Iapp Privacy Pro Podcast

Nearly five years after the implementation of the EU General Data Protection Regulation, Europe is immersed in a digital market strategy that is giving rise to a host of new, interconnected regulation. Among this complexity resides the proposed Artificial Intelligence Act. Originally presented by the European Commission April 2021, the AI Act is now in the hands of the Council of the European Union and European Parliament. If passed, this would be the world’s first comprehensive, horizontal regulation of AI. On my visit to Brussels for the IAPP Data Protection Congress, I had the opportunity to meet with AI Act Co-rapportuer and Romanian Member of Parliament Dragoș Tudorache in his office. During our extended conversation, we discussed the risk-framework for the proposal, how the legislation will intersect with existing regulations, like the GDPR, current sticking points with stakeholders and what this means for privacy and data protection professionals.

The highly anticipated mid-term elections in the U.S. so far have provided surprising results. Many political pundits expected a “red wave” of Republican candidates to take over both chambers of U.S. Congress. Though control of Congress is still up in the air, Democrats fared better than most expected. With some of the dust now settled, what do the 2022 midterm results mean for potential passage of the American Data Privacy and Protection Act, both in the lame duck session and the 118th Congress? Will House and Senate committee assignments change? What do the mid-term results mean for enforcement by federal agencies, like the Federal Trade Commission? And how will the results affect state privacy legislation in 2023 and beyond? To help shed light on these issues, I caught up with R Street Resident Senior Fellow for Cybersecurity and Emerging Threats Brandon Pugh and Public Knowledge Senior Policy Counsel Sara Collins.

As we round out 2022, digital technology is further embedding itself into our daily lives. Beyond the smartphone’s ubiquity, wearable sensors proliferate and are found everywhere from the gym to the bedroom. Intimate relationships are formed through dating apps more than ever before. We’re tracked in our cars, in retail establishments and online. At no time in history has data collection been as prevalent as it is now, and it’s only increasing. But what does that mean for the development of our identities and relationships, particularly for those who are most vulnerable? University of Virginia School of Law Prof. Danielle Citron has long explored these issues, which she’s presented in her new book, “The Fight for Privacy: Protecting Dignity, Identity and Love in the Digital Age.” I recently caught up with Prof. Citron to discuss her work, and how law – particularly civil rights law – society and privacy pros can all play a role in protecting what makes us human.

Since becoming U.K. Information Commissioner, John Edwards has been busy. Officially taking the reigns January 4, Edwards embarked on a listening tour to learn the ins and outs of the U.K. The former New Zealand Privacy Commissioner gave his first major public speech since heading up the ICO at the IAPP Data Protection Intensive in London last month and joined German Federal Commissioner for Data Protection and Freedom of Information Ulrich Kelber for a “commissioner’s chat” at the IAPP Global Privacy Summit in Washington, DC. While there, The Privacy Advisor Podcast host Jedidiah Bracy caught up with Edwards in person to discuss his priorities, how he foresees working with other data protection authorities, his thoughts on transborder data flows and the U.K.’s potential changes to it data protection law, and, most importantly, what he’s currently listening to for music.

In 1998, the U.S. was the first nation to enact a privacy law specifically tailored to protect children’s data. Nearly 25 years later, COPPA – the Children’s Online Privacy Protection Act – is one of several children’s privacy and data protection laws around the world. LinkedIn Vice President and Chief Privacy Officer Kalinda Raina first encountered the draft COPPA bill while interning at the Center for Democracy & Technology. In the years since, she has helped lead the privacy efforts at Nintendo and Apple. With three children of her own, Kalinda has an in-depth knowledge of children’s privacy issues, both as a parent and privacy pro. Her passion for the issue led her to start a YouTube channel to help educate parents and kids about privacy and safety issues and to shepherd a new book called “Children’s Privacy and Safety,” published by the IAPP. The Privacy Advisor Podcast host Jedidiah Bracy recently caught up with Kalinda to discuss children’s privacy, her work, and the new book.

The concept of privacy and data protection by design is not new in the privacy world. We know that privacy should be integrated in the foundational design of a product or service; that is should be baked in, not bolted on. But what that means in practice is often elusive. In 2018, Enterprivacy Consulting Group founder Jason Cronk wrote the book Strategic Privacy by Design, which was published by the IAPP. In it, Cronk offered insights for building processes, products and services that consider an individual’s privacy interests as a requirement. In the four years since, law and technology have continued to evolve, prompting Jason to write a second edition of the book. The IAPP's Jedidiah Bracy recently caught up with Cronk to discuss his work in designing for privacy and what’s new in his second edition.

