Latest / The FIT4Privacy Podcast | Exploring ISO Standards AI Privacy | Grow Skills Store / How is Privacy Changing with Tania Palmariellodiviney and Punit Bhatia in the FIT4PRIVACY Podcast E159 S07

Transcript

How is Privacy Changing with Tania Palmariellodiviney and Punit Bhatia in the FIT4PRIVACY Podcast E159 S07 · The FIT4Privacy Podcast | Exploring ISO Standards AI Privacy | Grow Skills Store

• 0:00
  How is privacy changing in the AI world?
• 0:03
  Well, yes, Sir, we always talk about digital trust, we talk
• 0:07
  about keeping data safe. But then AI creates a lot of
• 0:11
  simplicity or maybe complexity in terms of privacy.
• 0:15
  And then we'd say, OK, rely on ethics.
• 0:17
  And then we need to know what are the privacy challenges we
• 0:21
  have. So all this is very interesting
• 0:24
  and intriguing to know about, but what about having a
• 0:27
  conversation with a fellow privacy expert and exploring all
• 0:31
  these questions and seeing how is privacy changing in the AI
• 0:35
  world? I'm going to talk to Tanya
• 0:37
  Palmeralo Devini, who is going to have a good conversation with
• 0:42
  us. And as we do that, take
• 0:44
  advantage of Grow Skills dot store.
• 0:47
  We have some ISO courses for you.
• 0:50
  Welcome to the Fit for Privacy podcast, where your host, Puneet
• 0:53
  Bhatia discusses the latest trends, challenges and
• 0:56
  opportunities in privacy, artificial intelligence,
• 0:59
  sourcing, and related fields with industry leaders and
• 1:01
  experts. Whether you're a professional
• 1:03
  business leader or just passionate about topics like AI
• 1:06
  and privacy, this is your go to place for insightful
• 1:09
  conversations and practical advice.
• 1:12
  The Fit for Privacy podcast is brought to you by Fit for
• 1:14
  Privacy, your trusted partner in AI, privacy and sourcing matters
• 1:18
  and gross skill Store. Your go to destination for top
• 1:21
  tier training on ISO standards and key EU regulations.
• 1:25
  Remember that opinions expressed in this podcast are not legal
• 1:28
  advice. Now it's time to dive in today's
• 1:30
  episode. So hello and welcome to the Fit
• 1:36
  for Privacy podcast. Another episode and we have a
• 1:40
  privacy expert, AI expert, AI governance expert who's going to
• 1:43
  share with us her thoughts and her name is Tanya Palmarella
• 1:48
  Dovini. I hope I pronounced it OK.
• 1:51
  Very well. Thank you.
• 1:53
  Thanks for being here and welcome to Fit for Privacy
• 1:55
  podcast. Thank you for having me, it's a
• 1:58
  great honour. It's a pleasure.
• 2:01
  So let's start with the basic premise.
• 2:04
  We do data protection, we do AI, we do security and risk and
• 2:09
  governance. And the end objective is trust,
• 2:13
  trust of customer and that trust in the digital world, AI world,
• 2:18
  the emerging technology world is changing to what we call digital
• 2:22
  trust. Now give us a few thoughts on
• 2:26
  how do you see this digital trust.
• 2:29
  So I think for me, so my background is very much in
• 2:32
  health and social care and also also commercials as well.
• 2:37
  But if you think about people, the digital trust means that
• 2:40
  they're going to give you the data, whatever environment and
• 2:44
  trust that you will a use it responsible BB transparent about
• 2:48
  it and also protect it. So that's digital trust and
• 2:52
  what's it sounds simple. We know it isn't because
• 2:55
  obviously people, for example, if I ask you a question, if you
• 2:59
  go to your GP and you talk to your GP and you give them all
• 3:02
  your personal information, maybe information you wouldn't talk to
• 3:06
  your family about. Do you normally ask him or her?
• 3:10
  Do you say oh, what you're doing with my data?
• 3:12
  Or do you just talk about your issues so you receive care What,
• 3:15
  what would you do? What do you do?
