A Solo Cup of Privacy

Welcome to the Serious Privacy podcast, where Dr. K Royal was unepectedly solo (Paul Breitbarth, Ralph O'Brien, were both traveling). So she provides a completely unscripted episode covering changes she has seen in the past 2 decades aloing with some news highlights. She promised not to sing too much. @trustarc 

If you have comments or questions, find us on LinkedIn and Instagram @seriousprivacy, and on BlueSky under @seriousprivacy.eu, @europaulb.seriousprivacy.eu, @heartofprivacy.bsky.app and @igrobrien.seriousprivacy.eu, and email podcast@seriousprivacy.eu. Rate and Review us!

Subscribe today HERE

Back the Board Game! 
https://www.kickstarter.com/projects/seriousprivacy/serious-privacy-the-data-game

Powered by TrustArc

From Season 6, our episodes are edited by Fey O'Brien. Our intro and exit music is Channel Intro 24 by Sascha Ende, licensed under CC BY 4.0. with the voiceover by Tim Foley.

Transcript

Copy Transcript Copied

Tim 0:53

You're listening to the award-winning Serious Privacy Podcast sponsored by Trust Arc. Please welcome your hosts, Paul Breitbart, Ralph O'Brien, and Dr. Kay Royal.

SPEAKER_00 1:06

Hello and welcome to Serious Privacy. Bit of an unusual episode this week. Paul and myself was out this week, both working in our various endeavors. And we were due to have a guest on. But due to a technical and scheduling conflict, the guest wasn't able to arrive. And therefore, we have a unparalleled delight and an unparalleled treat for you this week. And that Kay Royal is doing an episode herself. And without further ado, you have to experience the wonders of K Royal asking herself an unexpected question. Her name is Kay Royal. And welcome to Serious Privacy.

