40:27

SUMMARY KEYWORDS

data, companies, location, privacy, people, opt, folks, brokers, collecting, colby, information, obtain, laws, employers, phone, privacy laws, track, state, number, consent

SPEAKERS

Debbie Reynolds, Colby Scullion

Debbie Reynolds  00:00

Personal views and opinions expressed by our podcast guests are their own and are not legal advice or official statements by their organizations. Hello, my name is Debbie Reynolds; they call me "The Data Diva". This is "The Data Diva" Talks Privacy podcast, where we discuss Data Privacy issues with industry leaders around the world with information that businesses need to know now. I have a special guest on the show. Colby Scullion. He is the CEO and founder of Avantis Privacy. Welcome.

Colby Scullion  00:38

Hey, Debbie. Great to be here. Thank you.

Debbie Reynolds  00:40

Yeah, we have a funny story. So I was in a coffee shop in Washington, DC, and just minding my business, and you came over like, hey, "The Data Diva". Nice to meet you. And we started chatting, and then you collaborated with a dear friend of mine, who's also been on the podcast, Jeff Jokisch. And we were supposed to have coffee, then all of us started chatting, and it was so much fun. You know, Jeff is one of my favorite people; I call him the data wizard. That's my nickname for him. I'm going to try and get him to embrace for many years. But I chatted with both of you all, and I was really excited about the work that you're doing with Avantis. And it's so different and unique. I want you to tell your backstory a bit around your trajectory and why you got interested in privacy.

Colby Scullion  01:36

Yeah, yeah. So, first of all, I love that story. I was looking forward to it; I was going to tag along with Jeff in that meeting. And he was a little bit late. And I was like, that's Debbie, I gotta talk. I was so glad we had a chance to talk. It was it was wonderful to meet in person. Yeah, kind of how I had really gotten started into privacy. What had gotten me interested in it was I originally started this company; we wanted to create, myself and an old business partner, to create a tool that would be helpful for local campaigns, ones that are like a local judge running for like, a supervisor of a particular township or a city, and just provides a tool that would provide some data solutions to them that isn't really all that readily available for folks that are running and just some smaller races is something that was affordable, and whatnot. So we started to build out the tool. And we had primarily just used in my State, I live in Pennsylvania, there's a voter registration file that we had utilized to really just kind of plot what elections that folks it voted in previously. And we kind of had an algorithm, or utilizing a number of things to do just to do a prediction of who would likely vote in the next election; I had then gotten introduced to some data brokers for that company I was looking to, for a candidate ad, augment my data set with some phone numbers. So I contacted a data broker and I was presented with a vast amount of data that I could purchase, theoretically. And I was shocked by the amount of information that was out there on somebody. So I looked into really how this was legal. So much of this information. Needless to say, I ended up opting myself out of these tools. And I was like, maybe I'm not in the right business. And we pivoted from there.

Debbie Reynolds  03:56

Oh, wow. That's an interesting story. I think maybe part of it, maybe two parts of it, of this issue, are that one, maybe we assume that these things aren't happening, right? You're assuming that if you didn't give someone your phone number, they wouldn't have it? Or they definitely wouldn't sell it; you probably assume that. And then the second thing is you probably assume that it's easy to opt out of these things. Neither of those things are true. So tell me your thoughts on it.

Colby Scullion  04:31

Yeah, it's really unfortunate. Yeah. So I often when I talk about this to folks who really aren't, you know, aren't really too much into the privacy space. I kind of explained to them whenever you say download an app on your phone and you're looking to just play a game, you want to play Angry Birds or something like that, that information with that game, while it can be free to you, your data. A lot of it is being sold to data brokers, unfortunately. And they do everything that they possibly can to hold on to that. There are a lot of them who try to avoid deceptive techniques to make it incredibly difficult to opt yourself out of by making their privacy policies difficult to find on the page, their opt-out links difficult to find, requiring emails that sometimes they'll come unanswered. And many of the other techniques that they employ make it difficult to remove information. And it's something that over the last so many months, I've done a significant amount of studying and research on, and that's why with Avantis, I feel like we have a kind of a unique perspective on things and a unique understanding because of some of the significant amount of research that has gone into actually figuring out how to opt out of just this vast swath of brokers.

