34:04

SUMMARY KEYWORDS

privacy, data, ai, year, law, technology, california, interesting, necessarily, states, role, talking, thinking, heavily, transparency, happen, lawyer, working, robocop, robot

SPEAKERS

Debbie Reynolds, Walter Robinson

Debbie Reynolds 00:00

Personal views and opinions expressed by our podcast guests are their own and are not legal advice or official statements by their organizations. Hello, my name is Debbie Reynolds; they call me "The Data Diva". This is "The Data Diva" Talks Privacy podcast, where we discuss Data Privacy issues with industry leaders around the world with information that businesses need to know now. I have a special guest on the show. Walter Robinson. He is the Data Privacy Manager at Janney, Montgomery Scott LLC. Welcome.

Walter Robinson 00:40

Thanks for having me.

Debbie Reynolds 00:43

Well, I'm always interested to see people on LinkedIn who are saying really interesting things or are in really great, interesting roles. You've had a long career in legal; you're a lawyer. And I was very interested by your move from compliance into privacy because I see that it's very common now. But I would love for you to be able to tell me about your interest in privacy.

Walter Robinson 01:11

Sure. So I started out as a trial attorney with Allstate Insurance Company a long time ago, over 20 years ago, and I litigated cases. And at some point during my career, I began to be a manager, managed attorneys, paralegals, assistants, and still tried cases. So my experiences heavily tilted towards civil litigation. So I tried motor vehicle cases, premises liability cases, subrogation, and commercial liability. And then, at some point, about a year and a half ago, I had a chance to take a voluntary termination package. So I decided at that time that it was a good time to make a move into something that I'd been interested in for a very long time, namely, technology and innovation. Enough. At the time, there weren't a ton of jobs out there that sort of tied law and technology together; there were some innovation jobs within the insurance industry. And then I started looking around a little bit more; I peeked into some groups on LinkedIn, and Data Privacy kept coming up whenever I would look at different groups related to technology and law. And then I really started to do some more digging; I'm like, wow, this is something that I really am interested in. And I felt like it was the perfect segue for me at the time because it requires communication skills, it requires risk management skills, which, on the insurance side of things, I had. In addition, it requires some understanding of technology. I don't think to be a Data Privacy, privacy lawyer, or Data Privacy manager; you necessarily have to have all the technical skills. You don't have to have a CISSP, necessarily. But I did kind of immerse myself in the tech and InfoSec side of things. And then, somewhere around June of 2022, I got a call from a headhunter, about the Janney position. So I took the role of a Data Privacy manager. And I've been in that ever since. And I've learned so much in that role about Data Privacy, but also about just how to communicate change to people. Because part of being in any role in privacy is about communicating changes in law, communicating changes in process and practice, and also communicating sort of the culture of privacy, all those things are important. And I've had a great time so far in my role; like I said, it's been a year, and I'm looking to learn a lot more as I go here.

Debbie Reynolds 04:48

Very good. I know a lot of people who are making that transition and people that I have seen in compliance or litigation moving over to privacy because they have an interest either they're really excited about all the new regulations that seem to pop up every day or very excited about what's happening in technology, I want your thoughts about collaboration. So in order to be in this type of role, it can't be like, I'm in my own little silo, doing whatever; you have to find a way to create those bridges with people who are in legal, people who are in those technology roles. So tell me how you found bridging that gap in your work?

