:57
not paying for the product, you are the product.
30:00
I heard there was a social media company and won't name names,
30:06
but that in their privacy policies essentially said if you
30:11
upload a picture or something, it's now their property.
30:14
So could you imagine uploading that picture with your grandkids
30:17
and then you see it on the Billboard?
30:18
Like come use our site, you know, look how happy our users
30:22
are. I mean, that's real damages as
30:25
far as I'm concerned, right? I'm not a lawyer.
30:27
So I'm, I'm going to go out there and say that's damages.
30:30
That's not, that's a violation of privacy, right.
30:33
And if somebody doesn't read 44 pages of mumbo jumbo, to me it's
30:37
kind of like when you go to a grocery store and they have a
30:40
sign like, you know, if our cars hit your car, it's not our
30:45
fault. Like just because you say it's
30:46
not your fault doesn't mean it's not your fault your property
30:49
damaged my property. So that's my opinion, right as a
30:53
as a non Esquire. We have never had an Esquire on
30:56
the show. And Jeff, you and I have been on
30:57
every show. So like, take that with a grain
31:01
of salt, but here's what I wanted to throw out there larks.
31:04
I've had this idea. It's kind of a crazy idea, so
31:07
I'm gonna throw it out there. So my idea was, what if there
31:10
were certain categories of privacy policy, like Privacy
31:14
Policy A, Privacy Policy B, Privacy Policy C so you could
31:20
get to know at a high level what AB and C were?
31:24
And then if a company said we follow, we we use privacy Policy
31:27
B, say, oh OK, I know what B is and I'm willing to give you
31:32
access to B. Or is it is that way too simple?
31:36
So I I think that the danger with that is that it, it does
31:41
seem to overly simplify the complexity sometimes of these
31:46
data sharing agreements that these companies have and the
31:51
resourcing and the outsourcing that they do to 3rd party
31:54
service providers for instance who may host their data or who
31:59
they use as managed service providers for IT support and so
32:02
on. And so depending you know some
32:06
companies want to do all of that in house and some companies
32:10
outsource it and some companies do some outsourcing and some in
32:14
house combinations of services. And so because every company
32:20
really would be providing different services and using
32:25
different vendors, I think it would be really hard to do that
32:29
in terms of having a a privacy ABC type of policy.
32:35
But I don't think it's a, it's an unreasonable ask for
32:39
companies to start simplifying the privacy policies that they
32:43
do have and just making sure that they are communicating
32:47
clearly and effectively and openly to their customers that
32:53
this is exactly what we're doing with your data.
32:56
Any deviation from this will require us to reach out to you
32:59
for further consent moving forward.
33:04
So you handled our soapbox version very well.
33:08
I'm going to get off of that, but I want to talk about
33:10
expectations. Are there differences and
33:13
expectations between public and private companies?
33:18
I guess what is, you know, what is the difference there that you
33:21
see when it comes to the expectation of privacy?
33:25
The expectation, sorry Jeff, just to clarify between private
33:28
companies and non private companies.
33:32
Yeah. So it could be private, could be
33:34
non private, it could be government.
33:36
Are there, I guess the different levels of expectations that
33:39
might be that, oh, I thought this was private, but it's not
33:42
really or maybe things that are well known, the opposite, right,
33:47
something like that. I guess I'm just trying to
33:48
understand what are the different expectations between
33:51
them. Yeah and sure.
33:53
So I think the best way to kind of summarize the the difference
33:58
in expectations is probably the difference that I think the
34:03
consumer or the user of the product or services actually
34:06
feels when they're engaging with different types of companies and
34:10
entities, which is often times when a person is interacting
34:16
with a government agency, for instance, they don't tend to
34:20
think that government agency is doing analytical research on on
34:26
their data that they're gathering from constituents.
34:29
They don't tend to think that they are partnering with other
34:33
sister agencies and sharing that data.
