When Paul's away - A week in Privacy with Ralph and K!

Welcome to the Serious Privacy podcast, where Ralph O'Brien, and Dr. K Royal cover a week in privacy, with a pretty random bag of stuff!  We discuss enforcement actions, AI legislation, jewellery, password advice, special category data and all the latest news and views!

Australian consultation

https://consultations.ag.gov.au/rights-and-protections/privacy-reform/

Carey leming substack

https://insights.priva.cat/

If you have comments or questions, find us on LinkedIn and Instagram @seriousprivacy, and on BlueSky under @seriousprivacy.eu, @europaulb.seriousprivacy.eu, @heartofprivacy.bsky.app and @igrobrien.seriousprivacy.eu, and email podcast@seriousprivacy.eu. Rate and Review us!

Subscribe today HERE

Back the Board Game! 
https://www.kickstarter.com/projects/seriousprivacy/serious-privacy-the-data-game

Powered by TrustArc

From Season 6, our episodes are edited by Fey O'Brien. Our intro and exit music is Channel Intro 24 by Sascha Ende, licensed under CC BY 4.0. with the voiceover by Tim Foley.

Transcript

Copy Transcript Copied

Tim 0:53

You're listening to the award-winning Sirius Privacy Podcast sponsored by Trust Ark. Please welcome your hosts, Paul Breitbart, Ralph O'Brien, and Dr. Kay Royal.

K 1:06

Hello, everyone, and welcome to Sirius Privacy. Now, I have to tell you, hearing my voice first is probably a little bit of surprise to y'all. So Paul is out this week, so Ralph and I decided that I can do the intro, and Ralph will do the unexpected question. So it's going to be completely unexpected. It doesn't even come from my little list of weird questions to ask this season. So what are we going to cover this episode? We're going to cover week in privacy for y'all because there's a lot happening in privacy, although there may be a couple, if I'm looking ahead, that we might dive into a little bit more detail on. So with that, welcome to Serious Privacy.

Ralph 1:45

My name is Ralph O'Brien, and your name is Kay Royal, and welcome to Serious Privacy.

K 1:50

Yes, it is. Did I forget that part? My name is Kay Royal.

Ralph 1:53

You still try to rob me from it.

K 1:56

All right, people, we're gonna get this organized. Paul's probably gonna listen and be like, I cannot leave the kids alone for one week. I cannot live two weeks, three weeks, whatever it is. There is an episode coming up that both Ralph and Paul are going on. I think just one episode, right?

Ralph 2:12

Yes.

K 2:13

I think all the others, it's Paul gone and because he's doing that whole European leaving work for a month kind of thing. Which I'm desperately jealous of. But I'll be by myself. So I am trying to line up a few speakers to join me for that. So we'll see if that works. If not, what do y'all think about a whole K solo episode? Yeah, let me know if that works.

Ralph 2:34

I think we'd be honored. It's time for the unexpected question.

K 2:39

Unexpected. Oh my god, what is it?

Ralph 2:41

I I get to do one. And I thought vlogging hard in the two minutes since you asked me to come up with one. And my unexpected question is gonna be quite meta, not as in the social media platform, as in uh as in meta. So I'm gonna say, what unexpected question has nobody asked us which you wish they had.

K 3:02

Oh, I was about to say I hate you, but that is something that's recorded and shouldn't be. So unexpected question that nobody has asked is Oh good lord, what's your favorite piece of jewelry?

Ralph 3:15

What's your favorite piece? And what is your favorite piece of jewelry, Kay?

K 3:18

Well, I would like to say my wedding band, right?

Ralph 3:21

That makes total piece of sense, yeah.

K 3:23

I should say my wedding band. But favorite piece of jewelry actually is my grandmother's diamond ring. So it's got three diamonds in it from her. And yeah, that's my favorite piece of jewelry. Anytime that I need to have good luck for something I'm going to, I make sure to wear her ring. But I also had this amazing swav Swavrovsky, I can't say the word right, crystal dragonfly that I got on a cruise that apparently my entire family had stopped by the store for days and said, My mom needs to see this, Kay needs to see this. So I walked in and said, I'd like to see the dragonfly. He's like, Let me guess. Your mom, Kay? I'm like, yeah, that's me.