• 3:17
  I think the question has the answer that I trust the GP to
• 3:22
  keep my data safe. Absolutely.
• 3:26
  And if you think about this in, in, you know, historically, we
• 3:30
  were born with this notion of confidentiality, right?
• 3:33
  We talked to a healthcare professional.
• 3:35
  They're going to keep it confidential.
• 3:36
  But in this day and age, what actually happens when you leave
• 3:39
  the consultancy room or even when you are in the consultancy
• 3:42
  room, they're going to put your data on a computer.
• 3:46
  So it's the confidentiality, the verbal confidentiality is
• 3:49
  maintained and you can trust them.
• 3:51
  However, once you put it on a computer, there's a lot more
• 3:54
  infrastructure, people, suppliers you will have to
• 3:58
  trust. Yeah.
• 4:00
  And I think this is sorry, no. No, go ahead, go ahead.
• 4:04
  And I think this is what makes me so excited discussing this
• 4:06
  topic. It's something where people
• 4:09
  really don't think about. We think, oh, you know, clients
• 4:11
  trust us. They or patients trust us, they
• 4:13
  don't care. That's not true.
• 4:14
  They trust us because they have this notion of confidentiality
• 4:18
  and they they trust us that we will respect the data.
• 4:21
  No vision statement, whether commercial or in health will say
• 4:25
  we do not care about our clients.
• 4:27
  So therefore for me, if you care about your clients, you care
• 4:30
  about that data. I agree with you 100% and you
• 4:36
  put in the notion of confidentiality, but then in the
• 4:39
  digital world, we also talk about the notion of integrity,
• 4:42
  which was not that much a challenge previously, and also
• 4:45
  the availability. So how does the trust get into
• 4:49
  these dimensions? Because we normally look at the
• 4:52
  CIA triad as a security dimension, but I think they also
• 4:57
  play a role in the trust dimension, right?
• 5:00
  Absolutely. So in the NHS in the UK, we
• 5:03
  always had this framework since I can think of in my career,
• 5:06
  which was the CIA triangle. And when we talked about
• 5:10
  confidentiality in in the NHS wasn't just about digital or any
• 5:15
  of that. It was about everything,
• 5:16
  everything, you know, but it's the physical environment.
• 5:19
  You know how the world beds positioned when you walk in, Are
• 5:23
  there any carers and families? Can they overhear your
• 5:25
  conversation in an elevator? So it's the whole aspect of
• 5:29
  confidentiality, whether it's verbal, physical or obviously on
• 5:34
  your laptop encrypted at the time.
• 5:36
  You know, when the whole thing started about they were losing
• 5:38
  USB sticks, they were unencrypted.
• 5:40
  So it took already in a whole other dimension then and moving
• 5:43
  forward now, 2025, we're not talking about any more
• 5:47
  encryption. If we're still talking about
• 5:48
  encryption, we have a huge issue, right?
• 5:50
  Encryption is it's a given, really should be.
• 5:54
  We know it doesn't always happen, but it should be a
• 5:56
  given. Now we're talking about moving
• 5:58
  on to cyber. You know, how do we secure it?
• 6:01
  AI, How do we secure them? You know, when, when suppliers
• 6:06
  come out with the most amazing tools that will enable efficient
• 6:10
  working in the NHS with all the budget cuts.
• 6:13
  But what does it mean? Do we understand as privacy
• 6:16
  expert? And if we don't understand,
• 6:18
  who's going to be the patient's voice?
• 6:20
  Who's going to make sure that the data is respected by using
• 6:24
  AI? Do we understand it when they
• 6:25
  say, Oh, no, sorry, it's safe and secure, but we will use it
• 6:28
  for training? What does it even mean?
• 6:30
  Where does it go? So that has a huge dimension,
• 6:33
  but also integrity, right? Because before, again, I'm, I
• 6:37
  will use a lot of NHS examples, but it can be an anything else.