34:36
So I think the assumption from the public when interacting with
34:41
something like a government entity is that they keep all of
34:45
that information in house. And while that may be true at
34:50
some agencies, at a lot of agencies they do share data with
34:53
one another in terms of identifying people, making sure
34:58
that people are not behind on certain payments and
35:01
requirements that they are legally obligated to apply to
35:04
and and so on to receive public services.
35:08
And so when it comes to private companies, especially to Jim's
35:14
point earlier, where if you're not paying for the service, you
35:20
are the product. I think a lot of people are
35:24
under the assumption that that is the case, that if you're not
35:28
paying for a service, you are somehow providing them some
35:33
benefit via your data, whether that's selling it, doing
35:37
analytics on it, opening yourself up to marketing emails
35:41
and so on. So I think that's really the
35:44
difference in expectations, is what the consumer themselves
35:49
thinks is happening. But the reality is companies,
35:53
nonprofits, government agencies, all of them share data to a
35:58
certain extent. And so that's why privacy
36:01
policies and privacy rights are are really increasingly
36:05
important. So we've been kind of talking
36:08
about it here, but social media, I would imagine when we talk
36:11
about being the product, I feel like that's a prime example of
36:15
that. Now you can make the argument
36:17
it's like, yeah, it's great. I'm able to have conversations
36:20
on X social media platform with people that I wouldn't normally
36:23
be talking with or I stay in contact with, but I'm trading
36:27
that ease of use or that functionality for something.
36:32
What are some of the concerns that social media brings to the
36:35
table when it comes to privacy? Sure.
36:38
So I would say not only social media, but even just apps in
36:43
general. I think some of the concerns
36:47
that are brought up with that are really things like intrusive
36:50
access or additional access than what's necessary for that app to
36:57
function or that social media platform to function.
37:01
So for instance, if you download something, I had this happen,
37:05
this was a long time ago, but I I downloaded a flashlight app.
37:10
This was before smartphones came with flashlight apps, and I
37:14
downloaded a flashlight app and it said you grant this app the
37:19
ability to read your text messages.
37:21
And I thought to myself, why do they need to read my text
37:25
messages just for a flashlight function on my phone?
37:31
So there's things that like that that come up even now where
37:36
social media platforms or apps just they try to light up a
37:41
little bit more than maybe what's necessary for them to
37:44
have access to. They also have the excessive
37:49
privacy and lengthy privacy policies that we were talking
37:52
about earlier where people just accept and and agree to share or
37:57
perhaps even to Jim's point, give up some ownership of what
38:02
they upload to that platform. And another concern is really in
38:09
terms of unnecessary or excessive marketing and sharing
38:13
of of your information, which is you may sign up for a social
38:18
media platform or an application and suddenly you start getting
38:22
emails from a lot of other companies who you've never
38:26
interacted with. You don't know how they got your
38:29
information. I actually get this quite often,
38:33
even through snail mail. So I'll get ads or I'll get
38:39
magazines that I did not subscribe to, and I have no
38:42
idea. I've never visited that
38:44
company's website. I've never been anywhere near
38:48
that magazine, so I'm not sure how it came to be in my in my
38:52
mailbox. And so things like that are
38:55
always concerning, you know, just how did you get my
38:59
information? And please, take, please take me
39:01
off your list. Yeah.
39:05
It seems like all those traces back to that comment.
39:08
I think these are with which is the context matters like it's an
39:12
it's depend. It depends which makes you not
39:16
only a great lawyer but a great consultant as well.
39:20
But I, you know, I even think like the context of you as
39:23
private private citizen versus you as an employee of a company.
39:28
So the context of who you're dealing with, whether it's
39:32
government or your employer or some private company they have
39:39
relationship with for maybe a credit card or some company that
39:44
came up with the flashlight app, which is really is, you know
39:46
potentially just trying to get your data so they can sell it
39:51
which or read your text messages, that's super creepy.
39:55
Anyway, you mentioned that you have a cybersecurity background,
39:59
so. Really.
40:00
A privacy person to the core, Esquire, but also a
40:05
cybersecurity background. So imagining that is helpful
40:10
when it comes to what you're doing Now.
