Lauren Ervin: Yeah.
Liisa Thomas: Welcome to Compliance Chronicles, where we learn from professionals shaping the world of compliance. your host, Liisa Thomas, ⁓ Privacy and Compliance counsel an professor at Northwestern Law School, and a lifelong learner of organizational change. ⁓ From journeys to hard-earned lessons, ⁓ these the chronicles that inspire and guide. ⁓ So we're back with another conversation with a leader in this space and I am delighted to and welcome you, Lauren, and I'm gonna turn it over to you ⁓ to say what you do right
Lauren Ervin: My name is Lauren Irvin and I am Associate General Counsel for Compass International Holdings.
Liisa Thomas: So Lauren, ⁓ how did you get the spot that you are in right now?
Lauren Ervin: An interesting trajectory. So I actually was in the financial services area for over 10 years. I started at a small litigation firm in Miami. I did some work for a really large bank and I segued that to go in house ⁓ to a ⁓ top non bank servicer. I worked there for about nine and a half years, and I had a boss, maybe a year five or six, who did privacy law. she said, you know, Lauren, I think privacy is gonna be a big deal one day. No one believes me, but I hope you do. And I did believe her. And she and I are still friends ⁓ she decided to leave the So she said, If I were you, ⁓ I would take on privacy at the time. I was doing basic, more general compliance, way she explained it to me it was still falling in that compliance bucket, but was something that I can segue and focus more on privacy. ⁓ So when she left, my new boss said, Who privacy? And I quickly but tentatively raised my hand. It was one of those like someone did someone in back something? ⁓ And I said, Yeah, I'll I'll take privacy law, and I did it for about four years for them. I've been here now about four years and I support our privacy, and data governance section for
Liisa Thomas: So this leads us into the next topic, which is some of the challenges that you've faced. So walk us through some of those challenges.
Lauren Ervin: Number one, I often say people consider some people consider privacy to be more like the art class. They they they know it maybe it's more of a left or right brain, I get people understand it, but they also feel it can be deprioritized sometimes. So I feel like my job is to kind of figure out how to convince people that it's a little bit more than art, right? A little bit more than band, but also band is important. Like I play clarinet. I think that it is important. I think art is important to kind of make you a more multifaceted individual. So I feel like for a company, it's just kind of the same kind of segue, which is I that this company has to do X, Y, and Z. But I also encourage you to think that the people who go to this company, they care about their privacy. They care about their own choices. ⁓ So it has be important as well. So let's bake it in. And make it more of a value proposition as opposed to something that you hate to do. So I try what I I always try to do, which is difficult sometimes, is to figure out how whatever I'm asking them to do actually can help the business as well. So I don't just try to focus on here's what you need to do. sometimes that would be difficult because no one likes to be this has to be done for these reasons because it goes against ⁓ the business's mindset of growth or opportunity or technological development. So hardest part of my role is really figuring out how I can transition from this AA is the right thing to do ⁓ and a regulatory, mandate of some sort, to but here's also why numerically this makes sense for our company. Other thing I would say would be just overall privacy framework, I think it's very difficult to keep up with all the different privacy laws, honestly. There's so many different ones and you want to make sure that you're doing right by different residents of different states or different regions. So I would say that ⁓ the hardest part is figuring out is am I doing right the residents? Am I doing right by the company that I'm employed with? ⁓ and that takes a lot of EQ as well as some IQ. I think the biggest challenge is trying to convince the business that I'm not making up rules that privacy truly is that evolving of a of a landscape, ⁓ I think is just difficult to do.
Liisa Thomas: Let's switch to things that you have learned lessons to navigate through complex set of laws, the ever-changing landscape, new laws, and to work with the business to get them ⁓ to changes ⁓ What are some of the things that you've learned along the way?
