Latest / Fractional Frequency / The Data Problem You Didn't Know You Had
Transcript
- Amy Crook: Hello? Erin Todus: Hi, good afternoon. Amy Crook: Good afternoon. How are you doing today? Erin Todus: I'm great. How about you? Amy Crook: I'm doing really good, really good. And I'm super excited that ⁓ our guest today is ⁓ Donata. ⁓ my goodness, I should have checked this first. Is it Str Strong Strong Skilred? Donata Stroink-Skillrud: Yeah, strength skill rune. Amy Crook: Strength skillred. ⁓ my goodness. British people are just not good at anything that's not simple. ⁓ okay, I guess it's strength skillred. Does that sound normal? Okay, good. Okay, that and we'll start again and go. Hi. Yeah, I'm good, thanks. How are you doing? Excellent, excellent. I'm really excited because today we are chatting with Donata Strong Skillred, a privacy attorney. Erin Todus: Thank Hi, how are you? I am good. Amy Crook: SAS founder and one of the people helping businesses navigate the increasingly complicated world of data privacy. She's the president of Termagedd, a software platform that automatically generates and updates website policies and law changes, solving problems that most companies don't even realize that they have until it's too late. In addition to running the company, Donata is deeply involved in the American Bar Association. Where she serves in multiple leadership roles focused on privacy, security, and emerging technology. So today we're going to have a conversation with Donata around what founders need to know: ⁓ privacy, compliance, how regulations are evolving, and why staying compliant is becoming both a legal and competitive advantage. So welcome, Donata. Donata Stroink-Skillrud: Thank you so much for having me. Amy Crook: Awesome. So good to have you here. So let's get right into it. What inspired you to launch Termageddon? Donata Stroink-Skillrud: Sure. So ⁓ when I was in private practice, I was working with web design agencies. So I was writing their contracts, ⁓ forming LLCs, corporations, things like that. And ⁓ you know, we noticed that their clients didn't really know what to do for their website policies. So I would write up their website policies for them and Kind of noticed that the process was very repetitive. So I was asking them very similar questions. And this was before all the privacy laws, even before GDPR. ⁓ so I was asking them similar questions like what information are you collecting? What are you doing with that information? Who are you sharing it with? And then I had like four or five templates that would Frankenstein together and to get their end product. And honestly, I just hated the process. Like it was really boring, really repetitive. ⁓ and I noticed that also a lot of small businesses couldn't afford my service. And that was around the time where I met my husband who was running his own ⁓ web agency, and we were talking over dinner, and he was telling me how his clients don't know what to do for policies, and he's not really comfortable like copying and pasting a competitor's policies for them. And I was kind of sharing my frustrations. And ⁓ we came up with the idea for for Thermageddon together to kind of solve. Both of our problems. Amy Crook: That's awesome. I love that. Just over dinner, solving the world's problems. I love it. And so how has your team evolved since that first conversation? Donata Stroink-Skillrud: Sure. So we started with just the two of us. ⁓ so originally the product was built by a ⁓ third party firm who did application design. ⁓ and you know, throughout time we added more people, you know, we added somebody in sales, and then ⁓ we hired our CTO, then we hired more developers, and we hired a support person. ⁓ so now there's nine of us. ⁓ so the team has grown ⁓ quite a lot over the last few years, ⁓ which is awesome. It's nice to have other people to ⁓ talk about at the end of the day of frustrations or, you know, good things that happened. ⁓ so yeah, we have a great team. Amy Crook: So why do you ⁓ your customers need these these privacy policies? ⁓ what's the risk? Donata Stroink-Skillrud: Yeah, so really, you know, the first question, why do people need this? ⁓ so you know, most modern websites collect personal data. And I think a lot of small businesses are not realizing that. So, you know, what happens is they think that only really sensitive personal data is protected. So, you know, my site's not collecting social security numbers, passport numbers, or card information, that means I'm good to go. ⁓ but unfortunately that's just not true. So Privacy laws protect personal data of any kind, ⁓ which is really any information that could identify someone or any information related to an identified person. So data like names, emails, phone numbers, IP addresses, physical addresses, all of that information is protected. And most modern sites do collect data. So, you know, if you have a contact form, email newsletter sign-off