00:00:23Privacy and Data
00:05:46Data Privacy and Innovation in Tech
00:15:33The Future of Data Protection
00:18:46Privacy and Data Governance Solutions
00:31:48Ethical Frameworks in AI Regulation
00:44:27Embracing Privacy for Business Success
ABOUT THIS EPISODE
Privacy has been a major casualty of the Internet. Twenty five years ago Silicon Valley leading light, Sun’s CEO Scott McNealy said we “have zero privacy. Get over it.” And that has been the truth ever since and the profits basis for AdTech behemoths Google, Meta, and more.
The good news is that, in the quarter century since advertising became the Internet’s business model, few have gotten over it, including powerful national and regional regulators.
In this wide-ranging discussion with Steve and George, Michelle Finneran Dennedy, CEO of PrivacyCode, Inc. and Partner at strategy consulting firm Privatus.Online
speaks to this shift toward restoring online privacy and what her company is doing to streamline implementation of privacy enhancing practices.
In this Making Data Better episode, Michelle addresses:
- The immorality of Data Subject Access Requests
- Ethics vs. zero trust
- The impossibility of privacy regulation compliance
- AdTech’s shifting model
- The liability tornado about to strike data hoarding enterprises
This is an important and exciting conversation. Take a listen.
English
United States
SHOW NOTES 🔗
TRANSCRIPT 🔗
WEBVTT
00:00:23.298 --> 00:00:31.568
Welcome to Making Data Better, a podcast about data quality and the impact that it has on how we protect, manage and use the digital data critical to our lives.
00:00:31.568 --> 00:00:35.606
I'm George Peabody, partner at Lockstep Consulting, and thanks for joining us.
00:00:35.606 --> 00:00:38.161
With me is Lockstep founder, steve Wilson.
00:00:38.161 --> 00:00:42.441
Hi, steve, g'day, george, good to be with you, glad you're here.
00:00:42.441 --> 00:00:44.325
So, steve, let's get into it.
00:00:44.405 --> 00:00:49.054
Today we're addressing what I consider to be the biggest negative effect of the internet.
00:00:49.054 --> 00:00:54.412
My list has more than one entry on it, but my biggest one is the loss of privacy.
00:00:54.412 --> 00:01:09.808
We've got big tech companies who have every incentive to know everything about me, because our business model is based entirely on advertising to me totally targeted advertising, a corollary of that or along with it.
00:01:09.808 --> 00:01:17.733
We've got an entire ecosystem of data brokers who aggregate and resell every bit of my digital dust that they can hoover up.
00:01:17.733 --> 00:01:30.331
So, and then there's this enterprise belief that it's the best thing you can do is store every bit of data that you've ever encountered to help with your marketing and maybe risk management.
00:01:30.331 --> 00:01:38.474
And then, of course, analytics you're going to apply to all that someday that make all that data be useful to you.
00:01:38.474 --> 00:01:50.251
So we've got this pervasive habit and business model that is all about learning everything you can about people, without regard for the immediate need for the data and without any concrete reason.
00:01:50.251 --> 00:01:58.022
Often, in other words, as other studies have shown, even with all that data, bad decisions and injustices are made.
00:01:59.004 --> 00:02:00.087
Okay, Steve, I give up.
00:02:00.087 --> 00:02:02.832
I realize I'm complaining about the state of the world here.
00:02:02.832 --> 00:02:05.786
You've worked in digital privacy for years.
00:02:05.786 --> 00:02:07.228
Where do we start?
00:02:07.930 --> 00:02:08.832
Well, that's interesting.
00:02:08.832 --> 00:02:13.812
I got into privacy almost by accident from many years working in identity.
00:02:13.812 --> 00:02:15.786
Often put that in air quotes.
00:02:15.786 --> 00:02:19.609
Security and privacy are different.
00:02:19.609 --> 00:02:29.530
Cyber security starts, I think, with important data and thinking about what makes data important to you, and then you have controls to protect the value of data.
00:02:29.530 --> 00:02:34.812
There's a well-known set of dimensions that you look at data through from the security perspective.
00:02:35.560 --> 00:02:38.068
I think that privacy is sort of the opposite of that.
00:02:38.068 --> 00:02:39.747
I think that privacy is about restraint.
00:02:39.747 --> 00:02:44.771
I think that privacy is about what you don't do with data rather than what you do do.
00:02:44.771 --> 00:02:51.967
I think that privacy is about what you don't do with data rather than what you do do, and therefore the technology is not as important as policy and governance and I put policy in quotes as well.
00:02:51.967 --> 00:02:58.313
It's not just those big, thick 20-page policies, but policy like what is your organization's culture?
00:02:58.313 --> 00:03:00.396
What do you want to do with data?
00:03:00.396 --> 00:03:08.824
How is it important to you that old promise that we respect your privacy by businesses?
00:03:08.824 --> 00:03:09.425
If they really mean that?
00:03:09.425 --> 00:03:10.849
Here's the paradox of privacy.
00:03:10.849 --> 00:03:13.942
They need to choose not to know things about you.
00:03:13.942 --> 00:03:18.461
They need to say we're going to mind our own business, we don't want to know everything about you.
00:03:18.461 --> 00:03:19.622
That's respecting privacy.
00:03:19.622 --> 00:03:21.165
So that's how I come at this.
00:03:23.770 --> 00:03:24.070
Wow.
00:03:24.070 --> 00:03:27.216
So, yeah, I kind of went in the other direction, didn't I?
00:03:27.216 --> 00:03:30.530
I was all about collecting every bit of data and whining about that.
00:03:30.530 --> 00:03:35.391
You're pointing out that it's about minimizing the data that's being captured in the first place.
00:03:35.391 --> 00:03:43.794
Well, to help us further unravel this privacy knot, it's our great pleasure to welcome Michelle Finnernan-Denady.
00:03:43.794 --> 00:03:51.189
Pleasure to welcome Michelle Finnernan-Denady, who's the CEO of Privacy Code Inc and partner at strategy consulting firm Privatus Online.
00:03:51.189 --> 00:03:54.822
Get that right, michelle Privatus, privatus.
00:03:54.822 --> 00:03:56.548
All right, I was going to ask.
00:03:56.548 --> 00:04:01.670
I was thinking earlier is this a world where we use the word privacy or privacy?
00:04:03.181 --> 00:04:04.582
This is going even back further.
00:04:04.582 --> 00:04:12.485
So there is publicus, which is your public persona or your cultural, ethical rules that you follow, and then there is privatus.
00:04:12.485 --> 00:04:17.591
So privatus is your private self or your individualized self.
00:04:18.271 --> 00:04:18.692
Gorgeous.
00:04:19.540 --> 00:04:24.213
Well, you were an attorney before becoming a CEO and a consultant.
00:04:24.213 --> 00:04:27.288
I want to ask, to begin with, what brought you to privacy?
00:04:27.288 --> 00:04:29.949
How did you get into this domain?
00:04:30.620 --> 00:04:35.391
Yeah, I think, like so many people, steve included we kind of backed into it.
00:04:35.391 --> 00:04:38.689
So I started out life as an intellectual property lawyer.
00:04:38.689 --> 00:04:44.360
I was a patent litigator and then entered the world of high tech, which is interesting to me.
00:04:44.360 --> 00:05:35.483
I was doing a lot of medical devices and pharmaceutical work in patents and then ended up in high tech and I think are we supposed to call ph scale really, on the internet was dawning and you could buy and trade and do business online and so somehow, magically, that absolves you of doing what you needed to do.
00:05:35.483 --> 00:05:45.771
And as a patent litigator coming into this environment and a businesswoman looking over the Sun Microsystems portfolio, I said this is really.
00:05:46.271 --> 00:05:51.608
The paradox for me was that the value is in sharing information.
00:05:51.608 --> 00:06:38.069
The value was we had people like Whit Diffie who was talking about encryption, we had early versions of what we now call Kubernetes and we were dealing with what we called the grid or the utility back then which we all now call the cloud distributed secure compute, and so when I looked at the portfolio and the business needs of this company, as well as the 165 countries in which we were doing business and the various cultures that those imply, everything rang a bell in my head saying if you want to do business well, you better get privacy right, because you have customers and you have employees and these are pretty critical characters in your business drama.
00:06:38.069 --> 00:06:45.550
And if you're a government entity, you have citizens and voters and those are pretty important constituents for you.
00:06:45.550 --> 00:06:57.067
So wherever you find a person, you find a story that needs to be told, a connection that needs to be made, and so you have privacy and identity.
00:06:58.930 --> 00:07:00.293
Love that story to be told.
00:07:00.293 --> 00:07:04.687
The theme of our podcast is what is the story behind the data?
00:07:12.600 --> 00:07:13.302
And the story, you know, it's amazing.
00:07:13.302 --> 00:07:21.451
I mean, data is quite benign until humans get their eyeballs on it, and then it can be very good and it can be very evil, and so I think that's the thing to remember is, you know, this is an ingredient.
00:07:21.451 --> 00:07:25.714
So data, really telling the story, I think is the right thing.
00:07:25.714 --> 00:07:30.851
And, exactly as you said, george, is like the old fashioned way for the old people who don't like making money.
00:07:30.851 --> 00:07:39.291
They stockpile as much data as they get their hands on, they scrape the internet and they steal all of our data and they put it into generative AI models.
00:07:39.954 --> 00:07:42.884
That seems really attractive in this day and time, doesn't it?
00:07:42.884 --> 00:07:46.812
It seems like you'd give somebody a trillion dollars to do more of that.
00:07:46.812 --> 00:07:51.130
The reality is it's already setting a time bomb off.
00:07:51.130 --> 00:07:55.730
You can dig in a pile of pony dung as much as you want.
00:07:55.730 --> 00:08:05.663
You ain't going to find a pony in there, but to find something that's fresh, something that's new, something that's targeted, something that's individualized, that has value.
00:08:05.663 --> 00:08:09.350
That's fresh, something that's new, something that's targeted, something that's individualized, that has value, that's current.
00:08:09.350 --> 00:08:22.045
So the old-fashioned way of just because I can, I do because mainframes are cool that's changing, and it's changing very, very rapidly the new value model is coming into focus.
00:08:22.827 --> 00:08:24.190
Let me react to that really quickly.
00:08:24.190 --> 00:08:26.966
And we didn't prep for this, so I apologize for this story out of the blue.
00:08:26.966 --> 00:08:35.057
But you'll remember 15 years ago, the Google Street View catastrophe, where the Street View cameras had a good job to do.
00:08:35.057 --> 00:08:36.841
They're photographing the streets of the world.
00:08:36.841 --> 00:08:47.607
But some bright engineer realized that the equipment on the back of the Google car had a Wi-Fi transponder and they could also pick up Wi-Fi transmissions that were quoted in the public domain.
00:08:48.482 --> 00:08:52.326
And this chap innovated by collecting that data and just started mining it to see what was there.
00:08:52.326 --> 00:08:53.907
It was a process of discovery.
00:08:53.907 --> 00:08:56.809
It was a process of literally data mining.
00:08:56.809 --> 00:09:01.511
You know there's a vein of data, let's mine it, let's see what's there.
00:09:01.511 --> 00:09:03.265
That was the Google culture.
00:09:03.265 --> 00:09:04.566
They reward innovation.
00:09:04.566 --> 00:09:09.047
They make a stupendous amount of money out of using data in innovative surprising ways.
00:09:09.820 --> 00:09:17.667
And when they all got sprung and they said you were collecting that data without intent, you don't need it, you didn't tell people you were doing it.
00:09:17.667 --> 00:09:35.552
It doesn't matter that it was in the public Wi-Fi mish, it was personal data, you had no right to just grab it they were shocked and they sort of gave the guy an attitude transplant and said we won't do that again, but I thought it spoke to the culture of an innovative company, a purely digital company that feels as though it's got the rights.
00:09:35.552 --> 00:09:40.993
Like frontiers people to you know it's like the old oil rush.
00:09:40.993 --> 00:09:45.508
We know this valuable treasure is under the ground or under the digital ground.
00:09:45.508 --> 00:09:48.551
Let's go and find out what's there and dig it up and use it.
00:09:48.551 --> 00:09:51.562
And I thought that is anathema to privacy.
00:09:51.562 --> 00:09:55.292
And yet it's so counterintuitive that you should not do that.
00:09:57.221 --> 00:09:58.341
Yeah, I think that's right and.
00:09:59.102 --> 00:10:32.288
I think that's where it's getting really interesting, because we now have more subtle controls than we had back in those kind of early kind of oil days of get whatever data you can, because we didn't have fat pipes to every home, we didn't have the stability in the Wi-Fi connections that we have today, we certainly didn't have the fidelity of the identity tools to layer whose persona is whose where, and so there was sort of this feeling of just because I can, I will.
00:10:32.288 --> 00:10:38.734
And the reality is, I think the more innovative view, ironically, is quite old fashioned.
00:10:38.734 --> 00:10:43.658
That's a weird sentence to say that innovation always starts, for me, with ethics.
00:10:43.857 --> 00:10:44.938
What do people want?
00:10:44.938 --> 00:10:56.246
The things that people become really, really addicted to and they really really like are things that bring out our human passions hunger, thirst, lust, greed.