• 6:40
  It's just an NHS integrity is really important because if you
• 6:44
  have the wrong information on a patient record, you potentially
• 6:48
  could kill the patient. You know, if you don't have, if,
• 6:51
  if the record has been tampered with, the allergy information
• 6:54
  has gone, wasn't available availability or was recorded
• 6:58
  wrong, you have a huge issue. Now we say I, there's a lot of
• 7:03
  things that can go wrong and believe me, I'm an innovator.
• 7:06
  I want to enable innovation. What we can't forget in these
• 7:10
  privacy by design is the safety by design.
• 7:13
  So if you have an AI in the background and now my
• 7:16
  pronunciation, I'm not an English native speaker, but
• 7:19
  sometimes, you know, when we have transcripts, it's not what
• 7:22
  I say honestly, the, the transcript comes and that's not
• 7:25
  what I said. Now imagine that in a clinical
• 7:27
  setting, so where the cheques and balances about making sure
• 7:30
  that what the AI has picked up in the background is actually
• 7:34
  what the patient has said. So that is important.
• 7:37
  And also deepfakes, you know, is there possibility that someone
• 7:42
  gets hold of this recording and then use a set for something
• 7:46
  else? People are worried about that.
• 7:48
  I was in a conversation the other day with someone from a
• 7:51
  supervisor authority and the, the panel, they used the
• 7:56
  transcribing and they said that they really don't want to use
• 7:59
  the transcribing because there are, they don't want their voice
• 8:03
  to be taken and used for a deep fake and them saying things they
• 8:08
  haven't said. And I can understand that
• 8:10
  there's supervisor authority. So we need to think about these
• 8:13
  things. We can't just say, yes, we want
• 8:16
  to enable yes, yes, we all are for innovation.
• 8:18
  You know, I work with research, I work with medical research.
• 8:21
  They need AI to provide the care to put faster, you know, the
• 8:26
  algorithms to identify cancer. It's not about that.
• 8:30
  It's about how are we designing it?
• 8:32
  And can we trust our suppliers for for the patients to trust
• 8:36
  us, we need to be able to trust our suppliers.
• 8:38
  And that for me, if you look at all the reports, where do you
• 8:42
  have your biggest risks unit? Where are your biggest risks in
• 8:44
  these day and age when it comes to digital?
• 8:47
  Where are your risks? In the cloud, it's all in.
• 8:53
  Errors and suppliers. This is the thing, you know, we
• 8:56
  always in the NHS talked about human errors, emails sent in
• 9:00
  errors. Now when I look at the
• 9:02
  incidents, it's suppliers, the supply chain.
• 9:06
  Yeah, it's of course the challenge which has become in
• 9:10
  the last 10 or maybe 15 years is earlier the risk was human error
• 9:17
  and human interpretation, but human was the biggest error,
• 9:20
  more or less. And we said the human is the
• 9:23
  weakest link, so that you need to train and this and that and
• 9:26
  that. And nowadays what's happening is
• 9:28
  since all the data is in cloud and all these bots, agents and
• 9:33
  everybody's listening, the risk is in there because the your
• 9:38
  data is no longer in one location in one building and you
• 9:42
  don't know where, where is that It's no longer in the building.
• 9:45
  It's somewhere in some data centre which has a backup
• 9:48
  somewhere and which is replicating to somewhere.
• 9:50
  And then they're sharing the data to someone based on their
• 9:54
  contracts and agreements. And that whole supply chain is
• 9:58
  not being provided by one company, but set of companies,
• 10:01
  one providing data centre, 1 providing the service, 1
• 10:05
  providing the translation, one providing the LLM or one
• 10:07
  providing the voice to speech to text and one interpreting text,
• 10:14
  1 converting into the minutes. So that's the complexity that a
• 10:16
  complex world we are in. And I agree with you that yes,
• 10:21
  this AI world creates a lot of complexity.