It’s difficult to remember a time when people didn’t extoll cliches like “privacy is dead” or “data is the new oil.” No doubt, privacy is constantly challenged by ever advancing technology, and data is mined ubiquitously for its value, but privacy is far from dead. Washington University in St. Louis School of Law Prof. Neil Richards agrees, but notes that though privacy is very much alive, it is up for grabs. These are some of the initial thoughts that helped inform his new book, “Why Privacy Matters.” IAPP Editorial Director Jedidiah Bracy recently caught up with Richards to discuss his new book and why there’s plenty of food for thought in there for privacy pros.

Though many privacy pros are still grappling with the EU General Data Protection Regulation, the EU is now busy leading a new generation of data regulations. As part of its Digital Single Market strategy, the EU is looking to not only protect data but also to create frameworks that allow for data flows, while aiming to mitigate hate speech and misinformation. Through an ambitious line of of proposed laws – including the Data Act, Data Governance Act, Digital Markets Act, Digital Services Act and the AI Act – the EU is poised to place a slew of new requirements for companies doing business in the region. Though not all privacy-related, privacy pros should be paying attention to this space. To catch up on this flurry of activity, IAPP Editorial Director recently chatted with journalist Luca Bertuzzi.  

Cybersecurity is inextricably connected to privacy in countless ways. Like privacy law and regulation in the U.S., cybersecurity stands on a patchwork quilt of rules, laws, regulations and court cases. Stanford Cyber Policy Center Senior Policy Advisor Jim Dempsey has been teaching cybersecurity law since 2015 and worked in the area for decades, whether as an academic, a government representative on the U.S. Privacy and Civil Liberties Oversight Board, or an advocate at the Center for Democracy & Technology. He’s long thought about the cybersecurity space and how it matches up to privacy and data protection. In fact, he’s thought so hard on this subject that he published a new book with the IAPP called “Cybersecurity Law Fundamentals.” IAPP Editorial Director Jedidiah Bracy recently caught up with Dempsey to discuss cybersecurity’s current state of play, the biggest issues companies face from a world burgeoning with adversaries and what to look for in his new book.

Data protection and competition enforcement have been on a collision course in recent years. The Big Tech platforms have amassed powerful market share with vast amounts of user data. This inevitable convergence is shaping up on both sides of the Atlantic. U.S. President Joe Biden has appointed notable antitrust proponents to powerful government positions in recent months. And in Brussels, the European Commission has released a slew of draft legislation to help bolster its Digital Single Market efforts, curtail Big Tech hegemony, and promote competition. Journalist Samuel Stolton has been following these developments with an ear to the ground in Brussels. Host Jedidiah Bracy recently caught up with Stolton right as news emerged that Amazon faces a record $888 million fine related to GDPR violations.

On July 13, Ohio Lt. Governor Jon Husted announced the introduction of the Ohio Personal Privacy Act. The law applies to organizations doing business in Ohio or whose products or services target consumers in the state. Businesses with annual gross revenues exceeding $25 million, or process personal data of 100,000 or more Ohio consumers, or derive 50% of gross annual revenues from the sale of personal data would be covered. Like other laws, it does offer some consumer rights, including correction, deletion and portability, as well as an opt-out right for the sale of personal data. Most notably, the OPPA includes a carve out for businesses that reasonably conform with the U.S. National Institution of Standards and Technology’s Privacy Framework. Host Jedidiah Bracy recently caught up with Husted to discuss the bill, the NIST provision, and what the OPPA could mean for the future of privacy law at the state, federal and international levels. 

Voice-activated products and services are proliferating, while voice-recognition technology is on the rise. In addition to popular voice-activated assistants, call centers are beginning to use advanced voice-intelligence technology in novels ways. The technology could lead to plenty of innovation, but the potential privacy, safety and fairness issues will need some thinking. In his new book "The Voice Catchers: How Marketers Listen In to Exploit Your Feelings, Your Privacy, and Your Wallet," Joseph Turow describes the rise of what he calls the “voice intelligence industry” and how artificial intelligence is enabling personalized marketing and profiling through voice analysis. IAPP Editorial Director Jedidiah Bracy caught up with Turow to discuss the potential privacy issues and what privacy pros and policy makers should be thinking about with this nascent industry.

Notice and consent have been foundational principles in privacy and data protection for decades. But do they provide individuals with the ability to make informed decisions as they navigate products and services? Will laws like the California Privacy Rights Act help change how companies design their privacy notices? For Jennifer King, the Privacy and Data Policy Fellow at Stanford's Institute for Human-Centered Artificial Intelligence, the notice-and-consent paradigm as it currently stands is a “farce” that needs an overhaul, not just from a legal standpoint, but also from a human-technology interaction perspective. IAPP Editorial Director Jedidiah Bracy chats with King about what's needed for an effective paradigm shift in this space. 