00:10:56.246 --> 00:11:00.961
We love being on social media as much as we hate being on social media.
00:11:00.961 --> 00:11:01.543
Why?
00:11:01.543 --> 00:11:04.809
Because we crave connection with people.
00:11:04.809 --> 00:11:06.874
It's a very basic human thing.
00:11:06.874 --> 00:11:18.701
So, by really looking at, what do we really want, what are we serving, how much does it cost, what are people wanting to do with that information and what if that information is false?
00:11:18.701 --> 00:11:31.933
So starting to have these questions again because we have the fidelity that we have today that we did not 20 years ago, I think, opens up a whole new can of really valuable innovation.
00:11:31.933 --> 00:11:35.261
I've stunned George into silence.
00:11:35.943 --> 00:11:36.605
Yeah, you have.
00:11:36.605 --> 00:11:51.955
I'm trying to take what you said and trying to search for the evidence that there are tech companies who actually get what you're saying and agree with it and are casting themselves as stewards.
00:11:51.955 --> 00:11:57.500
I'm still looking at the paradigm, the business paradigm of the net, which is basically advertising.
00:11:57.821 --> 00:11:58.623
Still ad tech?
00:11:58.623 --> 00:12:01.051
Yeah, yeah, and I think that's right.
00:12:01.051 --> 00:12:06.912
I think what exists today, you still see remnants of that old-fashioned sort of ad tech world.
00:12:06.912 --> 00:12:08.260
Right, it's like Remnants.
00:12:08.280 --> 00:12:08.922
That's Google's.
00:12:08.922 --> 00:12:13.791
That's virtually 90% of Google's revenues, if not more.
00:12:14.493 --> 00:12:15.293
Yeah, but it's changing.
00:12:15.293 --> 00:12:24.490
I mean, look at just, the Europeans are saying, oh, we don't like your Google cookies and things, and so that changed radically and overnight.
00:12:24.490 --> 00:12:28.404
And how much money are they spending into trying to shift their models?
00:12:28.404 --> 00:12:42.065
How much money are they now investing into trying to find various ways of obfuscation and various privacy enhancing technologies to either do an anonymization or figure out how to do radical personalization?
00:12:42.065 --> 00:12:46.048
I think even those big, big companies are investing in what's next.
00:12:46.769 --> 00:12:53.982
You put your finger on what I suspect is the major mover of the market these days, which is regulation.
00:12:53.982 --> 00:12:55.186
Is that right?
00:12:55.567 --> 00:12:56.528
It always has been.
00:12:56.528 --> 00:13:03.772
So this nonsense, this nonsense that, oh, regulation is going to stop innovation how was Silicon Valley formed?
00:13:03.772 --> 00:13:14.024
Silicon Valley was formed we broke up the telephone monopolies and there was all this room for building.
00:13:14.024 --> 00:13:15.105
There was all this sort of regulation.
00:13:15.105 --> 00:13:25.094
After deregulation, they re-regulate other things and people find innovative models to go around things, sometimes to find a loophole, but also sometimes to truly innovate.
00:13:25.094 --> 00:13:31.251
Regulation hasn't stopped the pace of innovation in human history yet.
00:13:31.251 --> 00:13:37.211
So, yes, the lobbyists will continue to lobby and they're adorable and we love them.
00:13:37.211 --> 00:13:40.469
However, the facts are the facts.
00:13:40.469 --> 00:13:42.086
The cash is the cash.
00:13:42.086 --> 00:13:47.081
I don't see a slowdown, even though we have actually known rules.
00:13:47.081 --> 00:13:53.542
I would prefer to have actually a federal law in the United States rather than state-by-state patchworks.
00:13:53.542 --> 00:13:55.006
I think it protects more people.
00:13:55.006 --> 00:14:05.052
I think it gives us a way to show that we're driving on the right side of the digital highway and we can signal to other drivers that we're on the move.
00:14:05.052 --> 00:14:09.912
This patchwork of little power fiefdoms, I think, is destructive.
00:14:12.441 --> 00:14:12.942
Absolutely.
00:14:12.942 --> 00:14:24.173
Your point makes me think that how glad I am, despite its occasional misses, that the FAA exists and does such a good job of making air travel as well.
00:14:24.173 --> 00:14:26.288
It's the safest way to move a person in the world.
00:14:26.759 --> 00:14:28.488
Yeah, well, you put your finger on it.
00:14:28.488 --> 00:14:29.692
I've long said it.
00:14:29.692 --> 00:14:31.721
This is one of my first conversations with Steve.
00:14:31.721 --> 00:14:43.926
They had these great drawing people at this conference we were at and we were talking about what did we do when piracy was the biggest threat to commerce, when we were trading nutmeg and tea?
00:14:43.926 --> 00:14:51.861
Well, we had admiralty law, and so when a ship was in port, it was one thing, when a ship was in the shipping lanes, it was another thing.
00:14:51.861 --> 00:15:18.508
We followed each other, we had rules, we understood what it meant to help a distressed fellow sailor, and a lot of this was to prevent pirates, to preserve goods and services, to cling together with the technology that we had to do commerce and literally find our way in an emerging planet, despite which country of origin that vessel emanated from and where they were heading.
00:15:18.508 --> 00:15:33.144
I think that's where we really, despite a world that's starting to be more and more kind of nationalized again, for this type of commerce, for privacy to thrive, for identity to thrive, we need to think more and more about standards than ever before.
00:15:33.966 --> 00:15:34.527
I love that.
00:15:34.527 --> 00:15:36.672
I love talking to a real lawyer.
00:15:36.672 --> 00:15:39.268
There's so many what we call in Australia Bush lawyers.
00:15:39.268 --> 00:15:44.767
I love talking to a real lawyer and your background, michelle, I think is deep.
00:15:44.767 --> 00:15:51.695
It seems to me as a non-lawyer that we're probably on the cusp of new jurisprudence.
00:15:51.695 --> 00:16:00.287
Just as shipping created that and just as the oil rush in the 1850s, 1870s created new property law, regulated a whole lot of intangibles.
00:16:00.919 --> 00:16:05.461
I talk to technologists and they say you can't regulate data, it's ones and zeros, it's intangible.
00:16:05.461 --> 00:16:07.427
I talk to technologists and they say you can't regulate data, it's ones and zeros, it's intangible.
00:16:07.427 --> 00:16:13.264
Well, you know what we do in a civilized world we regulate telecommunication bandwidth.
00:16:13.264 --> 00:16:16.311
That's not even a thing, it's not even physics.
00:16:16.311 --> 00:16:18.884
Bandwidth is so intangible we regulate the hell out of that.
00:16:18.884 --> 00:16:20.951
So I think that we're on a cusp.
00:16:20.951 --> 00:16:26.511
I see data protection, which is sort of synonymous with privacy.
00:16:26.511 --> 00:16:28.701
Gdpr stands for data protection.
00:16:28.701 --> 00:16:44.018
I see a bigger form of data protection where we look at what makes data valuable from every dimension the human dimension, the social dimension, the business dimension titrate out the properties of data that makes it valuable and attend to maximizing that value.
00:16:44.018 --> 00:16:51.610
And knowing that it's a multi-discipline sort of thing, I can see I'm so optimistic that we're actually going to see some good things in the next 10 or 20 years.
00:16:52.533 --> 00:16:54.365
I think we will too, and some of it.
00:16:54.365 --> 00:16:56.308
Again it goes back to, like, those human needs.
00:16:56.308 --> 00:17:04.836
Greed is a big motivator and we saw that when Apple decided to flex its muscles on what it's calling privacy.
00:17:04.836 --> 00:17:13.194
You saw what it was able to basically punch Facebook in the nose pretty hard enough so that they did this weird head fake with Web3.
00:17:13.194 --> 00:17:15.333
Like, oh, we're doing Lyndon Labs again.
00:17:15.333 --> 00:17:16.991
I was like you guys are so cute.
00:17:16.991 --> 00:17:20.454
That clearly was a head fake in my mind.
00:17:20.454 --> 00:17:27.435
It was like right after the market fell over on its side, suddenly we're doing this weird thing that didn't work, doesn't have a business case.
00:17:27.435 --> 00:17:29.267
That's cute.
00:17:29.267 --> 00:17:30.849
Why?
00:17:30.849 --> 00:17:37.028
Because suddenly we've got this immense power with this, as Steve says, an intangible right.
00:17:37.028 --> 00:17:49.712
And if you go back and you read, it's actually a beautiful piece of prose the Morn and Brandeis piece from 1892, I always get that year wrong from Harvard Law Review called the Right to Privacy.
00:17:49.712 --> 00:17:51.016
What was it about?
00:17:51.016 --> 00:17:54.596
It was actually about the dawn of new technologies.
00:17:54.596 --> 00:17:59.017
It was about Kodak-ing or taking portable photography.
00:17:59.744 --> 00:18:04.691
Although the portability was a giant heavy box, but you might see a woman's ankle.
00:18:04.691 --> 00:18:07.518
Oh my, think about it.
00:18:07.518 --> 00:18:34.808
It's like morality and ethics, and what they discuss in that article is really the evolution of you know, when Fred got out of the cave and hit Ted over the head with a hammer, that they understood was something that they should have rules about, and then when you just threatened him with the club, it was a very long time before that was actually recognized as a criminal and a civil harm.
00:18:34.808 --> 00:18:42.009
The fear of that bat hitting you was an ephemeral right that we agreed as a society our ethics.
00:18:42.009 --> 00:18:43.736
Before the law happens, we have ethics.
00:18:43.736 --> 00:18:46.009
We decided that to happen.
00:18:46.009 --> 00:18:54.817
So privacy and this is why we fight so voraciously, I think, against this nonsense and nihilism of privacy's dead because we have toys.
00:18:54.817 --> 00:19:04.035
No, privacy's alive because we have people and people who have dignity and stories and we have ethics.
00:19:04.035 --> 00:19:13.558
Cultures decide how they want to interact as groups with one another, so as long as we have people and culture, we will have privacy.
00:19:14.786 --> 00:19:17.652
Let's take it right down to you what's your work?
00:19:17.652 --> 00:19:23.634
Tell us about what you're CEO of yeah, what the company is doing, because I'm hearing this and I go.
00:19:23.634 --> 00:19:25.107
This is hard.
00:19:26.271 --> 00:19:27.335
Oh no, this is fun.
00:19:27.335 --> 00:19:33.191
Yes, it's hard because it's valuable, so you should pay us lots of money, but it's fun.
00:19:33.191 --> 00:19:35.998
So, basically, two lines of business.
00:19:35.998 --> 00:19:39.665
So Privacy Code is an AI-driven platform.
00:19:39.665 --> 00:19:43.613
I would have said NLP-driven a year and a half ago, but now we'll say AI.
00:19:43.613 --> 00:20:07.232
We use natural language processing and we actually take written documents that are usually written in legalese and they'll have either your RFPs or your notices or your policies or your privacy impact assessments, and we'll scan them in and we read them against a requirements library that has three subject matters responsible AI or new technology.
00:20:07.232 --> 00:20:17.521
It will be the same set of criteria for quantum Privacy, of course, or data protection and data quality and data governance.
00:20:17.521 --> 00:20:26.246
So three different sort of types of libraries, and so they're captive in two types of tasks processes, technologies.
00:20:26.246 --> 00:20:32.912
So if you make a promise and you say we promise to respect your privacy, we list our vendors.
00:20:32.912 --> 00:20:50.267
Well, you're going to find a whole category of requirements from places like NIST and GDPR the Australian laws that say what to do with vendors and so we've already broken them down task by task what could be a policy, what could be a technology control and then we put them into projects.
00:20:50.488 --> 00:20:58.667
So that's one line of business is helping to do that translation between and amongst technology and word people so that you can get your work done.
00:20:58.667 --> 00:21:01.028
Know what you need to get done so that you can get your work done.
00:21:01.028 --> 00:21:02.911
Know what you need to get done.
00:21:02.911 --> 00:21:07.775
And really no one can be expected to be as geeky as Steve and I are.
00:21:07.775 --> 00:21:16.281
If you're a UX person, I'm going to tell you exactly what I need in your UX so that we can help our customers engage in.
00:21:16.281 --> 00:21:21.567
If we're going to call it opting in or opting out, I don't care.
00:21:21.567 --> 00:21:24.652
It's going to be some sort of informed consent mechanism and I'm going to tell you what to present.
00:21:24.652 --> 00:21:32.290
Now, you are not going to be the right person, probably, to store the proof of that consent.
00:21:32.290 --> 00:21:34.395
That may be someone who's doing my logging.
00:21:34.395 --> 00:21:38.132
That may be someone who's doing my security criteria or my consent management.
00:21:38.673 --> 00:21:50.699
That person is going to get a task that says every time someone pushes this beautiful button designed by my gorgeous UX, the result is going to be this kind of time and date stamp, et cetera.
00:21:50.699 --> 00:21:52.790
So how do we do these times and dates?
00:21:52.790 --> 00:22:00.417
So that experts are doing expert things and then the person who's doing the data governance on top looks across the environment and says how are we doing?
00:22:00.417 --> 00:22:02.127
How are we doing on?