• 10:24
  But on the other side, I think and I believe it also creates
• 10:29
  simplicity in terms of privacy or in terms of privacy
• 10:33
  protection. And let's talk about that as
• 10:36
  well because yes, it's a scary world and that's, yes, there are
• 10:39
  a lot of risks. It's like a knife with which you
• 10:42
  can cut onion or fingers. But let's cut the onions and see
• 10:47
  how can AI maybe help us simplify the privacy protection
• 10:52
  or landscape? Absolutely, but like with
• 10:55
  everything, if used responsible and transparent, the risk that
• 10:58
  AI exacerbates. If you think many years back,
• 11:02
  the risk the Internet, you know, we were all talking about the
• 11:04
  Internet, then social media, then Facebook.
• 11:06
  But if you follow it through and you really have your
• 11:10
  architecture right and you have your flow right, I'm not saying
• 11:12
  that the risk is completely eliminated.
• 11:14
  We're not talking about this. We're talking about a risk based
• 11:16
  approach. So we can actually mitigate
• 11:19
  that. And that's why we need to all
• 11:21
  work together from the privacy person, the architecture person,
• 11:25
  the IT person, the EI specialist and the suppliers.
• 11:29
  If we all follow it through, everyone can be more assured.
• 11:33
  And I think that doesn't happen as much.
• 11:35
  So if you're talking about CIA, around AI, it's about you need
• 11:41
  to follow the entire data flow from the start.
• 11:44
  So when the patient talks to you or the AI in the background to
• 11:48
  where it ends up. And if you can't follow that
• 11:50
  through, you will be able to identify risks and therefore put
• 11:53
  build mitigations in. We should do that before you
• 11:56
  actually launch a product. So I think a lot of times, and
• 11:59
  we know that. When do they come to us?
• 12:02
  Oh, we're going live tomorrow. Here's a data protection pack
• 12:04
  assessment or we already have a contract in place.
• 12:09
  We already bought the tool, risk assessed retrospectively.
• 12:12
  And that's where a lot of things then are like, well, I, I can
• 12:15
  pick up the risks we might be able to mitigate, but really is
• 12:19
  the supplier going to change the entire design?
• 12:22
  It's going to cost money, you know.
• 12:24
  So I think this is a lot of things that people in the
• 12:27
  organisations need to think about.
• 12:28
  They need to start talking to each other much, much earlier to
• 12:33
  then identify the best supplier and also have a list ready.
• 12:37
  What do we want a trusted supplier to look like?
• 12:40
  You know, not just go out. I want this tool.
• 12:42
  OK, you want an AI tool, but how do you want it to be built?
• 12:47
  How are you building it around CIA?
• 12:49
  And I think that's where there's still a lot of work to do was.
• 12:53
  A lot of, absolutely. I think to enable trust, you
• 12:57
  need to act responsibly, you need to do the right thing, you
• 13:01
  need to follow the law and that's where they'll come. 2
• 13:04
  dimensions. When we have a law like in the
• 13:07
  UK or in the USI in Europe, not US that much, but in UK and EU,
• 13:14
  that's easier because the law mandates it.
• 13:17
  But then if you're a healthcare company in the US, OK, you have
• 13:20
  HIPAA and others, you still follow them.
• 13:23
  But if you don't have a law, then it's left to
• 13:27
  interpretation. Do when we lean on the
• 13:30
  responsible AI, responsible privacy, responsible data use
• 13:34
  and being following the right practises for security and so
• 13:38
  on. And that's when we get into the
• 13:40
  dimension of what we call ethical AI or ethical data use.
• 13:45
  And that's not easy. That's not comprehensible for
• 13:49
  everyone, especially with when people are driven by business
• 13:53
  objectives, no. Absolutely.
• 13:55
  I agree. And I think, you know, again, as
• 13:57
  you said, I provide so many opportunities and especially in
• 14:01
  health as well, you know, but it just the needs the, the process
• 14:07
  needs to be right, the documentation needs to be right,
• 14:10
  people skill sets need to be right.
• 14:13
  And also the limitation, you know, as a data protection
• 14:15
  officer, privacy champion, depending where you worked
• 14:18
  before, you might not know everything, but then make that
• 14:21
  clear. Don't provide false assurances.
