In June 2013, a series of high-profile U.S. government surveillance disclosures to major media outlets rippled throughout the world and changed the calculus for the privacy profession.  Hard to believe it's now been 10 years since an unknown U.S. government contractor leaked to the world massive amounts of information about top secret U.S. intelligence programs. Within weeks, Edward Snowden became a household, if not, controversial name — not only in the privacy profession — but to consumers and citizens far and wide. A lot has transpired since the summer of Snowden in 2013. The U.S. has altered some of its surveillance laws, and the trans-Atlantic relationship between the U.S. and EU has grown complicated after a series of data transfer agreements were struck down by the EU's highest court. The third such agreement is pending.    Though the privacy world is constantly changing, it seems fitting to stop and take stock of this last decade to see how much, if anything, has changed. To help measure the ripple effect, IAPP Editorial Director Jedidiah Bracy chatted with IAPP Senior Research Fellow Muge Fazlioglu and Research and Insights Director Joe Jones to uncover what's changed in the U.S. and abroad, as well as how consumer attitudes have evolved since then. 

The Privacy Advisor Podcast

Assessing the Snowden revelations 10 years later

We often focus on consumer policy when discussing privacy laws and obligations, but companies must protect their employee data, as well. Navigating complex employee privacy and labor laws in the U.S., for example, can be challenging, and new state laws, like the California Privacy Rights Act, apply more pressure on privacy pros charged with ensuring employee data is protected and handled appropriately. Littler Mendelson Privacy and Data Security Practice Group Co-Chair Zoe Argento knows the workplace privacy field well and advises clients on a wide range of issues. IAPP Editorial Director Jedidiah Bracy recently caught up with Argento to discuss some of the pressing trends in the workplace privacy space, including CPRA obligations, workplace surveillance and artificial intelligence issues, international data transfers and data security best practices.  

The ins and outs of workplace privacy law: A chat with Zoe Argento

The prospect of day-to-day life with artificial intelligence is no longer a future endeavor. AI systems comprise countless applications across public and private organizations, and through open-sourced systems, such as ChatGPT, AI is now consumer-facing and usable. The U.S. National Institute of Standards and Technology was directed by the National Artificial Intelligence Initiative Act of 2020 to create a voluntary resource for organizations designing, developing, deploying or using AI systems to help manage risk and to promote trustworthy and responsible development of AI systems. As a result, NIST released the AI Risk Management Framework 1.0 along with supplementary documents to help organizations. To learn more about the newly released framework and how organizations should approach it, IAPP Editorial Director Jedidiah Bracy caught up with NIST Research Scientist and Principle Investigator for AI Bias Reva Schwartz.

NIST's Reva Schwartz on the new AI Risk Management Framework

In early February, the U.S. Federal Trade Commission published a proposed order that fines telehealth and discount prescription provider GoodRX $1.5 milllion. Though part of the case involves deception – one of two prongs under the FTC Act – the case also raises the first-of-its-kind use of the Health Breach Notification Rule. To help better understand the novel and complex issues that are embedded in the case, IAPP Editorial Director Jedidiah Bracy caught up with Wilmer Hale Partner Kirk Nahra to discuss some of the takeaways privacy pros in any industry vertical should consider. 

Top takeaways from the FTC-GoodRx case: A chat with Kirk Nahra

Without a doubt, 2022 was a packed year for privacy-related news and developments. But according to Goodwin Partner and IAPP Westin Emeritus Senior Fellow Omer Tene, 2023 is set to call and raise the stakes. To be sure, 2023 didn’t hesitate. On Jan. 4, just a few days before we sat down for our interview, the Irish Data Protection Commission levied a massive 390 million euro fine on Meta social networks Facebook and Instagram. Yet, that’s only the tip of the iceberg. In this episode of The Privacy Advisor Podcast, which was recorded January 10, IAPP Editorial Director Jedidiah Bracy sat down with Tene to discuss what he thinks will be some of the biggest developments in privacy in 2023, including why he believes a federal U.S. privacy law still has a chance in the new U.S. Congress. 