Walter Robinson 05:39

Well, it's interesting in my role; now, I'm not in the law department, I'm actually in the IT department, and I report to the CISO. So we have meetings every morning, 8:15 to 9, something like that. But we have meetings every morning to go over the technical side of things. So that's where I'm looking to like to go over the threats that have occurred overnight, new threats that have come up. So like I said, it's heavily info security. And then sometimes InfoSec and privacy intersect. And that's always interesting because that's where I can actually chime in. But beyond just the IT aspect of it, I've had to work heavily with the law department, I've had to work heavily with marketing, heavily with HR, especially in light of the CPRA and changes in California operations. So you're working across the company, not just to keep them informed, but also to stay informed about what they're doing. And what they plan to do. So you really need to keep your ear to the ground to understand how some of the things that they're doing can interplay with privacy laws, privacy regulations, and just some of the general privacy principles that we talked about all the time. And the other group I have to interface with is compliance. And they play a rather large role and a lot of what we're trying to accomplish in privacy. So you really have to be able to tell people, sometimes bad news, tell them no, you can't do that, but still leave a shine on their shoes, which is interesting, because as a lawyer, that's also something that you do as a trial lawyer. That's something that you tried to do; you try to sway the jury, right? You're trying to communicate certain things to a jury; I think it's the same thing; try to communicate either up or down because it says a lot of communication to the executive level, but there's also a lot of communication to the staff level as well. And just trying to get people to understand some principles like data minimization and that keeping all the paper or all the data is not necessarily a shield. It can be a liability.

Debbie Reynolds 08:40

That's true. Tell me a little bit about how you break down silos because I know from experience working with lawyers that a lot of times if you're a lawyer in our room with a group, maybe you're working with marketing or HR, people shut down, they don't really want to talk, or they feel like oh, this person's going to slap my hand for something I'm doing so how do you get people to open up and truly communicate and trust you in your role?

Walter Robinson 09:20

Well, there are a few things. One, since I report up to the law department. I think it makes it a little bit easier to walk into a room and have a frank discussion or pick up the phone and have a frank discussion. Because they know my goal is different from the legal department, even though I'm a lawyer, my role in privacy is to help them stay ahead of things. I don't like to say stay out of trouble because that has different connotations, but to stay ahead of things, I think it's important to stay ahead of the changes to the law. So if you can count it in those terms like I'm here to help, we have all these changes to State laws coming up, we have changes to breach notification laws that happen all the time, regulations that change. And I'm here to help you keep ahead of those things. And people seem to respond to that. I'm not saying that right off the bat, everyone's super welcoming, but over time, once you prove yourself in terms of why you're there, I feel like people do respond favorably.

Debbie Reynolds 10:48

And how is it working with the technical people? So privacy has a technical side and a legal side; you have people, maybe people like me, who are more technical that you end up working with. Tell me how that relationship plays out. Because the way that I've seen it, a lot of times, let's say you're working with someone on your role, you're counseling them, but maybe they're asking a question that may not be in your wheelhouse, is more technical in nature, how do you have those conversations? And how do you bring in these other resources that may be more technical?

Walter Robinson 11:26

I mean, I rely heavily on our InfoSec team, our net team, our security engineering team; they really have the knowledge, the deep knowledge about the technology. And the bells and whistles simply go where I have been trying to increase my knowledge of those things over time because I don't like going into meetings not necessarily knowing everything that people are talking about. So that's been great. Because as they're talking, I can look things up later, after a meeting is over, I can dig around and see what they're talking about. But in terms of translating things for people, I try to keep it as simple as possible if I can. So if I don't have to break things down into technical terms, I find it's easier to communicate things that way. And also, it's more manageable in terms of making sure that people understand.

Debbie Reynolds 12:47

Very good. What is happening in the world right now that you have your eye on? That has a privacy implication that you're saying, oh, wow, I don't know if I like the way this is going.

Walter Robinson 13:00

Well, ChatGPT and AI is a particularly interesting area right now. And it has raised in my mind some very serious privacy issues because I think a lot of people are thinking that they can use it to help them get a leg up in their job or to help them perform certain tasks, but they don't think through the privacy implications of that. So if you're taking corporate data and putting it into an AI program, whatever it is, ChatGPT or whatever, here you may run into problems. And certainly, if you're using information that is client-based or proprietary, you're definitely going to run into problems. So in terms of things that are on the horizon, that's one big thing. In terms of legislation, I'm really excited to hopefully see some movement on Federal privacy law. And interestingly enough, I was talking with someone the other day about TikTok in China and how that may be the impetus for Congress to pass some legislation this year. Because everyone's been talking about TikTok and to a lesser degree, Twitter and privacy. Nothing's really moved the needle, but it seems like now, it's at the forefront of people's minds. So hopefully, there'll be some movement there in 2023.