forms, e-commerce, block commenting, analytics, advertising. you know, you're collecting personal data, which could ⁓ subject you to privacy laws. And if you're not ⁓ compliant with those laws, you could be subject to fines or lawsuits. Amy Crook: And they're pretty significant, right? Like I I remember when GDPR came in in Europe, which was ⁓ a huge shift in like the way everybody had to operate. Do you remember as well, like your email for maybe like six months, everybody had to update their terms and like ⁓ my goodness, it was crazy. But the fines that come come along with some of this non-compliance, it they're pretty steep. Donata Stroink-Skillrud: Yeah. Yeah. Amy Crook: Like it's a lot of money. Donata Stroink-Skillrud: Yeah. Yeah, they are. So, you know, GDPR can be twenty million euros or more. ⁓ here in the US it they start at twenty five hundred per violation. ⁓ and in privacy law, twenty ⁓ per violation means per website visitor whose privacy rights were infringed upon. So let's say you have one hundred website visitors from California this month, the fine would be calculated as twenty five hundred times a hundred. ⁓ so that can add up really quickly. And then there's also the risk of potential lawsuits too. Amy Crook: Yeah, yeah. It's crazy. Erin Todus: And websites can collect all kinds of information. We work with clients that have access to incredible amounts of data. And they're looking at geospatial information and consumer behavior and search patterns. And if you step back and ask, where did you get all of this? It's from the website, from tracking cookies that they're probably consciously applying in those cases. But I can see how you could set up a website, especially with a lot of the sort of self-serve services that are available out there today and not really realize what you're setting up. Donata Stroink-Skillrud: For sure. Yeah. I mean, ⁓ Squarespace is a great example. Most Squarespace sites will turn on Squarespace Analytics by default. ⁓ where it's not necessarily a setting that a website owner sets, it just automatically comes with it unless they specifically go in and turn that off. ⁓ you know, or a lot of agencies when they build sites, they will just automatically add Google Analytics to the website because, you know, they're trying to help the client. ⁓ But what happens at the end of the day is we talk to this client and we say, hey, you have Google Analytics on the site. We're going to need this, this, and this. And they're like, no, I don't. ⁓ yeah, you do. Like you had to like show them that they have it, but they're like, I've never signed into analytics. I've never checked any of the data. I've never done anything with the data. Well, in that case, ⁓ you should really consider just removing that from the site because Erin Todus: I'm Donata Stroink-Skillrud: It collects data, it tracks people, it can even subject you to additional privacy laws that you normally wouldn't be subject to. ⁓ and those can be pretty high risk tools right now. Erin Todus: Wow, that's interesting. So interesting. What would you say are the immediate risks of not having like a basic privacy policy in place? You mentioned there are sort of layers of risk, but at just the root of it, aside from the fines, you talked about ⁓ lawsuits. Is there maybe reputational risk at stake? What else comes to mind? What else do you talk about with your clients? Donata Stroink-Skillrud: Anyway, I think we call it. Yeah, so I guess first of all, basic really has no bearing on compliance. ⁓ so to avoid fines and lawsuits, the the privacy policy has to have all of the disclosures required by the privacy laws that apply to the business. So each privacy law has a specific set of disclosures that the privacy policy has to contain for it to be compliant with that law. ⁓ so basic sounds nice. ⁓ a lot of business owners want basic. ⁓ but basic will really do nothing for you if you don't have those required disclosures. ⁓ you know, in terms of risks, so the immediate risk would be fines. ⁓ so like we talked about 2,500 per violation. ⁓ another potential privacy risk could be lawsuits for tracking people without their consent. ⁓ and then also, you know, reputational harms, as well as you know, people just leaving your site. So You know, it used to be that consumers, you know, we didn't really care so much about privacy, right? Like you went on websites, you put in your email, you put in your name, you put in your phone number, put in your credit card details, you got your stuff, and that was that, right? ⁓ unfortunately that's changed. ⁓ so a lot of consumers are really interested in their privacy now, which is why we're seeing so many of these privacy laws being proposed and passed. ⁓ so consumers are looking for a privacy focused website and experience. So really what can happen there is you know, if a consumer doesn't see that, they can leave the site and not buy from you, not submit their information. ⁓ but then also they can unsubscribe from your email list. ⁓ if they're getting emails nonstop that they never signed up for, they can mark your phone number or spam. ⁓ you know, if you're texting them without consent or repeatedly texting them for no reason. ⁓ so that's definitely a risk as well, is that ⁓ consumers won't be willing to interact with you. Erin Todus: Yeah. I mean, all it takes is for your data to end up in one pair of wrong hands and you've got randomly generated numbers calling you all day and all night. I've certainly had a brush with this number. Donata Stroink-Skillrud: It's it's a nightmare. Yeah. My phone is basically unusable now because of the amount of spam calls that I get. Yeah. ⁓ what I also think, you know, there's tools that are really creepy to consumers that some websites use. ⁓ one example is IP intelligence tools, which is you go to the website and let's say you look at couches. You never bought anything, you never submitted your information. Amy Crook: Yeah. Erin Todus: Thank Donata Stroink-Skillrud: But five minutes later, you get an email from that company with those couch ads. And you're just like, How did they get my email? Well, they get the email through IP intelligence tools, but the problem is that the consumer never consented to that on a lot of sites. You know, if they consent to getting emails, great, send them the emails. But if they didn't consent to it and they get an email from you when they never submitted their email, that is so creepy to so many people. And they immediately unsubscribe, they immediately delete all your emails and they immediately like they never they will never shop with you again. ⁓ so, you know, being really careful about what kind of tracking and reaching out you do, ⁓ to make sure that you're not, you know, creeping people out too much. Amy Crook: Yeah. Erin Todus: I'm continuously grouped out. I feel like my phone can even listen to me because I've had conversations about ⁓ product or an idea and not, at least as far as I can recall, not made any kind of search history about it. And then I get served ads. I mean, is that real? Have you come across that in your work? Donata Stroink-Skillrud: Yeah, there have been lawsuits about that where, you know, your phone listens to you, or maybe you search something that's like tangential to it. Like let's say you searched, ⁓ you know, my room are is this these are the dimensions of my room. What size couch should I get? And all of a sudden you're getting all these couch ads, even though you never actually search for a couch. ⁓ so it's all through this advertising, basically surveillance network that we all live in. where if you, you know, talk about something with your phone or computer close to you, you search something that's sanctional to it, ⁓ you know, you'll get ads for it. It there there's been examples of like women who don't know that they're pregnant getting ads for pregnancy products and then they find out that they're pregnant. So I mean, yeah, they know a lot about us. Erin Todus: That is so creepy. Wow. Last time we talked though, Denada, you mentioned that, you know, particularly in the case of small business, you've got clients who have sort of leveraged their commitment to privacy as a way to build trust with their customers. Tell us more about that. Donata Stroink-Skillrud: Mm-hmm. Yeah. So, you know, first step is is realizing that consumers are actually interested in this and they want to make sure that the business they're dealing with is taking their privacy seriously. ⁓ and you can think about it from your own standpoint, right? Like me as a business owner, I'm a consumer myself, right? I buy stuff all the time. And just think about it. If you go in and you purchase something, you don't necessarily want to hear from them 30 times per day for the rest of your life. You don't want to be getting text messages with ads forever. Like you bought the couch, you're done, right? Like you're not some kind of couch collector now. so to start us off, you know, it's really about following those rules set out in privacy laws and making sure you're careful about your communications with customers. So that can mean things like obtaining consent ⁓ before you text somebody, keeping marketing emails to a reasonable amount or frequency. Erin Todus: Thank Donata Stroink-Skillrud: ⁓ having the right policies and consent solution in place, all those things can demonstrate to customers that your business is trustworthy from a privacy perspective. Erin Todus: I think that makes a ton of sense and just being thoughtful about the communication cadence and how often you're hitting people. People get hit with, at least in my case, probably 100 plus emails a day that are both business and personal. You just can't possibly keep up with it all. I don't know anybody can. ⁓ You serve a pretty diverse and wide array of clients, small, Donata Stroink-Skillrud: Right. Yeah. Erin Todus: across industry sectors, can you tell us a little bit about how the need for privacy policies sort of differ across those use cases and maybe in some ways are they the same? Donata Stroink-Skillrud: Yeah, so really in general thinking about this, unless you're in a really regulated industry, like let's say you're in healthcare, you're a hospital or finance, you're a bank, your industry doesn't really matter that much when it comes to privacy law compliance. So what we're really thinking about is more of what personal data you're collecting, how you're collecting it, what you're doing with it, who you're sharing it with. ⁓ you know, if you're collecting a large volume of data or make over a certain amount of revenue every year, then you may have more privacy laws that apply to you. So you might have more requirements as opposed to if you didn't do those things. ⁓ but that's not really based on industry. And there's also a lot of privacy laws that apply to small businesses and even nonprofits as well. So it's not so much about the industry ⁓ unless you're somewhere that's extremely regulated with their own specific laws. But overall what we really kind of pay attention to more is what's on your website. Erin Todus: Mm-hmm. Yeah, that makes sense. So tell me, so these privacy laws are always being updated and changed. We subscribe to industry-specific updates and communications about HR legislation, for example. It seems like that comes in pretty regularly, and it's different in every state. It's like wrapping your arms around a body of information like that is nearly impossible for normal people who are Amy Crook: Mm. Thanks. Erin Todus: but also trying to run a business and focus on a million other things. How does your product work in that respect? How do you keep on top of all of the changes all of the time? Donata Stroink-Skillrud: Yeah. Sure. So I guess the the first part of how it works. ⁓ so you ⁓ purchase the license and then you answer a series of questions. So the first set of questions helps the software figure out which laws apply to you because that's what we base the policies on, because that's what tells us what disclosures need to be in the policies. ⁓ and then we ask follow-up questions to ⁓ create those disclosures, and then we create the policy text. And then an embed code. The embed code is what goes onto your website's policy pages, displays the policy text, and then also allows us to push updates. ⁓ so ⁓ a part of our service is tracking those changes. So new ⁓ privacy laws that are proposed and passed, guidance, ⁓ you know, enforcement cases, and also existing privacy laws change too. So there's a lot of new technologies coming out, like AI, that have an impact on privacy. So, you know, privacy laws that were written in nineteen eighty eight ⁓ don't necessarily have the bandwidth to cover that. ⁓ so existing privacy laws change as well. ⁓ so through that tracking, what we do is if there's something new that affects the customer, ⁓ we'll send them an email letting them know. and then we'll also update their text through the embed codes too. Erin Todus: that's cool. So they don't really have to worry about keeping up with it as long as they've populated the form correctly. They're taken care of. That's awesome. And I'm going to tag a question on here because you mentioned this and now I'm curious about it. You talked about AI and how these a lot of these laws obviously were written without that in mind. What big changes do you expect to see in the short term, you know, next couple of years, perhaps with the entry of AI in the space? Donata Stroink-Skillrud: I mean, in terms of legislation, we'll probably see new laws covering AI or existing laws being amended to cover AI. ⁓ but really what I expect to see is a lot more businesses getting into trouble for using AI inappropriately. So the thing that we're really concerned about from a privacy standpoint is AI getting access to personal data of your customers, right? ⁓ so there's a lot of businesses out there that use AI for like general research. Like I'm a florist in Chicago, what should I do to market my business? Or, you know, I got a customer ticket with this question, but I'm not sure what they're asking. But they're just putting in the question. They're not putting the name and email and phone number and stuff. You know, those kinds of uses of AI are not, you know, super harmful from a privacy perspective. They're not getting access to any personal data. It's not really that big of a deal. But You also see a lot of businesses implementing AI chatbots on websites or integrating AI into their customer support platforms or their email marketing or all this stuff where AI is getting all of this access to personal data. And the problem is that the business is not being careful about making sure that this personal data is not being used to train the AI. So what happens is, you know, AI gets access to the customer's