Latest / Privacy Please / S5, E227 - Avishai Ostrin, Founder & CEO at TrustIZ

Transcript

S5, E227 - Avishai Ostrin, Founder & CEO at TrustIZ · Privacy Please

• 0:10
  Speaker 1: all righty, then.
• 0:11
  Speaker 1: Ladies and gentlemen, welcome back to another episode of privacy, please.
• 0:14
  Speaker 1: I'm your host, cameron ivy, alongside my other host, gabe gums.
• 0:19
  Speaker 1: Gabe, how you doing today, man, I am well.
• 0:21
  Speaker 1: How are you, sir, doing?
• 0:24
  Speaker 1: Well, right, great, we got a we got a guest with us today.
• 0:27
  Speaker 1: Um, avi, he's been on.
• 0:29
  Speaker 1: Actually we were looking back.
• 0:31
  Speaker 1: Um, what was it?
• 0:33
  Speaker 1: uh, almost like was it three years ago almost that, while yeah, a lot of different things going on, so we wanted to catch up with you and see what was going on, what has changed, what you're in, you know what you're getting into right now, what you're dealing with with, and just talk privacy and all the things.
• 0:48
  Speaker 1: So, avi, welcome back on the show, man Welcome back.
• 0:51
  Speaker 2: Thank you very much.
• 0:51
  Speaker 2: First, you're going to have to tell us how it is.
• 0:53
  Speaker 2: You look five years younger, even though we saw you three years ago.
• 0:56
  Speaker 2: You should go the other way.
• 1:00
  Speaker 3: Yeah, that's true, I can tell you.
• 1:02
  Speaker 3: It's not for a lack of stress and stuff going on in my life.
• 1:06
  Speaker 3: So it's some.
• 1:07
  Speaker 3: Yeah, it's that magic elixir I seem to be.
• 1:10
  Speaker 3: But yeah, thank you, you guys don't look too shabby yourselves.
• 1:14
  Speaker 3: I appreciate it, especially for being a Jets fan and having kids too and a company like that's a lot it.
• 1:25
  Speaker 3: It is I'm not sure which order I would put those in in terms of levels of stress, but uh jet span father and uh company owner.
• 1:34
  Speaker 3: But uh, yeah, for sure that's that'll do it.
• 1:37
  Speaker 1: So what's going?
• 1:38
  Speaker 1: What's going on right now?
• 1:39
  Speaker 1: What?
• 1:39
  Speaker 1: Okay, let's, let's catch everybody up that they never listened to your episode.
• 1:43
  Speaker 3: Yeah so if anyone wants to go back and listen to that, that was a fun episode we did in February 2021.
• 1:52
  Speaker 2: So it was almost three years ago.
• 1:53
  Speaker 3: Yeah, awesome, awesome.
• 1:55
  Speaker 3: So back then I was, I was heading the privacy department at a UK law firm that was based out of here out of Israel department, at a UK law firm that was based out of here out of Israel.
• 2:09
  Speaker 3: And pretty quickly after that, after we had that episode, I kind of made a little bit of a change where I moved from a law firm providing legal advice to you know, always in privacy to my clients to a company that provided data protection officer consultancy services, and that was an interesting transition.
• 2:29
  Speaker 3: I sort of felt a little bit I had reached a point in my career where I felt like, just as a privacy lawyer, I felt like companies were coming to me or clients were coming to me when something was broken, when something was wrong.
• 2:42
  Speaker 3: We were talking about this before Gabe, about things being broken and having to was wrong.
• 2:43
  Speaker 3: We were talking about this before Gabe, about things being broken and having to be fixed.
• 2:48
  Speaker 3: And that's where I felt like I was always coming in after the fact.
• 2:52
  Speaker 3: And I really wanted to kind of grab the bull by the horns and just be there right at the beginning and right before things were broken and try to prevent them from being broken, and so I joined the consultancy that helped companies build privacy programs, offer data protection officer services, worked with some really awesome tech and awesome companies right on the cutting edge of the tech that was coming out of here out of Israel, obviously, the startup nation.
• 3:23
  Speaker 3: I did that for a couple of years and then a year ago a year and a month actually ago I decided to go out on my own and jump in the deep end and I started my own consultancy.
• 3:37
  Speaker 3: It's been a year now and things have been going.
• 3:40
  Speaker 3: It's been a whirlwind, but, you know, things have been really, really going great, and so what I do now the company that I founded is called Trust Is and it's short for it's sort of a play on the phrase trust is everything right, because everything that we do in our space, in tech, in compliance, whether it's privacy or AI governance or things like that it's all about building trust.
• 4:07
  Speaker 3: That's the end game.
• 4:09
  Speaker 3: That's what we're always striving for is building trust with consumers, building trust with the people that are using the different tech, and that's what I help companies do.
• 4:19
  Speaker 3: At the end of the day, I help companies build that trust through privacy, compliance, data protection officer services and AI governance, and so that's been sort of my journey over the past three years.
• 4:32
  Speaker 3: It's been an amazing one and I'm super like thrilled with the stuff that I've achieved, but also I'm looking forward and I think there's a lot, a lot to still do, and I'm excited about it.
• 4:45
  Speaker 2: Awesome, it's awesome.
• 4:46
  Speaker 2: Well, A congratulations on the new venture.
• 4:48
  Speaker 2: That's just huge.
• 4:49
  Speaker 2: That's a lot of work, and hats off to you.
• 4:52
  Speaker 2: Thank you.
• 4:53
  Speaker 2: By the way, for those that were interested, it was season two.
• 4:56
  Speaker 2: Episode 52 is where Avi first Gosh.
• 4:59
  Speaker 1: That's crazy Episode 52.
• 5:00
  Speaker 2: Yeah, season two, episode 52.