40:14
The thing that came to mind was, you know how I think it's GDPR
40:18
really caused this, which is every website you go to now,
40:22
it's like the first thing you have to do is like you accept
40:24
their cookie policy. I don't know how that makes
40:28
anything better, because like every single site requires you
40:31
to accept the cookie policy. If you don't accept cookies,
40:34
you're not going anywhere on the web.
40:36
Yes. Yeah.
40:37
So in terms of cybersecurity and how that's been helpful to me is
40:43
I I think it provides a lot more context around the fact patterns
40:50
and the incidents or the situations that I encounter with
40:55
customers and clients before and now are the clients that I serve
40:59
as a consultant. But privacy and cybersecurity
41:03
are really what I like to say, two sides of the same coin.
41:07
They're very complementary to each other.
41:09
In my mind, the Venn diagram between them really overlaps.
41:15
I wouldn't say it's it's a complete circle but there's
41:18
there's a lot of overlap between the two topics.
41:21
And so in terms of a question I get asked quite often is what is
41:27
the difference between cybersecurity and privacy.
41:31
Especially when I became the state chief privacy officer I
41:34
got this question a lot from friends and family asking I
41:37
thought I thought you were doing that before as as a deputy Sizzo
41:43
and the reality is they're connected, but they're not quite
41:46
the same. So the way I think of
41:48
cybersecurity is once you have the data and the infrastructure
41:53
in place, what controls are you putting in place to make sure
41:56
that you are locking that data down, being mindful of the
42:01
sensitivity of the data and etcetera.
42:04
Privacy, to your point on cookies, is more front loaded in
42:09
terms of actually gathering the data, making sure that you're
42:14
only collecting that data what you need.
42:16
You're not being overly prescriptive and what you can
42:20
collect from your customers and consumers of your services or
42:24
products and being mindful to put in place retention policies.
42:30
You know data gets deleted after X number of months or years or
42:34
when it's no longer useful to the company or the entity.
42:38
And cyber and privacy really have to work together a lot to
42:42
make sure that privacy considerations are taken into
42:48
into the fold when cybersecurity parameters and controls are
42:52
being established and vice versa.
42:54
So, you know, cybersecurity then reaches back out to privacy a
43:00
lot, perhaps during incidents, unfortunately, if there's
43:05
there's implications that some PII or some very sensitive
43:08
information was affected in that incident.
43:14
So as I mentioned earlier in the podcast, I think that there's
43:17
got to be so many of our listeners out there who are
43:20
interested in a career in privacy and, you know, hear your
43:24
story and would love some advice in terms of how do they get into
43:29
this exciting field and move to a senior leadership position.
43:34
What advice would you give them? Yeah.
43:35
So I think my main advice would probably be that they should do
43:40
lots of learning and reading. They they don't necessarily need
43:45
to be an Esquire. There are quite a bit of chief
43:49
privacy officers that are attorneys or were attorneys at
43:55
one point in their careers. But it's not necessary.
43:59
I think more So what you need is the ability to read, articulate,
44:08
write concise language, work on compliance and governance issues
44:15
and really be mindful of consumer protection.
44:19
So privacy to me is really an extension of consumer
44:23
protection. It's making sure that that
44:26
companies are doing right by their customers and their
44:29
clients that that ultimately those customers have the right
44:34
to be able to interact with that company and ask them what type,
44:39
what type of data do you have on me, how is it shared limit
44:43
perhaps that company's data that they have on them be able to
44:47
request deletions or corrections and so on and and just be open
44:52
and honest with those people that are using their services or
44:56
buying their products. So I think the best, the best
45:01
advice I would say for somebody starting a career in privacy is
45:04
to make sure that you are passionate about constantly
45:08
learning to our points earlier with the patchwork pulled up
45:13
regulations in place and you know it's constantly growing
45:17
day-to-day, month to month and year to year.