K 1:51

Hey everybody. I don't know if I'm gonna have a guest today or not. No idea if I'm going to include this episode in our recordings. I guess if you're listening to this, we decided to do so. So if I'm Oh see. And I know y'all like Kay not seeing. I get that. Okay. Let's talk a little bit about, I guess I need to do an introduction. Today is going to be a solo episode. And I guess basically it's going to be a week in privacy, but maybe a history of what I've seen over privacy since I've been in it for over two decades. Let's just stay with the over two decades, all those three decades. God help me. Unexpected question. What's the only state in the United States that I've ever dreamed of living? And bonus points if you get to the specific area that I wanted to live. I guess I'm trying to do Jeopardy thing, but it ain't working, is it? It's Research Triangle Point, North Carolina. So Raleigh, Durham, that area, North Carolina, and I know it's in the South, and I say I've never wanted to live in the South. But when I was a cancer research nurse, that was the area where a lot of the research brands were originating out of and people that I worked with. And I just fell in love with the area. Don't know that I ever really visited it specifically to visit, but loved it. So, okay, let's move on to a little bit of privacy history. Not that this is Kay's bio show, but what the heck? Let's call it the K Bio show in a week in privacy. So I unofficially started in privacy in my early twenties. I was working at an inpatient psychiatric hospital and had noticed that when people would call the front desk and ask for a patient, they would be, if that patient was there, they would be told, we're sorry, we can't give out that information. Now, this was in the early 1990s, mid-1990s. I don't know that HIPAA was even passed at this point. And this was even further a psychiatric hospital. And there were only three inpatient psychiatric hospitals in Mississippi. But I noticed that they called the front desk and said, Can you connect me to K Royal? Or is K Royal a patient there? The front desk would say, I'm sorry, we can't give out that information. However, if they called and said, Please connect me to Cave Royal on the alcoholic ward, they would say, Please hold. That in itself was giving an answer, right? Because if you knew that your ex was on an alcoholic board somewhere or you had your suspicions, all you had to do was call the three hospitals and ask, can I speak to cave oil on the alcoholic board? Put and hold, and that would be your confirmation, right? So I created an entire system of when the person went through intake, of getting a code and being able to establish a password, writing those policies for the business office, the admissions, the clinical staff, the front desk, the administration, the medical records, writing all the policies and how we track that. And it actually became a best practice among psychiatric hospitals in the United States. And like I said, I believe before HIPAA, because I was working there. My daughter was born in 1993. So this would have been around 94, 95, right? So before HIPAA came along. And then as a registered nurse, I was a registered nurse when HIPAA came along. And so I was the one that was reading the laws back before there was internet, back before there was Google, and explaining that to the hospital administrators, the doctors, the nursing staff, things like that. So you would have thought that I knew a long time ago I was going into privacy. But there we go. It took until I became an attorney and then moved to Texas and got a job in regulatory affairs with Concentra. So that was my first official privacy type was at Concentra Urgent Care, National Urgent Care Center. And privacy has always been under-resourced. Let's just be frank, everywhere. For some reason, they think that we can expand our brain and do a lot more of the privacy governance activities without having more hands on board, right? And that's simply not true. No, I don't know. The rest of y'all show of hands, raise your hand out there if you've been sufficiently resourced pretty much across the board. I'm not seeing any hands, right? I'm not seeing any hands. Although I do know that there are teams that are sufficiently resourced. Align technology, who I was their first privacy person, was a privacy counsel, I believe is up to 30 or 50 people in their privacy department now. So go figure. Some teams do get appropriate resources once the need is recognized. And other, they just think we can clone ourselves fully grown and be able to approach the work. Again, I feel like I need to give a disclaimer, not necessarily talking about my current employer. I try to leave out all topics that would touch on my current employer and do on the record. I have a fabulous team at Crawford. I love the people I work with. They're absolutely phenomenal. And I love the other professionals that I work with as well, in compliance, in security, in information technology. I just think it's a really good company to work for, no doubts whatsoever. So let's talk a little bit about the changes that I've seen in privacy. I know one of y'all were going to ask that. What have I seen since I've gotten into it? I've seen privacy become a whole lot more bigger of a topic, right? But we're rarely a topic in and of ourselves. GDPR made us pay attention to it, but it's a data protection, not strictly a privacy, right? And then CCPA made people in the United States start paying a lot more attention to it. And people think privacy is the same thing as data protection, not necessarily. And you have to understand that outside the United States, the laws deal more with human rights and dignity. In the United States, it seems to deal more with control over your data specifically. And I don't know if that's because of the big tech world that we live in here. Well, it's beyond and most of the big tech companies around the world come out of the United States, and there's a reason for that, right? But data is gold. And so a lot of companies have this attitude that if they collect the data, it's their data. Now, a few years ago, we had the term zero party data come up. Not a thing, right? Zero party data is not a thing. The data belongs to the person that the data is about. That person through their