00:22:02.127 --> 00:22:10.487
You know, when we do things that are truly informed consent, we're actually hitting 1920, maybe even 60 different countries requirements at once.
00:22:10.487 --> 00:22:12.070
That's wonderful.
00:22:12.070 --> 00:22:13.032
Look at that.
00:22:13.032 --> 00:22:17.954
You can actually celebrate that stuff and you can actually start to assign weights and values.
00:22:18.497 --> 00:22:19.882
So, pravadas, what do we do?
00:22:19.882 --> 00:22:21.326
We do strategic consulting.
00:22:21.326 --> 00:22:27.659
So we look at your business problem and we think about how do you connect that to your data issues?
00:22:27.659 --> 00:22:29.712
How do you connect that to dollars?
00:22:29.712 --> 00:22:38.065
How do you connect that to actually getting this implemented so that your culture is sustaining what you say that you're doing?
00:22:38.065 --> 00:22:41.255
It's so much more than writing the right policy.
00:22:41.255 --> 00:22:43.953
That's like writing the right pitch deck to get cash.
00:22:43.953 --> 00:22:45.869
There's no magic pitch deck.
00:22:45.869 --> 00:22:47.836
It's a combination of a lot of different things.
00:22:48.904 --> 00:22:53.497
I do create a dashboard of progress around each one of those three areas.
00:22:53.904 --> 00:22:54.969
It's a progress board.
00:22:55.611 --> 00:22:57.396
So, it looks like a task board.
00:22:57.396 --> 00:23:08.880
It's tied in with our wonderful Atlassian, our favorite Australia Well, Canva is getting to be a pretty big deal too, but one of our favorite Australian phenoms so it's already tied into Jira.
00:23:08.880 --> 00:23:36.946
So if your technical teams are already using Jira, like the rest of the world, all they do is they receive a ticket in their normal platform and so everyone else can either go onto the code and look at the Kanban or the project progression and you can discuss right there and everything is tracked so that you can say show your auditors at the end what I call a P-BOM or a privacy bill of materials that you can say here's what it looks like from end to end.
00:23:36.946 --> 00:23:42.366
And if they need to look at it further, they can say, aha, well, and everything's tied back to the standards too.
00:23:42.366 --> 00:23:57.351
So they can say everything's organized in the same kind of chapter and verse and there's cited paragraphs if you want to geek out on it of like here's where it is in GDPR, here's where it is in secure control framework, et cetera.
00:23:58.113 --> 00:24:01.967
And then, if you really have to figure out, like, does George still work here?
00:24:01.967 --> 00:24:18.767
He was in charge of the UX last year you can click on that and say, oh yeah, he assigned this now to Steve and Steve has now taken over, so you can audit your stack, you can mature your stack, you can just know where you're at with data rather than just words.
00:24:18.767 --> 00:24:30.260
We're actually assigning deeds, matching them to standards, and now we're speaking a common language, so that we're not just sort of slipping down this well of, oh my gosh, it's overwhelming.
00:24:30.260 --> 00:24:31.390
Privacy is too hard for me.
00:24:32.325 --> 00:24:38.563
And you're solving that wicked problem of privacy policy being like a dual-use artifact.
00:24:38.563 --> 00:24:53.815
Yep, but it's dominated by legalese and it's become a defensive mechanism, or even it's become a bit of trickery, where businesses have got a covert mission and they get their lawyers to write something that supports the covert mission, without saying what it is.
00:24:53.815 --> 00:24:59.835
It occurs to me that it's dual use, like a privacy policy, if it's really a statement of what the company is going to do with data.
00:24:59.835 --> 00:25:00.926
Why do I want your data?
00:25:00.926 --> 00:25:01.748
What am I going to do with it?
00:25:01.748 --> 00:25:02.990
What do I owe you?
00:25:02.990 --> 00:25:04.893
I going to do with it?
00:25:04.893 --> 00:25:05.554
What do I owe you?
00:25:05.574 --> 00:25:08.859
I like to see that as like an embryonic document that lives with the project.
00:25:08.859 --> 00:25:20.119
You start by articulating what, how, when, why and where, and then it turns into a guidance for designers and it also turns into meeting your regulatory needs.
00:25:20.119 --> 00:25:25.069
Now, I don't underestimate the complexity of writing a legally compliant privacy document, and nobody should.
00:25:25.069 --> 00:25:41.288
You should get legal advice, as Michelle would do, but your process using NLP winds up being able to extract the dimensions of that important document that mattered to different stakeholders, I think it's very important to you, everything that you should like.
00:25:41.468 --> 00:25:49.878
Years ago, I did a graphic novel privacy policy when I was at mcafee intel and I realized we were doing a b2c product.
00:25:49.878 --> 00:25:55.634
We're doing a lot of family protection, we're doing a lot of mobile phone stuff and security is.
00:25:55.634 --> 00:26:03.068
Security is hard and it has its own special language and everyone has their standards and you know we're using the, the des, this and that this.
00:26:03.068 --> 00:26:05.377
We do that to sound smart to ourselves and that's adorable.
00:26:05.377 --> 00:26:07.125
Standards and we're using the DES, this and the this.
00:26:07.125 --> 00:26:10.107
We do that to sound smart to ourselves and that's adorable.
00:26:10.127 --> 00:26:18.686
But when we're trying to communicate and be fiduciaries, it's a lot better when you can talk to them, and nothing translates faster than pictures.
00:26:18.686 --> 00:26:25.094
So we did these pictures of these nerdy little ninjas and they weren't stylized, or so we did this pictures of these nerdy little ninjas and they weren't stylized, or they didn't.
00:26:25.094 --> 00:26:34.586
They had one ab, like the nice dome, dad bod, and they demonstrated you know, this is what a cookie is, and we had a thing that said what cookies are, and this is.
00:26:34.586 --> 00:26:38.175
This is what we do with when we say we're keeping some of your data.
00:26:38.175 --> 00:26:49.571
As for research, this is what this means, and so we explained in in pictures as much as in words, and it went over really well and I was really proud of that work.
00:26:49.571 --> 00:27:00.757
It's not easy to do because you have to be very thoughtful that you're not over promising or under explaining things, and we did append the actual words to the policy.
00:27:00.944 --> 00:27:11.556
But what I learned from that exercise is, if you're going to demonstrate visually what you're doing, you have to know what it is that you're doing.
00:27:11.556 --> 00:27:25.929
And I think that's the trick of this is, once you have invested and you've done a really thorough job of understanding what your data assets are A, you deserve to brag about them because they are a commercial differentiator.
00:27:25.929 --> 00:27:33.192
And B, you should make it easy, because you should be proud of that and you should not expect no company is compliant.
00:27:33.192 --> 00:27:35.685
So let's just start right there, right now.
00:27:35.685 --> 00:27:36.846
Forevermore.
00:27:36.846 --> 00:27:39.931
There is no such place as compliance-ville.
00:27:39.931 --> 00:27:41.333
That's like thin young, as compliance-ville.
00:27:41.333 --> 00:27:44.576
That's like thin, young, perfect, brilliant, smart, rich.
00:27:44.576 --> 00:27:57.165
She's lying, whoever that is.
00:27:57.165 --> 00:27:57.886
She's lying to you.
00:27:57.886 --> 00:28:02.655
So compliance is something that you're going to try to go for in this complex area, but some of these things are actually they conflict with each other.
00:28:02.655 --> 00:28:11.259
So understanding someone's point of view on what they think is readiness or compliant with their point of view.
00:28:11.259 --> 00:28:17.836
It's really important to understand so that you can interact with them with the right due care.
00:28:18.925 --> 00:28:21.515
I love how you don't sugarcoat privacy, michelle.
00:28:21.515 --> 00:28:23.811
There's a couple of things that happen.
00:28:23.811 --> 00:28:32.069
We've got like the orthodox privacy by design manifesto that talks about a positive sum game and as if there's just one dimension and everything's going to be good.
00:28:32.069 --> 00:28:33.233
And it's not.
00:28:33.233 --> 00:28:44.797
I mean, privacy involves tensions, and I think the act of restraint, the act of promising I'm not going to know things about you when I do business with you, that comes with a cost and there's a tension there, and I think that that's good.
00:28:45.605 --> 00:28:59.494
The other thing, of course, is that there's privacy perfectionism, because we think that there's compliance Great, and we give it to the lawyers and once they issue some sort of decree that you are compliant, you think job done, privacy tick, but it's not ever perfect.
00:28:59.494 --> 00:29:05.807
The funny thing is that we know that security is not perfect.
00:29:05.807 --> 00:29:23.430
We know that it would come with infinite cost to have perfect security, so you don't even think about it anymore, and I wish that we thought about privacy similarly, and I don't mean look for compromises by any means, but I do mean set an expectation that privacy is a factor that can be optimized but never reach perfect.
00:29:23.971 --> 00:29:28.359
Yeah, I mean, I think that's going to be really important now that we're going to be sharing more and more training sets.
00:29:28.359 --> 00:29:34.077
So when I go to the supermarket in person, people can see me.
00:29:34.077 --> 00:29:35.471
I'm not invisible.
00:29:35.471 --> 00:29:43.374
So the fact that I'm there and the fact that I've gone down this aisle or that aisle if you want to call that compromise, that's fine.
00:29:43.374 --> 00:29:55.262
If you want to just talk about it interoperable with society, you can call it that too, but it's a different situation than if I have like, say, I had a doctor's appointment and they made house calls.
00:29:55.262 --> 00:30:06.086
I don't know if anywhere in the world they still do that, but imagine if they did and imagine the intimacy of that interaction, very different than the supermarket example.
00:30:06.086 --> 00:30:13.119
So being able to communicate, am I a supermarket or am I a psychiatrist?
00:30:13.119 --> 00:30:16.071
Do my data sets reflect that?
00:30:16.071 --> 00:30:26.219
It's going to be really critical because the next frontier is this generation of generative AI is not going away, nor should it.
00:30:27.065 --> 00:30:47.511
I think there are leaps and bounds of things that we'll be able to do and get through sort of some grunt work that we didn't want to do in the first place, but it's going to be more critical than ever that we focus on quality, focus on quality and we're going to have to be critical about the kinds of answers we're getting back, because it's hard enough now.
00:30:47.531 --> 00:30:56.576
If you have anything or if you're a parent and God help you you Google some malady, you're either totally fine or you have cancer.
00:30:56.576 --> 00:30:59.729
Those are the two answers that are always true.
00:30:59.729 --> 00:31:09.942
It's like sex, drugs, rock and roll you're always dying on Google and yet will it be true?
00:31:09.942 --> 00:31:15.605
But if you doubt everything, then you actually won't get the benefits of some of this stuff.
00:31:15.605 --> 00:31:34.577
So if I'm well curating that grocery, it may be that for a community you can really have the kind of levels of freshness and wholesomeness and maybe even healthcare woven in that are very helpful and delightful things, but you'll also be able to understand when things are starting to go wrong.
00:31:34.577 --> 00:31:37.988
Data has a shelf life that's very short.
00:31:39.259 --> 00:31:40.906
Mulling over, mulling over.
00:31:41.480 --> 00:31:43.606
We're not going by your script at all, are we George?
00:31:44.189 --> 00:31:46.306
We're not, and it's perfect that we aren't.
00:31:46.306 --> 00:31:53.403
And sometimes people call me grumpy, george, and your comments about generative AI.
00:31:53.403 --> 00:32:08.797
I've spoken with AI professionals themselves who are actually concerned with regulation and being able to prove the results and point to why the AI made a particular decision, and most of them throw up their hands and say they can't do.
00:32:08.797 --> 00:32:10.820
It Isn't that cool.
00:32:10.820 --> 00:32:11.903
That's the magic of it.
00:32:11.903 --> 00:32:16.330
Well, it's a black box and then we've trained this black box.
00:32:16.330 --> 00:32:18.295
I'm sorry, but so much of it.
00:32:18.295 --> 00:32:26.205
As you sort of alluded to earlier, michelle, we train these systems so much on the bullshit that's endemic on the net.
00:32:26.205 --> 00:32:34.165
I'm grumpy because I think human beings are often just lazy and don't have the ability to be critical about the results that come back.
00:32:34.165 --> 00:32:45.210
So it's really the responsibility of regulators and the producers and providers of data to do a really good job on this, because citizens, they don't have the tools or the time.
00:32:45.911 --> 00:32:51.749
Yep, I think that's true and I think the critical skills that we're going to have to.
00:32:51.749 --> 00:32:56.491
Hopefully we can use some of this to do a better job educating our people as a whole.
00:32:56.491 --> 00:33:03.309
Definitely, here in the US we're having all sorts of issues with education and deciding what should be educated.
00:33:03.309 --> 00:33:06.001
I think we have an opportunity here.
00:33:06.001 --> 00:33:15.346
We have an opportunity of this brand new kind of whiz-bang thing to help communication by writing better, and we have beautiful examples of.
00:33:15.346 --> 00:33:20.407
Grammarly is a beautiful example of a, you know, a writing assist tool and an engine.
00:33:20.407 --> 00:33:35.354
But we also will have the opportunity to force citations and look for, you know, should this issue have more varied citations or are you going to the same source for the same thing?