Debbie Reynolds  06:00

One thing that you guys do, and Avantis is very unique. And I would love your thoughts on this to be able to explain it. And that's part of your focus on location data. So the reason why location data is important is because, as we see, these regulations try to give people more control or try to force companies either to be more transparent or to minimize the personally identifiable information that they're collecting. Some of these laws aren't considering location data necessarily as personally identifiable information, even though without someone's name or any other information, if you have their location data, it will be pretty easy to figure out who that person is, right, to re-identify them. So tell me about that problem.

Colby Scullion  06:51

Yeah, so we decided that looking into location data removal would be a pretty good idea. So over the last few years, the problem of location data brokers has been written about periodically from a number of different outlets. One of the more famous articles that was written about them was kind of a sting in the sense that Vice had done whenever they had purchased, like, $160 data on people going to medical health clinics. And there are numerous stories that are very similar to this. And so it's like how do these brokers get this data, like I had said earlier, about the example for, say, Angry Birds, where you have folks who just want to download a game, and in return, they end up working out their location coordinates, and a number of different other pieces of identifiable information. And if the information is sent out, and it's not identifiable at the time, it's incredibly easy to re-identify somebody; we had determined that this is really a massive problem. And for a fair amount of time, and then a lot of research and finding out how these companies work, understanding their data flows, and understanding how we can work to help our customers get their data wiped out from these companies because what they're doing is, it sincerely needs to be regulated.

Debbie Reynolds  08:34

You know, there was a story that I saw. And I want to say this app, I think the name was Life 360, something like that. It's sort of a family app where a person is supposed to check in with a family or help parents track kids and stuff like that. And there was a report that within 30 minutes of someone checking into an app, that data is sold to a data broker. So I don't think people know that, and I don't think people understand that. But then also, I'd love your thoughts, expound upon this location data thing, because I think people assume, let's say, okay, so let's check my location data. So all I have to do is turn location services off of my phone. And that's it. There are just so many devices, and there are so many ways that location data gets collected. Can you talk a little bit about those other ways?

Colby Scullion  09:29

Yeah, yeah. So some of the ways that location data gets collected is from your phone. Some apps, like I said, have built-in software development kits that actually take that data from the app, it collects on you, and send it directly to a data broker. Additionally, there's also other ways to do this. You can also get put into the admin streams. And this information can be picked up from companies at Adtech companies and data brokers as well; there's a number of different ways. When it comes down to tracking, there's a plethora of ways that these companies really try to track folks, anywhere from browser fingerprinting to IP tracking, just any way that they can possibly find, to track you to build as big of a profile as they possibly can, the larger profile that they can build on you, the more that they can monetize. And it's a particularly scary thing to think about because, just me personally, I don't want people I don't know seeing where I go all the time. It's not like I have, it's not that I have anything in particular to hide, but it's just like, just it's a complete violation of privacy. And it's just unfortunate that it's so readily available. And just the amount of data out there is mind-boggling. And one thing that I found interesting was it's not hard to purchase this data. This data can be purchased from a data marketplace, such as Oracle or Narrative, or something like that. And a lot of times don't require you to really prove much about yourself at all; you don't have to prove that you work for a particular company, they don't look into who you are, or anything like that. If they do, it's fairly minimal; I had to go through next, and no checks or anything like that; I just submitted a couple of basic details about myself that I could have completely made up. And I was able to purchase mobile location data. That's an incredibly scary thing whenever you think about how easy it is to re-identify.

Debbie Reynolds  11:45

And there was a case that had come up. It was on the East Coast, I'm not sure. But the case was about sort of issue was about law enforcement, not going through the proper channels, like getting search warrants for stuff. And instead of doing that, they just went and bought, I think, this example, they spent like $160 and got this location data report. And it's sort of like an unreasonable search and seizure issue at that point. But I think what's happening is that companies that play in this space, they're taking advantage of the fact that there really aren't any laws that talk about exactly what they're doing. And especially, and I want your thoughts, very frustrating to me, is that a lot of the laws around privacy, they're interpreted as if the person that you gave the data to and you're holding them accountable, where you may not know who has your data, who is collecting it, you certainly don't know who is being sold to. So it's kind of an underground marketplace.