45:20
You really need to be mindful that what you know today could
45:25
change in two months and you're going to have to keep up with
45:31
with all of that to keep pace. I wanted to wrap up with the
45:36
kind of a funnier question. I don't know how fun this is,
45:38
but we always love to talk about AI and deepfakes and it's kind
45:43
of like cutting edge. I don't think there's anyone who
45:46
knows for sure how this is going to play out, but wondering what
45:50
your level of concern or how you think about AI deepfakes and how
45:56
it's going to affect privacy. And you know, even like, I think
45:59
there's a low tech version of that, which is identity theft,
46:03
right? And that kind of all feels like
46:05
it. It's part of your Venn diagram,
46:08
as you know. Where does identity and privacy
46:11
overlap? Identity theft is definitely in
46:14
that intersection. But what about the AI and
46:18
deepfakes? Where?
46:19
Where's your head at with that? Yeah.
46:21
So the AI deepfakes, the biggest threat really is to data
46:27
protection and proprietary information.
46:30
And we've seen this, yeah, even before AID fakes became a thing,
46:36
which is, you know, targeted social engineering campaigns by
46:41
criminals to try to get finances moved around within
46:45
corporations, get some proprietary information that
46:48
they wouldn't be Privy to otherwise.
46:51
And things like, for instance, AI voice cloning is really
46:55
concerning to me. That somebody would be able to
46:58
call someone they work very intimately with day-to-day and
47:04
clone someone else's voice. Their business partner, their
47:07
boss, somebody within their organization, and make a
47:11
believable argument that they should transfer funds or they
47:14
should close an account and so on.
47:17
Grant excessive permissions to somebody that either doesn't
47:21
exist within the organization or shouldn't have those
47:23
permissions. That's all really concerning and
47:27
I think what is most concerning about it is that I I don't think
47:32
companies are quite keeping up with training their staff
47:35
adequately to accommodate for these new situations that are
47:41
going to be occurring that have occurred and will be occurring
47:45
increasingly in the future. Meaning, a lot of us have been
47:48
through cybersecurity training, perhaps we're some of us are
47:53
probably subjected to the phishing emails that that you
47:56
get as testing to make sure that you recognize phishing emails
48:01
and report them adequately. But it's also very important to
48:05
train your staff on these AID fakes that exist and have them
48:10
also be mindful that they may get a phone call, they may get a
48:14
text message, they they might get a voicemail from someone who
48:21
it's not actually who they think they're talking to.
48:24
And so being able to really educate your staff and your
48:28
employees on that and protect your organization is, is really
48:33
important. You also mentioned identity
48:37
theft, I think Jim, right. And so I think I have really big
48:41
concern there is just how does somebody prove that it wasn't
48:47
them, which can be hard to do. So for instance, when you call
48:53
certain service providers or certain vendors, you get the
48:57
standard, this phone call will be recorded and it's going to be
49:02
very hard at times for somebody to prove that that that's not
49:07
actually me talking even though it sounds exactly like me.
49:12
And so I I think we'll see that moving forward too.
49:16
I find that interesting that you kind of flipped it.
49:20
Where I thought you would go is how do you prove that someone is
49:23
yourself wait that you are you Now we're talking about how do
49:27
you prove that wasn't you. I mean it's you always feel like
49:30
we're we're caught between a rock and a hard place here where
49:33
it's like OK we have to be concerned about if I call in
49:35
somebody you know historically in the US at least they'd ask
49:39
for last four of your social number which should never have
49:42
been used that way but too late that's how that's how they and
49:45
now it's well, I called and that wasn't me.
49:48
Well prove it like how you supposed to.
49:51
Yeah. I mean it's like you're going to
49:52
have to like. I feel like it's it's such a
49:55
difficult balance that we need to strike here.
49:59
Yeah, I agree. It's it's not something that we
50:03
we want to have to do, but I think it's something that we're
50:06
increasingly going to have to think about.
50:08
OK. Well, I appreciate you being
50:09
part of this and our shenanigans.
50:13
I want to end on a lighter note, and I got to weave privacy into
50:16
that because it's just this is how we roll here.