• 5:02
  Speaker 2: A lot's changed in the world since season two, episode 52.
• 5:06
  Speaker 2: We're on season five now and so, from a catch up perspective, what is what?
• 5:12
  Speaker 2: What's the number one change you've seen over those last three years?
• 5:17
  Speaker 2: That's really affected the way you are thinking about the problems today.
• 5:19
  Speaker 3: So obviously, from a technological perspective, you know it's, it's been.
• 5:23
  Speaker 3: How many minutes are we into the episode now?
• 5:25
  Speaker 3: And we still haven't said the term AI.
• 5:28
  Speaker 1: Actually, I mentioned it before, but yeah, it's AI right, no question like hands down.
• 5:34
  Speaker 3: that's what everyone's talking about and it's coming up in every single conversation.
• 5:39
  Speaker 3: It's funny because even the more traditional companies before that weren't as tech savvy.
• 5:46
  Speaker 3: You know, like you had the traditionally.
• 5:48
  Speaker 3: You sort of had the tech heavy companies that were building this really cool cutting edge technology, and then the more traditional ones, and now even the traditional ones, like you know just to throw an example out there, like a local construction company is thinking about oh, how can I leverage AI in order to make my people more efficient and reduce costs and things like that.
• 6:08
  Speaker 3: So it's really sort of perforated everything and gotten into everything and AI is just all over the place.
• 6:16
  Speaker 3: So that, in terms of the technology, that is certainly something that I'm seeing much more of today than we did back then.
• 6:25
  Speaker 3: The other thing, like if I'm thinking about, like the clients themselves, what's interesting is, I'm actually seeing a lot more maturity when it comes to talking about these types of issues of compliance and regulation and things like that.
• 6:40
  Speaker 3: There seems to be there seems to have been a very good maturity in terms of where people are coming to.
• 6:48
  Speaker 3: Like you're seeing companies coming much, much early on in the journey, which obviously makes my job A much more interesting, b much more, you know, efficient and effective, if I can get in, like on the ground level, when they're just laying the foundation and the scaffolding of the product, and I can, you know, steer them in the correct direction.
• 7:09
  Speaker 3: So I'm seeing those conversations happen earlier in the cycle and that's very exciting and, I think, something that's really been a good byproduct of some of the regulations that we've seen come out over the last couple of years.
• 7:28
  Speaker 2: Look, we couldn't spell your name without AI, could you?
• 7:30
  Speaker 2: Awesome?
• 7:32
  Speaker 3: I like that.
• 7:33
  Speaker 3: I can't spell your name without AI.
• 7:36
  Speaker 1: I don't know if I'm jumping the I don't want to say gun here, that's the wrong term but especially because I'm going to be bringing up the war, like how has the war affected what's going on in privacy and data security and everything?
• 7:49
  Speaker 1: What have you seen there?
• 7:50
  Speaker 2: And how's that?
• 7:51
  Speaker 2: You might want to be more specific.
• 7:53
  Speaker 2: Which of the wars?
• 7:54
  Speaker 2: The war, yeah.
• 7:55
  Speaker 2: Which of the wars?
• 7:56
  Speaker 2: So that's fair.
• 7:57
  Speaker 3: Yes, that's fair.
• 7:58
  Speaker 3: So, for those who don't know my background, I'm originally from the US, but I grew up here in Israel, have lived here since age seven, so really grew up here and live with my family about 20 minutes north of Tel Aviv, which people are probably familiar with that area If you haven't been here, it's very beautiful.
• 8:24
  Speaker 3: Familiar with that area, if you haven't been here, it's very beautiful.
• 8:26
  Speaker 3: I would recommend coming and visiting, although I would wait until things calm down a little bit, which we're all hoping to happen soon.
• 8:34
  Speaker 3: So, domestically, for us it's been really interesting.
• 8:38
  Speaker 3: Obviously, personally, I started my business on Octoberober 1st 2023, so six days before, you know, october 7th, which was the the big, uh, terrible, terrible day that happened last year, and so that was like a shock to the system and I was totally like questioning myself for months after that, like what am I doing?
• 9:04
  Speaker 3: How can?
• 9:05
  Speaker 3: I possibly build a business and how can I possibly make this?
• 9:09
  Speaker 3: Is this viable?
• 9:11
  Speaker 3: And what have I done to like the future of my family?
• 9:14
  Speaker 3: And I'm really proud to say that it was.
• 9:20
  Speaker 3: It was a, you know there was there was a rough patch there at the beginning, but I really pushed through and persevered and I'm very thankful that I had the support of my family and doesn't necessarily have to be starting a business.
• 9:44
  Speaker 3: But if you're hearing this and you're thinking like, oh, I want to make this change or I want to, you know, go into this type of business, or I want to start my own business, or anything like that, I think what I took away from the experience personally is that we can really overcome a lot of challenges and so, and so I would say you know, go for it, you can, you can.
• 10:09
  Speaker 3: I believe in every single person in our amazing industry.
• 10:13
  Speaker 3: So I would, I would encourage everyone to take those risks and good things will come.
• 10:18
  Speaker 3: So that's sort of on the kind of personal side, I guess, or national slash personal side with me.
• 10:26
  Speaker 3: Interestingly, in parallel, in the past year actually, israel has managed to pass a pretty, pretty serious reform of our privacy law.
• 10:41
  Speaker 3: There was an amendment that was passed a few months ago.
• 10:45
  Speaker 3: It's going to go into effect in 2025.
• 10:47
  Speaker 3: And so because of that change in the law, we're actually seeing a lot more interest actually domestically from companies that didn't necessarily take privacy all that seriously because of sort of the history of privacy legislation in Israel, it's historically been something that hasn't really been on the top of people's minds.