Colby Scullion  12:54

It is. A lot of these companies boast that they have massive profiles on people in 5, 6, 7, 8000 data points on people. And these are data points that your family members might not even know about you. Your point about law enforcement utilizing this is true. There's actually a few location brokers out there that specialize in this type of thing, where instead of, like you said, instead of obtaining a warrant and go through the proper legal channels to find a person, a suspect, they instead say, okay, well, we'll just go to a location data broker, they'll likely have a lot of this information on the target particular target that we have. And we'll be able to potentially find this person that way. And there's a whole system set up to do this. So yeah, I'm not a lawyer, but apparently, it's kind of a legal gray area. But it really shouldn't be. I mean, there really needs to be action taken on companies like this for people to forgo their constitutional rights just because the government wants an easy way out to obtaining data on you. It's disgusting.

Debbie Reynolds  14:18

Yeah, I agree with that. You know, an example I like to give a lot of people play in a space, they talk a lot about advertising and marketing, right? Where they say, hey, we just want to sell this person a product. But the flip side of that, or the underbelly of that, is that the State may use it for more harmful purposes and maybe something that you couldn't even get out of or answer for. So, for example, let's say let's say a company says hey, Colby walked down to the corner store, and he got a coffee or something? So because he did that, we know we want to sell him X type of coffee or we want to advertise something But what if someone says, hey, this robbery happened on the street, Colby walked down there? So now he's like a suspect. So what would you do then?

Colby Scullion  15:09

Yeah, yeah, exactly. There's so many different ways that you could be tracked. And then, like I said, location brokers seem to have found just about every way to do it. And going into your point about ad tech, well, we know ad tech is extremely invasive. And we know that they employ methods that really should not be allowed. And I think, fortunately, some of the, you know, Apple and Google, Google, following Apple typically are cracking down to a degree on some elements of ad tech. But it's a particularly dangerous thing when somebody can be tracked to the extent that they are. I can't help but think about folks who were in the military and who might be overseas; they have their own personal devices. And it wouldn't not difficult at all for somebody who wants to obtain data on our soldiers, or physicians obtain information about who they are, and their profiles are already massive because these brokers have so much data on each and every one of us that it doesn't take a lot to get a massive amount of data on people and even the real time location, which is incredibly scary.

Debbie Reynolds  16:34

One area of concern, and this is something you guys are going to do for me. But I invited you to come speak in front of the Internet of Things advisory board for the Department of Commerce and this around location tracking. So I'm very concerned about this issue, especially as it relates to IoT. I tell people IoT devices are like a computer without a screen. And a lot of people don't understand that a lot of these devices may be collecting data, in concert with other devices with these devices will at some point, talk to each other. And they'll be talking about you like, this is what Colby is up to today, he walked to the refrigerator, he listened to this music, he did that. So it's concerning, around that data collection, who's collecting it, why they're collecting it, and then also, you know, what type of inferences will be made as a result of that, which may be right or wrong?

Colby Scullion  17:32

Yeah, it's like, it's interesting because whenever you look at how location is determined on a phone, right, if you rely just on the GPS in your phone, it doesn't pinpoint you down to the exact spot that you are right there's kind of a little if you look at yourself on a map, whenever you are utilizing GPS, there's a circle around you, right, and then that you could kind of be anywhere in that circle, maybe even a little bit outside of it. A lot of ways that you can be more precisely tracked is location from GPS in conjunction with, say, your connection or proximity to, say, a particular Wi-Fi network; that is one way that folks are able to increase the accuracy of your location. Additionally, your phone is always constantly scanning if you have Bluetooth on for a free Bluetooth connection that it can connect to. And that can also help understand exactly where you are. The technology to do this is very, very cheap. And IoT devices are generally speaking very cheap. So having all of these things in conjunction with the main location source, which would be your GPS, can really help give you a pretty high amount of accuracy and to understand where exactly a person is. So it's not just your GPS,

Debbie Reynolds  19:06

Right, in general, is basically in there to Internet-connected devices or something either connected or can be wrapped by a device that are close to each other. They can up the accuracy very well, like you say, like air tag, right?

Colby Scullion  19:24

Yeah, yeah.

Debbie Reynolds  19:25

There's been a controversy about that in the news, and rightfully so. Yeah. So when you think about, like businesses, What risks do location data polls for businesses that are collecting this data?