Lauren Ervin: I've been in-house with two different organizations and thing that I've learned is you have to really learn the business first. ⁓ you have to understand just it's like almost like a mediation that if I am asking a business partner who trusts me, who trusts my judgment to ⁓ stop their plan is to implement something that I think is recommended for the company, ⁓ I have to understand what I'm I have to understand. how long it'll take them to implement that. I have to understand the downstream impacts. I'll give you a prime example. If I ask them to create or help me create a data map or a data inventory, I didn't just say, hey, we need this in order to fulfill DSARS. ⁓ I say is ⁓ these things are accurate. Yes, I need this for these reasons, ⁓ also look at it this way, you will now be able to see ⁓ we host information. It'll be easier for you when you go to create a bigger platform. better platform or when you go to talk to a consumer about X, Y, and Z. It's about trying to figure out what does a business need? How are we continuing to grow as a business? And let me see how I can figure out how these compliance objectives that matter to me and my team, how can I make it matter to you as well? And I think sometimes if we're all talking above each other and we're just trying to keep it surface, we're not talking about what the underlying real issues are as to why it is impediment to your request. if I know you and you're comfortable with me, you might tell me, Lauren, I just gotta ask to do X, Y, and Z. And I don't have the bandwidth. What you're saying is important. I value what you're saying. How about three weeks instead one week? Maybe they would have been afraid to ask me that before, but now I I get what they're asking. I don't just say I need this. I say, hey, by the way, this is the law. Here's why I'm asking you to do this. What do you think? How can you implement this? What are you thinking? I'm relying on their expertise too, not just me asking for a particular line item. I want them to use their creative juices as a coder, an engineer, a product person, ⁓ You're the expert in field. I'm telling you what needs to be done. What do you think is the best way to do that? I made them a ⁓ a colleague, if you will, so in a different space. They're coming back and they're saying, well, actually, Lauren, if you give me a couple more days, I can actually do this for you, I can build this out for you. And they always come up with better ideas than I had, honestly, to begin with. And sometimes they they go into more privacy by design more than they would have if I just asked them to do X, Y, and Z
Liisa Thomas: We've talked about this before that overlay of culture. And so ⁓ ⁓ time to understand different perspectives. it takes lot of extra skills to navigate that in an international or multinational organization.
Lauren Ervin: Spot on. ⁓ I worked for a company that hired a lot of people offshore. And it took after you know, it only takes you a little bit of time, but when you start realizing a pattern, ⁓ I just ask questions like, hey, in your culture, what does this mean? Or, ⁓ you know, what do you mean by You just realize it's a different way of thinking. And a lot of times they're being ⁓ even extra respectful. You just maybe is used to US culture per se. And it's the same lessons that you learn with your everyday colleagues, maybe someone in Seattle. thinks differently than someone in New York, Or an engineer is going to think differently than a banker. It's just a matter of meeting someone where they are. ⁓
Liisa Thomas: So this leads us to parting advice. words that you could share for someone who is either starting out ⁓ is been doing this for a long time and looking for a little word of encouragement, solidarity, that there's someone else out there going through what they're going through.
Lauren Ervin: I think for me it's just don't be afraid to ask for what you want. that's something that took me a while to get there mentally because you always extrapolate and think to yourself, if I ask for this and you say no and this and that, You go through the negative, chain more than the positive chain. I'll set it up for them in a way that makes it even maybe feel like their idea in a little way, But either way, I just feel like if you ask for what you want. at least that person knows, okay, here's your North Star. here's where you're trying to get to. Let's make my life a little bit easier because now I may not have to do so many building blocks to get there. I just ask for it. The most they can say is no. ⁓ And then can have a conversation onto why you said no. but I'm not I'm just not afraid to ask anymore. Lauren
Liisa Thomas: Thank you so much for doing this. We have now learned that we're going to ask for what we want. The worst that can happen is they will say ⁓ I think the subtext there is don't take it personally. And we are going to raise our hands ⁓ if tentatively.
Lauren Ervin: I love that. Yes. All right.