• 11:12
  Speaker 3: And now, because the law has changed and gotten more serious and the regulator has gotten way more ability to impose sanctions and much more authority, people are all of a sudden perking up and starting to take note of it, and so from that perspective, it's also been really great because we've gotten a lot of people, you know, calling in and saying hey, we heard something's going on.
• 11:37
  Speaker 3: Can you help us navigate these?
• 11:39
  Speaker 3: you know this new thing and we're able to be there and help them navigate it, so that's been also a really cool thing that's happened.
• 11:48
  Speaker 1: Yeah, that must have helped your business, I would imagine.
• 11:50
  Speaker 3: Yeah, definitely it is helping, for sure.
• 11:54
  Speaker 3: There's actually even a requirement, similar to the GDPR requirement, for certain kinds of companies and for certain kinds of entities, like public entities and companies processing a high volume of sensitive personal data to actually appoint a data protection officer, and so that's a job title that just hasn't existed here beforehand, and all of a sudden now is not only is it existing, but it's now a legal requirement in certain circumstances, and so we're getting questions and queries from companies about, like, what is this new thing that we need that we need to deal with.
• 12:32
  Speaker 3: So that's.
• 12:32
  Speaker 3: That's been really cool and really interesting, and I've been enjoying a lot of the conversations that we've been having around that.
• 12:40
  Speaker 2: What was the driver of such legislation?
• 12:42
  Speaker 2: I mean, I'm always curious because you know like in the US, obviously CCPA is not at the federal level and has a very different driver than you know.
• 12:51
  Speaker 3: Every piece of legislation has, like, the history behind you know how it came to be and this law is no different.
• 13:12
  Speaker 3: So for people who aren't familiar, Israel's privacy law is actually pretty, you know.
• 13:18
  Speaker 3: Actually, one of the first ones in 19 is from 1981, is.
• 13:23
  Speaker 3: Israel's privacy law.
• 13:24
  Speaker 3: So it's, it's.
• 13:25
  Speaker 3: It's pretty old, I think.
• 13:26
  Speaker 3: Certainly predates me.
• 13:29
  Speaker 3: So there you go, giving a little bit of my disclosing my age right there, but you can imagine what technology was like back then and it hadn't gone through many major there.
• 13:46
  Speaker 3: I think there were two major amendments that were made over the years, but nothing recent.
• 13:51
  Speaker 3: In 2011, israel received the adequacy status from the European Union.
• 13:59
  Speaker 3: Under the old regime, the EU Priv directive this is pre GDPR received adequacy status and, for people who may be less familiar with that, what that basically means is that data could flow.
• 14:13
  Speaker 3: There are only a handful of countries around the world who have this status and Israel is one of them, and basically what it means is that data can flow freely from the European Union to Israel without the need for additional measures like standard contractual clauses or things like that.
• 14:29
  Speaker 3: So that was achieved in 2011 with the promise that Israel's privacy law was going to be modernized and sort of amended.
• 14:39
  Speaker 3: That didn't really happen, and then the EU actually came and said we're doing a review of all of the adequacy decisions that were given and we may be thinking about those who haven't brought their law up to speed, you know, potentially maybe taking that away or putting limitations on it, and so it was actually that sort of what was the main, I think, the main driver Obviously, there were internal things also the privacy regulator really wanted to really push this forward and it was like a personal almost like a personal driver for him to be able to raise the bar when it comes to privacy compliance in Israel, and they were able to do it.
• 15:35
  Speaker 3: They had a really intense period of sessions in Parliament.
• 15:42
  Speaker 3: Obviously, this type of piece of legislation has to go through hearings and committees and the process is pretty lengthy.
• 15:50
  Speaker 3: So and and they had they had a lot of sessions on it, but they were able to finally pass it through and it was passed in August and it's going to go into effect next August in 2025.
• 16:03
  Speaker 1: That was my next question.
• 16:04
  Speaker 3: Yeah, yeah, so it's going into effect in August 2025.
• 16:08
  Speaker 3: And it's interesting because, you know, we have this phrase called the Brussels effect, right, which is regulation out of the EU that impacts regulation around the world, right?
• 16:21
  Speaker 3: So the formation of CCPA, based on obviously different from the GDPR but almost like, based on some of the principles of how GDPR was built, is sort of one effect that it had.
• 16:34
  Speaker 3: You know, EU to US and now we're seeing, like this is the Israeli law is sort of the Brussels effect that we received from the GDPR was like the push from the adequacy standpoint to say, guys, you need to get your ducks in a row if you're going to keep this adequacy status.
• 16:52
  Speaker 1: I don't know if we went over it.
• 16:53
  Speaker 1: What's the name of this one?
• 16:54
  Speaker 1: Does it have a name?
• 16:55
  Speaker 3: Of Israel's privacy law.
• 16:57
  Speaker 1: Yeah.
• 16:58
  Speaker 3: Yeah, it's called the Protection of Privacy Act.
• 17:00
  Speaker 3: It's still 1981, but it's.
• 17:03
  Speaker 1: I'm sure it's got an acronym right.
• 17:04
  Speaker 1: It's probably Israel.
• 17:07
  Speaker 3: P-O-P-A.
• 17:09
  Speaker 3: I think Papa maybe.
• 17:10
  Speaker 1: Oh yeah, Papa.
• 17:11
  Speaker 3: Papa, I've heard of that, not to be confused with Tom Papa.
• 17:17
  Speaker 1: And there's also one called PEPA somewhere else.
• 17:19
  Speaker 1: Not Peppa Pig, Right there's POPIA.
• 17:22
  Speaker 3: There's PIPEDA, there's all the.
• 17:25
  Speaker 3: When you get privacy, it's always with a P.
• 17:27
  Speaker 3: So there you go.