00:33:35.354 --> 00:33:37.647
So there is an opportunity here.
00:33:37.647 --> 00:33:41.911
I think that's a little bit Pollyanna-ish to assume it's going to be baked in.
00:33:41.911 --> 00:33:52.594
I think you should assume it's not baked in unless it's worth a lot of money, but I also think that it shows the value of the data sets themselves.
00:33:52.594 --> 00:33:56.250
So right now we're we're trained on like what is it?
00:33:56.500 --> 00:34:08.126
Reddit and cat videos is most of the results on these you need to have, you know, I think, one of one of the biggest issues in bias.
00:34:08.126 --> 00:34:08.668
So there's two.
00:34:08.668 --> 00:34:10.206
There's a couple of issues in biases.
00:34:10.206 --> 00:34:19.740
A lot of this stuff is trained on very biased data and even people who have access to this podcast or anything online, that's not the world.
00:34:19.740 --> 00:34:26.503
That's only about 60% of the human beings on the planet right now even have access to clean water and the internet.
00:34:26.503 --> 00:34:31.125
So we're not representing the globe and I think the other thing that's you know.
00:34:31.125 --> 00:34:43.550
So the sample is biased and the other thing is the answer in funny quotes might be the right answer, but the right answer might be that you should pay women less than you pay men.
00:34:43.550 --> 00:34:47.501
So the right answer that exists in society today might suck.
00:34:47.501 --> 00:34:56.614
So it might be that even though you're getting a correct answer back, you might be getting a morally corrupt answer back.
00:34:56.614 --> 00:34:59.547
I've been asked with no imagination.
00:35:00.081 --> 00:35:16.927
Child labor was a thing when the coal mines were small and you needed small workers to fit through the logical Exactly, and if it's just about money, and that's how rewarding our society is just cash, then it is, you know, back to the beginning.
00:35:17.246 --> 00:35:22.331
It's the big oil rush times and you can bonk anybody you want over the head.
00:35:22.331 --> 00:35:34.327
I think that that's not a very sustainable society, and so that's where regulation and, more importantly in this era, because it goes so much faster ethics, really comes in.
00:35:34.327 --> 00:35:48.791
People think that they can't know ethics because it's sort of like an opinion, but it turns out this is a 3,000-year-old discipline of really interrogating what are the basic structures of ethical interrogation and what's our point of view?
00:35:48.791 --> 00:35:54.755
And then again, being transparent, am I looking at a collective ethic where really it is?
00:35:54.755 --> 00:36:07.112
The ancestral society, the oldest, you know, continuous societies on the planet go for collective ethics, whether we like it or not, as individualistic Westerners, it's true.
00:36:08.219 --> 00:36:11.041
Or are we looking at, you know, like zero trust?
00:36:11.041 --> 00:36:13.583
Security depends on trusting no one.
00:36:13.583 --> 00:36:18.547
That's a very individual, single person narrative.
00:36:18.547 --> 00:36:25.932
So if I'm building on a network, that's that I need to understand to go to the mean and probably not going to find my outliers.
00:36:25.932 --> 00:36:38.431
My Picassos don't live there, but the guys who can fold jeans at the mall probably are.
00:36:38.431 --> 00:36:54.059
So, depending on what you want your outcome of your tool to be, it's really important to understand what their ethics are, as well as what is their regulatory kind of compliance posture, if you will their regulatory kind of compliance posture, if you will.
00:36:54.059 --> 00:36:57.710
And Michelle, is your privacy code platform expressing ethics through its regulatory understandings.
00:36:58.360 --> 00:36:59.402
To the extent that.
00:36:59.402 --> 00:37:06.342
So we have the model cards that Timo Gru and some others have come up with to do ethical innovation.
00:37:06.342 --> 00:37:20.476
So if you're using that process, it basically will suggest that to you, that you should have a process that says how to do critical design and how to, how to recognize bias and what to do.
00:37:20.476 --> 00:37:22.826
And this is from our Pravadas framework.
00:37:22.826 --> 00:37:26.842
It's I have to look at it cause it's a long acronym, but it's called bears teach.
00:37:26.842 --> 00:37:31.612
So that's this is the acronym is B is bias and fairness.
00:37:31.612 --> 00:37:32.853
So this is the acronym, is B is bias and fairness.
00:37:32.853 --> 00:37:55.010
Ethical compliance and values, alignment, accountability and responsibility, robustness and reliability, security and privacy we did put them together for you, George Transparency and explainability, environmental impact and sustainability, which is a big deal these are heavy models Autonomy and control we cheated here.
00:37:55.010 --> 00:37:59.905
It's scalability, so we'll use the C for teach, Scalability and performance.
00:37:59.905 --> 00:38:02.307
And then, finally, human impact and safety.
00:38:02.307 --> 00:38:11.099
So BEARS TEACH is the acronym and this is the ethical framework, as well as the functional framework for our risk assessment profile.
00:38:11.119 --> 00:38:15.684
Let's pick that up and pop it in our show notes too, okay, as we edit this production.
00:38:15.684 --> 00:38:16.346
That'd be great.
00:38:16.346 --> 00:38:17.208
That'd be helpful.
00:38:17.871 --> 00:38:18.070
Yeah.
00:38:18.070 --> 00:38:24.760
So we do like a scorecard and kind of a risk heat map of where are you on any of these things?
00:38:24.760 --> 00:38:39.849
Because you might have something so critical, because you've got cellular research and so you are using protein fold management, maybe you are using quantum compute Heavy, heavy load on the environmental factor, maybe high load on societal impact factor.
00:38:39.849 --> 00:38:51.092
So this might be something where you're saying, okay, let's go for that because the benefits are here and we know about the tradeoffs here and it fits this sort of model.
00:38:51.092 --> 00:38:58.391
If you're using quantum computing for advertising models to sell middle-aged people face cream, whatever.
00:39:00.740 --> 00:39:04.452
Yeah, I think some of this stuff talks about the dynamism of privacy.
00:39:04.452 --> 00:39:06.947
That privacy is normally framed around.
00:39:06.947 --> 00:39:07.971
What do I know about you?
00:39:07.971 --> 00:39:10.365
Personal information, is it identifiable?
00:39:10.365 --> 00:39:11.068
What do I have?
00:39:11.068 --> 00:39:26.226
The fascinating thing to me about AI and even good old big data is that there's stuff that I might have and I don't know yet because the algorithm hasn't run or I don't have the algorithm yet that does the protein folding to predict the probability of diabetes.
00:39:26.226 --> 00:39:38.190
But the funny conversation that we need to have around this dashboard that you're describing, michelle, is give people some settings where they can enter into the bargain with the data holder.
00:39:38.190 --> 00:39:41.007
The data holder says this is what I might know about you.
00:39:41.007 --> 00:39:42.451
Are you cool with that?
00:39:42.451 --> 00:39:44.547
What I might be able to figure out?
00:39:44.547 --> 00:39:48.269
I might be able to synthesize the risk of height conditions.
00:39:48.269 --> 00:39:55.007
Do you want me to do that and have a meaningful dialogue around what the outcome of some of these enormously important algorithms could be?
00:39:55.528 --> 00:39:57.900
Mostly outside, if we do it properly.
00:39:58.181 --> 00:40:05.248
I think so too, and I think once we do that, we'll stay away from and I've been saying this in public more and more.
00:40:05.248 --> 00:40:09.041
It's a spicy take on it, but I'll give you guys some spice.
00:40:09.041 --> 00:40:14.190
I think DSARs have become immoral and I'll tell you why.
00:40:14.190 --> 00:40:24.748
The data subject access request We've always had the right to correct and the right to accuracy and we should continue to do that.
00:40:24.748 --> 00:40:27.155
Who is asking for the data subject access requests?
00:40:27.155 --> 00:40:36.126
Do you think it's like hourly wage makers or people who speak the native language as a second language?
00:40:36.126 --> 00:40:41.048
Do we think that it's people who don't have the same kinds of educ for that crust tool on the edge?
00:40:41.048 --> 00:41:09.391
And our lawyers are running around like chickens because there's like 72 hours and you have to get back this data subject access request and so we're breathlessly doing this and breathlessly, maybe, maybe, honoring those requests.
00:41:09.391 --> 00:41:17.610
So if they say, please forget me in your database, if they have that capability, if they have that capability, if they have done the architectural work, readers, they have.
00:41:17.690 --> 00:41:20.385
That is a hot take and it stimulates me.
00:41:20.385 --> 00:41:27.751
It reminds me that one of you know it's canonical in electronic health records that people have the right to know who has been accessing their records.
00:41:27.751 --> 00:41:31.853
Now, you know, in a hospital situation there's dozens of professionals who have every right and they can't do their job unless they look at my records.
00:41:31.853 --> 00:41:34.983
Now, you know, in a hospital situation, there's dozens of professionals who have every right and they can't do their job unless they look at my records.
00:41:34.983 --> 00:41:38.786
Now, do I want to get pinged every three minutes that somebody's looked up my record?
00:41:38.786 --> 00:41:41.221
I mean, it's a sort of a luxury of the worried.
00:41:41.221 --> 00:41:44.487
Well, and the people that care about that stuff are not.
00:41:44.487 --> 00:41:47.161
Actually that's the hot take of yours, isn't it?
00:41:47.181 --> 00:41:52.012
The people that are making those requests aren't actually by some measure important.
00:41:52.472 --> 00:41:52.833
They're not.
00:41:52.833 --> 00:41:55.289
I mean, I won't say they're not important, everyone's important.
00:41:55.289 --> 00:42:02.900
But I will say like A, they don't have the tools to do anything about it other than to say naughty you or I'm going to take you to the commissioner.
00:42:03.842 --> 00:42:11.275
And if we think that's the result, we should just give that staff directly to the commissions and have them do what they do.
00:42:11.275 --> 00:42:14.682
That staff directly to the commissions and have them do what they do.
00:42:14.682 --> 00:42:22.382
I think the more important part is it has sucked resources away from the core, from actually deleting stuff at the end of the process.
00:42:22.382 --> 00:42:36.007
Exactly as you say, we've thought in our past that storage was cheap and we were going to need this data forever, and so people who have long left our organizations stored and stored and stored data.
00:42:36.007 --> 00:42:38.215
They don't own this stuff anymore.
00:42:38.215 --> 00:42:45.920
It's probably for campaigns that haven't been run for 10, 15, sometimes 30 years, as we've seen in some hotel cases, for example.
00:42:45.920 --> 00:43:05.367
It may have been accurate at the time, but we've got all of this sort of liability tornado sitting in our bellies, and shouldn't we be cleaning that up first before we start doing all of this sort of dance of you know with fans and feathers?
00:43:05.367 --> 00:43:06.590
It's a grumpy old lady.
00:43:06.590 --> 00:43:12.610
Take on things, but I'd rather go to the core first than you, first than put lipstick on it.
00:43:13.780 --> 00:43:20.179
I'm wishing every tech organization was embedding privacy code into its process right away, right?
00:43:20.179 --> 00:43:26.833
So I have to say I loved your P-BOM, your Privacy Bill of Materials, because that gets instructions.
00:43:26.833 --> 00:43:40.748
This is what you have to do to build a complete product UX, whatever it is, and that's how we can talk to each other, rather than a DSAR, which will become valuable if you do these steps.
00:43:40.789 --> 00:43:43.385
I mean, that's the ironic thing about my crowing about.
00:43:43.385 --> 00:43:47.074
It is if we can talk to each other as vendors.
00:43:47.074 --> 00:43:52.246
If we could talk to each other and say like this is who I am, I'm somebody who does it.
00:43:52.246 --> 00:43:54.864
Right now it's all or nothing, Do you sell data or not?
00:43:54.864 --> 00:44:02.724
And everyone's like oh yeah, you have to say yeah, Like that's how we stay in business.
00:44:03.586 --> 00:44:05.170
There's no, there's no middle answer.
00:44:05.170 --> 00:44:05.672
There's no.
00:44:05.672 --> 00:44:14.288
Well, you know, we, we parse it and most of it is we use this and you can't tell all your secrets because then you make things very insecure.
00:44:14.288 --> 00:44:18.271
So there's no real great answer, but there's a good answer here.
00:44:19.701 --> 00:44:23.371
So, michelle, what's the good word to leave us with?
00:44:23.371 --> 00:44:26.489
Because we need to bring this in for a landing.
00:44:27.139 --> 00:44:41.735
If you like cash, of any denomination or currency, you should fall in love with privacy, because we tell the stories about customers, about voters, about people, about students.
00:44:41.735 --> 00:44:47.690
So if you like having customers and employees, you should love privacy.
00:44:47.690 --> 00:44:49.233
We're about the money.
00:44:50.800 --> 00:44:51.722
Well, thank you very much.
00:44:51.722 --> 00:44:55.344
It's been an absolute pleasure to have you on Making Data Better.
00:44:55.344 --> 00:44:57.108
Really appreciate your time.
00:44:57.108 --> 00:44:58.871
Thank you very much.
00:44:58.891 --> 00:44:59.893
It's been a wild ride.
00:45:01.179 --> 00:45:01.822
Thanks, Michelle.