activities online may create data with a third party through their activities. So if they engage with the website, they may be creating data through the cookies. Now, is that data theirs? There's a big argument on that, right? Because you are tracking a person, you are creating a profile for a person, and that profile should be protected, and the person should have a right to know if they have a profile and the right to delete that profile if they so choose, unless there's a legitimate reason not to do so. But by engaging with the world, we create data. We may engage with other people, create data that also is that person's, engage with the company. By rights, that data should also belong with the company, things like that. Now, when it comes to a business and their service provider or a controller and their processors, and if y'all have listened to the podcast at any point that have talked about this, y'all know I despise the terminology controller and processor. I do not believe the definition fits the actual business engagement. They define a controller as the entity that ultimately determines what happens with the data. And that's not true. Companies quite often hire vendors and other companies to do things that they don't have the expertise in. And if they don't have the expertise in it, they're not really making a call on what happens with that data, are they? So, European regulators, if you're listening, maybe think about how to define that better because it's very challenging for processors, whether we're the first processor or we're a downstream processor, to write a contract that accommodates all the entities above them. They may be one entity above them if they're the first processor, and for another company, they may be the third processor, and for another company, they may be the 11th processor. You don't know who your clients are and don't control who your clients and the role they play upstream, right? So how do you write a contract that accommodates that your upstream processors or controllers have a right to that contract, other than maybe the negotiated commercial terms, and they have a right to the audit finding. So if you have a stock report or an external audit finding or certification, by right, the clients above us have the right to have that information. That way they know that where they're sharing their data to has controls in place. And that is a very different and difficult context to deal with, right? Is how do you do that? So what have I seen changed? I thought at some point when GDPR was passed that we would start seeing privacy having a seat at the table. I have not seen that materialize. Now, again, share your hands, please, if you have seen that materialize. What I have seen is privacy reporting to the board, but that seems to be hit or miss, right? Typically they're reporting to the governance committee or they're reporting to the audit committee. Those are the two I see mainly that they have. But in other companies I've been with, there are actual committees on data governance, of which privacy needs to be a seat at that committee table because no one governs what happens with personal data more so than privacy. Now they may be equal. Security has to secure the data. AI has to have the ethics with the data. There may be others that also have a role to play, but privacy is just as important in those roles to determine what happens with the data. And people don't like to think of privacy really governing what happens with data, but basically that's what it is when you boil it down to the white. And also when you're looking at AI, the two biggest issues are whether or not personal data is being managed appropriately in your AI efforts and whether or not intellectual property are being managed appropriately. That seems to be more of a Gen AI issue. One of the things that we also deal with is that company wants to control what their vendors do with AI. And that this is a global problem, right? We all know this. This is a global problem. We're all wrestling with this issue. But you have to understand that determining ownership for AI inputs and outputs is a very murky area because the script that you write to generate a response or the request that you make, the AI agent that you build should belong to the company that's creating that, right? And so for a client to say that they own the output. No, maybe there's an argument that you own the output if it's being developed for you, like any other intellectual property, right? But otherwise, that's a very murky area to get into. There's no black lines anywhere. It's all gray, right? It's all 50 million shades of gray out there. I think it's past enough time to where we can call something shades of gray again without getting into some other topics that maybe y'all would find more entertaining on the podcast. Let's just get right past that one. What I've seen develop is more and more regulations, AI regulation, developing more privacy threads to adjacent regulations. So compliance, ethics, government oversight, governance oversight, HR deals, policies, acceptable use, things like that. Other adjacent areas are also becoming more regulated. In my class, I actually have a guy with the FTC in the class and definitely have hit it out with him. Turns out he did know my name. I was like, thank God you don't know my name with the FTC, but you never want the FTC to know your name. Turns out he did know my name because he's been through AIPP conferences and has heard me speak, which I think is fantastic, right? I don't speak with IAPP or develop materials with them the way I used to. They've grown so big. I I was with them, God, I think back when they hit 3,000 people. And now we're way above that. We're way, way above 3,000 people globally. And so I don't do as much with them as they wish. I wish I could get on their board. I have been trying for years to get on their board. So if any of y'all have any pool with the IAPP board, throw my name up there, would you please? Because I would love to be more involved in the governance. I've been on many of their board committees. So the education board, the annual conference board. I've been on the women in privacy board, I've been on the diversity board, I believe. I think I've been all six boards. I would love to be on the actual board. So any of