• 14:23
  Because in the end of the day, what is going to happen if
• 14:26
  there's a breach? What is going to happen if
• 14:28
  patients stop trusting you? They're not going to come to you
• 14:31
  anymore and then they're not going to have the care that they
• 14:34
  require. And that because some, some
• 14:37
  breaches are, you know, the, the likelihood of harm is very low
• 14:40
  in all of that. But some preachers we, we do
• 14:43
  you. Do you remember the 1A cry cyber
• 14:45
  attack on the NHS in 2017? Do you remember that one?
• 14:48
  So you cyber attack on the NHS, What was the result?
• 14:51
  Appointments were cancelled, surgery was delayed, ambulance
• 14:54
  had to be diverted. Millions and millions had taken
• 14:58
  the hit because of a cyber attack.
• 15:01
  And from then onwards, we, you know, we have invested
• 15:03
  infrastructure and all of that, but that doesn't mean it doesn't
• 15:06
  happen. Now we're looking at AI.
• 15:07
  And then I went to a conference in Frankfurt and IBM was talking
• 15:10
  about quantum computing. And I'm like, the digital age
• 15:14
  moves so fast all of the time. So AI could actually help us,
• 15:21
  but we still need that human intervention and oversight.
• 15:24
  So AI can help us build privacy models and all of that, but it
• 15:29
  still has to come from us because we can then look at it
• 15:32
  and see does this fit this scenario?
• 15:35
  And I think that's very well in GDPR.
• 15:38
  In the GDPR, you know, when they say the DPO has to have the
• 15:41
  skill set in accordance, it's not verbatim, but in accordance
• 15:46
  to the data processing activities.
• 15:48
  That means that maybe you work in an organisation where you
• 15:51
  have minimal data, you know, just e-mail addresses for
• 15:54
  marketing purpose. Then your skill set, you know,
• 15:57
  is OK if you just don't have to protection.
• 16:00
  But if you work in health and care, your skill set has to be
• 16:03
  much wider. You have to understand the risk
• 16:05
  profile. You have to understand when you
• 16:07
  work with HIV data, when you work with, you know, domestic
• 16:12
  abuse data, sexual assault referral centres, it's not the
• 16:15
  same. And if you don't have the skill
• 16:18
  set, then you need to get the training.
• 16:20
  There's a reason why GDPR put that in the law.
• 16:23
  You know, not everyone can just be ADPO on a one day training
• 16:26
  course. They can learn.
• 16:28
  Not saying this everyone can learn it, but you have to be
• 16:31
  careful when you deal with certain data sets and you need
• 16:35
  to be willing to say actually I need more training because I'm
• 16:39
  not aware of that. No, I think I agree with you.
• 16:44
  The beauty of GDPR is it gives you the opportunity to be ADPO.
• 16:48
  But you need to be responsible and you need to learn the art.
• 16:52
  And even even after learning, you can have an interpretation
• 16:57
  because you can have many interpretations of GDPR and
• 16:59
  that's always context based because the context matters.
• 17:03
  Same data sometimes based on the volume of the scale, you have to
• 17:07
  have different, different way of looking at it.
• 17:10
  It's risk based, it's context based and it's also to an extent
• 17:15
  interpretation based of the organisation, industry based or
• 17:18
  the usage based of the supply chain.
• 17:19
  How many people will have, how many users will have access.
• 17:23
  So all that complicates things and that's where the responsible
• 17:26
  usage and experience comes in to play.
• 17:29
  And that's where we also get into the dimension which we say
• 17:36
  we only have the challenge of protecting data so far.
• 17:39
  Now with the AI, because whenever I'm speaking at a
• 17:42
  conference, that's the question that comes.
• 17:45
  You talk about privacy, but what about AI?
• 17:48
  And the question that's usually asked is AI is data hungry.
• 17:52
  So we need as much data as possible.
• 17:55
  In fact, all of it. Does the GDPR apply?
• 17:58
  And I usually reply, yes, it does on the personal data
• 18:02
  because some of your data is personal.
• 18:04
  So AI is data hungry and it has two elements.