50:20
You're also a mother of two boys.
50:22
What's the most surprising thing your boys have taught you about
50:26
privacy? Yeah, well, that's a good
50:28
question. I think the most surprising
50:30
thing my boys have taught me about privacy.
50:33
My boys are still quite young, so they're not, you know,
50:36
they're not on tablets, they're not on cell phones or anything
50:39
like that. But I think even now that their
50:43
preschool age, what they taught me is to set boundaries with
50:47
people in my life. And what I mean by that is I
50:51
live in the United States, a lot of my family is overseas, and
50:56
they use Facebook quite frequently to communicate with
51:00
me or to see updates or photos of my children.
51:03
And what I've learned is that there's times where I've had to
51:08
set boundaries with family members, because I'm very
51:11
mindful of my privacy permissions on certain
51:15
platforms, but other people may not be, And so they can download
51:23
pictures, upload pictures, and, you know, perhaps they don't
51:28
have as restrictive of permissions as I do.
51:32
And so I I think that's something important to keep in
51:36
mind not only for myself, but I think for listeners as well to
51:40
make sure that it's it's not just about what you're sharing,
51:45
it's about what people around you can share about you as well.
51:50
I can, I I mean, it's not the same story, but I hate when my
51:54
wife posts picture of me on Facebook.
51:55
Like, no, stop it. Don't do that.
51:58
I just don't want to be on there, Jim.
52:01
You've got, you've got a couple boys has have they taught you
52:03
anything about privacy? Yeah, they're and minor
52:06
teenagers. I have a little bit of A twist
52:10
on this, which is that gone through various stages with my
52:14
kids and one of the stages was they're playing Little League
52:17
baseball. And the people who run our
52:19
Little League are honest people. So I don't want this to reflect
52:23
on them. But their website technology was
52:26
like, they had like their homemade website and it was
52:29
like, come in, create a profile, put all your private data in it
52:33
and then, you know, submit. Here's the thing.
52:35
This is what really bothered me about the whole thing.
52:38
Like, you know, this database is getting cracked, right?
52:41
And all this data is ending up in the dark web.
52:43
So you try to fix some, pick some password that definitely,
52:47
if it ended up in the dark web, wouldn't allow somebody to get
52:51
into something important, right? But also, you just knew all that
52:55
data is just, I know that most people don't know that, but
52:59
like, there's almost like a guarantee.
53:02
But the thing that bothered me about it was it was like either
53:06
fill this information out or don't let your kid play a Little
53:09
League baseball. Those are your choices.
53:11
And I was like, man, then like, because if it wasn't for the
53:16
kids to go do something that they wanted to do, I don't know,
53:19
like, sorry, I'm, you're not getting my data.
53:22
So, you know, I don't know if that's what my kids taught me,
53:27
but I would not have been in that situation otherwise.
53:30
So there you go. That's my story.
53:31
What about you, Jeff? Well, I don't have kids so but I
53:34
take my my personal privacy, you know, very seriously.
53:38
I don't want my data out there either, so I can't add anything
53:41
on the on the child front. But I got a follow up question
53:43
for you Jim. Do your kids know that they're
53:46
older? And Laura, be interesting to see
53:48
how maybe years progress as they go older, but do they think
53:52
about the privacy implications of the services that they're
53:54
using or they just sign up for stuff?
53:58
I don't think so and I think my 16 year old is just constantly
54:02
on social media like just all the time now.
54:06
I've noticed from my older son, he seems to be less and less
54:09
absorbed in it, which I'm hoping happens with my my younger boy
54:13
too, because so little story. I took my younger son to a
54:18
college baseball game at Clemson this weekend and I was looking
54:22
around and like the people who are in college, they weren't
54:25
like sitting there like glued eyeballs on their phone the
54:29
whole time. They were talking with their
54:30
friends and interacting, having a good time.
54:33
So I think the hope for me is that they grow out of it a
54:37
little bit. I my personal feeling is like, I
54:41
think it's like destructive to society overall, having people
54:47
like with their eyeballs glued to their devices all the time
54:50
and like living on social media. And I think especially for young
54:54
kids that, you know, there's so much cyberbullying going on.