Liisa Thomas: Thank you again. hope you enjoyed this episode of Compliance Chronicles, ⁓ we look for guidance and inspiration from the personal journeys of compliance professionals. ⁓
Liisa Thomas: Welcome to Compliance Chronicles, where we learn from professionals shaping the world of compliance. your host, Liisa Thomas, ⁓ Privacy and Compliance counsel an professor at Northwestern Law School, and a lifelong learner of organizational change. ⁓ From journeys to hard-earned lessons, ⁓ these the chronicles that inspire and guide. ⁓ So we're back with another conversation with a leader in this space and I am delighted to and welcome you, Lauren, and I'm gonna turn it over to you ⁓ to say what you do right
Lauren Ervin: My name is Lauren Irvin and I am Associate General Counsel for Compass International Holdings.
Liisa Thomas: So Lauren, ⁓ how did you get the spot that you are in right now?
Lauren Ervin: An interesting trajectory. So I actually was in the financial services area for over 10 years. I started at a small litigation firm in Miami. I did some work for a really large bank and I segued that to go in house ⁓ to a ⁓ top non bank servicer. I worked there for about nine and a half years, and I had a boss, maybe a year five or six, who did privacy law. she said, you know, Lauren, I think privacy is gonna be a big deal one day. No one believes me, but I hope you do. And I did believe her. And she and I are still friends ⁓ she decided to leave the So she said, If I were you, ⁓ I would take on privacy at the time. I was doing basic, more general compliance, way she explained it to me it was still falling in that compliance bucket, but was something that I can segue and focus more on privacy. ⁓ So when she left, my new boss said, Who privacy? And I quickly but tentatively raised my hand. It was one of those like someone did someone in back something? ⁓ And I said, Yeah, I'll I'll take privacy law, and I did it for about four years for them. I've been here now about four years and I support our privacy, and data governance section for
Liisa Thomas: So this leads us into the next topic, which is some of the challenges that you've faced. So walk us through some of those challenges.
Lauren Ervin: Number one, I often say people consider some people consider privacy to be more like the art class. They they they know it maybe it's more of a left or right brain, I get people understand it, but they also feel it can be deprioritized sometimes. So I feel like my job is to kind of figure out how to convince people that it's a little bit more than art, right? A little bit more than band, but also band is important. Like I play clarinet. I think that it is important. I think art is important to kind of make you a more multifaceted individual. So I feel like for a company, it's just kind of the same kind of segue, which is I that this company has to do X, Y, and Z. But I also encourage you to think that the people who go to this company, they care about their privacy. They care about their own choices. ⁓ So it has be important as well. So let's bake it in. And make it more of a value proposition as opposed to something that you hate to do. So I try what I I always try to do, which is difficult sometimes, is to figure out how whatever I'm asking them to do actually can help the business as well. So I don't just try to focus on here's what you need to do. sometimes that would be difficult because no one likes to be this has to be done for these reasons because it goes against ⁓ the business's mindset of growth or opportunity or technological development. So hardest part of my role is really figuring out how I can transition from this AA is the right thing to do ⁓ and a regulatory, mandate of some sort, to but here's also why numerically this makes sense for our company. Other thing I would say would be just overall privacy framework, I think it's very difficult to keep up with all the different privacy laws, honestly. There's so many different ones and you want to make sure that you're doing right by different residents of different states or different regions. So I would say that ⁓ the hardest part is figuring out is am I doing right the residents? Am I doing right by the company that I'm employed with? ⁓ and that takes a lot of EQ as well as some IQ. I think the biggest challenge is trying to convince the business that I'm not making up rules that privacy truly is that evolving of a of a landscape, ⁓ I think is just difficult to do.
Liisa Thomas: Let's switch to things that you have learned lessons to navigate through complex set of laws, the ever-changing landscape, new laws, and to work with the business to get them ⁓ to changes ⁓ What are some of the things that you've learned along the way?