• 17:31
  Speaker 1: It's true.
• 17:31
  Speaker 1: Do you know any of the main differences?
• 17:33
  Speaker 1: You said there's similarities with the GDPR, Any key differences that stand out to you that you might that come off the top of your head.
• 17:41
  Speaker 3: Yeah, so it's always interesting when you talk about like local legislation and comparing it, comparing the approach to the way that it's approached in other countries.
• 17:54
  Speaker 3: Obviously, you know, in the US the privacy is very much seen as a consumer right, whereas in the EU.
• 18:01
  Speaker 3: It's seen as a basic human right, consumer rights whereas in the EU it's seen as a basic human right.
• 18:04
  Speaker 3: So in Israel as well, we consider privacy is considered a human right.
• 18:15
  Speaker 3: There's constitutional, you know, israel's constitution does talk about people's right to privacy in their bodies and in their homes, and so that is based on Israel's constitution and so from that perspective, the approach is a bit similar.
• 18:31
  Speaker 3: Traditionally, israeli privacy law has been actually very security focused.
• 18:38
  Speaker 3: So because we have a lot of, you know, we're seen as like the cyber nation, right, there's a lot of cyber companies, there's a lot of focus on cybersecurity.
• 18:48
  Speaker 3: So there's always been this conflation in Israel between privacy and cybersecurity and people who say, oh, I'm, you know, I'm protecting the data, therefore I'm privacy compliant, and trying to have to explain that, no, actually those are two, you know, they're obviously two sides of the same coin, but they're two separate issues.
• 19:08
  Speaker 3: And so now what we have in the privacy law is we do have, we do have a principle-based law.
• 19:18
  Speaker 3: One of the main differences between GDPR and Israeli privacy law is that, while GDPR has six different lawful bases for processing so we have consent you have contractual necessity, legitimate interest, lawful obligation, etc.
• 19:36
  Speaker 3: Obligation, etc.
• 19:42
  Speaker 3: In Israel it's all based on consent.
• 19:43
  Speaker 3: So you have to obtain consent in order to process personal data, and if someone withdraws consent, then you can't process their data anymore.
• 19:48
  Speaker 3: For those familiar with the Canadian privacy regime, it's very similar to that in the sense that Canada also has a consent as the sole lawful basis for processing personal data.
• 20:01
  Speaker 3: So that is one very major difference.
• 20:05
  Speaker 3: Also, conceptually, israel still.
• 20:09
  Speaker 3: Unfortunately, one of the things that we still have in Israel is a definition of databases.
• 20:16
  Speaker 3: So it's not about processing of personal data.
• 20:19
  Speaker 3: It's about processing of data in databases, which is a little bit of an antiquated way of thinking about things, but like protecting a database as opposed to just looking at specific processing activities.
• 20:31
  Speaker 2: I'm not super offended by that, I think, unless one defines database too narrowly, because what I like about it is some things that others kind of try to like Databroke is certainly stateside try to skirt is that they're not like keeping a database of a bunch of PII right, like because of how they keep it.
• 20:53
  Speaker 2: They're like, well, that's not a database, obviously they're just getting cheeky with some of the wording there.
• 20:58
  Speaker 2: Not a database, obviously they're just getting cheeky with some of the wording there.
• 21:01
  Speaker 2: But I mean a database does not necessarily have to mean an ACID compliant, you know RDBMS system.
• 21:06
  Speaker 2: By any stretch of the imagination it could just be this notebook.
• 21:09
  Speaker 3: Yeah no, it's true, it's true, but then, yeah, it's, it's true, it's just, I feel, what, what, what's?
• 21:17
  Speaker 3: I think what bothers experts most about it is it's assuming you know the way that modern technology has evolved and the way that we live our lives and the way that we have our personal data and our PII and our personal information out there.
• 21:39
  Speaker 3: I guess database implies some sort of structured base of information, whereas we have a lot of information that's out there in unstructured formats, exactly.
• 21:54
  Speaker 2: Right.
• 21:55
  Speaker 3: Unstructured, unstructured formats, all kinds of connections between different databases and and you know data lakes and places where our personal information resides that you can't necessarily classify into a neat filing cabinet of database A, database B, database C.
• 22:17
  Speaker 1: So is it like a general term?
• 22:18
  Speaker 1: Is it a general term?
• 22:21
  Speaker 3: Yeah, it's a general term.
• 22:23
  Speaker 3: There isn't really a specific definition of what a database is.
• 22:27
  Speaker 3: It's just a collection of personal data that then needs to be protected.
• 22:31
  Speaker 3: So if you think about, let's say the way we think about it is more sort of as opposed to a specific system.
• 22:39
  Speaker 3: We think about it more of the type of information.
• 22:44
  Speaker 3: So let's say you're going and you're working.
• 22:46
  Speaker 3: Let's say you're looking at a company A that has human resources data.
• 22:51
  Speaker 3: They may have seven different systems in which that data is stored, but you look at it holistically and all those systems together comprise one database, which is HR information.
• 23:06
  Speaker 3: So it's sort of more of a conceptual legal term than it is a technological term.
• 23:12
  Speaker 3: But yeah, I mean it's just sort of a different way of thinking about it and conceptualizing it.
• 23:20
  Speaker 1: That's interesting because you know, I don't know, do you work with companies in the US as well?
• 23:26
  Speaker 3: Yeah, sure.
• 23:26
  Speaker 3: I work with companies all over the world.
• 23:28
  Speaker 1: Okay, that's good to know for the listeners too.
• 23:30
  Speaker 1: But, yeah, so, compared to, like, what I'm hearing, compared to Israel's and the European, you know, gdpr and their privacy acts, compared to the state privacy acts that are in the United States, like CCPA there's a lot of them coming out in January of 2025.