• 18:09
  It wants to use data and it wants to consume data and then
• 18:13
  it wants to interpret data and keep the data for its learning.
• 18:17
  And how do you see this usage and sharing of data for AI
• 18:21
  purposes? And I'm when I'm saying data,
• 18:23
  I'm using broadly or including personal data as well.
• 18:30
  And, and that comes back to knowledge and expertise.
• 18:34
  And I always develop and learn. I don't know everything, but I
• 18:38
  always try to know my limitations.
• 18:40
  But even sometimes there's things you don't think about.
• 18:42
  And I'll give you an example on what you just asked.
• 18:45
  So, you know, so the training and development on data, on
• 18:48
  personal data, obviously I would say that if you have an
• 18:53
  organisation and you use our eye for efficiency, you should, but
• 18:58
  you don't need the personal data.
• 18:59
  You should exclude the personal data, but also be careful.
• 19:02
  So when I went to the conference, I listened to this
• 19:04
  talk and I was like, Oh my God. And I'm working a lot with
• 19:07
  research in the NHS or research data.
• 19:09
  And we always talk about anonymized data to minimise the
• 19:13
  risk, right? And this person was talking
• 19:15
  about that there was these people had consultant to the
• 19:19
  research for ethnic minority who had because of the ethnic
• 19:24
  minority, they had certain diseases.
• 19:25
  And that's what the purpose of this research was.
• 19:28
  But then they via I also, it was then anonymised data.
• 19:32
  So they then took the anonymised, the anonymised data,
• 19:36
  which really looked anonymised. And the I came up with finding
• 19:41
  out that all of these people that have this genetic trait
• 19:46
  were from a village of a special specific ethic and religion.
• 19:53
  So obviously now they all became identifiable.
• 19:57
  And I was like, I never thought about this, that, you know, I
• 20:00
  mean, when you're not exposed to that, you don't think about
• 20:02
  that. And that's what you have to be
• 20:03
  careful just because you think, oh, it's just the name or
• 20:07
  actually we've removed all the name.
• 20:09
  We know that, the law says. You know, it's anything that
• 20:12
  makes them identifiable, but sometimes say I can make them
• 20:16
  identifiable without you realising it because of the fast
• 20:19
  processing, because they can put pick, you know, from the
• 20:23
  Internet data together and then can identify that particular
• 20:27
  cohort. So that's the danger of it.
• 20:30
  You really need to think it through.
• 20:31
  If you use AI for training purposes and let them use the
• 20:36
  data, it might put data together and makes the whole situation
• 20:41
  identifiable, and then obviously you're in trouble.
• 20:45
  I fully agree with you. I was recently at a conference
• 20:49
  and somebody said, hey, this is AAI tool, it does this and this,
• 20:53
  this is identic. AII won't name the tool, but and
• 20:56
  I said, OK, that's cool. Have you looked at its privacy
• 20:58
  policy? And now then I came in.
• 21:02
  Of course, I looked at the privacy notice and looked OK.
• 21:07
  Then I created a free account and I went, then how will I
• 21:10
  control my privacy settings? What options do I have?
• 21:14
  And Can you imagine there was no option to contain or to change
• 21:19
  privacy settings because I wanted to say you will not use
• 21:22
  my personal data to train your algorithm.
• 21:25
  You will not use my voice or my commands to train yourself.
• 21:31
  And like the example you say, the regulator didn't want their
• 21:34
  voice to be interpreted and deep fixed to be created.
• 21:37
  But I wanted to do some basic settings so that it works in my
• 21:40
  context. I'm open to you.
• 21:42
  The I'm all pro innovation. I as an entrepreneur I want to
• 21:47
  simplify things for me and my customers, but in the remit of
• 21:51
  the right usage of data and there was no option to use or
• 21:56
  configure these right elements. So it's a scary world sometimes,
• 22:01
  but we can have that conversation of scary world and
• 22:05
  how we can protect it for ages. But in view of the time, I would
• 22:10
  say, what do you do on a daily basis?