00:45:01.822 --> 00:45:07.233
Great insights and thanks for the candor and the optimism.
00:45:07.760 --> 00:45:08.342
Absolutely.
00:45:08.342 --> 00:45:10.168
You can't do what we do without being optimistic.
00:45:10.820 --> 00:45:11.181
Indeed.
00:45:11.181 --> 00:45:12.224
Thanks, Michelle.
00:45:12.224 --> 00:45:13.188
We'll see you on the other side.
00:45:13.588 --> 00:45:14.760
Yes, sir, thank you.
00:00:23.298 --> 00:00:31.568
Welcome to Making Data Better, a podcast about data quality and the impact that it has on how we protect, manage and use the digital data critical to our lives.
00:00:31.568 --> 00:00:35.606
I'm George Peabody, partner at Lockstep Consulting, and thanks for joining us.
00:00:35.606 --> 00:00:38.161
With me is Lockstep founder, steve Wilson.
00:00:38.161 --> 00:00:42.441
Hi, steve, g'day, george, good to be with you, glad you're here.
00:00:42.441 --> 00:00:44.325
So, steve, let's get into it.
00:00:44.405 --> 00:00:49.054
Today we're addressing what I consider to be the biggest negative effect of the internet.
00:00:49.054 --> 00:00:54.412
My list has more than one entry on it, but my biggest one is the loss of privacy.
00:00:54.412 --> 00:01:09.808
We've got big tech companies who have every incentive to know everything about me, because our business model is based entirely on advertising to me totally targeted advertising, a corollary of that or along with it.
00:01:09.808 --> 00:01:17.733
We've got an entire ecosystem of data brokers who aggregate and resell every bit of my digital dust that they can hoover up.
00:01:17.733 --> 00:01:30.331
So, and then there's this enterprise belief that it's the best thing you can do is store every bit of data that you've ever encountered to help with your marketing and maybe risk management.
00:01:30.331 --> 00:01:38.474
And then, of course, analytics you're going to apply to all that someday that make all that data be useful to you.
00:01:38.474 --> 00:01:50.251
So we've got this pervasive habit and business model that is all about learning everything you can about people, without regard for the immediate need for the data and without any concrete reason.
00:01:50.251 --> 00:01:58.022
Often, in other words, as other studies have shown, even with all that data, bad decisions and injustices are made.
00:01:59.004 --> 00:02:00.087
Okay, Steve, I give up.
00:02:00.087 --> 00:02:02.832
I realize I'm complaining about the state of the world here.
00:02:02.832 --> 00:02:05.786
You've worked in digital privacy for years.
00:02:05.786 --> 00:02:07.228
Where do we start?
00:02:07.930 --> 00:02:08.832
Well, that's interesting.
00:02:08.832 --> 00:02:13.812
I got into privacy almost by accident from many years working in identity.
00:02:13.812 --> 00:02:15.786
Often put that in air quotes.
00:02:15.786 --> 00:02:19.609
Security and privacy are different.
00:02:19.609 --> 00:02:29.530
Cyber security starts, I think, with important data and thinking about what makes data important to you, and then you have controls to protect the value of data.
00:02:29.530 --> 00:02:34.812
There's a well-known set of dimensions that you look at data through from the security perspective.
00:02:35.560 --> 00:02:38.068
I think that privacy is sort of the opposite of that.
00:02:38.068 --> 00:02:39.747
I think that privacy is about restraint.
00:02:39.747 --> 00:02:44.771
I think that privacy is about what you don't do with data rather than what you do do.
00:02:44.771 --> 00:02:51.967
I think that privacy is about what you don't do with data rather than what you do do, and therefore the technology is not as important as policy and governance and I put policy in quotes as well.
00:02:51.967 --> 00:02:58.313
It's not just those big, thick 20-page policies, but policy like what is your organization's culture?
00:02:58.313 --> 00:03:00.396
What do you want to do with data?
00:03:00.396 --> 00:03:08.824
How is it important to you that old promise that we respect your privacy by businesses?
00:03:08.824 --> 00:03:09.425
If they really mean that?
00:03:09.425 --> 00:03:10.849
Here's the paradox of privacy.
00:03:10.849 --> 00:03:13.942
They need to choose not to know things about you.
00:03:13.942 --> 00:03:18.461
They need to say we're going to mind our own business, we don't want to know everything about you.
00:03:18.461 --> 00:03:19.622
That's respecting privacy.
00:03:19.622 --> 00:03:21.165
So that's how I come at this.
00:03:23.770 --> 00:03:24.070
Wow.
00:03:24.070 --> 00:03:27.216
So, yeah, I kind of went in the other direction, didn't I?
00:03:27.216 --> 00:03:30.530
I was all about collecting every bit of data and whining about that.
00:03:30.530 --> 00:03:35.391
You're pointing out that it's about minimizing the data that's being captured in the first place.
00:03:35.391 --> 00:03:43.794
Well, to help us further unravel this privacy knot, it's our great pleasure to welcome Michelle Finnernan-Denady.
00:03:43.794 --> 00:03:51.189
Pleasure to welcome Michelle Finnernan-Denady, who's the CEO of Privacy Code Inc and partner at strategy consulting firm Privatus Online.
00:03:51.189 --> 00:03:54.822
Get that right, michelle Privatus, privatus.
00:03:54.822 --> 00:03:56.548
All right, I was going to ask.
00:03:56.548 --> 00:04:01.670
I was thinking earlier is this a world where we use the word privacy or privacy?
00:04:03.181 --> 00:04:04.582
This is going even back further.
00:04:04.582 --> 00:04:12.485
So there is publicus, which is your public persona or your cultural, ethical rules that you follow, and then there is privatus.
00:04:12.485 --> 00:04:17.591
So privatus is your private self or your individualized self.
00:04:18.271 --> 00:04:18.692
Gorgeous.
00:04:19.540 --> 00:04:24.213
Well, you were an attorney before becoming a CEO and a consultant.
00:04:24.213 --> 00:04:27.288
I want to ask, to begin with, what brought you to privacy?
00:04:27.288 --> 00:04:29.949
How did you get into this domain?
00:04:30.620 --> 00:04:35.391
Yeah, I think, like so many people, steve included we kind of backed into it.
00:04:35.391 --> 00:04:38.689
So I started out life as an intellectual property lawyer.
00:04:38.689 --> 00:04:44.360
I was a patent litigator and then entered the world of high tech, which is interesting to me.
00:04:44.360 --> 00:05:35.483
I was doing a lot of medical devices and pharmaceutical work in patents and then ended up in high tech and I think are we supposed to call ph scale really, on the internet was dawning and you could buy and trade and do business online and so somehow, magically, that absolves you of doing what you needed to do.
00:05:35.483 --> 00:05:45.771
And as a patent litigator coming into this environment and a businesswoman looking over the Sun Microsystems portfolio, I said this is really.
00:05:46.271 --> 00:05:51.608
The paradox for me was that the value is in sharing information.
00:05:51.608 --> 00:06:38.069
The value was we had people like Whit Diffie who was talking about encryption, we had early versions of what we now call Kubernetes and we were dealing with what we called the grid or the utility back then which we all now call the cloud distributed secure compute, and so when I looked at the portfolio and the business needs of this company, as well as the 165 countries in which we were doing business and the various cultures that those imply, everything rang a bell in my head saying if you want to do business well, you better get privacy right, because you have customers and you have employees and these are pretty critical characters in your business drama.
00:06:38.069 --> 00:06:45.550
And if you're a government entity, you have citizens and voters and those are pretty important constituents for you.
00:06:45.550 --> 00:06:57.067
So wherever you find a person, you find a story that needs to be told, a connection that needs to be made, and so you have privacy and identity.
00:06:58.930 --> 00:07:00.293
Love that story to be told.
00:07:00.293 --> 00:07:04.687
The theme of our podcast is what is the story behind the data?
00:07:12.600 --> 00:07:13.302
And the story, you know, it's amazing.
00:07:13.302 --> 00:07:21.451
I mean, data is quite benign until humans get their eyeballs on it, and then it can be very good and it can be very evil, and so I think that's the thing to remember is, you know, this is an ingredient.
00:07:21.451 --> 00:07:25.714
So data, really telling the story, I think is the right thing.
00:07:25.714 --> 00:07:30.851
And, exactly as you said, george, is like the old fashioned way for the old people who don't like making money.
00:07:30.851 --> 00:07:39.291
They stockpile as much data as they get their hands on, they scrape the internet and they steal all of our data and they put it into generative AI models.
00:07:39.954 --> 00:07:42.884
That seems really attractive in this day and time, doesn't it?
00:07:42.884 --> 00:07:46.812
It seems like you'd give somebody a trillion dollars to do more of that.
00:07:46.812 --> 00:07:51.130
The reality is it's already setting a time bomb off.
00:07:51.130 --> 00:07:55.730
You can dig in a pile of pony dung as much as you want.
00:07:55.730 --> 00:08:05.663
You ain't going to find a pony in there, but to find something that's fresh, something that's new, something that's targeted, something that's individualized, that has value.
00:08:05.663 --> 00:08:09.350
That's fresh, something that's new, something that's targeted, something that's individualized, that has value, that's current.
00:08:09.350 --> 00:08:22.045
So the old-fashioned way of just because I can, I do because mainframes are cool that's changing, and it's changing very, very rapidly the new value model is coming into focus.
00:08:22.827 --> 00:08:24.190
Let me react to that really quickly.
00:08:24.190 --> 00:08:26.966
And we didn't prep for this, so I apologize for this story out of the blue.
00:08:26.966 --> 00:08:35.057
But you'll remember 15 years ago, the Google Street View catastrophe, where the Street View cameras had a good job to do.
00:08:35.057 --> 00:08:36.841
They're photographing the streets of the world.
00:08:36.841 --> 00:08:47.607
But some bright engineer realized that the equipment on the back of the Google car had a Wi-Fi transponder and they could also pick up Wi-Fi transmissions that were quoted in the public domain.
00:08:48.482 --> 00:08:52.326
And this chap innovated by collecting that data and just started mining it to see what was there.
00:08:52.326 --> 00:08:53.907
It was a process of discovery.
00:08:53.907 --> 00:08:56.809
It was a process of literally data mining.
00:08:56.809 --> 00:09:01.511
You know there's a vein of data, let's mine it, let's see what's there.
00:09:01.511 --> 00:09:03.265
That was the Google culture.
00:09:03.265 --> 00:09:04.566
They reward innovation.
00:09:04.566 --> 00:09:09.047
They make a stupendous amount of money out of using data in innovative surprising ways.
00:09:09.820 --> 00:09:17.667
And when they all got sprung and they said you were collecting that data without intent, you don't need it, you didn't tell people you were doing it.
00:09:17.667 --> 00:09:35.552
It doesn't matter that it was in the public Wi-Fi mish, it was personal data, you had no right to just grab it they were shocked and they sort of gave the guy an attitude transplant and said we won't do that again, but I thought it spoke to the culture of an innovative company, a purely digital company that feels as though it's got the rights.
00:09:35.552 --> 00:09:40.993
Like frontiers people to you know it's like the old oil rush.
00:09:40.993 --> 00:09:45.508
We know this valuable treasure is under the ground or under the digital ground.
00:09:45.508 --> 00:09:48.551
Let's go and find out what's there and dig it up and use it.
00:09:48.551 --> 00:09:51.562
And I thought that is anathema to privacy.
00:09:51.562 --> 00:09:55.292
And yet it's so counterintuitive that you should not do that.
00:09:57.221 --> 00:09:58.341
Yeah, I think that's right and.
00:09:59.102 --> 00:10:32.288
I think that's where it's getting really interesting, because we now have more subtle controls than we had back in those kind of early kind of oil days of get whatever data you can, because we didn't have fat pipes to every home, we didn't have the stability in the Wi-Fi connections that we have today, we certainly didn't have the fidelity of the identity tools to layer whose persona is whose where, and so there was sort of this feeling of just because I can, I will.
00:10:32.288 --> 00:10:38.734
And the reality is, I think the more innovative view, ironically, is quite old fashioned.
00:10:38.734 --> 00:10:43.658
That's a weird sentence to say that innovation always starts, for me, with ethics.
00:10:43.857 --> 00:10:44.938
What do people want?
00:10:44.938 --> 00:10:56.246
The things that people become really, really addicted to and they really really like are things that bring out our human passions hunger, thirst, lust, greed.
00:10:56.246 --> 00:11:00.961
We love being on social media as much as we hate being on social media.
00:11:00.961 --> 00:11:01.543
Why?
00:11:01.543 --> 00:11:04.809
Because we crave connection with people.
00:11:04.809 --> 00:11:06.874
It's a very basic human thing.
00:11:06.874 --> 00:11:18.701
So, by really looking at, what do we really want, what are we serving, how much does it cost, what are people wanting to do with that information and what if that information is false?
00:11:18.701 --> 00:11:31.933
So starting to have these questions again because we have the fidelity that we have today that we did not 20 years ago, I think, opens up a whole new can of really valuable innovation.
00:11:31.933 --> 00:11:35.261
I've stunned George into silence.