• 23:48
  Speaker 1: I think there's like six or seven, and a lot of what I'm seeing in those is there's a lot of there's thresholds, there's opt-out mechanisms, there's a lot of things that are in there.
• 23:58
  Speaker 1: There's similarities in there.
• 24:00
  Speaker 1: They're very different because of the way you said.
• 24:02
  Speaker 1: It's more about the human right compared to the consumer, and that's why there's so many little things that the state laws have.
• 24:10
  Speaker 1: Am I on the right path?
• 24:13
  Speaker 3: Yeah, you're definitely on the right path and I completely understand.
• 24:17
  Speaker 3: So the answer is from that perspective.
• 24:20
  Speaker 3: In terms of scope, it's much more similar to GDPR.
• 24:24
  Speaker 3: So there's no thresholds.
• 24:26
  Speaker 3: Your database, right.
• 24:27
  Speaker 3: So, for example, if you're, the security measures that you have to impose on the data that you have will depend on the sensitivity of the data, the number of data subjects that you have, the number of people that have access to the database.
• 24:58
  Speaker 3: That's an interesting one that doesn't exist.
• 25:00
  Speaker 3: So access rights determine the security measures that you need to impose.
• 25:06
  Speaker 3: So that's an interesting one, but in terms of the, I guess, very much different from the US state laws that are coming out.
• 25:18
  Speaker 3: From the US state laws that are coming out because, number one, it's all data subjects, regardless of the consumer context.
• 25:26
  Speaker 3: So they can be employees, they can be, you know, individuals, even if they aren't direct consumers of the business.
• 25:32
  Speaker 3: So it's not just necessarily in the business context and also, there isn't that threshold, it's.
• 25:37
  Speaker 3: It applies to all, all processing.
• 25:40
  Speaker 3: So so nobody, nobody's really exempt, even if they're government or health care or whatever yeah, no, obviously there's the, the standard household household exemption, like there is in the gdpr.
• 25:52
  Speaker 3: You know, if you're keeping like your the, the, the modern day equivalent of a Rolodex.
• 25:59
  Speaker 1: Oh man.
• 26:00
  Speaker 3: Yeah, there you go See.
• 26:03
  Speaker 3: Now you're showing your age, now I'm showing my age.
• 26:05
  Speaker 1: Although I did say that the 1981 law predates me, so you, can guess even though I'm in the 80s too, so if that makes you feel any better, yeah, there you go too.
• 26:21
  Speaker 3: So if that makes you feel any better, yeah, there you go.
• 26:23
  Speaker 3: Um, so, so, yeah, so there's the the household exemption exists, but not the uh but, but, but certainly in terms of the um, certainly in terms of the applicability of the law it would apply to to anyone processing uh personal data.
• 26:36
  Speaker 3: And then the interesting.
• 26:37
  Speaker 3: The other interesting thing to note for anyone who is doing business in Israel or has any interest in Israeli privacy law is that we have a very a regulator that is certainly using or not use I shouldn't say using, that's not the right word but is very much leaning into the new regime and talking very much, you know, going to every speaking at every privacy event in Israel, talking about how enforcement is going to ramp up and they're really going to take it to the next level and putting people on notice.
• 27:15
  Speaker 3: People on notice, and the regulator has received a lot more leeway and a lot more authority under the new law.
• 27:27
  Speaker 3: And they do very much seem at least from what they're saying publicly to they seem like they're going to start, you know, cracking down on enforcement August 2025.
• 27:37
  Speaker 3: So it's going to be interesting certainly.
• 27:40
  Speaker 1: What's the most common challenge that you run into with your customers right now today?
• 27:46
  Speaker 1: Is there like one that stands out that's coming up very frequently?
• 27:50
  Speaker 3: Yeah, I think it's still.
• 27:52
  Speaker 3: I mean, this was the case back when we spoke last and I think it still is very much the case.
• 27:57
  Speaker 3: The clients, the companies that I tend to work with, are operating globally, and the lack of a unified standard globally is just a really, really difficult thing for companies to be able to comply with and to stand by.
• 28:16
  Speaker 3: Obviously, companies that are operating in the EU will, and other countries will, take the GDPR as the global benchmark.
• 28:25
  Speaker 3: Yeah, but once you're, once you're, once you go beyond the, you go, if you're in Israel, the EU and the U?
• 28:33
  Speaker 3: S, for example, and then you start going into other jurisdictions.
• 28:36
  Speaker 3: Um, then it starts becoming really tricky and really complicated and you in some cases, have conflicts between certain laws, right.
• 28:45
  Speaker 3: So I work, for example, I do some work with with fintech companies that there's always, you know, financial regulation versus privacy.
• 28:54
  Speaker 3: Are you retaining the?
• 28:54
  Speaker 2: data.
• 28:54
  Speaker 2: Are you deleting the data?
• 28:55
  Speaker 3: Everyone has different interests and they're all like you know we need to.
• 28:56
  Speaker 3: We need to delete it under EU law is privacy?
• 28:57
  Speaker 3: Are you retaining the data?
• 28:58
  Speaker 3: Are you deleting the data?
• 28:59
  Speaker 3: Everyone has different interests and they're all like you know we need to.
• 29:02
  Speaker 3: We need to delete it under EU law, but we have to retain it under you know, South African banking regulations.
• 29:08
  Speaker 3: So how do we reconcile those?
• 29:10
  Speaker 3: So that's just an example.
• 29:12
  Speaker 3: But you know, building a global privacy program sounds really great in theory but is very difficult to implement in practice and that's I would say that's probably the most difficult thing that I find, you know.
• 29:27
  Speaker 2: Yeah, I imagine I certainly want to be mindful of the time.
• 29:33
  Speaker 2: I know certainly how much more we do it, dylan.