Ralph 4:02

I actually own three wedding wings, all from broken marriages now, so there we go. So I've been married three times. I should add that.

K 4:10

Does that cover the fact that Tim loves wedding bands? So he's got 17 of them? And people are like, but isn't the wedding band you got married with the most important one? No, being on my third marriage, the more important one is having a great spouse.

Ralph 4:25

Yeah, that makes total sense.

K 4:27

So I'd rather him just be married and not wear a wedding band. He can wear 17 wedding bands. I don't care what he wears, but I'd rather have him be a good husband than wear a wedding band that was significant to him because it got put on his wedding day. That is immaterial to me.

Ralph 4:43

I've been trying to think of an answer to my own question, the whole what would you like to ask that you'd never been asked?

K 4:49

A bit deflected, so you can think of one.

Ralph 4:52

We could then use that on a future podcast. How about something like what's a data protection decision you've made in your personal life that you wouldn't do within the organization or something like that? Yeah. What would you do personally that you wouldn't do in as a business? What would you do as a business that you wouldn't do personally? How's that? Where do you draw those red lines ethically? That's a fun one.

K 5:13

I have no idea. Because being in privacy, I probably take the same steps everywhere. But okay, let me say the one thing in my personal life that bugs the daylights out of me that I should be doing. Cloaked or something for your phone because I get three spam calls an hour. And I don't know which service to go with. So if any of y'all are out there and you know what service to go with, holler at me and let me know. But also password keepers. So I have recommended a password keeper for work in conjunction with security and opinions, and we've come out with an opinion on which one work should you. I think it's usually one password. I do not use one personally, and I won't.

Ralph 5:54

No, I've got a big problem having one password to access all of my passwords. I've said this before. I I create sort of my own encryption system where I actually have all my passwords written down, but they're in a code so that only I can decide what they are. So I can look at something and in my head then do that translation.

K 6:12

You know what it is because you have a formula that you use. Pretty much, yeah.

Ralph 6:16

I've got my own Egyptian tape.

K 6:19

Yeah. For a long time my password was based on a chemotherapy drug.

Ralph 6:24

Wow.

K 6:25

Because I was a oncology nurse and a hospice nurse. And so we gave lots of chemotherapy drugs, of course. And most of them are almost impossible to remember or pronounce or spell if you hear it. So it was chemotherapy drugs.

Ralph 6:41

If somebody calls up the IT helpline and says, What's the I've forgotten my password, can you help me? And he says, So yeah, of course they can. And then they say, It's your fault, really, because you make your passwords really complex and hard to remember. He says, What's your current password? He says, It's Chewy, Dewey, Louie, Donald Mickey, Goofy and Minnie. He says, That's a really long part. Why'd you come up with that? He said, We had said it had to be seven characters or more.

K 7:05

The seven characters, you've gotten me with that one before, and I haven't remembered it. But I will say the guy who created the standard for passwords of changing it every 90 days, having a capital and a lowercase and a special character and a number, he came out about seven years ago, five to seven years ago, and apologized to the world. And I know I've shared that on the podcast before, but he apologized because it really does nothing. It doesn't help. It's not the most secure way of doing it. And what he said was the most secure way is the way that you see very sophisticated security teams at very mature and sophisticated companies say, use four random words because there's no logic to four random words. If you use a sentence or the lyric of a song, which we used to recommend to someone, think of your favorite song or your favorite food, and then abbreviate those and put those together and make that your password. And a lot of people do that as well, so they can remember what it is. But this is for random words. Nothing capitalized, nothing lowercase, no numbers, no special characters, just four random words.

Ralph 8:13

There's a geolocation app called walk free words that's really good for finding your location. That could be a pretty good password generator in that case.

K 8:22

Right. So it's crazy. So yeah, just y'all know that your IT companies make or your IT departments making you doing this really isn't the best password thing out there. But on the other hand, can you remember four to five random words that have no meaning to you whatsoever?