Colby Scullion  19:42

I think it could really open them up to potential fines and lawsuits and perhaps even lawsuits from individuals. I can't help but imagine that there is probably a significant amount of data, location data from children, and folks who are under 18, that have cell phones. Most kids, you know, after the age of, I don't know, maybe, say 10, 11, 12, right, have a cell phone; it would be mind-boggling to me to assume that these location brokers do not have data on our children. And I think if I'm a location broker, I think I'm very scared for anything like that to ever come out. Because with their methods of collection, the apps that they pull from kids like games, a lot of these games, of course, are free, get parents don't want to pay for them; they're paying for it with their information. I can't help but think that there's probably a door that's wide open there for some sort of fine or suit that would be put against some of these location broker companies.

Debbie Reynolds  20:55

I heard of the case a couple of years ago. And this should be very concerning to employers now, especially because there are States like California and other States that are coming up that are trying to create more transparency within the employer-employee relationship. So employers in California have to be more transparent about the data that they collect on the individual, their employees, and cell phones, and what they were doing is that they were tracking people's location and what they were doing when they aren't at work. So a company using that data, whatever it is, against someone, or whatever, could be a huge problem because they're over-collecting data; there really is no true purpose there, especially in this case, they weren't able to articulate why they were collecting data, I think it was just sort of an automatic thing. They just made, whoever set up set it up that way, but then they sort of misused that data for other purposes that were outside of the employment context. What are your thoughts?

Colby Scullion  22:07

Yeah, I think that this is a massive problem. Yeah, a lot of folks have company phones. And if they don't have a company phone, they have their own phone that their company will effectively manage their settings for them. The company can basically pull a set amount of data, and the employee has next to no say as to what data they can pull from their own personal phone; most of the time, I don't believe that they collect, say, the contents of your text messages, although they perhaps could. Yeah, I think it's a massive problem. And I also think it's a massive problem whenever it comes to technology that is tracking, say, folks who might be working remotely; plenty of technologies out there that are readily available, and tons of companies are using them to track individuals, the number of clicks that somebody does, the number of keystrokes that you have, the pages that you go into, and really just basically, mining every bit of your daily work. Employers should be more results-oriented. Is the employee getting done what they have to do if they're working remotely? And if not, then you can start to take action. But if they're meeting their deliverables, it's ridiculous that in almost any circumstance, an employer would track somebody to such a degree as to how many clicks they're taking each day.

Debbie Reynolds  23:40

Yeah, I think at the employers who do this ultra surveillance, well, first of all, I always say if you don't know how to manage people, you think those statistics make a difference, right? How many clicks someone does or something, but employees are very industrious. So they could be meeting all the marks but not actually doing their job. So if you make doing clicks their KPI, they can do that. That doesn't mean the projects are going to be good, or they're going to be on time, or anything like that. So yeah, go for it.

Colby Scullion  24:24

Yeah, exactly. I remember the first job I had out of college, and one of the best pieces of advice I had gotten from somebody who was kind of my mentor was, listen, you're not going to be busy every day. But you really need to make sure that you look busy, and I always found that to be kind of funny.

Debbie Reynolds  24:49

So what's happening in the world right now that's concerning you, something that you see, you're like, oh my goodness, I don't like the way this is going?

Colby Scullion  25:02

How much time do we have here, Debbie? Oh, wow. That's a lot. I'll actually I'll talk about this. So I'll keep it privacy-related here, right? One thing that I'm concerned about is I'm a very big advocate for regulating privacy in this country, right? And it's really, really unfortunate that most of the country lives in a State that does not have a privacy law. And you start having this patchwork of privacy laws throughout the country, and one for companies, it creates a massive problem in terms of compliance, like that is a huge undertaking to comply with each state's individual Data Privacy requirements. But one thing that I am terribly concerned about when it comes to regulations, I really genuinely feel like our country's politicians are not particularly interested in actually passing it. For instance, post American Data Privacy and Protection Act, right. It was sponsored by four folks in the House of Representatives, each one of them uses or has used in the past a data broker to contact constituents to do analysis on different parts of their geography that they cover. And that's particularly concerning, and these are just the folks that had sponsored this bill. Now, folks, the problem is, I would be shocked to find if there was any United States politician, on the national level, who's not utilizing to some degree data from data brokers who just consistently violate our privacy rights. And, you know, one thing that my company does is we're looking to continue to expand the amount of political data brokers that we remove you from. And they are one of the most difficult to remove you to remove your data from. But I guess that's why I see a lot of folks on LinkedIn who are somewhat hopeful for a national privacy legislation to pass. But I don't want to be a pessimist or anything like that. But it's there is a heavy reliance on these types of platforms. And the amount of data and services, and features that these data brokers give politicians is really, it's ridiculous. And it's getting cheaper and cheaper for them to obtain it, actually. So, if I were to say, what really concerns me about the world, I would say that would certainly be one of them.