Debbie Reynolds 14:50

If movement happens, it has to happen this year. I think because next year, things tend not to happen in an election year. So I think this is the time and it's the opportunity to do something; you mentioned TikTok. And one of the concerns that I have about people being up in arms about TikTok is that I feel like we should use a lot of that energy to try to advance Federal, more comprehensive legislation on privacy and not just go after one application, because TikTok is very popular, and people have concerns about it with their AI. And the things they're doing, but there are other probably thousands of other apps that use that type of technology also. So I think, if you're only looking at TikTok and not looking at this broader scheme, or other technologies that are doing similar things, we're spinning our wheels and probably not taking the opportunity to do something more comprehensive as needed. What are your thoughts?

Walter Robinson 16:05

Yeah, I mean, obviously, TikTok is not the only technology that is harvesting people's data for other purposes or non-business purposes, necessarily. But I do think that from a political standpoint, TikTok became the perfect fall guy for everything that's been going on. And I'm actually optimistic. I don't think TikTok is that much more nefarious than Instagram, Facebook, Meta, or anything like that. But I do feel like the fact that it's China, and we have some political issues with China, may be something that drives Congress to move this thing. It seems like the President's ready to sign some kind of Data Privacy legislation, but that doesn't seem to be a big hurdle necessarily. So it'll be interesting to see how it plays out in the coming year. I mean, the big tech companies have a big lobbying group, so I'm sure they're going to want to have some say in whatever legislation actually ends up being passed.

Debbie Reynolds 17:31

Yeah. The White House has been very clear on putting forth things, especially as it relates to cybersecurity. But in some ways, I feel like people feel like cybersecurity and privacy are the same thing. So they think they're advancing in both. So I would like to see more advancement on the privacy side, not just the cyber side on a Federal level. But who knows? We have the ADPPA proposal last year that fizzled out because of the midterm elections. And so I think people are trying to pick up some of those pieces and try to advance things. But I would love to see these groups that are trying to advance separate bills come together or maybe one comprehensive bill; what are your thoughts on that?

Walter Robinson 18:21

Yeah, I mean, I think there's been so much movement on a State level for comprehensive Data Privacy laws. And that seems to be snowballing. I think the stumbling block may be that States like California, for example, have such an interest in, they were the first, and they have the most stringent laws in the country. I don't think they necessarily want to sue the Federal government. And there's a lot of pushback there. So I don't know. I mean, it seems as if they should be working together, but there's a lot of behind-the-scenes political stuff going on that seems to slow things down. And certainly, it would be helpful, from a privacy perspective, to see some consistency. In terms of the State laws, it does look like most of the State laws that are passed are very similar GDPR based laws. But I guess it remains to be seen if some of these other States that are thinking about passing privacy laws are actually going to follow suit.

Debbie Reynolds 19:45

Yeah. I think the future for us is a lot more State laws, States can pass these laws faster. When I guess Iowa was the most recent State to pass a law right. So wow, now I can't print this on a sheet of paper. Now I'm like, I've got to add six columns instead of five; it's like we're going to have 50 columns like this, and also are things that the States are borrowing from these other privacy laws. So they may not be extremely different, but they're different enough to be annoying and have nuances that just make it really irritating. And for me, it seems like we're moving into a situation almost like someone says Carolina barbecue. So we'll say, Virginia-style privacy law, and it'll be four or five laws that are more like Virginia or more like California. You mentioned ChatGPT, and for me when I think about ChatGPT, even though it works a bit differently, I feel like I'm having a bit of deja vu. Because when Google Translate came out, I feel like we were telling people not to put confidential information and not put sensitive information in there. So when ChatGPT came out, I thought we told people not to put sensitive stuff and confidential stuff on the Internet. What is it about ChatGPT to get people to forget that lesson from way back when?