A look at privacy developments in 2023 with Omer Tene

California has long led the way on many privacy-related laws, going back to at least 2002 when it passed the first data breach notification law in the U.S. More recently, passage of the California Consumer Privacy Act and the California Privacy Rights Act has prompted other states to follow suit. Baker McKenzie Partner Lothar Determann has long practiced and taught international data privacy law, and beginning in 2013, published the book, “California Privacy Law.” Now in its fifth edition and published by the IAPP for the last three editions, the new edition comes as the CPRA goes into effect, with implementing regulations on the way. IAPP Editorial Director Jedidiah Bracy caught up with Determann to talk about the California’s privacy regime, what companies should be doing to comply, what’s new in the updated book, and what’s on the horizon for federal and state privacy law in the U.S. and beyond.

All things 'California Privacy Law' with Lothar Determann

With the rise of data subject rights in privacy law, privacy practitioners are often challenged with operationalizing what can be a complex and risky endeavor. California, through the CCPA and CPRA, has emerged as a leader on this in the United States. Advocacy organization Consumer Reports has not only been working on policy with states like California on data subject rights but also with industry on standardizing consumer data rights. With a number of companies in the privacy tech vendor space, CR is announcing the open standard called the Data Rights Protocol. It’s also in the early stages of acting as an authorized agent on behalf of consumers, with a service its calling Permission Slip. IAPP Editorial Director Jedidiah Bracy talks with Ginny Fahs, associate director of product R&D for Consumer Reports Digital Lab, and Technology Policy Director Justin Brookman, to learn about their open-sourced protocol and what they’re doing to help both consumers and organizations operationalize data subject rights.

Operationalizing data subject rights: How Consumer Reports is aiming to help

Nearly five years after the implementation of the EU General Data Protection Regulation, Europe is immersed in a digital market strategy that is giving rise to a host of new, interconnected regulation. Among this complexity resides the proposed Artificial Intelligence Act. Originally presented by the European Commission April 2021, the AI Act is now in the hands of the Council of the European Union and European Parliament. If passed, this would be the world’s first comprehensive, horizontal regulation of AI. On my visit to Brussels for the IAPP Data Protection Congress, I had the opportunity to meet with AI Act Co-rapportuer and Romanian Member of Parliament Dragoș Tudorache in his office. During our extended conversation, we discussed the risk-framework for the proposal, how the legislation will intersect with existing regulations, like the GDPR, current sticking points with stakeholders and what this means for privacy and data protection professionals.

The EU AI Act: A discussion with MEP and Co-rapporteur Dragoș Tudorache

The highly anticipated mid-term elections in the U.S. so far have provided surprising results. Many political pundits expected a “red wave” of Republican candidates to take over both chambers of U.S. Congress. Though control of Congress is still up in the air, Democrats fared better than most expected. With some of the dust now settled, what do the 2022 midterm results mean for potential passage of the American Data Privacy and Protection Act, both in the lame duck session and the 118th Congress? Will House and Senate committee assignments change? What do the mid-term results mean for enforcement by federal agencies, like the Federal Trade Commission? And how will the results affect state privacy legislation in 2023 and beyond? To help shed light on these issues, I caught up with R Street Resident Senior Fellow for Cybersecurity and Emerging Threats Brandon Pugh and Public Knowledge Senior Policy Counsel Sara Collins.

What the 2022 midterm election results mean for US privacy law

As we round out 2022, digital technology is further embedding itself into our daily lives. Beyond the smartphone’s ubiquity, wearable sensors proliferate and are found everywhere from the gym to the bedroom. Intimate relationships are formed through dating apps more than ever before. We’re tracked in our cars, in retail establishments and online. At no time in history has data collection been as prevalent as it is now, and it’s only increasing. But what does that mean for the development of our identities and relationships, particularly for those who are most vulnerable? University of Virginia School of Law Prof. Danielle Citron has long explored these issues, which she’s presented in her new book, “The Fight for Privacy: Protecting Dignity, Identity and Love in the Digital Age.” I recently caught up with Prof. Citron to discuss her work, and how law – particularly civil rights law – society and privacy pros can all play a role in protecting what makes us human.