54:59
Like as a parent it, you know it scares you.
55:03
But you know other than having like some kind of net nanny
55:06
software that you can spy on them 24 hours a day, how would
55:09
you even know it's happening? And so, yes, that very much
55:12
concerns me. Or do you want to add anything
55:15
to that or later? No, I.
55:17
I can't wait to get to that later on down the road.
55:19
We'll punt. Yeah, I I I'm not sure I go back
55:23
and forth on you know that I get asked a lot.
55:26
Well at what age are your kids gonna get cell phones?
55:30
And yeah I go back and forth on saying never or when they move
55:34
out of my house and and and you know that the functional use of
55:40
a cell phone which is when they're out of your sight and if
55:43
there's an emergency they can reach you.
55:45
And so that balancing act is is a hard thing to strike the
55:51
proper permissions and use and and and going a little bit too
55:55
far opening them up to being able to be bullied at all hours
56:01
or or even messaged at all hours that you know even nice messages
56:05
from friends do they really need to do that all day long and so
56:11
on. But I do want to touch on
56:13
something that Jim mentioned which is that his children would
56:18
not have been allowed to play that sport unless he gave that
56:23
information up. And that's something I try to be
56:26
really mindful of. As with the the flashlight
56:29
example that I mentioned earlier is why.
56:34
Why do you need this information?
56:36
You know, there's there's information you might need for
56:39
my son to be able to play baseball, such as his age,
56:43
because you want to make sure he's on the right team or shoe
56:46
size or, you know, uniform size or glove size and so on.
56:52
But there's other information that is probably not necessary
56:55
for me to provide. It's one thing for you to know
56:59
the school district he's at. It's another thing for you to
57:01
know his his student ID or God forbid his Social Security
57:06
number, me to have his birth certificate on file and so on.
57:11
There's just things you you need for certain services and
57:15
products and things that you don't.
57:16
And so I think that's important for individuals to keep in mind
57:21
as they move forward using products and services and
57:23
companies. But it's also something for
57:26
companies and entities to keep in mind as they build out
57:29
processes and just making sure that they're limiting what
57:34
they're asking and really only asking for that which they need.
57:39
I think that's great advice. I don't know if we can end on a
57:41
better note than that, so we'll probably leave it there.
57:45
Laura, thank you so much for being part of this.
57:48
It's great working with you and having you on the show and being
57:50
able to bring your expertise. I'm sure there will be privacy
57:53
things that come up. And I'm going to nominate you to
57:56
be our reporter in the field for privacy things and come back.
58:00
And if you're willing, talk to us about things that might be
58:02
changing, you know, in in the world or the US or whatever it
58:04
may be that folks in our space should be cognizant of us.
58:07
So thank you so much for taking the time with us.
58:10
We'll leave it there. We're on the web.
58:12
IDC, podcast.com, Twitter, X, whatever it's called When you
58:16
listen to this at IDAC Podcast Mastodon.
58:19
I don't want to forget that Jim got on me last time on not not
58:21
mentioning Mastodon at IDAC Podcast at Infosec dot exchange.
58:26
We're on LinkedIn, We'll have links in our show notes.
58:28
You can connect with Jim, Laura, myself, if you've got questions
58:31
about anything that came up. And yeah, like subscribe, do all
58:35
that stuff, share it with a friend.
58:36
We continue to grow, which is awesome.
58:38
Be sure to use our conference discount codes and we hope to
58:40
see you at Identity Week and Identiverse later this year.
58:43
So thanks everybody for listening and we'll talk with
58:46
everyone in the next one. You've been listening to
58:49
Identity at the Center. We hope you've enjoyed the show.
58:53
Make sure to like, rate and review and we'll be back soon.
58:58
But in the meantime, hit the website at
59:00
identity@thecenter.com and find us on Twitter at IDAC Podcast.
59:07
See you next time on Identity at the Center.