Walter Robinson 21:19

It seems like the media has really hyped up ChatGPT to the level that everyone's interested in. What it's about, trying to test it out, see what it does. I think people in general, the public in general, are more cognizant of the privacy and the sensitivity of certain data. But I just think people are curious. It's human nature. They wanted to see what it can do. They've heard that it could be the precursor to the rise of the robots. They're scared. I mean, it's an interesting time, certainly, to be alive right now. Because the benefits of ChatGPT, or AI, seem to far outweigh the negatives. But there are a lot of naysayers who are saying, oh, no, AI is going to rule the world in 10 years if we don't look out. I don't believe that. I mean, I believe that there have been a lot of technologies that, initially, people thought were going to be a problem to the world, and turns out that they were great for society and helped us create some great positive things.

Debbie Reynolds 22:44

So you don't believe in the evil robot theory?

Walter Robinson 22:47

I do not believe in the evil robot. There was a movie growing up in the 90s. Robocop? Yeah, I guess people are thinking this is the beginning of Robocop. I don't know. It could help out with some of the situations we have with the police and things like that. We did have rogue cops that were programmed to do everything right.

Debbie Reynolds 23:12

Yeah, I had not ever seen Robocop until this year. And when I saw it, I thought, wow. So people need to rewatch this movie. One thing that happened in that movie is the robots are programmed to do something. I think they were supposed to target someone. And they couldn't stop it, right? So the robot killed someone. They're like, oh, it's just a bug. Fix that. Yeah. I think that's the concern that people have, especially when they watch movies about things like this because they're thinking, what if we tell them to do something and it doesn't stop? Or what if we have it do something, and it's going to turn on me? So I think even though that seems far-fetched in some regards, I think that is an argument that you need to really think about because what I feel, and maybe you feel this too, a lot of times, people talk a lot about the benefits, but they don't really anticipate what the harm could possibly be. So my thing is, you need to have a balanced view of that. So don't throw it out. Like, oh, my God, this is so terrible. We can't do this. So maybe it is people want to be on the fringe of both sides. So one area thinks that things are so great about AI. They don't want to hear anything bad about it. Others think it's the end of the world. What do you think?

Walter Robinson 24:40

I mean, I do think that if the United States wants to remain a global power economic power, the genie is out of the bottle, right? We can't go back. We can't put a halt to it. Because all our competitors are using it, and who knows how they're using it? Now that's the scary part. I mean, who knows how other countries are using it without any kind of guardrails? And as you can see with some things that have happened recently, or at least how people think COVID came about. Yeah, we need to guard rails; you're right about that.

Debbie Reynolds 25:28

I know I feel like we need to get on; I don't know if we'll ever be on the same page. But I think these times remind me of the commercial Internet. So I remember when people were like, can't be on the Internet. And we know how that turned out. Okay, there are harmful things that happen on the Internet. But people use the Internet for business and different other things. So I think trying to stop it, it's not realistic because it's already out there. As you say, the genie is out of the bottle; well, we have to find ways to use or leverage these innovations, especially in ways to create, in my view, more productivity. So the ability to really be a helper to people is really the true way to be able to use AI. But then also, as you say, about privacy, thinking about the privacy implications when you're sharing information that maybe you shouldn't.

Walter Robinson 26:27

Yeah, and the other concern is people are going to lose jobs behind AI. And behind some of this advanced technology, and I think people think it's jobs at McDonald's, or things like that. But I can see where you don't need as many lawyers, if you have AI, looking over contracts, you don't need as many, I don't know, nurses, if you have AI, reviewing patient charts and things like that. So there are real-life issues and impacts to it. And society is going to change a lot over the next 10 years. And it already has I mean, you look at what's going on in France, and it doesn't take that much to push a nice society into kind of chaos.