Ralph 8:37

And different ones for each account, of course, or website.

K 8:39

And different ones for each account, because if you're using the same password for work that you use for personal, stop that. Because typically your personal controls are not as strong. All apologies to Alex, because his personal words are probably stronger than work. But yeah, don't do that. And don't use the same password for your finance accounts and your credit report accounts that you would for other personal words. So just be smart out there, people. I like the idea of having a formula, although if someone breaks your formula, they might break it. But on the other hand, it's really hard to break a formula, right?

Ralph 9:14

Especially what I've got in my and what is that? I'm gonna tell you on the podcast. I'm not weird.

K 9:21

Have you seen the video where the person does that? They stop people on the street and they ask them their password, and they're like, oh no, I'm not gonna tell you that. It it's my pet's name. Then they get to talking about where do you live and where do you work and what do you do? And do you are you gone all day? Is your pet home alone? What's your pet's name? And they tell them.

Ralph 9:37

Yeah. There's been a lot made online. Uh I've seen this on LinkedIn a lot, a number of sort of AI generates pictures of like kids having their first day at school because everyone's going back to school here, early September. People post their photographs online of the kids' first day at school, and in the background is their house with the house number, and the school the kids go to is on the U.S.

K 9:56

And they're saying what school they go to and what their name is and what grade there is and how old they are and what's their favorite things, which you would be able to entice a child to pay attention to you if you were to mention their favorite things. It's what the hell, people? What are you thinking? You're not thinking. You don't think like us. We're paid to be paranoid.

Ralph 10:17

Well, well done. Ten minutes in, and we haven't covered anything we want to cover. This is what happened when Paul's away.

K 10:21

Well, no, we have covered significant privacy things that people need to know.

Ralph 10:27

This is true. Good security tips.

K 10:30

There we go. Let's talk privacy now. What do you got?

Ralph 10:33

Yeah, we've got a couple of big ones, and I've got a small one here from the UK. Uh one of the bigger ones, I guess, is the follow-up to the settlement. I think we said on the podcast last week when it was breaking news that the settlement largely goes in Meta's favour. And I'd really look at Carrie Lemming's blog Substack. She's done a really good Substack talking about how it's more advantageous to Meta than it is to everyone else. And Paul last week said, but the main concern is why only in America? Why only kids? And why are you going to pay this money over 10, 11 years? So it does seem stack somewhat in Meta's favour. And what's been interesting to me in the fallout over the next week is all of the other countries putting out statements saying, hey, if you're going to do it in America, do it here. What's interesting in the EU, a lot of the things Meta is saying are going to be requirements of the DSA anyway.

K 11:27

Your kids are no less valuable.

Ralph 11:29

Exactly. And the UN have come out this week and said basically that governments need to step up rather than wait for courts and companies to act. And that children should not have to wait for a lawsuit to be safe online. I'm going to say not just children. This focus on children is great, but we should all be safe online in to some respect, as much as we take any risks putting ourselves out there. And you know how I feel about age assurance and verification as well. So I think that's a really interesting sort of message from the UN coming in here about trying to make it more of a sort of a global approach rather than a sort of a local approach. And let's face it, 18 billion is far less than the trillions that were supposed to be on the table if it had gone to court.

K 12:16

Yeah. It's crazy. It's crazy. And I haven't seen what Meta has responded to that. I'm going to admit that I didn't even go look.

Ralph 12:24

They've certainly admitted no wrongdoing as part of the settlement, of course. I think you've got some interesting news though from California, as I understand it.