Prospects for a federal privacy law in the U.S. ramped up in recent years, but even though data protection is a bipartisan issue, nothing has come close to passing. At the same time, U.S. state activity is swarming, and many countries around the world are developing and implementing their own national privacy laws. So what’s it going to take for the U.S. to pass a federal law? Rep. Suzan DelBene, D-Wash., was the first congressional lawmaker to propose federal privacy legislation in 2021. Her bill received praise from the U.S. Chamber of Commerce and other industry groups for its approach, but does the bill have what it takes to cross the finish line? The Privacy Advisor Podcast host Jedidiah Bracy recently caught up with DelBene to talk about her proposed bill, the state of play on Capitol Hill, and what it will take for the U.S. to pass federal privacy legislation.

Artificial intelligence and machine learning technologies are rapidly developing across virtually all sectors of the global economy. One nascent field is empathic technology, which, for better or worse, includes emotion detection. It is estimated that the emotion detection industry could be worth $56 billion by 2024. However, judging a person's emotional state is subjective and raises a host of privacy, fairness, and ethical questions. Ben Bland has worked in the empathic technology space in recent years and now chairs the IEEE's P7014 Working Group to develop a global standard for the ethics of empathic technology. We recently caught up to discuss the pros and cons of the technology and his work with IEEE. 

U.S. government surveillance bubbled back up in headlines in recent weeks. Portugal's data protection authority halted transfers of data to the U.S. after complaints that census data were being sent back to the U.S. The same week, a U.S. Foreign Intelligence Surveillance Court decision was published, in which it renewed a U.S. surveillance program even though it found some Federal Bureau of Investigation employees illegally accessed email data. This comes as the U.S. and EU try to hammer out a renewed data transfer agreement in the wake of the "Schrems II" decision that invalidated Privacy Shield. April Falcon Doss worked at the U.S. National Security Agency for 13 years. In 2017, Doss joined the U.S. Senate Select Committee on Intelligence for the Russia investigation. She also wrote a book, "Cyber Privacy: Who Has Your Data and Why You Should Care," and took a new job at Georgetown University Law Center. Host Jedidiah Bracy recently caught up with Doss to discuss the state of play of U.S. surveillance law,

The Norwegian Consumer Council made waves in early 2021 after its complaint to Norway's data protection authority, Datatilsynet, against Grindr resulted in an intention to fine the company $12 million, the highest fine ever levied by the nation’s DPA. Grindr responded to the proposed enforcement action, arguing it has refined its consent mechanism, but the case isn't over. The NCC has long worked with other advocacy organizations to bring protections and awareness for consumers around privacy issues in the marketplace. In 2018, they released an in-depth report on “dark patterns” to demonstrate how companies nudge users into making decisions that may not always be in their best interest. IAPP Editorial Director Jedidiah Bracy, CIPP, recently caught up with the NCC’s Finn Myrstad to discuss the NCC's case against Grindr and, more broadly, what companies can do to avoid using dark patterns at the expense of their users.

In the wake of "Schrems II," the future of data transfers is on shaky ground. True, the Biden administration has demonstrated that it’s taking trans-Atlantic data flows seriously after appointing Christopher Hoff in January, not long after Biden was inaugurated. And though both the U.S. Department of Commerce and European Commission are working together in earnest, short of changing its national security laws, what else can be done to prevent another legal challenge and potential invalidation to a future agreement? Baker MacKenzie Global Data Privacy and Security Group Chair Brian Hengesbaugh has an idea. Using his background in international policy and data protection, Hengesbaugh thinks now is the time for the Biden administration to “go big” and initiate an international treaty among democratic nations and their shared values around both human rights and national security. He explains in this latest episode of The Privacy Advisor Podcast. 

Virginia joined rarified air March 2 after its governor signed the Consumer Data Protection Act into law. Though California was the first state to pass baseline privacy legislation, Virginia was the first to do so absent a ballot initiative. So, what is in Virginia’s CDPA? Where does it overlap with provisions in the California Consumer Privacy Act, California Privacy Rights Act or EU General Data Protection Regulation? What are some early steps businesses should consider as they make preparations? And, what effect will the CDPA — if at all — have on other state privacy laws, and ultimately, on potential federal privacy legislation? These are a few of the issues IAPP Editorial Director Jedidiah Bracy, CIPP, discussed with Fox Rothschild Partner Odia Kagan, CIPP/E, CIPP/US, CIPM, FIP.

Concepts like “privacy engineering” and “privacy by design” have been in the privacy lexicon for several years, but do we all know or agree about what they mean? What is a privacy engineer? Sure, when we discuss privacy by design, we’re talking about baking privacy considerations in from the start and not just bolting them on after a product or service has been designed, but what is privacy by design in practice? How do you ensure your tech and legal teams can understand each other, and how can you get senior leadership to buy into privacy as a business advantage instead of an obstacle? These are a couple of issues IAPP Editorial Director Jedidiah Bracy, CIPP, recently discussed with Nishant Bhajaria, head of technical privacy and governance at Uber.