00:11:35.943 --> 00:11:36.605
Yeah, you have.
00:11:36.605 --> 00:11:51.955
I'm trying to take what you said and trying to search for the evidence that there are tech companies who actually get what you're saying and agree with it and are casting themselves as stewards.
00:11:51.955 --> 00:11:57.500
I'm still looking at the paradigm, the business paradigm of the net, which is basically advertising.
00:11:57.821 --> 00:11:58.623
Still ad tech?
00:11:58.623 --> 00:12:01.051
Yeah, yeah, and I think that's right.
00:12:01.051 --> 00:12:06.912
I think what exists today, you still see remnants of that old-fashioned sort of ad tech world.
00:12:06.912 --> 00:12:08.260
Right, it's like Remnants.
00:12:08.280 --> 00:12:08.922
That's Google's.
00:12:08.922 --> 00:12:13.791
That's virtually 90% of Google's revenues, if not more.
00:12:14.493 --> 00:12:15.293
Yeah, but it's changing.
00:12:15.293 --> 00:12:24.490
I mean, look at just, the Europeans are saying, oh, we don't like your Google cookies and things, and so that changed radically and overnight.
00:12:24.490 --> 00:12:28.404
And how much money are they spending into trying to shift their models?
00:12:28.404 --> 00:12:42.065
How much money are they now investing into trying to find various ways of obfuscation and various privacy enhancing technologies to either do an anonymization or figure out how to do radical personalization?
00:12:42.065 --> 00:12:46.048
I think even those big, big companies are investing in what's next.
00:12:46.769 --> 00:12:53.982
You put your finger on what I suspect is the major mover of the market these days, which is regulation.
00:12:53.982 --> 00:12:55.186
Is that right?
00:12:55.567 --> 00:12:56.528
It always has been.
00:12:56.528 --> 00:13:03.772
So this nonsense, this nonsense that, oh, regulation is going to stop innovation how was Silicon Valley formed?
00:13:03.772 --> 00:13:14.024
Silicon Valley was formed we broke up the telephone monopolies and there was all this room for building.
00:13:14.024 --> 00:13:15.105
There was all this sort of regulation.
00:13:15.105 --> 00:13:25.094
After deregulation, they re-regulate other things and people find innovative models to go around things, sometimes to find a loophole, but also sometimes to truly innovate.
00:13:25.094 --> 00:13:31.251
Regulation hasn't stopped the pace of innovation in human history yet.
00:13:31.251 --> 00:13:37.211
So, yes, the lobbyists will continue to lobby and they're adorable and we love them.
00:13:37.211 --> 00:13:40.469
However, the facts are the facts.
00:13:40.469 --> 00:13:42.086
The cash is the cash.
00:13:42.086 --> 00:13:47.081
I don't see a slowdown, even though we have actually known rules.
00:13:47.081 --> 00:13:53.542
I would prefer to have actually a federal law in the United States rather than state-by-state patchworks.
00:13:53.542 --> 00:13:55.006
I think it protects more people.
00:13:55.006 --> 00:14:05.052
I think it gives us a way to show that we're driving on the right side of the digital highway and we can signal to other drivers that we're on the move.
00:14:05.052 --> 00:14:09.912
This patchwork of little power fiefdoms, I think, is destructive.
00:14:12.441 --> 00:14:12.942
Absolutely.
00:14:12.942 --> 00:14:24.173
Your point makes me think that how glad I am, despite its occasional misses, that the FAA exists and does such a good job of making air travel as well.
00:14:24.173 --> 00:14:26.288
It's the safest way to move a person in the world.
00:14:26.759 --> 00:14:28.488
Yeah, well, you put your finger on it.
00:14:28.488 --> 00:14:29.692
I've long said it.
00:14:29.692 --> 00:14:31.721
This is one of my first conversations with Steve.
00:14:31.721 --> 00:14:43.926
They had these great drawing people at this conference we were at and we were talking about what did we do when piracy was the biggest threat to commerce, when we were trading nutmeg and tea?
00:14:43.926 --> 00:14:51.861
Well, we had admiralty law, and so when a ship was in port, it was one thing, when a ship was in the shipping lanes, it was another thing.
00:14:51.861 --> 00:15:18.508
We followed each other, we had rules, we understood what it meant to help a distressed fellow sailor, and a lot of this was to prevent pirates, to preserve goods and services, to cling together with the technology that we had to do commerce and literally find our way in an emerging planet, despite which country of origin that vessel emanated from and where they were heading.
00:15:18.508 --> 00:15:33.144
I think that's where we really, despite a world that's starting to be more and more kind of nationalized again, for this type of commerce, for privacy to thrive, for identity to thrive, we need to think more and more about standards than ever before.
00:15:33.966 --> 00:15:34.527
I love that.
00:15:34.527 --> 00:15:36.672
I love talking to a real lawyer.
00:15:36.672 --> 00:15:39.268
There's so many what we call in Australia Bush lawyers.
00:15:39.268 --> 00:15:44.767
I love talking to a real lawyer and your background, michelle, I think is deep.
00:15:44.767 --> 00:15:51.695
It seems to me as a non-lawyer that we're probably on the cusp of new jurisprudence.
00:15:51.695 --> 00:16:00.287
Just as shipping created that and just as the oil rush in the 1850s, 1870s created new property law, regulated a whole lot of intangibles.
00:16:00.919 --> 00:16:05.461
I talk to technologists and they say you can't regulate data, it's ones and zeros, it's intangible.
00:16:05.461 --> 00:16:07.427
I talk to technologists and they say you can't regulate data, it's ones and zeros, it's intangible.
00:16:07.427 --> 00:16:13.264
Well, you know what we do in a civilized world we regulate telecommunication bandwidth.
00:16:13.264 --> 00:16:16.311
That's not even a thing, it's not even physics.
00:16:16.311 --> 00:16:18.884
Bandwidth is so intangible we regulate the hell out of that.
00:16:18.884 --> 00:16:20.951
So I think that we're on a cusp.
00:16:20.951 --> 00:16:26.511
I see data protection, which is sort of synonymous with privacy.
00:16:26.511 --> 00:16:28.701
Gdpr stands for data protection.
00:16:28.701 --> 00:16:44.018
I see a bigger form of data protection where we look at what makes data valuable from every dimension the human dimension, the social dimension, the business dimension titrate out the properties of data that makes it valuable and attend to maximizing that value.
00:16:44.018 --> 00:16:51.610
And knowing that it's a multi-discipline sort of thing, I can see I'm so optimistic that we're actually going to see some good things in the next 10 or 20 years.
00:16:52.533 --> 00:16:54.365
I think we will too, and some of it.
00:16:54.365 --> 00:16:56.308
Again it goes back to, like, those human needs.
00:16:56.308 --> 00:17:04.836
Greed is a big motivator and we saw that when Apple decided to flex its muscles on what it's calling privacy.
00:17:04.836 --> 00:17:13.194
You saw what it was able to basically punch Facebook in the nose pretty hard enough so that they did this weird head fake with Web3.
00:17:13.194 --> 00:17:15.333
Like, oh, we're doing Lyndon Labs again.
00:17:15.333 --> 00:17:16.991
I was like you guys are so cute.
00:17:16.991 --> 00:17:20.454
That clearly was a head fake in my mind.
00:17:20.454 --> 00:17:27.435
It was like right after the market fell over on its side, suddenly we're doing this weird thing that didn't work, doesn't have a business case.
00:17:27.435 --> 00:17:29.267
That's cute.
00:17:29.267 --> 00:17:30.849
Why?
00:17:30.849 --> 00:17:37.028
Because suddenly we've got this immense power with this, as Steve says, an intangible right.
00:17:37.028 --> 00:17:49.712
And if you go back and you read, it's actually a beautiful piece of prose the Morn and Brandeis piece from 1892, I always get that year wrong from Harvard Law Review called the Right to Privacy.
00:17:49.712 --> 00:17:51.016
What was it about?
00:17:51.016 --> 00:17:54.596
It was actually about the dawn of new technologies.
00:17:54.596 --> 00:17:59.017
It was about Kodak-ing or taking portable photography.
00:17:59.744 --> 00:18:04.691
Although the portability was a giant heavy box, but you might see a woman's ankle.
00:18:04.691 --> 00:18:07.518
Oh my, think about it.
00:18:07.518 --> 00:18:34.808
It's like morality and ethics, and what they discuss in that article is really the evolution of you know, when Fred got out of the cave and hit Ted over the head with a hammer, that they understood was something that they should have rules about, and then when you just threatened him with the club, it was a very long time before that was actually recognized as a criminal and a civil harm.
00:18:34.808 --> 00:18:42.009
The fear of that bat hitting you was an ephemeral right that we agreed as a society our ethics.
00:18:42.009 --> 00:18:43.736
Before the law happens, we have ethics.
00:18:43.736 --> 00:18:46.009
We decided that to happen.
00:18:46.009 --> 00:18:54.817
So privacy and this is why we fight so voraciously, I think, against this nonsense and nihilism of privacy's dead because we have toys.
00:18:54.817 --> 00:19:04.035
No, privacy's alive because we have people and people who have dignity and stories and we have ethics.
00:19:04.035 --> 00:19:13.558
Cultures decide how they want to interact as groups with one another, so as long as we have people and culture, we will have privacy.
00:19:14.786 --> 00:19:17.652
Let's take it right down to you what's your work?
00:19:17.652 --> 00:19:23.634
Tell us about what you're CEO of yeah, what the company is doing, because I'm hearing this and I go.
00:19:23.634 --> 00:19:25.107
This is hard.
00:19:26.271 --> 00:19:27.335
Oh no, this is fun.
00:19:27.335 --> 00:19:33.191
Yes, it's hard because it's valuable, so you should pay us lots of money, but it's fun.
00:19:33.191 --> 00:19:35.998
So, basically, two lines of business.
00:19:35.998 --> 00:19:39.665
So Privacy Code is an AI-driven platform.
00:19:39.665 --> 00:19:43.613
I would have said NLP-driven a year and a half ago, but now we'll say AI.
00:19:43.613 --> 00:20:07.232
We use natural language processing and we actually take written documents that are usually written in legalese and they'll have either your RFPs or your notices or your policies or your privacy impact assessments, and we'll scan them in and we read them against a requirements library that has three subject matters responsible AI or new technology.
00:20:07.232 --> 00:20:17.521
It will be the same set of criteria for quantum Privacy, of course, or data protection and data quality and data governance.
00:20:17.521 --> 00:20:26.246
So three different sort of types of libraries, and so they're captive in two types of tasks processes, technologies.
00:20:26.246 --> 00:20:32.912
So if you make a promise and you say we promise to respect your privacy, we list our vendors.
00:20:32.912 --> 00:20:50.267
Well, you're going to find a whole category of requirements from places like NIST and GDPR the Australian laws that say what to do with vendors and so we've already broken them down task by task what could be a policy, what could be a technology control and then we put them into projects.
00:20:50.488 --> 00:20:58.667
So that's one line of business is helping to do that translation between and amongst technology and word people so that you can get your work done.
00:20:58.667 --> 00:21:01.028
Know what you need to get done so that you can get your work done.
00:21:01.028 --> 00:21:02.911
Know what you need to get done.
00:21:02.911 --> 00:21:07.775
And really no one can be expected to be as geeky as Steve and I are.
00:21:07.775 --> 00:21:16.281
If you're a UX person, I'm going to tell you exactly what I need in your UX so that we can help our customers engage in.
00:21:16.281 --> 00:21:21.567
If we're going to call it opting in or opting out, I don't care.
00:21:21.567 --> 00:21:24.652
It's going to be some sort of informed consent mechanism and I'm going to tell you what to present.
00:21:24.652 --> 00:21:32.290
Now, you are not going to be the right person, probably, to store the proof of that consent.
00:21:32.290 --> 00:21:34.395
That may be someone who's doing my logging.
00:21:34.395 --> 00:21:38.132
That may be someone who's doing my security criteria or my consent management.
00:21:38.673 --> 00:21:50.699
That person is going to get a task that says every time someone pushes this beautiful button designed by my gorgeous UX, the result is going to be this kind of time and date stamp, et cetera.
00:21:50.699 --> 00:21:52.790
So how do we do these times and dates?
00:21:52.790 --> 00:22:00.417
So that experts are doing expert things and then the person who's doing the data governance on top looks across the environment and says how are we doing?
00:22:00.417 --> 00:22:02.127
How are we doing on?
00:22:02.127 --> 00:22:10.487
You know, when we do things that are truly informed consent, we're actually hitting 1920, maybe even 60 different countries requirements at once.
00:22:10.487 --> 00:22:12.070
That's wonderful.
00:22:12.070 --> 00:22:13.032
Look at that.
00:22:13.032 --> 00:22:17.954
You can actually celebrate that stuff and you can actually start to assign weights and values.
00:22:18.497 --> 00:22:19.882
So, pravadas, what do we do?
00:22:19.882 --> 00:22:21.326
We do strategic consulting.
00:22:21.326 --> 00:22:27.659
So we look at your business problem and we think about how do you connect that to your data issues?
00:22:27.659 --> 00:22:29.712
How do you connect that to dollars?