K 12:33

I do. If y'all missed, I'm just going to say David Strauss, if you're a fan, I'm calling you out here. He posted a wonderful summary about California's legislature, closed its 26th season. And I'll get into a little bit about legislative. You know what? I'll do it now. In the U.S., some of you may not understand why if a bill didn't pass in one year, is it still carried over to the next year? In some states it is, in some states it's not. What you might need to know is that each state can run these differently. So some states have a two-year season. So if a bill doesn't have pass the first season, and these are the minority, these are the fewest, I think. If something doesn't pass the first season, it can roll over to the second season. If it's not passed the second season, it's gone. Other states run, some states, I think maybe even lower than the two-year season. Some states only run a legislative session every other year. Some states run them every year, but one year it's long and goes through August, and the next year may be really short and only be for two months, maybe three months. And so you have a shorter season. And then there are the states that run short sessions and they're considered part-time. And so your elected officials may only have to go for four months or so, and then they're out the rest of the year and they got to go get a paying job. They don't volunteer, but they don't pay them very well either. And then other states run a full year session every year. And so your legislature should be appropriately compensated for that. But it means that's their full-time job. That's what they're doing. So if you ever wonder how the US, why is a bill dead? Why is it not dead? I didn't know they closed the CS session in Mar. There's every state does it a little differently. And if you throw that in your search or your co-pilot or whatever, it'll probably come up with the rules for what each state does. So back to California. Session closed August 31st, which was just this week, and 24 bills now head to the governor to sign. So what do we have? We have a CCPA amendment restricting or selling or sharing sensitive personal information with third parties unless the consumer initiates the transaction. That's a little crazy. Data brokers law or not law, a bill. It shortens a data broker deletion request window from 45 to 30. Children's privacy, the age-appropriate design code, has now been officially appealed and it's being replaced with a harm prevention standard. Chatbots, two of them on there, companion chatbot restrictions, a ban on companion chatbot toys, which we've talked about a little bit, and mandatory independent child safety audits. And another one is obligations on customer service chat box used by large businesses, and they define that as over $500 million. Insurance ones, there's an Insurance Information Privacy Protection Act, what I'll be paying attention to with my job. AI transparency amends the AI Transparency Act, removing the 1 million monthly user threshold from the covered provider and adding in a user right to inspect system provenance data. Employment. Employers can't rely solely on automated decision systems for discipline or termination. Health AI, you have to regulate AI in clinical settings. Thank you. Thank you. I noticed in my own doctor's notes that apparently I consented to using an automated device. Okay. And lightness rights. So this is no doubt for California, the lightness rights. Anything that looks like someone extends the name, image, and lightness protection to AI generated digital replicas. And then you have to disclose when AI or ads use synthetic performers, which the performers are saying that's cutting into our livelihood, especially for commercials and things like that, that they're using synthetic. So the California was pretty good. I think I took basically all the time. We can stop the session now. Not really. But California has been very active. But I will say I looked something up for one of my AI classes. I mean AI ethics and AI innovation and strategy. And one of the discussions, I used the point about I found at the National Conference of State Legislators, so if that's not on your favorites list, it needs to be NCSL. And they disclose that over this legislative season, 49 states proposed 1,465 bills.

Ralph 17:03

That's huge.

K 17:04

For AI, AI only.

Ralph 17:07

Surely this is where we talk about national laws rather than just state laws, right? I know there's 50 states, you've got to divide all those laws by 50, but even listing off the Californian ones, 24 of them there. Yeah. People often wonder why we talk about California a lot on this. It is where some of the large technology companies are based, so it is going to have a huge influence on the rest of the world, right?

K 17:28

And the county of LA is like the ninth largest economy in the world.

Ralph 17:33

Yeah. I think California itself is like the fifth or something, yeah. But it's crazy, really. And I often wonder this is perhaps one of the advantages of coming from Europe, and I say this as the UK that's got a completely separate regime now from the European regime. But just how do you keep up with all of these changes and amendments and advise a business accordingly? It's got to be crazy.