billing details. That's used to train the AI. And then some person completely unrelated to the business says, What's Jean Doe's social security number or credit card number? And then the AI spits that information back as the answer, and all of a sudden there's a huge data breach. So I would be very, very careful with making sure that however you use AI into the business, number one, don't give it access to production. Like we've seen so many. ⁓ companies that have had their entire production and ⁓ backups wiped because they integrated AI into it, like just don't do that. ⁓ and then also don't put personal data into the AI unless you have some kind of self-hosted system in place. Erin Todus: Wow. Yeah. Can you imagine like you've got some sort of chat bot on your site and then you've got traffic coming through that bot that are not even necessarily customers feeding their information in and then that could materialize into a per head lawsuit and fines. That's a Amy Crook: Yeah. Yeah. Donata Stroink-Skillrud: Yeah, I mean, you know, AI chatbots come with a lot of reputational risks too. Like I've had this happen to me where submit a support ticket to to chatbot, which I didn't know was AI, ⁓ to company saying, like, you know, you said my billing is going up by this much, but the email didn't really make sense. Can you confirm? The the chatbot tells me, ⁓ no, this is only for new customers. This is not for existing customers. And then I realize that the chatbot's AI. And then I submit a support ticket to the company to a regular person. And they're ⁓ yeah, this applies to regular customers, not just new customers. I'm like, but wait, your website told me that it's new customers only. And now I'm upset because you're giving me conflicting information. And you know, these companies try to hide behind the fact that this chatbot is AI, so it's not super accurate. But as a customer, I don't care. Like I'm just trying to get information from you about your business that's accurate, AI or not. So I think it's gonna cause a lot of reputational risk and upset customers too with these chat bots just because the information that they're providing is not accurate. Erin Todus: Yeah. ⁓ Amy Crook: Yeah. That that just makes me want to highlight just just one thing from our conversation previously. because as you can imagine, every client and every person that we speak to through fractional frequency is like all about AI. AI, AI, AI. And I remember we talked about how you had used AI with your business and you were like, no. Donata Stroink-Skillrud: What? Amy Crook: So I just I just would love for you to share a little bit about your decision making and and kind of the practicalities of why ⁓ automation is not something that's helpful. ⁓ 'cause I think there's a good lesson out there for everyone around like the juice has to be worth the squeeze. So if you could just share what you shared with us previously, I think that would be really helpful. Donata Stroink-Skillrud: Yeah. So I would like to say first of all, I'm not like a complete AI hater, right? Like I do I do feel like there's some instances in which AI can be used, it can save you time, it's it's pretty good. my issue in my industry is with the accuracy, right? So if I go into an AI and say, write me a GDPR compliant privacy policy for this particular website. Amy Crook: No Donata Stroink-Skillrud: It's gonna spit out something that to like a lay person looks really professional and really nice. But unfortunately, it doesn't have all the right disclosures. GDPR is not the only privacy law that applies to me. There's a lot of other laws with a lot of other disclosure requirements. And number three, it just made stuff up. Like it said, I'm selling data. ⁓ or it said that I'm using Google Analytics and I'm not, you know, so. If you're a lay person, like on the surface, everything looks really good. But if you're an expert looking into it, you're like, man, this looks nice, but it's actually garbage. Like if I were to have to create a compliant privacy policy with an AI, I would have to tell it all the privacy laws that apply to me. I would have to tell it all the disclosures that those privacy laws require. I would have to tell it all of my business and privacy practices with those disclosures. And then it can spit something out for me that's relatively decent. But the problem is that a small business owner doesn't know all of these things. And then it also doesn't update it for me and and things like that. And I mean, as lawyers, there are so many lawyers that have been sanctioned for using AI for court cases where they have an AI write a brief and it just makes up cases that are totally and completely false. And the lawyer never checks those cases. And then they submit the brief and the court's like, what are you doing? Like, you're gonna get sanctioned for this because this is all just false information. So to me, like if you are using AI, number