On the need for intimate privacy - A chat with Danielle Citron

Since becoming U.K. Information Commissioner, John Edwards has been busy. Officially taking the reigns January 4, Edwards embarked on a listening tour to learn the ins and outs of the U.K. The former New Zealand Privacy Commissioner gave his first major public speech since heading up the ICO at the IAPP Data Protection Intensive in London last month and joined German Federal Commissioner for Data Protection and Freedom of Information Ulrich Kelber for a “commissioner’s chat” at the IAPP Global Privacy Summit in Washington, DC. While there, The Privacy Advisor Podcast host Jedidiah Bracy caught up with Edwards in person to discuss his priorities, how he foresees working with other data protection authorities, his thoughts on transborder data flows and the U.K.’s potential changes to it data protection law, and, most importantly, what he’s currently listening to for music.

A chat with U.K. Information Commissioner John Edwards

In 1998, the U.S. was the first nation to enact a privacy law specifically tailored to protect children’s data. Nearly 25 years later, COPPA – the Children’s Online Privacy Protection Act – is one of several children’s privacy and data protection laws around the world. LinkedIn Vice President and Chief Privacy Officer Kalinda Raina first encountered the draft COPPA bill while interning at the Center for Democracy & Technology. In the years since, she has helped lead the privacy efforts at Nintendo and Apple. With three children of her own, Kalinda has an in-depth knowledge of children’s privacy issues, both as a parent and privacy pro. Her passion for the issue led her to start a YouTube channel to help educate parents and kids about privacy and safety issues and to shepherd a new book called “Children’s Privacy and Safety,” published by the IAPP. The Privacy Advisor Podcast host Jedidiah Bracy recently caught up with Kalinda to discuss children’s privacy, her work, and the new book.

Children's privacy and safety: A conversation with Kalinda Raina

The concept of privacy and data protection by design is not new in the privacy world. We know that privacy should be integrated in the foundational design of a product or service; that is should be baked in, not bolted on. But what that means in practice is often elusive. In 2018, Enterprivacy Consulting Group founder Jason Cronk wrote the book Strategic Privacy by Design, which was published by the IAPP. In it, Cronk offered insights for building processes, products and services that consider an individual’s privacy interests as a requirement. In the four years since, law and technology have continued to evolve, prompting Jason to write a second edition of the book. The IAPP's Jedidiah Bracy recently caught up with Cronk to discuss his work in designing for privacy and what’s new in his second edition.

Talking Strategic Privacy by Design with Jason Cronk

It’s difficult to remember a time when people didn’t extoll cliches like “privacy is dead” or “data is the new oil.” No doubt, privacy is constantly challenged by ever advancing technology, and data is mined ubiquitously for its value, but privacy is far from dead. Washington University in St. Louis School of Law Prof. Neil Richards agrees, but notes that though privacy is very much alive, it is up for grabs. These are some of the initial thoughts that helped inform his new book, “Why Privacy Matters.” IAPP Editorial Director Jedidiah Bracy recently caught up with Richards to discuss his new book and why there’s plenty of food for thought in there for privacy pros.

A chat with Neil Richards on 'Why Privacy Matters'

Though many privacy pros are still grappling with the EU General Data Protection Regulation, the EU is now busy leading a new generation of data regulations. As part of its Digital Single Market strategy, the EU is looking to not only protect data but also to create frameworks that allow for data flows, while aiming to mitigate hate speech and misinformation. Through an ambitious line of of proposed laws – including the Data Act, Data Governance Act, Digital Markets Act, Digital Services Act and the AI Act – the EU is poised to place a slew of new requirements for companies doing business in the region. Though not all privacy-related, privacy pros should be paying attention to this space. To catch up on this flurry of activity, IAPP Editorial Director recently chatted with journalist Luca Bertuzzi.  

From the AI Act to the DSA: Catching up on the EU's digital agenda

The International Association of Privacy Professionals is the largest and most comprehensive global information privacy community and resource, helping practitioners develop and advance their careers and organizations manage and protect their data. More than just a professional association, the IAPP provides a home for privacy professionals around the world to gather, share experiences and enrich their knowledge. Founded in 2000, the IAPP is a not-for-profit association with more than 70,000 members in 100 countries. The IAPP helps define, support and improve the privacy profession through networking, education and certification. This podcast features IAPP Editorial Director Jedidiah Bracy, who interviews privacy pros and thought leaders from around the world about technology, law, policy and the privacy profession.

hubhopper

The Privacy Advisor Podcast

hubhopper