00:22:29.712 --> 00:22:38.065
How do you connect that to actually getting this implemented so that your culture is sustaining what you say that you're doing?
00:22:38.065 --> 00:22:41.255
It's so much more than writing the right policy.
00:22:41.255 --> 00:22:43.953
That's like writing the right pitch deck to get cash.
00:22:43.953 --> 00:22:45.869
There's no magic pitch deck.
00:22:45.869 --> 00:22:47.836
It's a combination of a lot of different things.
00:22:48.904 --> 00:22:53.497
I do create a dashboard of progress around each one of those three areas.
00:22:53.904 --> 00:22:54.969
It's a progress board.
00:22:55.611 --> 00:22:57.396
So, it looks like a task board.
00:22:57.396 --> 00:23:08.880
It's tied in with our wonderful Atlassian, our favorite Australia Well, Canva is getting to be a pretty big deal too, but one of our favorite Australian phenoms so it's already tied into Jira.
00:23:08.880 --> 00:23:36.946
So if your technical teams are already using Jira, like the rest of the world, all they do is they receive a ticket in their normal platform and so everyone else can either go onto the code and look at the Kanban or the project progression and you can discuss right there and everything is tracked so that you can say show your auditors at the end what I call a P-BOM or a privacy bill of materials that you can say here's what it looks like from end to end.
00:23:36.946 --> 00:23:42.366
And if they need to look at it further, they can say, aha, well, and everything's tied back to the standards too.
00:23:42.366 --> 00:23:57.351
So they can say everything's organized in the same kind of chapter and verse and there's cited paragraphs if you want to geek out on it of like here's where it is in GDPR, here's where it is in secure control framework, et cetera.
00:23:58.113 --> 00:24:01.967
And then, if you really have to figure out, like, does George still work here?
00:24:01.967 --> 00:24:18.767
He was in charge of the UX last year you can click on that and say, oh yeah, he assigned this now to Steve and Steve has now taken over, so you can audit your stack, you can mature your stack, you can just know where you're at with data rather than just words.
00:24:18.767 --> 00:24:30.260
We're actually assigning deeds, matching them to standards, and now we're speaking a common language, so that we're not just sort of slipping down this well of, oh my gosh, it's overwhelming.
00:24:30.260 --> 00:24:31.390
Privacy is too hard for me.
00:24:32.325 --> 00:24:38.563
And you're solving that wicked problem of privacy policy being like a dual-use artifact.
00:24:38.563 --> 00:24:53.815
Yep, but it's dominated by legalese and it's become a defensive mechanism, or even it's become a bit of trickery, where businesses have got a covert mission and they get their lawyers to write something that supports the covert mission, without saying what it is.
00:24:53.815 --> 00:24:59.835
It occurs to me that it's dual use, like a privacy policy, if it's really a statement of what the company is going to do with data.
00:24:59.835 --> 00:25:00.926
Why do I want your data?
00:25:00.926 --> 00:25:01.748
What am I going to do with it?
00:25:01.748 --> 00:25:02.990
What do I owe you?
00:25:02.990 --> 00:25:04.893
I going to do with it?
00:25:04.893 --> 00:25:05.554
What do I owe you?
00:25:05.574 --> 00:25:08.859
I like to see that as like an embryonic document that lives with the project.
00:25:08.859 --> 00:25:20.119
You start by articulating what, how, when, why and where, and then it turns into a guidance for designers and it also turns into meeting your regulatory needs.
00:25:20.119 --> 00:25:25.069
Now, I don't underestimate the complexity of writing a legally compliant privacy document, and nobody should.
00:25:25.069 --> 00:25:41.288
You should get legal advice, as Michelle would do, but your process using NLP winds up being able to extract the dimensions of that important document that mattered to different stakeholders, I think it's very important to you, everything that you should like.
00:25:41.468 --> 00:25:49.878
Years ago, I did a graphic novel privacy policy when I was at mcafee intel and I realized we were doing a b2c product.
00:25:49.878 --> 00:25:55.634
We're doing a lot of family protection, we're doing a lot of mobile phone stuff and security is.
00:25:55.634 --> 00:26:03.068
Security is hard and it has its own special language and everyone has their standards and you know we're using the, the des, this and that this.
00:26:03.068 --> 00:26:05.377
We do that to sound smart to ourselves and that's adorable.
00:26:05.377 --> 00:26:07.125
Standards and we're using the DES, this and the this.
00:26:07.125 --> 00:26:10.107
We do that to sound smart to ourselves and that's adorable.
00:26:10.127 --> 00:26:18.686
But when we're trying to communicate and be fiduciaries, it's a lot better when you can talk to them, and nothing translates faster than pictures.
00:26:18.686 --> 00:26:25.094
So we did these pictures of these nerdy little ninjas and they weren't stylized, or so we did this pictures of these nerdy little ninjas and they weren't stylized, or they didn't.
00:26:25.094 --> 00:26:34.586
They had one ab, like the nice dome, dad bod, and they demonstrated you know, this is what a cookie is, and we had a thing that said what cookies are, and this is.
00:26:34.586 --> 00:26:38.175
This is what we do with when we say we're keeping some of your data.
00:26:38.175 --> 00:26:49.571
As for research, this is what this means, and so we explained in in pictures as much as in words, and it went over really well and I was really proud of that work.
00:26:49.571 --> 00:27:00.757
It's not easy to do because you have to be very thoughtful that you're not over promising or under explaining things, and we did append the actual words to the policy.
00:27:00.944 --> 00:27:11.556
But what I learned from that exercise is, if you're going to demonstrate visually what you're doing, you have to know what it is that you're doing.
00:27:11.556 --> 00:27:25.929
And I think that's the trick of this is, once you have invested and you've done a really thorough job of understanding what your data assets are A, you deserve to brag about them because they are a commercial differentiator.
00:27:25.929 --> 00:27:33.192
And B, you should make it easy, because you should be proud of that and you should not expect no company is compliant.
00:27:33.192 --> 00:27:35.685
So let's just start right there, right now.
00:27:35.685 --> 00:27:36.846
Forevermore.
00:27:36.846 --> 00:27:39.931
There is no such place as compliance-ville.
00:27:39.931 --> 00:27:41.333
That's like thin young, as compliance-ville.
00:27:41.333 --> 00:27:44.576
That's like thin, young, perfect, brilliant, smart, rich.
00:27:44.576 --> 00:27:57.165
She's lying, whoever that is.
00:27:57.165 --> 00:27:57.886
She's lying to you.
00:27:57.886 --> 00:28:02.655
So compliance is something that you're going to try to go for in this complex area, but some of these things are actually they conflict with each other.
00:28:02.655 --> 00:28:11.259
So understanding someone's point of view on what they think is readiness or compliant with their point of view.
00:28:11.259 --> 00:28:17.836
It's really important to understand so that you can interact with them with the right due care.
00:28:18.925 --> 00:28:21.515
I love how you don't sugarcoat privacy, michelle.
00:28:21.515 --> 00:28:23.811
There's a couple of things that happen.
00:28:23.811 --> 00:28:32.069
We've got like the orthodox privacy by design manifesto that talks about a positive sum game and as if there's just one dimension and everything's going to be good.
00:28:32.069 --> 00:28:33.233
And it's not.
00:28:33.233 --> 00:28:44.797
I mean, privacy involves tensions, and I think the act of restraint, the act of promising I'm not going to know things about you when I do business with you, that comes with a cost and there's a tension there, and I think that that's good.
00:28:45.605 --> 00:28:59.494
The other thing, of course, is that there's privacy perfectionism, because we think that there's compliance Great, and we give it to the lawyers and once they issue some sort of decree that you are compliant, you think job done, privacy tick, but it's not ever perfect.
00:28:59.494 --> 00:29:05.807
The funny thing is that we know that security is not perfect.
00:29:05.807 --> 00:29:23.430
We know that it would come with infinite cost to have perfect security, so you don't even think about it anymore, and I wish that we thought about privacy similarly, and I don't mean look for compromises by any means, but I do mean set an expectation that privacy is a factor that can be optimized but never reach perfect.
00:29:23.971 --> 00:29:28.359
Yeah, I mean, I think that's going to be really important now that we're going to be sharing more and more training sets.
00:29:28.359 --> 00:29:34.077
So when I go to the supermarket in person, people can see me.
00:29:34.077 --> 00:29:35.471
I'm not invisible.
00:29:35.471 --> 00:29:43.374
So the fact that I'm there and the fact that I've gone down this aisle or that aisle if you want to call that compromise, that's fine.
00:29:43.374 --> 00:29:55.262
If you want to just talk about it interoperable with society, you can call it that too, but it's a different situation than if I have like, say, I had a doctor's appointment and they made house calls.
00:29:55.262 --> 00:30:06.086
I don't know if anywhere in the world they still do that, but imagine if they did and imagine the intimacy of that interaction, very different than the supermarket example.
00:30:06.086 --> 00:30:13.119
So being able to communicate, am I a supermarket or am I a psychiatrist?
00:30:13.119 --> 00:30:16.071
Do my data sets reflect that?
00:30:16.071 --> 00:30:26.219
It's going to be really critical because the next frontier is this generation of generative AI is not going away, nor should it.
00:30:27.065 --> 00:30:47.511
I think there are leaps and bounds of things that we'll be able to do and get through sort of some grunt work that we didn't want to do in the first place, but it's going to be more critical than ever that we focus on quality, focus on quality and we're going to have to be critical about the kinds of answers we're getting back, because it's hard enough now.
00:30:47.531 --> 00:30:56.576
If you have anything or if you're a parent and God help you you Google some malady, you're either totally fine or you have cancer.
00:30:56.576 --> 00:30:59.729
Those are the two answers that are always true.
00:30:59.729 --> 00:31:09.942
It's like sex, drugs, rock and roll you're always dying on Google and yet will it be true?
00:31:09.942 --> 00:31:15.605
But if you doubt everything, then you actually won't get the benefits of some of this stuff.
00:31:15.605 --> 00:31:34.577
So if I'm well curating that grocery, it may be that for a community you can really have the kind of levels of freshness and wholesomeness and maybe even healthcare woven in that are very helpful and delightful things, but you'll also be able to understand when things are starting to go wrong.
00:31:34.577 --> 00:31:37.988
Data has a shelf life that's very short.
00:31:39.259 --> 00:31:40.906
Mulling over, mulling over.
00:31:41.480 --> 00:31:43.606
We're not going by your script at all, are we George?
00:31:44.189 --> 00:31:46.306
We're not, and it's perfect that we aren't.
00:31:46.306 --> 00:31:53.403
And sometimes people call me grumpy, george, and your comments about generative AI.
00:31:53.403 --> 00:32:08.797
I've spoken with AI professionals themselves who are actually concerned with regulation and being able to prove the results and point to why the AI made a particular decision, and most of them throw up their hands and say they can't do.
00:32:08.797 --> 00:32:10.820
It Isn't that cool.
00:32:10.820 --> 00:32:11.903
That's the magic of it.
00:32:11.903 --> 00:32:16.330
Well, it's a black box and then we've trained this black box.
00:32:16.330 --> 00:32:18.295
I'm sorry, but so much of it.
00:32:18.295 --> 00:32:26.205
As you sort of alluded to earlier, michelle, we train these systems so much on the bullshit that's endemic on the net.
00:32:26.205 --> 00:32:34.165
I'm grumpy because I think human beings are often just lazy and don't have the ability to be critical about the results that come back.
00:32:34.165 --> 00:32:45.210
So it's really the responsibility of regulators and the producers and providers of data to do a really good job on this, because citizens, they don't have the tools or the time.
00:32:45.911 --> 00:32:51.749
Yep, I think that's true and I think the critical skills that we're going to have to.
00:32:51.749 --> 00:32:56.491
Hopefully we can use some of this to do a better job educating our people as a whole.
00:32:56.491 --> 00:33:03.309
Definitely, here in the US we're having all sorts of issues with education and deciding what should be educated.
00:33:03.309 --> 00:33:06.001
I think we have an opportunity here.
00:33:06.001 --> 00:33:15.346
We have an opportunity of this brand new kind of whiz-bang thing to help communication by writing better, and we have beautiful examples of.
00:33:15.346 --> 00:33:20.407
Grammarly is a beautiful example of a, you know, a writing assist tool and an engine.
00:33:20.407 --> 00:33:35.354
But we also will have the opportunity to force citations and look for, you know, should this issue have more varied citations or are you going to the same source for the same thing?
00:33:35.354 --> 00:33:37.647
So there is an opportunity here.
00:33:37.647 --> 00:33:41.911
I think that's a little bit Pollyanna-ish to assume it's going to be baked in.
00:33:41.911 --> 00:33:52.594
I think you should assume it's not baked in unless it's worth a lot of money, but I also think that it shows the value of the data sets themselves.
00:33:52.594 --> 00:33:56.250
So right now we're we're trained on like what is it?
00:33:56.500 --> 00:34:08.126
Reddit and cat videos is most of the results on these you need to have, you know, I think, one of one of the biggest issues in bias.
00:34:08.126 --> 00:34:08.668
So there's two.
00:34:08.668 --> 00:34:10.206
There's a couple of issues in biases.