• 22:13
  I mean, of course I know it, but why don't we tell our listeners
• 22:18
  as well? So when obviously I have several
• 22:22
  clients depending from what they want to do, so they come to me
• 22:26
  and say, oh, we want to introduce an idol.
• 22:28
  The first thing I ask is why? What is the objective?
• 22:32
  Because sometimes as you know, this is a long standing story.
• 22:35
  You want something fancy, you go to an IT provider and actually
• 22:38
  what you want and you say you want is actually not what you
• 22:41
  need. So that's the first thing.
• 22:42
  What, what are you trying to achieve then?
• 22:46
  You know, they tell you the product and so on.
• 22:47
  And I really look deeply. I, I ask for high level designs
• 22:51
  and why do I ask for that? Because I've worked so closely,
• 22:54
  this amazing information security people and
• 22:57
  cybersecurity people in architecture.
• 22:58
  Otherwise I wouldn't necessarily know to ask these questions,
• 23:01
  right? Because not everyone has come
• 23:03
  through the same career journey. So ask them all of these
• 23:06
  questions. And then when it comes to AI,
• 23:08
  and I do say, are you using that data to train the AI?
• 23:12
  If they say yes, I'm not necessarily going to say no.
• 23:15
  So we can't implement it. I want to understand more why.
• 23:19
  What part are you using? What are you going to do with
• 23:22
  it? Where's it going to behold?
• 23:23
  Where's it going to go? You know, these, these all
• 23:25
  things matter on premises off. You know, there's so many when
• 23:29
  we talk with, especially in health and care, not each AI
• 23:32
  goes actually off in the cloud because they do their own
• 23:35
  programmes which sit on site. So they're different elements
• 23:39
  you need to discuss and you need to find the right people to
• 23:42
  explain to you exactly where this data goes.
• 23:46
  And I think the importance of this is if you think about when
• 23:49
  the Euro, the Royal Free Hospital Trust, what happened,
• 23:52
  patients felt really betrayed. Why?
• 23:55
  So a few years ago, the Royal field partnered with Google
• 23:58
  DeepMind on an app. The intention was pure.
• 24:01
  The intention was to ensure that they, you know, that they could
• 24:06
  detect kidney injury. It wasn't anything else.
• 24:09
  However, no one followed it up in the way that it was
• 24:13
  transparent about it. So 1.6 million patient records
• 24:19
  were obviously transferred without properly informing
• 24:21
  patients. So then you lose the trust.
• 24:25
  Patients would not have expected a tech company to get the data
• 24:29
  for an app test without consent. So yes, we have consent for
• 24:32
  treatment consent, not consent under U kg DPR.
• 24:36
  But you're now sharing data with Google Deep Mind on an app.
• 24:40
  Do your patients understand that?
• 24:42
  If not, then you have done something wrong.
• 24:44
  And I'm not, I'm not particularly crushing a
• 24:47
  particular trust because I think these people out there in the
• 24:49
  NHS doing an amazing job, I was part of it.
• 24:53
  You just really need to think about it and you have to have
• 24:56
  someone that understands and translates it for you.
• 24:59
  Absolutely. And that you come in, I come in,
• 25:02
  or privacy experts come in. Absolutely, absolutely.
• 25:06
  But I always would. I'm lucky because when it's
• 25:09
  something major like this, I go to my chief of my security
• 25:12
  officer, I go to my AI expert, governance expert.
• 25:15
  So once I have a lot of expertise, I still bring people
• 25:18
  in. When it's.
• 25:20
  Something this big. Yeah, I think together we are
• 25:22
  stronger. Absolutely.
• 25:25
  And I'm very lucky as you know. You know, I work with Barry Malt
• 25:28
  and others. We, we network, we discuss, we
• 25:30
  say have you come across this app?
• 25:32
  What have you done? Because sometimes you forget to
• 25:35
  ask a specific question and that's normal because even if
• 25:39
  you have really good templates, we have developed AI governance
• 25:42
  templates, we used it from the ISO, we have developed our own,
• 25:45
  we use systems. Would you always, sometimes you
• 25:49
  might forget one question, someone else will remember that
• 25:53
  question. Oh, what about this, have you
• 25:55
  thought about this? Like I always think about
• 25:58
  records. I mean, children are babies,
• 26:00
  they don't consent, right? They can't consent.