K 17:55

Right. It's absolutely bonkers. And especially if parts of your business are getting advice from their external counsel or outside consulting firms or something, and they're getting advice. And here's an example: the California, the new regulations for the cybersecurity audits, and then the privacy for the automated decision making. Chapter nine is clearly for your security departments as an internal audit. And Chapter 10 is clearly for your privacy department because it's on the use of personal data. We do risk assessments day in and day out. That's our job. What happens if they get advice from a consultant or a law firm or whatever they're using that tells them that the security department has to do chapter 9 and chapter 10 because they don't know enough about the company to ask, do you have an AI department? Maybe we should be talking to them. Do you have a privacy? Maybe we should bring them in. And I've heard from quite a few people, especially the privacy and security. That's why it came to mind for me. And by the way, disclaimer again, things I talk about don't necessarily mean they're with my current employer. I do talk to people and I engage in a lot of conversation. There's been a lot of confusion there. Some of the big four advisory companies, some of the big law companies, some of the smaller law firms are actually giving out this advice without asking questions. Do you have everyone involved in here that you should have in here? Do you have legal because it's a law? Do you have audit because it's an internal audit? Do you have privacy because it's a personal data risk assessment? Do you have security? Maybe it wasn't security talking to people. Maybe it was an HR. Ask the questions. And if your consulting firm is not asking those questions, or your law firm is not asking those questions, you need to inform them.

Ralph 19:44

No, I would totally agree.

K 19:46

Have the right people in the room.

Ralph 19:49

Yeah, no, we've always said a cross-functional team is necessary to manage sort of things. But m my advice has always been to organizations don't create a new meeting. Nobody likes a new meeting. If you can tag it onto the agenda with someone with the right stakeholders there, so much the better.

K 20:05

Absolutely. Absolutely. But there's a lot moving and it's hard for people to stay on top. I have heard a lot of people say they stay on top by listening to us. Thank you for people who do that, but we don't cover everything. So please make sure that you are getting information from your law firms or your consulting firms or something like that as well. But be smart enough to ask the right questions too.

Ralph 20:28

And of course, we should probably shout out to our sponsors who have got the Nimity updates here as well, shouldn't we?

K 20:33

TrustArc, fabulous. That's a really good way to stay on top. Nimity is the best privacy research company in the world. Period, hands down. I can't tell you how happy I was when TrustArc bobbed them. Although I hated just not see any more Terry and Camille. But yeah.

Ralph 20:50

Yeah, I wonder how Terry McQuay's doing. I haven't spoken to him for a long time.

K 20:54

We need to look that up, don't we?

Ralph 20:56

Yeah, we do. So we actually had Carly Kind on a couple of weeks ago, the Australian Federal Commissioner, and there's been some interesting stuff coming out of Australia, and we'll put the link in the show notes as well. But there's a consultation from the Australian government out there at the moment on reforms to their sort of Privacy Act. So this isn't more yet, but I had a sort of a glance through the proposed changes and some interesting stuff in there. There's some clarifications and strengthening of existing obligations, definition of personal data, including inferred data, singling out of individuals, including geolocation and genomic data within special category data, 72-hour data breach reporting.

K 21:45

Which, by the way, typically when there's a 72-hour data breach reporting, or a 24-hour, or whatever hour there is, that runs from the time a company learns of it or should have learned of it. So if your vendor's vendor has something four months ago, you're not going to learn about it until a certain date. And if you have to report it, if your vendor's vendor didn't already report it, or your vendor's vendor, or your vendor didn't report it, maybe you're obligated to report it, but you have that time frame to do it. Whatever time they take does not take away from yours. Now, I don't know if that applies to all laws. I'm going to be honest. I don't look at all laws. But it does pretty consistently. I have not found a law that it does not apply to for privacy, that it doesn't take away from your time. Your time starts clocking from when you found out or should have found.

Ralph 22:38

It looks like the Australian model is moving towards more like a GDPR like model. When I look at the rest of the changes, fair and reasonable handling tests, the word fairness isn't in the Australian privacy principles, more specific consent requirements, making a formal definition of consent, getting rid of implied consent.

K 22:58

I love definitions of consent. I hate having to meet them, but I do like them.

Ralph 23:02

Restrictions on buying and selling information, data destruction and retention principles, a controller processor accountability model, and a lot more around governments and documentation. So data breach, privacy by design, blah, blah, blah. So it looks almost like an upgrade to push it towards more like a GDPR-like model.

K 23:23

Document.

Ralph 23:24

I'm actually doing a webinar with another company on September the 14th looking at documentation. And one of my big things that I've been talking about a lot is documentation, defensive documentation is great.