one, I would make sure that you're an expert in whatever you're asking it to do so that you can double check it. And I would double check literally everything that it tells you with a trusted source because AI hallucinates all the time. And you want to make sure that you're getting the right information. Like I was seeing something on Reddit where This company integrates AI into its financial forecasting. And it's making these decisions based on what the AI is telling them to do. Everything sounds so good. Like it sounds so smart. And then in six months, somebody on the board says, you know, can you like double check what numbers is the AI using on this financial forecasting? And the guy asks the AI and he's like, I've I just I've been making this information up. And they're like, we've been making decisions for six months. based on what this thing is telling us and all the information is made up. So just be careful is all I'm saying. Amy Crook: Yeah. I'll co-sign that too. I was ⁓ rewriting a policy handbook for one of my clients. And you know, I was using ⁓ Chat GPT to help me with some of the language. and then I was mentioning one regulation in that's ⁓ relevant in Illinois. And then as I was reading what it's given me, I was like, that's not right. That's not the Erin Todus: Wow. Thank Donata Stroink-Skillrud: Yeah. Amy Crook: Like and I I meant it was like having me second guess so I had to quickly like go and do some r research on the on the gov website and I was like, I knew that was wrong. But yeah, I mean if you don't know, like for sure, you could end up putting together a whole lot of fiction in your in your face. Donata Stroink-Skillrud: Yeah. Yes. Yes. And one of the things that I like to do is I like to ask it for the source. So I ask it a question and I'm like, give me the sources where you got this information. And half the links are four or four errors. Like they don't exist. And I'm like, so you're just making this up. Erin Todus: Yeah, I've started that too. And then sometimes they're like random websites that I've never heard of somebody's blog post or something. It's like, kind of eye opening when you start to peel back the ears a little bit. Last question for you, Janata. And then I know that we've got like some quick hit advice we'll ask you for. I think that, you know, there's a lot, there's a lot to consider of all the things that we've talked about, especially for Amy Crook: Yeah. Donata Stroink-Skillrud: Mm. Yeah. For sure. Erin Todus: either a small business owner or a new founder who's just diving into their business and maybe feeling overwhelmed by the information. What would you say for somebody like that? Like what's, what is the best just first step in the right direction? Donata Stroink-Skillrud: Yeah. So, you know, if I was a business, the first thing that I would do is I would figure out which privacy laws apply to me. Because if you don't know that, you don't know what requirements you need to meet. ⁓ you know, you don't know what your privacy policy needs to say. You don't know if you can track people without consent. ⁓ you don't know what your form consent needs to look like. ⁓ so some questions that you should be asking yourself, ⁓ well, I guess before I do that, ⁓ first, you know. Privacy laws are meant to protect individuals, not businesses. So the privacy laws of other states and countries can't apply to you if you're collecting personal data from there. ⁓ you know, they apply to small businesses, they apply to for profits, nonprofits, you know, the whole gamut. So, you know, to determine which laws apply to you, some of the questions you should be asking yourself is, you know, who can access my website and have their personal data collected? So like, Who could go to your site and submit a contact form or have their data collected through Google Analytics or similar tools? ⁓ who can access your site and be tracked? ⁓ where are your customers located? And then to whom do you offer goods or services? ⁓ so ask those questions and then once you determine which laws apply to you, you know, you'll know what standards you actually need to meet. And that's really the best place to start. Amy Crook: Yeah, that makes perfect sense. Well, hopefully that's been helpful for anybody out there that ⁓ is a founder or even just somebody who is looking to make good decisions around policy for their organization. ⁓ Donata, where can people find you, find out more about you, connect with you? Erin Todus: So, thank you. Donata Stroink-Skillrud: Yeah, so you can connect with me on LinkedIn, Donata Strong Skillroot. ⁓ feel free to connect or send me a message. ⁓ and then you can also find our company ⁓ termagedon.com or Termageddon on all social media platforms. Amy Crook: That's awesome. Thank you so much for spending some time with us today, Donata. Donata Stroink-Skillrud: Yeah, thank you for having me. Erin Todus: Thanks, Denada. Talk soon. Amy Crook: Bye.