• 29:36
  Speaker 2: I've got a little time to hang myself there.
• 29:37
  Speaker 2: I'm not certain how much more we do it.
• 29:38
  Speaker 2: I've got a little time to hang myself there, but we're nearing the end of November which means we're pulling up on 2025 territory, which means it's time for predictions.
• 29:47
  Speaker 2: What do you see?
• 29:49
  Speaker 2: What do you see really?
• 29:51
  Speaker 2: Either changing the landscape in the year coming and or becoming more ever-present.
• 29:57
  Speaker 2: That is there now.
• 29:58
  Speaker 2: What are your?
• 30:01
  Speaker 3: general predictions for 25?
• 30:02
  Speaker 3: Wow, that's a great, that's an excellent question.
• 30:05
  Speaker 3: So I think this state privacy laws.
• 30:10
  Speaker 3: It's snowballing and the snowball is just going to continue growing.
• 30:15
  Speaker 3: We have, I think, growing.
• 30:24
  Speaker 3: We have, I think, 19, if I'm not mistaken, 19 laws in the US and we're going to keep going.
• 30:30
  Speaker 3: I was a little bit hopeful for when the APRA was introduced, the draft federal privacy bill earlier this year, but that was a very short-lived experiment, as were its predecessors, so I don't see that coming anytime soon, but I do certainly see states adopting many more states adopting consumer privacy laws.
• 30:52
  Speaker 3: I think that we'll see some really interesting regulatory questions coming out around AI and privacy.
• 31:01
  Speaker 3: I think that there's, you know, there's still a lot of unanswered issues around that, things like data retention, deletion, you know, questions that really we haven't been grappling with, we haven't had to grapple with yet, but we really, we really will, and I think that's gonna that's gonna be super interesting, like from a from, as a person that is very interested and follows very closely the developments in AI governance as well as privacy, just to see where that is taking us right.
• 31:36
  Speaker 3: So some of the, for example, some of the copyright lawsuits that are pending in the courts now against some of the big AI providers, like OpenAI and Google and others, around the use of copyright in AI.
• 31:52
  Speaker 3: I think, yeah, and just a continuation of the trends that we've seen, with regulators sort of cracking down on the big tech.
• 32:03
  Speaker 3: I think I don't see any.
• 32:05
  Speaker 3: I don't see anyone slowing down on that front and and I think 2025 will will be no different, I do think, if I can say something, that's going to be, it's probably going to survive.
• 32:20
  Speaker 3: This is my prediction.
• 32:22
  Speaker 3: I do think that the third iteration of US adequacy in the form of the data privacy framework seems to be at least for now, seems to be safe.
• 32:36
  Speaker 3: I haven't seen any major challenges of that.
• 32:38
  Speaker 3: As opposed to its predecessors, privacy Shield and Safe Harbor, which were both struck down by the EU courts, it doesn't look like the data privacy framework is going down that route, which is, in my opinion, a very good thing that we can finally put that whole, all those shenanigans, behind us, and just focus on actually doing the work.
• 33:02
  Speaker 1: So from that perspective, I'm happy.
• 33:05
  Speaker 3: Wouldn't that be nice right?
• 33:07
  Speaker 1: Well, so you have your predictions.
• 33:08
  Speaker 1: Those are good.
• 33:09
  Speaker 1: Now take what you would hope to happen.
• 33:13
  Speaker 1: What do you think is one thing that could actually make things less complicated, for how things are so complicated, especially for these global companies that are dealing with data all over the place?
• 33:24
  Speaker 3: Yeah, I think that anything that brings us closer to some sort of global standard, some sort of like an international body releasing a Again, I'm realistic, so I don't think this is actually going to happen.
• 33:42
  Speaker 3: But if there was one thing that I would be hopeful that would happen is it's one of the international bodies, whether it's the UN or the OECD, or one of these international bodies would sort of stand up and say okay, enough with this nonsense of jurisdiction by jurisdiction.
• 34:01
  Speaker 3: Here's the global privacy standard and we're sort of going to make things these are.
• 34:07
  Speaker 3: The principle obviously needs to be principle based.
• 34:09
  Speaker 3: It can't be you know specific rules, because each country will interpret and implement it differently in the same way that different countries in the EU interpret the GDPR differently and somehow it still seems to work.
• 34:22
  Speaker 3: So we can have harmonization on a principle based harmonization, harmonized privacy framework.
• 34:29
  Speaker 3: You can figure out the acronym for that PBPF PBPF the principle based privacy framework, and sorry've got to put the G the global in there.
• 34:44
  Speaker 3: Yeah, there you go.
• 34:46
  Speaker 3: Doesn't it work the other way around?
• 34:50
  Speaker 3: First you figure out a really good acronym and then you figure out what it stands for right, like CANSPAM.
• 35:02
  Speaker 3: That would be a backronym.
• 35:04
  Speaker 3: A backronym, oh, there you go.
• 35:10
  Speaker 3: Very good, I like it, I like it.
• 35:11
  Speaker 3: So, yeah, just something like that that would allow companies to, just because, at the end of the day, it's the frustrating thing, I think, from my perspective, is you have companies that really want to do the right thing.
• 35:20
  Speaker 3: It's not like someone's coming and saying, oh I want to do shady stuff, so let me like figure out which where I need to incorporate and what I need to do in order to avoid X, y, z rules.
• 35:33
  Speaker 3: And that's not the case.
• 35:34
  Speaker 3: The case is we want to do the right thing, but it just works out that because we're operating in 10 different jurisdictions and we have 10 different legal regimes that apply to us, it just makes things that much more complicated, and so that's what I would hope to see is some sort of harmonization.
• 35:52
  Speaker 1: I can't imagine.