SPEAKER_02 23:35

Yeah.

Ralph 23:35

Just make sure it does something. Like things like DPAAs, I've often said, just make sure you're actually taking actions after it rather than just a document with it.

K 23:44

Exactly. You're not just writing a document and sticking in a drawer, which was a funny story for U.S. attorney client privilege. Of events that were happening in medical care facilities, and of course they would document, gave the wrong medicines, get the right medicine, or whatever happened, and it's intended for the nurse supervisor, the hospital administrators, and their attorneys. But apparently the document was just being filled out and stuck in a drawer. And the attorney was never seeing it and therefore never had privilege and therefore could not actually advise the company what to do. So make sure you're using it.

Ralph 25:07

I'm always interested in actions that actually protect people. That's what it comes down to rather than documents to defend the legal entity. A little bit of a personal story to do with the podcast. It's really lovely to do this podcast because actually what happens is we get approached by lots of great people and we get lots of pitches for guests and all that kind of good stuff. Sometimes they're a little bit wonky and written by AI, and they obviously haven't listened to the podcast at all. And that's a bit of a you can spobble a aisle off, generally speaking. So if you've got to pitch us a guest, try not to use it being written by AI, please.

K 25:39

And send us an example of their speaking. Yeah, that's really we've had boring guests on before, first season. We will never do that again.

Ralph 25:46

But actually, we were featured on uh sort of a top podcast list this week for million podcasts. So congratulations us and congratulations to the other people on the on the list as well. And why and then because we were featured on this million best podcast list for that we were right there at the top of the GDPR ones, apparently, we got a flurry of these calls. And what was really interesting about it is we also got an Article 14 information notice to tell us that our data had been scraped from the internet under legitimate interests and authentic companies. So I clicked through the links to look at this data broker company who was going to sell our data to all of these different companies for AI training and all of this kind of stuff. So for the first time in a long time, I've actually made a complaint to the regulator this week.

K 26:38

There you go. Kudos to them if they can replicate any little redneck on a privacy pudding.

Ralph 26:44

Yeah, I just think it's interesting that we are now we are our data has been scraped from the internet under legitimate interests. And actually, I would say kudos to the company in terms of actually letting us know under Article 14, you know. Yeah. Wouldn't have known without the Article 14 notice. And kudos for them for actually having an EU and a UK representative. Uh I looked into that as well. But the very fact that they're scraping data under legitimate interest and using it for God knows what, I think I'm gonna I'm gonna have fun with it.

K 27:11

I never thought of that in all of the the recommendations for check to see if your data's been scraped, especially published materials. I never thought about the podcast. I did think about the textbook I wrote. So if you teach a class on privacy and security, I have a privacy and security case law book out there by West Academic, written by Wayne Unger and myself. Yes, it needs to be updated. There we go. Nice little plug. But I looked at that, I looked at the GDPR little guidebook that I wrote, which yes, I need to update that too. I just need to update everything. I never thought about the podcast, but I also never thought about my dissertation.

Ralph 27:45

Oh, yeah, your dissertations online as well.

K 27:47

Dissertations are being stolen wholesale.

Ralph 27:50

Yeah, exactly. Funny enough, I've had it personally with the board game as well, and I'm gonna keep plugging the board game throughout September and October.

K 27:57

Plug away.

Ralph 27:58

I won't apologize for it. Go to the Kickstarter, type in serious privacy, register. I think people are really gonna enjoy it when it launches in October. We appreciate your support. But that's me again, putting the Kickstarter out there. As soon as the Kickstarter page went up, I got a ton of messages saying Oh, I bet. Hey, we'd like to market you. Hey, we'd like to manage your Google ads. Hey, we'd like to pop a metal.

K 28:21

Did you say what kind of product it is? It's a data protection board game.

SPEAKER_02 28:27

Yes, indeed.