Debbie Reynolds  26:44

I agree with that. We had an election recently in Chicago, and I started getting these text messages on my phone. I was like, I don't agree to this, you know, and a lot of it, well, you know, they say, oh, they'll send it, and then I'll say, oh, you press stop or something like that. And to me, that's one of the biggest problems that we have in the US. So that is, a lot of these advertisements or contacts are not opt in; it's opt-out. So it's like you can get a billion messages, but it is your responsibility to fight all these different people at home; stop sending me this, texting me this. So in a way, I wish that the onus is not put on a consumer from a marketing perspective, I literally saw, and I'm sure a lot of companies do this, where they'll say, okay, we'll put a button on our website. And so you can opt out of data sharing. And then they list like 200 places that they share your data, you have to go into each button to try each one you have to like click no, no, no, no, no, no, it was like that should not be that consumers not have to do that. And so they do it because they know that people are going to get tired like, oh, it's not worth it. But it shouldn't be so hard. And we're seeing legislation in Europe, where they're saying opting out to be as easy as opting in. Right, but we don't even have opt in and we just have a firehose of data, and we have to try to fight everything. But what are your thoughts?

Colby Scullion  29:35

Yeah, it's really troubling, and you're right. Like, they completely rely on people who don't have the time, which none of us do have the time to go through and opt out of as many solutions as they are, I'm sorry, opt out of as many sites and companies as they possibly can. It's just not feasible for folks. And you know, whenever we were kind of coming up with the idea of Avantis and where we were looking to, how we were looking to position ourselves. I think one of the most critical things is, that we understand that privacy is difficult; privacy is confusing, especially in the United States. And the way we want to portray ourselves and communicate to our customers is really just in some plain text language that we can. Unlike some of these privacy policies, that if you want to read through, you need a legal degree, we want to communicate with folks just using regular terms. And I think that being that these companies make the datasphere so difficult to comprehend for somebody who might not be really all that knowledgeable of it. And that's kind of where we're hoping to bridge that gap.

Debbie Reynolds  30:57

I heard someone use a term. And I want your thoughts about this because I think this is the way that we're going. Someone said that we're moving into a trust economy, where people will give their data to people they trust, or they'll at least have more of a trust lens in which they want to evaluate companies. So, in my view, I think that's an opportunity for companies where they want to create the right transparency and stuff like that. And they want data from people; if they do it in a trustworthy way, they'll probably get better data and more data, right? Especially if they are doing something that benefits the individual. So a lot of this data sharing and data brokering that we're talking about doesn't really benefit the person. What are your thoughts?

Colby Scullion  31:46

You're 100% right. Like when it comes to, I look at the emails, for instance, that I get. And most of the companies that I just don't, I'm not even remotely interested in. Sometimes I have no idea how they even have my email. So yeah, I think that creating some sort of system network, whatever you might call it, that would be able to one, confirm the identity of the person, hopefully owns their data in this system, right? And then I think, having a way that they can consent, to share their information with brands, and consent to having advertisements sent to them, I'm out there, there's a number of companies where I'm very happy to obtain their, to get their advertising, for instance, there's a market down the street from me, that sends out like their weekly sales, that I look forward to getting it every week. So I know if I'm gonna go down or not to purchase something. And then for every one of those, there's 10, 20 other emails that I received that I just don't want, and I have to unsubscribe from. So yeah, I think that having something like that would really be an infrastructure set up that way would be fantastic. Fantastic for consumers. And for companies. If you're from a company perspective, if you know that I'm interested in your particular product, and you know that I'm actually identified and verified, that's perfect to send me highly tailored advertising that I consent to and I'm happy to receive.