00:34:10.206 --> 00:34:19.740
A lot of this stuff is trained on very biased data and even people who have access to this podcast or anything online, that's not the world.
00:34:19.740 --> 00:34:26.503
That's only about 60% of the human beings on the planet right now even have access to clean water and the internet.
00:34:26.503 --> 00:34:31.125
So we're not representing the globe and I think the other thing that's you know.
00:34:31.125 --> 00:34:43.550
So the sample is biased and the other thing is the answer in funny quotes might be the right answer, but the right answer might be that you should pay women less than you pay men.
00:34:43.550 --> 00:34:47.501
So the right answer that exists in society today might suck.
00:34:47.501 --> 00:34:56.614
So it might be that even though you're getting a correct answer back, you might be getting a morally corrupt answer back.
00:34:56.614 --> 00:34:59.547
I've been asked with no imagination.
00:35:00.081 --> 00:35:16.927
Child labor was a thing when the coal mines were small and you needed small workers to fit through the logical Exactly, and if it's just about money, and that's how rewarding our society is just cash, then it is, you know, back to the beginning.
00:35:17.246 --> 00:35:22.331
It's the big oil rush times and you can bonk anybody you want over the head.
00:35:22.331 --> 00:35:34.327
I think that that's not a very sustainable society, and so that's where regulation and, more importantly in this era, because it goes so much faster ethics, really comes in.
00:35:34.327 --> 00:35:48.791
People think that they can't know ethics because it's sort of like an opinion, but it turns out this is a 3,000-year-old discipline of really interrogating what are the basic structures of ethical interrogation and what's our point of view?
00:35:48.791 --> 00:35:54.755
And then again, being transparent, am I looking at a collective ethic where really it is?
00:35:54.755 --> 00:36:07.112
The ancestral society, the oldest, you know, continuous societies on the planet go for collective ethics, whether we like it or not, as individualistic Westerners, it's true.
00:36:08.219 --> 00:36:11.041
Or are we looking at, you know, like zero trust?
00:36:11.041 --> 00:36:13.583
Security depends on trusting no one.
00:36:13.583 --> 00:36:18.547
That's a very individual, single person narrative.
00:36:18.547 --> 00:36:25.932
So if I'm building on a network, that's that I need to understand to go to the mean and probably not going to find my outliers.
00:36:25.932 --> 00:36:38.431
My Picassos don't live there, but the guys who can fold jeans at the mall probably are.
00:36:38.431 --> 00:36:54.059
So, depending on what you want your outcome of your tool to be, it's really important to understand what their ethics are, as well as what is their regulatory kind of compliance posture, if you will their regulatory kind of compliance posture, if you will.
00:36:54.059 --> 00:36:57.710
And Michelle, is your privacy code platform expressing ethics through its regulatory understandings.
00:36:58.360 --> 00:36:59.402
To the extent that.
00:36:59.402 --> 00:37:06.342
So we have the model cards that Timo Gru and some others have come up with to do ethical innovation.
00:37:06.342 --> 00:37:20.476
So if you're using that process, it basically will suggest that to you, that you should have a process that says how to do critical design and how to, how to recognize bias and what to do.
00:37:20.476 --> 00:37:22.826
And this is from our Pravadas framework.
00:37:22.826 --> 00:37:26.842
It's I have to look at it cause it's a long acronym, but it's called bears teach.
00:37:26.842 --> 00:37:31.612
So that's this is the acronym is B is bias and fairness.
00:37:31.612 --> 00:37:32.853
So this is the acronym, is B is bias and fairness.
00:37:32.853 --> 00:37:55.010
Ethical compliance and values, alignment, accountability and responsibility, robustness and reliability, security and privacy we did put them together for you, George Transparency and explainability, environmental impact and sustainability, which is a big deal these are heavy models Autonomy and control we cheated here.
00:37:55.010 --> 00:37:59.905
It's scalability, so we'll use the C for teach, Scalability and performance.
00:37:59.905 --> 00:38:02.307
And then, finally, human impact and safety.
00:38:02.307 --> 00:38:11.099
So BEARS TEACH is the acronym and this is the ethical framework, as well as the functional framework for our risk assessment profile.
00:38:11.119 --> 00:38:15.684
Let's pick that up and pop it in our show notes too, okay, as we edit this production.
00:38:15.684 --> 00:38:16.346
That'd be great.
00:38:16.346 --> 00:38:17.208
That'd be helpful.
00:38:17.871 --> 00:38:18.070
Yeah.
00:38:18.070 --> 00:38:24.760
So we do like a scorecard and kind of a risk heat map of where are you on any of these things?
00:38:24.760 --> 00:38:39.849
Because you might have something so critical, because you've got cellular research and so you are using protein fold management, maybe you are using quantum compute Heavy, heavy load on the environmental factor, maybe high load on societal impact factor.
00:38:39.849 --> 00:38:51.092
So this might be something where you're saying, okay, let's go for that because the benefits are here and we know about the tradeoffs here and it fits this sort of model.
00:38:51.092 --> 00:38:58.391
If you're using quantum computing for advertising models to sell middle-aged people face cream, whatever.
00:39:00.740 --> 00:39:04.452
Yeah, I think some of this stuff talks about the dynamism of privacy.
00:39:04.452 --> 00:39:06.947
That privacy is normally framed around.
00:39:06.947 --> 00:39:07.971
What do I know about you?
00:39:07.971 --> 00:39:10.365
Personal information, is it identifiable?
00:39:10.365 --> 00:39:11.068
What do I have?
00:39:11.068 --> 00:39:26.226
The fascinating thing to me about AI and even good old big data is that there's stuff that I might have and I don't know yet because the algorithm hasn't run or I don't have the algorithm yet that does the protein folding to predict the probability of diabetes.
00:39:26.226 --> 00:39:38.190
But the funny conversation that we need to have around this dashboard that you're describing, michelle, is give people some settings where they can enter into the bargain with the data holder.
00:39:38.190 --> 00:39:41.007
The data holder says this is what I might know about you.
00:39:41.007 --> 00:39:42.451
Are you cool with that?
00:39:42.451 --> 00:39:44.547
What I might be able to figure out?
00:39:44.547 --> 00:39:48.269
I might be able to synthesize the risk of height conditions.
00:39:48.269 --> 00:39:55.007
Do you want me to do that and have a meaningful dialogue around what the outcome of some of these enormously important algorithms could be?
00:39:55.528 --> 00:39:57.900
Mostly outside, if we do it properly.
00:39:58.181 --> 00:40:05.248
I think so too, and I think once we do that, we'll stay away from and I've been saying this in public more and more.
00:40:05.248 --> 00:40:09.041
It's a spicy take on it, but I'll give you guys some spice.
00:40:09.041 --> 00:40:14.190
I think DSARs have become immoral and I'll tell you why.
00:40:14.190 --> 00:40:24.748
The data subject access request We've always had the right to correct and the right to accuracy and we should continue to do that.
00:40:24.748 --> 00:40:27.155
Who is asking for the data subject access requests?
00:40:27.155 --> 00:40:36.126
Do you think it's like hourly wage makers or people who speak the native language as a second language?
00:40:36.126 --> 00:40:41.048
Do we think that it's people who don't have the same kinds of educ for that crust tool on the edge?
00:40:41.048 --> 00:41:09.391
And our lawyers are running around like chickens because there's like 72 hours and you have to get back this data subject access request and so we're breathlessly doing this and breathlessly, maybe, maybe, honoring those requests.
00:41:09.391 --> 00:41:17.610
So if they say, please forget me in your database, if they have that capability, if they have that capability, if they have done the architectural work, readers, they have.
00:41:17.690 --> 00:41:20.385
That is a hot take and it stimulates me.
00:41:20.385 --> 00:41:27.751
It reminds me that one of you know it's canonical in electronic health records that people have the right to know who has been accessing their records.
00:41:27.751 --> 00:41:31.853
Now, you know, in a hospital situation there's dozens of professionals who have every right and they can't do their job unless they look at my records.
00:41:31.853 --> 00:41:34.983
Now, you know, in a hospital situation, there's dozens of professionals who have every right and they can't do their job unless they look at my records.
00:41:34.983 --> 00:41:38.786
Now, do I want to get pinged every three minutes that somebody's looked up my record?
00:41:38.786 --> 00:41:41.221
I mean, it's a sort of a luxury of the worried.
00:41:41.221 --> 00:41:44.487
Well, and the people that care about that stuff are not.
00:41:44.487 --> 00:41:47.161
Actually that's the hot take of yours, isn't it?
00:41:47.181 --> 00:41:52.012
The people that are making those requests aren't actually by some measure important.
00:41:52.472 --> 00:41:52.833
They're not.
00:41:52.833 --> 00:41:55.289
I mean, I won't say they're not important, everyone's important.
00:41:55.289 --> 00:42:02.900
But I will say like A, they don't have the tools to do anything about it other than to say naughty you or I'm going to take you to the commissioner.
00:42:03.842 --> 00:42:11.275
And if we think that's the result, we should just give that staff directly to the commissions and have them do what they do.
00:42:11.275 --> 00:42:14.682
That staff directly to the commissions and have them do what they do.
00:42:14.682 --> 00:42:22.382
I think the more important part is it has sucked resources away from the core, from actually deleting stuff at the end of the process.
00:42:22.382 --> 00:42:36.007
Exactly as you say, we've thought in our past that storage was cheap and we were going to need this data forever, and so people who have long left our organizations stored and stored and stored data.
00:42:36.007 --> 00:42:38.215
They don't own this stuff anymore.
00:42:38.215 --> 00:42:45.920
It's probably for campaigns that haven't been run for 10, 15, sometimes 30 years, as we've seen in some hotel cases, for example.
00:42:45.920 --> 00:43:05.367
It may have been accurate at the time, but we've got all of this sort of liability tornado sitting in our bellies, and shouldn't we be cleaning that up first before we start doing all of this sort of dance of you know with fans and feathers?
00:43:05.367 --> 00:43:06.590
It's a grumpy old lady.
00:43:06.590 --> 00:43:12.610
Take on things, but I'd rather go to the core first than you, first than put lipstick on it.
00:43:13.780 --> 00:43:20.179
I'm wishing every tech organization was embedding privacy code into its process right away, right?
00:43:20.179 --> 00:43:26.833
So I have to say I loved your P-BOM, your Privacy Bill of Materials, because that gets instructions.
00:43:26.833 --> 00:43:40.748
This is what you have to do to build a complete product UX, whatever it is, and that's how we can talk to each other, rather than a DSAR, which will become valuable if you do these steps.
00:43:40.789 --> 00:43:43.385
I mean, that's the ironic thing about my crowing about.
00:43:43.385 --> 00:43:47.074
It is if we can talk to each other as vendors.
00:43:47.074 --> 00:43:52.246
If we could talk to each other and say like this is who I am, I'm somebody who does it.
00:43:52.246 --> 00:43:54.864
Right now it's all or nothing, Do you sell data or not?
00:43:54.864 --> 00:44:02.724
And everyone's like oh yeah, you have to say yeah, Like that's how we stay in business.
00:44:03.586 --> 00:44:05.170
There's no, there's no middle answer.
00:44:05.170 --> 00:44:05.672
There's no.
00:44:05.672 --> 00:44:14.288
Well, you know, we, we parse it and most of it is we use this and you can't tell all your secrets because then you make things very insecure.
00:44:14.288 --> 00:44:18.271
So there's no real great answer, but there's a good answer here.
00:44:19.701 --> 00:44:23.371
So, michelle, what's the good word to leave us with?
00:44:23.371 --> 00:44:26.489
Because we need to bring this in for a landing.
00:44:27.139 --> 00:44:41.735
If you like cash, of any denomination or currency, you should fall in love with privacy, because we tell the stories about customers, about voters, about people, about students.
00:44:41.735 --> 00:44:47.690
So if you like having customers and employees, you should love privacy.
00:44:47.690 --> 00:44:49.233
We're about the money.
00:44:50.800 --> 00:44:51.722
Well, thank you very much.
00:44:51.722 --> 00:44:55.344
It's been an absolute pleasure to have you on Making Data Better.
00:44:55.344 --> 00:44:57.108
Really appreciate your time.
00:44:57.108 --> 00:44:58.871
Thank you very much.
00:44:58.891 --> 00:44:59.893
It's been a wild ride.
00:45:01.179 --> 00:45:01.822
Thanks, Michelle.
00:45:01.822 --> 00:45:07.233
Great insights and thanks for the candor and the optimism.
00:45:07.760 --> 00:45:08.342
Absolutely.
00:45:08.342 --> 00:45:10.168
You can't do what we do without being optimistic.
00:45:10.820 --> 00:45:11.181
Indeed.
00:45:11.181 --> 00:45:12.224
Thanks, Michelle.
00:45:12.224 --> 00:45:13.188
We'll see you on the other side.
00:45:13.588 --> 00:45:14.760
Yes, sir, thank you.
SEARCH PAST EPISODES
Search past episodes of Making Data Better.
Disclaimer: The podcast and artwork embedded on this page are from Lockstep Consulting Pty Ltd, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.
EDIT
Thank you for helping to keep the podcast database up to date.