• 26:03
  The parents do. What would parents have to
• 26:05
  understand and clinicians have to understand these children
• 26:08
  grow up and they get access to their records.
• 26:11
  Would they expect to see that? Would that break families apart?
• 26:15
  Would that, you know, I mean research and so on?
• 26:17
  So these are the sort of questions that was experienced
• 26:20
  you might ask more. And the same as AI, would you
• 26:23
  think about deepfakes? Would you think about the
• 26:26
  future? Like right now it looks like an
• 26:29
  anonymized data set, but depending of what this person
• 26:33
  goes on to do later, AI can put it all together.
• 26:37
  Does it remain anonymized? You know, how do you risk assess
• 26:41
  that? Yeah, But can I say something
• 26:45
  because I don't want to just speak on the negative.
• 26:48
  When organisations handle data well, it does improve outcomes.
• 26:52
  OK. So COVID-19 NHS data was used to
• 26:56
  identify vulnerable patients for shielding.
• 26:58
  That's amazing, right? So we can't just look at the
• 27:02
  negatives that I just wanted to bring that in.
• 27:04
  No, absolutely. I think the way we started the
• 27:06
  conversation, it's about trust. So we don't do privacy
• 27:10
  protection because these stories are there.
• 27:12
  We do privacy because we don't want these stories to happen.
• 27:16
  And when these stories don't happen, the organisation does
• 27:18
  the right thing. We talked about being
• 27:20
  responsible, being ethical, being lawful, being compliant.
• 27:23
  And when you are all that, then you create trust.
• 27:26
  And when you create trust, your organisation is respected more
• 27:30
  and you get more customers. So it in the end drives
• 27:33
  customers to you because you're trusted and the same thing which
• 27:38
  the example you gave that there's AGP, if you go to
• 27:40
  agenda, a Doctor Who is trusting you, who's giving you the
• 27:46
  confidence that they will keep the information safe, you go
• 27:49
  there. But if you hear a story saying
• 27:51
  that clinic or that data there, they shared all the customer
• 27:54
  personal, personal data, other patients customer data, you
• 27:58
  would stop going to that clinic, irrespective of how good they
• 28:02
  are. And that's what we're talking
• 28:04
  about now in view of that, that we do the privacy expertise and
• 28:11
  the AI and governance expertise or compliance with the ISO
• 28:16
  standards or EU regulations, if someone wants to contact you,
• 28:20
  what's the best possible way, so.
• 28:22
  Obviously we have our website Data Privacy Simplified and my
• 28:27
  e-mail address, Tanya, Data Privacy Simplified dot co.uk and
• 28:32
  I have LinkedIn, so they can link me on LinkedIn.
• 28:35
  You know, I'm always happy for a chat, always happy to discuss
• 28:38
  these things through. Yeah, that's kind of the best
• 28:41
  way really to get in touch with me.
• 28:42
  So really, e-mail, LinkedIn. Thank you so much, Tanya.
• 28:46
  It was wonderful to have you. I don't know how the time went
• 28:50
  by, but it went by very well and I got another perspective, as we
• 28:55
  do when we talk to a colleague or an expert in privacy.
• 28:58
  Thank you for having me, it was a pleasure.
• 29:01
  It's a pleasure. Thank you for joining us on the
• 29:04
  Fit for Privacy podcast. We hope you found today's
• 29:06
  conversation valuable and thought provoking.
• 29:09
  Subscribe for more insights like this.
• 29:11
  If you enjoyed this episode, we'd appreciate that you'd share
• 29:13
  it and write us a review. For consulting, visit
• 29:17
  www.fitforprivacy.com. For certifications and training
• 29:21
  on ISO standards, visit www.growskills.store.
• 29:26
  You can also contact us for bespoke training for your staff
• 29:29
  and management. Until next time, stay safe, stay
• 29:32
  compliant, and grow your skills.