Lauren Ervin: I've been in-house with two different organizations and thing that I've learned is you have to really learn the business first. ⁓ you have to understand just it's like almost like a mediation that if I am asking a business partner who trusts me, who trusts my judgment to ⁓ stop their plan is to implement something that I think is recommended for the company, ⁓ I have to understand what I'm I have to understand. how long it'll take them to implement that. I have to understand the downstream impacts. I'll give you a prime example. If I ask them to create or help me create a data map or a data inventory, I didn't just say, hey, we need this in order to fulfill DSARS. ⁓ I say is ⁓ these things are accurate. Yes, I need this for these reasons, ⁓ also look at it this way, you will now be able to see ⁓ we host information. It'll be easier for you when you go to create a bigger platform. better platform or when you go to talk to a consumer about X, Y, and Z. It's about trying to figure out what does a business need? How are we continuing to grow as a business? And let me see how I can figure out how these compliance objectives that matter to me and my team, how can I make it matter to you as well? And I think sometimes if we're all talking above each other and we're just trying to keep it surface, we're not talking about what the underlying real issues are as to why it is impediment to your request. if I know you and you're comfortable with me, you might tell me, Lauren, I just gotta ask to do X, Y, and Z. And I don't have the bandwidth. What you're saying is important. I value what you're saying. How about three weeks instead one week? Maybe they would have been afraid to ask me that before, but now I I get what they're asking. I don't just say I need this. I say, hey, by the way, this is the law. Here's why I'm asking you to do this. What do you think? How can you implement this? What are you thinking? I'm relying on their expertise too, not just me asking for a particular line item. I want them to use their creative juices as a coder, an engineer, a product person, ⁓ You're the expert in field. I'm telling you what needs to be done. What do you think is the best way to do that? I made them a ⁓ a colleague, if you will, so in a different space. They're coming back and they're saying, well, actually, Lauren, if you give me a couple more days, I can actually do this for you, I can build this out for you. And they always come up with better ideas than I had, honestly, to begin with. And sometimes they they go into more privacy by design more than they would have if I just asked them to do X, Y, and Z
Liisa Thomas: We've talked about this before that overlay of culture. And so ⁓ ⁓ time to understand different perspectives. it takes lot of extra skills to navigate that in an international or multinational organization.
Lauren Ervin: Spot on. ⁓ I worked for a company that hired a lot of people offshore. And it took after you know, it only takes you a little bit of time, but when you start realizing a pattern, ⁓ I just ask questions like, hey, in your culture, what does this mean? Or, ⁓ you know, what do you mean by You just realize it's a different way of thinking. And a lot of times they're being ⁓ even extra respectful. You just maybe is used to US culture per se. And it's the same lessons that you learn with your everyday colleagues, maybe someone in Seattle. thinks differently than someone in New York, Or an engineer is going to think differently than a banker. It's just a matter of meeting someone where they are. ⁓
Liisa Thomas: So this leads us to parting advice. words that you could share for someone who is either starting out ⁓ is been doing this for a long time and looking for a little word of encouragement, solidarity, that there's someone else out there going through what they're going through.
Lauren Ervin: I think for me it's just don't be afraid to ask for what you want. that's something that took me a while to get there mentally because you always extrapolate and think to yourself, if I ask for this and you say no and this and that, You go through the negative, chain more than the positive chain. I'll set it up for them in a way that makes it even maybe feel like their idea in a little way, But either way, I just feel like if you ask for what you want. at least that person knows, okay, here's your North Star. here's where you're trying to get to. Let's make my life a little bit easier because now I may not have to do so many building blocks to get there. I just ask for it. The most they can say is no. ⁓ And then can have a conversation onto why you said no. but I'm not I'm just not afraid to ask anymore. Lauren
Liisa Thomas: Thank you so much for doing this. We have now learned that we're going to ask for what we want. The worst that can happen is they will say ⁓ I think the subtext there is don't take it personally. And we are going to raise our hands ⁓ if tentatively.
Lauren Ervin: I love that. Yes. All right.
Liisa Thomas: Thank you again. hope you enjoyed this episode of Compliance Chronicles, ⁓ we look for guidance and inspiration from the personal journeys of compliance professionals. ⁓