K 28:28

Specifically. Oh, as we're giving plugs, I would like to give a plug for the practical AI book by Shoshana Rosenberg. Of course. Oh my gosh. I actually pulled it out for my prayer classes, and I'm pulling it out for these classes. I actually cited her in one of my submitted papers. But absolutely, if you have not checked that book, that is a do not miss. Check that book. It's available on Amazon as well. So check that book. Not only does she really know what she's talking about and got the chops, it's written in a way that practitioners can absorb it and actually use it. It's practical AI governance. She did not pay us to make this plug. I'm just raving about a p that I love.

Ralph 29:11

No, it's put out there by Kogan Page and Shoshana is a friend of the pubs, let's put it that way, and also really noticeable for the work she's doing in Women in AI Governance.

K 29:20

Well, yeah. Co-founded Women in AI Governance with Emerald DeLoe.

Ralph 29:25

Yeah.

K 29:25

Does she still have that last name, Mary?

Ralph 29:27

I know she got married recently, but I don't think she's changed it. Yeah. And it's the work Women in AI Governance do shouldn't be downgraded or underestimating because they're they do some incredible stuff. And it's always amusing when I get messages uh asking me to attend women in AI governance events. But as an ally, I do enjoy going and hearing others' lived experiences. And funnily enough, so I actually put out a post this week on LinkedIn as well about sort of representation and how everybody, when it comes to data, has got different needs. And what you think when you're doing a DPIA or something that you feel is you've understood the risks. You don't have other people's lived experience. You don't understand how it might adversely impact other groups.

K 30:10

And you probably have a different cultural perspective and context to put it in as well. We've had on the podcast Native Americans here in the U.S., and how everybody assumes they have the same perspective and context on privacy. They don't. They really don't. And other cultures don't either. It's like I tell people don't take your whatever country, I'll use the U.S., don't take your U.S. perspective and decide what you know what sensitive data is. I used to track all the definitions of sensitive data, loved it. Dan Solob would hate me because he doesn't think there should be anything labeled as sensitive. He and I have had that conversation. But, and it was published by the IEEE as well, my my research. So my my point there is you don't know what sensitive data in other countries. Some countries have personality as sensitive data. Some countries have unusual addictions. I don't know what's usual, but unusual addictions as sensitive data. Some, the fact that you're adopted is sensitive data. In others, your membership in a professional association is sensitive information. In Europe, your voting, your politics are special categories of data. In the US, you can go down to the local office and buy the list if you're running for office. It's crazy. Don't ever push your own experiences off on others and think you understand what they might have. And it works for person to person too, not just culture to culture.

Ralph 31:33

And also contextually as well. When you've got two bits of data in conjunction, or you're added to a CC on an email list about a certain topic, my email isn't sensitive, but what's in the email or the list that you're on might well be. So yeah, it's either type of data, but the context of see it in.

K 31:52

That's like the grinder breaches that didn't release any sensitive data. People was just names and I think email address maybe. But the fact that they're a member of grinder. Yeah, tells you what potentially makes it sensitive information.

Ralph 32:07

Yeah. I've only got one more little one before we close.

K 32:11

Go for it. Yeah. This has been a wonderful session. I was actually going to add in something else and I forgot what it was. So take it away, Ralph.

Ralph 32:20

This is a penalty. It's a penalty from the ICO close to home here at the UK to a company called Elderly AIDS Limited, E-A-L. £190,000. So small compared to the meta group billions one that we're seeing. But it's these fines have got to be proportionate and dissuasive to the size of the organization and the breach. And this is, again, nuisance calls. Ironically. Ironically, you're going to go like this. They were deliberately targeting elderly people to promote call-blocking devices, claiming they were trying to protect the elderly people from nuisance calls. Oh my God.

K 33:02

You can't make this stuff up, people. You can't make it up. Reality is weird enough.

Ralph 33:08

It's a fine for nuisance calls of people selling devices to protect against nuisance calls.

K 33:14

And on that, we're gonna say goodbye. Until next time, as Paul would say, I would say bye, y'all.

Tim 33:22

Goodbye. Now that was serious privacy. Please subscribe on your favorite podcast app and leave us a review. You can find us on LinkedIn, Instagram, and Blue Sky as serious privacy. Feel free to drop us a question or a comment. We'd love to hear from you.