y'all listening out there, we'll just throw that out there. But that's what I've seen. And what's my biggest regrets about privacy is not seeing privacy get that seat at the table. I still feel like in a privacy realm that the privacy councils, the privacy officers, the data protection officers are, and maybe data protection officers don't belong in this conversation because they can't build something that then they have to critique on. But the privacy officers, the privacy councils, I find it challenging that these professionals are don't have the visibility with the executive leadership and with the board. I feel like they're pushed to the side a lot. And I hear this from tons and tons of people, right? This is not just my perspective. I feel like they're pushed to the side a lot in lieu of, oh, cyber is very sexy. AI is very sexy. Ooh, this is very sexy. That's very sexy. Privacy, you're not very sexy at all. I did think about calling our podcast the sexy privacy podcast, and that was turned down. I don't know why. We are sexy, right? We are sexy privacy. I think that's going to be the title of the show, right? The sexy privacy podcast episode. There we go. So let's talk a little bit about the privacy news for the day, what we've got going on. So some of you may have already paid attention to some of the things happening now. So let's see what I have coming in my list. So let's see what we have. I have digital landlords. So attorneys at Ashurst, Perkins, Co. We discussed the regulators tax center for data centers for real estate investment trusts. Okay, that's not privacy news, but there you go. Is cryptocurrency really a privacy topic? Y'all need to let me know. Okay, so China's Huawei forecasts billions of agencies will dominate AI traffic by 2035. That's a pretty good prediction to pay attention to. The U.S. court dismissed 4chan's case against Britain's media regulator, so U.S. Internet Forums 4chan and Kiwi Farms lawsuit against Britain's media regulator Ofcom has been dismissed by a court in D.C. which said it didn't have jurisdiction to rule on the matter. U.S. House uh representative is expected to vote as soon as Wednesday on bipartisan legislation that seeks to rein in electricity bills tied to the expansion of data centers that support artificial intelligence. So given that two of the top three that I talked about has to do with data centers and energy consumption might be something we pay a little bit more attention to. OpenAI's rogue agents probed Hugging Face for weaknesses two months before a major hack. So the agents from OpenAI hijacked Hugging Face user accounts and they probed it May, nearly two months before the July breach. So maybe security needs to pay a lot more attention to these probes that might come in. And I'm not on the security side. I don't know how you pay attention to probes. But there we go. Let's see. EU's Bonder Leon, Leon, back to the AI slowdown to invite Frontier Labs for talks. So the Euro Commission or President Ursulan Van de Leon, her name, Van de Leyen. I'm so sorry if I'm mispronouncing that. On Wednesday back calls by leading U.S. AI labs for a pause in the development of the technology, saying that she will invite the main frontier AI labs to discuss efforts to tackle the risk. Not familiar with the term frontier AI is those that are on the cutting edge, is exactly what it sounds like. Open AI endorsed a series of bipartisan bills before the U.S. Congress that they say will help prevent AI models from accelerating the threat of biological weapons and synthetic viruses. So that's really good, right? We need to ban that. Spanish data watchdog said it's received the first recorded notification of a personal data breach allegedly carried out by AI, a case that suggests autonomous systems are beginning to play a direct role in cyberattack. We've talked about this one frequently, maybe not frequently, but when we talk about AI, we have talked about that there is some autonomous activity starting to happen. And we need to quit poo-pooing that idea. Yeah, that's the term of our poo-pooing. We need to quit poo-pooing that idea and pay a little bit more attention to it. By the way, I know that we do shorts on Instagram. And last week y'all got to see me with my hair not done at all. And I said, I don't give a flying, flying for it. But this background, not my background, right? It's not my color, y'all. Sorry. Is in my wheelhouse? Not really my color. But there we go. Let's see. Attorney General Blanche says the DOJ would probe the AI-related violations. I wouldn't investigate anybody associated with AI if they violated the law. That doesn't seem to be current news, does it? U.S. House Speaker Mike Johnson said that there cannot be a moratorium on AI developed without losing the competitive edge to China, and the AI companies can regulate themselves. Now that's interesting. Let's drop that idea into Copilot, see what Copilot suggests for regulating itself. Actually, I might do that and let y'all know of my findings. The rest of y'all drop it into OpenAI, drop it into Centra, drop it into Clod, whatever. Let's see what AI says about regulating itself, right? The UK, the US, and Netherlands issue an advisory on Iran-Link spyware. It's a joint cybersecurity advisory detailing spyware, they say is being used by Iran to target dissidents, activists, and journalists. The FTC chair is suspicious of calls for AI antitrust exemptions. So they said always should be suspicious about AI companies seeking antitrust exemptions while they also lobbied for new regulations. That sounds like common sense. I like that one. Let's see, limit AI now or humanity will lose its agency, says the Nobel laureate Resta. So artificial intelligence having hijacked humanity's attention through social media and our biology by manipulating our need for intimacy will take away our agency unless we legislate now to limit it. Interesting. That one may decide a moment of thinking. I think she's right. Okay. There is no cryptocurrency bill in process now. The U.S. Senate failed to advance it. The Indian police will question Google over a lack of safeguards after smashing a criminal network that set up and managed more than 500,000 fake Gmail accounts to send hoax bomb threats to government offices. Okay, that needs to be researched. But is that only in