Debbie Reynolds 27:25

That's true. That's true. You touched a bit on HR. And that's why I'm talking to you a little bit about the HR changes with the CCPA. Because I think it will even though this is only in California, I think it will have a ripple effect in other States around how they think about employees. So employees typically in the past have not had very many rights around the data that companies collect about them. And so California, they're creating more transparency in that area. And I think it's concerning for companies because they had always thought that they never had to share that information. And now there has to be some type of transparency there. But I think what's going to happen as other States may pick that up, as well, especially as people are saying for example, you have a company, you have employees in all States. So they're like, well, why do the California people get more information than I do? What are your thoughts about that?

Walter Robinson 28:26

A couple of things. So with California, the fact that employees have the right to request their data, request to have their data deleted, it does create some confusion if you have employees in other States, and I think it's incumbent on companies to come up with a solid process upfront, based on California that they can use for some of these other requests that are going to come down the pipeline. So in terms of getting out ahead of it, I mean, it's more than just having good notice. At collection, on your company's website, or on your career page, you really have to be able to sort of find the data. And that's where HR comes in, find the data, but then find the other places where that data is unstructured data. So it's actually a big task to comply with California, but I think if companies get ahead of it now, they create a good process for California. They'll be in good shape when the other States start to fall like dominoes which inevitably they will.

Debbie Reynolds 29:59

Very good. If it were the world according to you, Walter, and we did everything you said, What would be your wish for privacy anywhere in the world, whether that be technology, legislation, or human behavior? What are your thoughts?

Walter Robinson 30:18

Well, I was thinking of how to do Federal privacy law. But that's a little too narrow and probably too self-serving. I think, really, what people crave right now is transparency. So transparency from companies with respect to how they use your data, how they're getting your data, like, are your cell phones and your Internet of things. Document items listening to you? Like, is Alexa listening to you, is your phone listening too? It should be transparent. When that happens, you should be able to know that if I click on this site, something might be tracking me or listening to me. I don't think there's that transparency level right now. And I haven't really seen anything that proposes to address that. So yeah, I mean transparency from companies. And also transparency from the people who communicate about privacy. I mean, hey, let us know if you know something is going on. And the quicker you can get it out to people, the better off everyone is. I'm not really sure if new legislation or new regulation will take care of that. But I do think educating people about what's going on.

Debbie Reynolds 31:52

I agree with that. I think it's almost like transparency is the foundation of great privacy. So it's soil that we need to have and cultivate in order to support all the other things that we do. Because I think when you are transparent with people, they have comfort in what you're doing with their data. They don't have a problem with sharing the data, especially if they feel that data sharing benefits them. So I think we've had up to this point, it's a lot of data sharing that benefits corporations or other people, not necessarily benefits us as humans.

Walter Robinson 32:33

And also transparency about how not only have they collected data, but how they're using it after they collected it, which a lot of the laws do address, but I don't think they necessarily go far enough in terms of the resale of data, the sharing of data. California is at the cutting edge right now, so it'd be interesting to see how they enforce it and how frequently it's enforced. That will really tell the tale of how strong the legislation is and the regulation is.

Debbie Reynolds 33:15

I agree. Well, thank you so much, Walter, for having this conversation. I'm sure a lot of people who are transitioning into privacy from different roles really find this really valuable. And also, I love your thoughts about this. Maybe we'll check in in a year or so and see what happened. Compare notes to see how things turned out.

Walter Robinson 33:39

Hopefully, there won't be an army of Robocops thrown in the streets at that time.

Debbie Reynolds 33:44

I help not. We'll record this and we'll keep track of how things go for the next couple of years for sure, but thank you so much.

Walter Robinson 33:52

Thank you.

Debbie Reynolds 33:53

I'll talk to you soon. Bye