• 35:53
  Speaker 3: No.
• 35:53
  Speaker 2: Harmonization, that'd be awesome.
• 35:55
  Speaker 1: When you're working with these privacy teams, or maybe they don't even have a privacy team, who knows?
• 35:59
  Speaker 1: I mean, if they're a pretty large company, I would imagine they would.
• 36:02
  Speaker 1: But what do you see in the tech side when it comes to, like that, collaboration with these companies or customers that you're working with?
• 36:10
  Speaker 1: Is there still a disconnect there from your perspective?
• 36:12
  Speaker 1: Is it still lacking on the privacy side, or what do you see from that end?
• 36:18
  Speaker 3: So I work with various different sizes of companies, as you say, the smaller ones that don't necessarily have an in-house privacy, and I'm sort of the sole privacy consultant as an external consultant.
• 36:34
  Speaker 3: That's always a challenge.
• 36:38
  Speaker 3: that's always a challenge getting to the relevant people in the company trying to kind of put together the regulatory and the tech and trying to figure out how to, how to, how to work collaboratively and how to convince them that working with me is actually good for them.
• 36:57
  Speaker 3: And uh, and I'm not trying to, I'm not trying to block anyone or stop anyone.
• 37:03
  Speaker 3: I you know.
• 37:04
  Speaker 3: I'm just trying to help us do a better job and build trust Right, because trust is everything.
• 37:10
  Speaker 3: Um and then yeah, and then internally, um, I think that there's internally.
• 37:17
  Speaker 3: I think there is also a you know, sorry, companies that have an internal resource tends to be better because they tend to be already on top of things and more sort of collaborate with the technical people.
• 37:36
  Speaker 3: But I will also say that one of the things that I am seeing which I think is great is a lot of tech tools in our space that are designed to sort of enable and give the internal privacy teams more sort of collaboration, more control, more alerts about what's going on in the code and within the actual technical teams, and that's really cool to see that people are actually investing in that type of software.
• 38:09
  Speaker 1: That was leading me to my next question, which was are you still seeing a lot of companies still using legacy tools for privacy now that there's so many better tools out there?
• 38:17
  Speaker 1: Not to not to do a shameless plug with something like transcend, but, uh, you know, like thinking about that next gen privacy where we're trying to automate things to make it easier for those tech teams and those privacy teams to make things a lot easier for their consumers to build that trust.
• 38:33
  Speaker 1: That's the biggest thing, like you were talking about is building trust is how do you build that trust?
• 38:37
  Speaker 1: Well, I think having a tech that using some kind of privacy solution, that is, a platform that is very efficient and automated, to where you can understand your data, know where it is and have things automated for your customers and consumers to make them feel like they have that trust in that technology as well.
• 38:57
  Speaker 3: Yeah, absolutely, and I think that that's one of the things that AI is going to specifically in our space is going to really make things much, much easier for the experts is sort of giving you that bird's eye view of what's going on and things like ropa's record of processing activities and you know other standard documentation that used to take you know ages to complete can now be automated and and kept up to date in real time.
• 39:29
  Speaker 3: I've seen and I work with several tools like yeah like transcend and like some of the other players in this space that I know that are out there and are being built literally as we speak, and it's really exciting to see like tools that are scanning code and giving privacy teams sort of real time access to okay, not what it says in the policy, because the policy is already two months outdated, because the engineers have already moved five steps ahead of what it says in the policy.
• 40:04
  Speaker 3: It just hasn't been updated yet because the update date hasn't arrived yet, but actually scanning in real time, giving alerts in real time, giving information in real time and cutting out the, you know, alleviating the necessity to do all of these manual tasks, all the time and I think that's going to be really, really great.
• 40:28
  Speaker 1: Yeah, agreed, because I know a lot of the older tools.
• 40:31
  Speaker 1: It takes a lot more resources, so a privacy team isn't going to know what an engineer would know For sure.
• 40:34
  Speaker 1: They're going to need to lot more resources, so a privacy team isn't going to know what an engineer would know For sure they're going to need to use those resources?
• 40:38
  Speaker 1: Yeah, definitely.
• 40:40
  Speaker 3: One of the biggest things that I hear from clients is like oh, we feel like we're working for the tool more than the tool is working for us Right.
• 40:49
  Speaker 3: That's like the number one piece of feedback that I hear about some of the more legacy tools is like we need to keep feeding it information as opposed to, and we haven't yet seen the benefits come back to us whereas the you know, some of these ai tools are almost like plug and play to use uh, to use one of the older uh antiquated uh, you know, one of the older uh tech phrases we don't.
• 41:21
  Speaker 1: Yeah, I mean, it's interesting, it's going to be really neat to see how that develops and if, if, uh, ai and privacy can find that balance of innovation without uh, without taking a hit on the privacy side for sure for sure.
• 41:35
  Speaker 3: No, I, I definitely, I think it's definitely going to happen.
• 41:38
  Speaker 3: It's not a question of if, it's a question of when.
• 41:41
  Speaker 3: And it's going to be great because what it's going to do is it's going to almost give privacy professionals superpowers, because they're going to be the number one thing that a privacy professional always yearns for and desires is to be in the room.
• 42:02
  Speaker 3: Do you remember that?
• 42:03
  Speaker 3: Did you see?
• 42:04
  Speaker 3: Have you seen Hamilton?
• 42:05
  Speaker 3: So I love that song.
• 42:07
  Speaker 3: You know the song in the room where it happens.
• 42:09
  Speaker 3: Room where it happens, the room where it happens.
• 42:13
  Speaker 3: Yeah so that's what a privacy that's all a privacy pro ever wants to be is in the room where it happens.