India? Why don't you look at that one, right? South Korea is going to develop new security guidelines for autonomous AI agents. You know what? The only ones who are worried about the autonomous AI are the ones doing illegal activities. So if they're already breaking the law, house is going to stop them for breaking the law, unless you can technologically put a governor on AI tech. I don't know how that's going to work, but there you go. Make a good effort. Center Point Energy disclosed a customer data breach in a SEC filing. As y'all know, here in the United States, the U.S. Securities and Exchange Commission requires that breaches be reported within four days of determining that they are material, and they have to do it through an SEC filing. So Center Point Energy filed one two days ago. I'm reporting this on September the 16th, that they had become aware in September of an online post by a third party claiming to have obtained a data set of information on some of its customers. All righty. Texas moved to penalize data centers for water biology. We know that's going to come hand in hand with the AI data use, energy use, right? The EU is also proposing a ban on social media and AI chatbots for under 15. This goes along with what we've talked before about the children. And so the European Union will propose a ban restricting under 15 years from social media, video sharing platforms, AI chatbots, and online games is the most sweeping plan yet to protect children from online dangers. We do know that there are some fallacies in protecting youth from online activities and internet. Don't know how far that's going to go. So let's move over to another resource. That one still had a whole bunch, but let's look at some others. Apple Watch New AI features and normalizing the idea that technology is always listening. We talked about that last week. We knew that. Norway is banning camera-enabled wearable pervert glasses. I like that. Time. Okay, nothing fancy on that website. Let's go to another one. Employers are using your personal data to make you accept lower pay. Surveillance pricing was just the beginning. That ought to be a pretty fascinating story, right? So you don't think your employer is using AI against you, or maybe not all companies are. I'd like to think that not all companies are. I don't know that my company is. Don't be so skeptical, right? Okay, so Boston dumped the flock cameras due to a data hole, but keeps the surveillance cameras. So it says Boston surveillance data was not staying in Boston. German police read signal, telegram, and WhatsApp messages without breaking encryption. They using one simple trick. I should probably deal more into that topic, but maybe not right now. Privacy Coalition is pushing the EU to put an end to cookie banners. Oh, I hate those cookie banners. Don't you hate those cookie banners? And I know people don't want us to just automatically opt people out of tracking cookies, marketing cookies, all these other cookies other than necessary cookies and functionality cookies because that's how they make money. But they're saying that these cookie banners are horrible and nobody likes them and you're not making meaningful choices. Even I get to the point sometimes of I hate to go in and select work cookies to have or not. I love the ones that pop up in their banner, that is accept all cookies, decline all cookies but necessary, and then manage your preferences. And I like the decline all but necessary option. It's very quick, it's easy. I know those that make money from it probably don't like it, but that's the only way cookie banners are going to work. I would like to be able to trust in browser settings. I don't trust in browser settings. I don't trust that all companies are able to appropriately react to browser settings. So there's my take on cookies. There we go. Flop camera logs show police tracking people who just hang around. But they're in public, you're allowed to track them. Sorry, you're in public. But you can't recreate a profile of them, right? That crosses the boundary. But you're allowed to watch what they do because they're in public. Let's see what we have. The shiny hunters claim a Florida DMV breach using Jeffrey Epstein's license as proof. There we go. Grinder was to pay out $35 million in a UK HIV data sharing settlement? Are 200 million LGTBs listening in, even when switched off, apparently? It logs your voice and scans household devices. I think we covered that last week. Why Windows users are being urged to turn off this little-known privacy setting? They can send samples of what you type to Microsoft's given comfortable privacy. You should do that. The flock backlash turns into a statewide fight as Florida pushes cameras off the road, so for quality of life. States with larger black populations tend to have more flock cameras. That's a weird and study, but also a bad finding. Speaks to maybe some underlying societal issues we have, right? Whole bunch of flock. Stories and Amazon Ring is moving to encrypt smart cameras, a whole bunch of cameras. Privacy Group takes aim at a credit agency over hidden shadow database that you cannot ask to see the records. Of course, if we didn't think that was a case, it's a case. Europe is looking at tightening smart glasses rules. We know that. Florida man was charged for vandalizing a fake plot camera that police set as bait and charged them with three felonies. Microsoft secretly stamps images you generate locally on Copilot. There we go. And they can be tracked back to you. So all of these fake pornography that you're creating with someone's face, whether for revenge porn, or your own purposes, especially child, let's not go there. Whole bunch of flop. Here's a TikTok child privacy came with a 400 million price tag. We talked about that. So I guess that takes us enough through a week in privacy just with Kay. And so I will sign off by saying let us know if there's anything you wish us to cover or talk about. And I'm talking for half an hour, right? Y'all take care. Let us know if you have anything. Bye, y'all.

Tim 28:54

Now that was serious privacy. Please subscribe on your favorite podcast app and leave us a review. You can find us on LinkedIn, Instagram, and Blue Sky at Sirius Privacy. Feel free to drop us a question or a comment. We'd love to hear from you.