Debbie Reynolds  33:29

I think a lot of my friends in Europe are a bit shocked because they have to consent, right, to advertising. So opt-in where ours is, you know, they just spray us with all types of stuff, we have to find our way out. So it's definitely a different paradigm. But I think I'm hoping to tie this changing a bit where maybe it's not worth it, you know, to companies do this whole spray and pray thing where they're using technology, try to hit as many people as possible, and maybe very few of those people are really their target audience. So if it were the world, according to you, Colby, and we did everything that you said, what would be your wish for privacy anywhere in the world, whether that be technology, legal stuff, or human behavior? What are your thoughts?

Colby Scullion  34:22

Yeah, I think I'm gonna refer to what we just talked about; I think that having some sort of infrastructure built to where I'm able to first of all control the amount of data that I have on myself that is disseminated to other, to brands, and that I can revoke access at any point, or I can reduce the amount of information they can obtain from me, for instance. I think having an infrastructure setup like that would be, is really, really critical in terms of just individual Data Privacy. And again, like I said, I think there's a great case to be made for brands adopting this as well. I mean, buying a mass marketing list and just sending out blanket emails and hoping somebody will purchase is probably not it's not the way of the future. And it's potentially more expensive than some other methods of doing that, like the trust method that we had talked about. Additionally, I also hope to see some national privacy laws that are strong, that put people's personal data back into their hands where they can give consent to companies before they decide to take it and do God knows what with it. Like I said, I am somewhat skeptical that that'll happen anytime soon, just because of the reasons I mentioned a little bit earlier. But I sincerely hope that that be passed.

Debbie Reynolds  36:10

Yeah, I hope so too. California was the first State to pass a data breach notification law. By 2019, all 50 states had data breach notification laws, but they're different in every State. And I was like, you all need to pass something like now, or we're going to have the same thing play out. And that's exactly what's happening. So, of course, California is in front, and other States are following and so crazy as data breach notification is, which is totally bananas. Like, it'd be totally ridiculous and outrageous. And we have ended up with 50 different State privacy laws.

Colby Scullion  36:50

It's mind-boggling. I cannot see why the folks in Washington cannot get things together and just get some of these basic things. And this is should all be bipartisan; I don't care what side of the aisle you're on. They're just basic, basic things that need to be passed, but I we'll see.

Debbie Reynolds  37:10

Yeah, I hope so. I don't know. In some ways, it seems like what has moved Congress a lot has been some things that impact them directly. So like, for example, in 1988, when Robert Bork was a nominee for the Supreme Court, people saw a reporter had gone to a Blockbuster video store and got his rental history. And as a result of that, they passed the law against that. And it came out like this, like, yes, I think it a couple of months, I think it came out. So, unfortunately, I would hate to have something happen like that. They will force people to move, but that seems to definitely get things moving.

Colby Scullion  38:01

Yeah, it's like the citizens can suffer for however long, but it's like once something happens to somebody in power, unfortunately, that's when it seems that change starts to happen a little bit more quickly. Absolutely. Hopefully, that won't be the case going forward.

Debbie Reynolds  38:16

Absolutely. Absolutely. Well, thank you so much for being on the show. This is great. I love what you and Jeff are doing with your company. And location data is like the Holy Grail at this point. Because that, you know, even though the laws right now they're forming, they're trying to wrangle the data issue, but location data to me, it should be its own special category.

Colby Scullion  38:45

Yeah, yeah, you know, if you don't have location privacy, you don't have privacy. At Avantis Privacy, we combine the location privacy aspect of things with the more traditional opt-out sort of company that, of course, we remove you from people search sites, large data brokers, and everything like that. But we also pair that with location removal. We also are going to be first in the market for another product, which is privacy counseling, which we're incredibly excited about because I think most folks, like I said earlier, are very unaware of some of the things that they can do to protect their Data Privacy. And it's confusing for most of this country. And I think that we'll be here to really help walk some of our clients through some of the best practices and ways to protect their data and do it and then in a fairly easy, simple way.

Debbie Reynolds  39:47

It's hard work. It's probably some of the most difficult work in privacy, in my opinion. So you guys are right on the cutting edge of that, and I'm really proud of what you all are doing. So keep up the good work, and well, I'll be following up with you guys on what you're doing, and I just really love it. So thank you so much.

Colby Scullion  40:06

Thanks so much, Debbie. I really appreciate it.

Debbie Reynolds  40:09

All right, we'll talk soon. Okay, bye-bye.