• 42:16
  Speaker 3: Yeah, so that's what a privacy that's all a privacy pro ever wants to be is in the room where it happens, in the room where that decision gets made in the room where the architecture of the new feature is getting, is getting built, and what these tools are going to allow them to do is be in the room where it happens, because they're literally going to be seeing it in real time, as as the code is being written, as opposed to, you know, three months down the line when they discover that they have a feature that's now been collecting data, sharing data.
• 42:43
  Speaker 3: You know these tools have been onboarded.
• 42:46
  Speaker 3: They don't even have any clue about what's going on.
• 42:48
  Speaker 3: Now, all of a sudden, we're, we're real time.
• 42:52
  Speaker 1: We're seeing it real time.
• 42:53
  Speaker 1: We're shortening.
• 42:54
  Speaker 3: Exactly, we're shortening the lag time for them and and that's you know- it's going to give.
• 43:00
  Speaker 1: Yeah, it's going to be huge.
• 43:01
  Speaker 1: That goes back to your point in the beginning, avi, where you said I don't want to come into these after the fact.
• 43:05
  Speaker 1: I want to be able to see it when it happens and be a part of it in the room where it happens.
• 43:10
  Speaker 1: Interesting, ok, and this episode is brought to you by Hamilton.
• 43:14
  Speaker 3: You can go see it on.
• 43:15
  Speaker 1: Disney Plus.
• 43:16
  Speaker 3: Lin-Manuel Miranda.
• 43:17
  Speaker 3: There we go, yeah.
• 43:18
  Speaker 1: Awesome.
• 43:19
  Speaker 1: Is there anything that you want to bring up that we didn't get to talk about?
• 43:23
  Speaker 1: I know we're coming up on time for the hour, but anything that you want to talk about, or if you want to let the listeners know how to find you, if they're interested in working with you, learning more from you or connecting with you, whatever, whatever that is yeah, with pleasure.
• 43:39
  Speaker 3: So, um, thank you very much.
• 43:42
  Speaker 3: Uh, yeah, so the company is trust is, uh, the website is trust isai, uh, it's with a z, so t-r-u-s-t-i-zai or zed.
• 43:53
  Speaker 3: If you're from the UK and you can find me on LinkedIn, I am very active on LinkedIn.
• 44:01
  Speaker 3: I love to connect with people there.
• 44:04
  Speaker 3: I love to have conversations there.
• 44:06
  Speaker 3: Please feel free to reach out, dm, engage with any of the posts.
• 44:11
  Speaker 3: I always love to hear people's feedback and people's thoughts on the things that I post and the things that I speak about, and if anyone needs any help with anything relating to privacy, consulting globally, dpo as a service or AI governance, please also feel free to reach out.
• 44:31
  Speaker 3: That would be awesome and really looking forward to having great conversations, because if there's one thing that our community is good at, it's having really, really interesting conversations with really interesting people like yourselves.
• 44:45
  Speaker 1: I agree.
• 44:45
  Speaker 1: That's why you're on, because you're interesting and you care, you are you.
• 44:50
  Speaker 1: I think that one thing that stands out to me from my perspective is that you're just being you and you're digging in and just going all in.
• 44:58
  Speaker 1: I love that and I thank you.
• 45:00
  Speaker 1: I appreciate that and thank you for taking the time to be with us again.
• 45:04
  Speaker 3: Thanks.
• 45:05
  Speaker 3: Well, the feeling is definitely mutual.
• 45:07
  Speaker 3: Cam and Gabe, it's really, it's always a pleasure to speak to you guys, and same.
• 45:12
  Speaker 1: One last thing before you go though, yeah, for sure.
• 45:15
  Speaker 1: What, since we're coming up on Thanksgiving.
• 45:18
  Speaker 1: What's, what's?
• 45:19
  Speaker 1: What's one thing that you're thankful for?
• 45:21
  Speaker 3: Oh, I wow, that's or multiple things.
• 45:24
  Speaker 1: No.
• 45:24
  Speaker 3: I was.
• 45:25
  Speaker 3: I was gonna say I'm thankful for so many things that I you know it's hard to pick just one, but I would have to say I'm really thankful for my family.
• 45:35
  Speaker 3: I think this past year has been, you know, both in terms of on and our dog, who gives me emotional support on a daily basis.
• 46:01
  Speaker 3: You know she actually my dog, brownie is a pretty by now is a pretty big privacy expert because she's just had to have so many conversations with me about some of the stuff when I didn't have anyone else around.
• 46:18
  Speaker 3: My wife was out at work and my kids were at school.
• 46:20
  Speaker 3: So now she knows all about you know, building privacy programs, drafting policies, reviewing DPAs so she actually has a lot of knowledge in the privacy space.
• 46:32
  Speaker 1: So she's pretty certified, sounds like.
• 46:34
  Speaker 1: She's oh she is definitely by far the most certified canine privacy professional out there I think, uh, you should start like a I don't know, like a instagram page with you and you and her like a privacy sidekick or something yeah, for sure, for sure.
• 46:53
  Speaker 3: Yeah, I mean it's, it's, she, doesn't she it's.
• 46:56
  Speaker 3: It's very hard to.
• 46:57
  Speaker 3: She's pretty cagey, no pun intended, so it's hard to get you know her, her view on things.
• 47:04
  Speaker 3: It's usually me giving her my view, but uh, but she's, uh, she's a good listener.
• 47:11
  Speaker 1: I love that man.
• 47:12
  Speaker 1: Well, Avi, thank you again for your time, and it's always great catching up man.
• 47:17
  Speaker 1: I'll definitely talk to you on LinkedIn and so on, but good luck going into 2025.
• 47:23
  Speaker 3: Thank you so much for having me on again and wishing you and your families, and everyone listening, a very happy Thanksgiving.
• 47:31
  Speaker 1: Appreciate that Same to you and yours.