E20 - Jennifer Mailander – Deputy General Counsel Fannie Mae Data Privacy & Cybersecurity
37:30
SUMMARY KEYWORDS
privacy, data, people, Fannie Mae, organizations, company, world, technology, important, understand, legal, business, ciso, questions, components, thought, diva
SPEAKERS
Debbie Reynolds, Jennifer Mailander
Debbie Reynolds 00:00
Personal views and opinions expressed by our podcast guests are their own and are not legal advice or official statements by their organizations. Hello, this is Debbie Reynolds of a "The Data Diva" Talks Privacy Podcast, where we discuss Data Privacy issues with industry leaders around the world with information that businesses need to know now. So I have with me today Jennifer Mailander, who's the Deputy General Counsel, and she has Data Privacy and Cybersecurity for Fannie Mae, is that correct? It is. Hello. Excellent. Excellent. Well, I have been thrilled to get to know you over these years, and I was so happy and excited that you say yes to do this podcast. I love to tell people two stories. So I want is, well, actually three stories. So one is how we met. One is sort of kind of my thoughts of you in general, and then you are partially responsible for my "Data Diva" moniker. Yes, so. So we met, we were on a panel in New York for the Masters' conference. I think it is in 2017 because I think it was like a year before GDPR came out. And I was telling Gail Gottehrer because I had her on the show. That was the first privacy panel I have been on wherever it was all women. And so we are a very diverse group of women. And we just all just sort of click together. I think, you know, it was a fantastic panel. I wish we had recorded it because I thought it went really well. So it was me, you, Gail Gottehrer, Keikoh Park, Amie Taal. And we've all sort of kept in touch with each other. And we do little things together, which is awesome over the years. And you're one of these people, they're only two people in my professional life, and you're one of these people that if you call me and say something, it's like it's done. So you're very wise and very smart. So I always, you know, take your advice very seriously, you know, you've suggested some really wonderful things to me. So one of the things that you suggested to me, you sent me an email, which was about The Quorum Initiative. So the quorum initiative is like a women's networking group. And at the time, they were trying to integrate a chapter in Chicago. And so you're part of the DC chapter. Right? Right. You're, and you were like, oh, Debbie, you should totally go to this thing. And I thought, you know, it's one of those moments, Okay, I'm gonna go to this thing, because, you know, dinner per se, is awesome. And so I did go to their inaugural event they had, and there was like a workshop about sort of LinkedIn and branding and stuff like that. And so we had gotten into groups, I think we were like, in pairs of two or something. And then people were like walking around, you know, trying to get us to sort of hone our elevator pitch and things like that. So one of the women who was facilitating was a reporter for The Wall Street Journal. And so I told her my elevator pitch, but she said, oh, you're like "The Data Diva." And we just laughed about it. And then I thought it was funny because the person was in my group was Yvette Pena, who she's like, the head of diversity for AARP. And she was like, Oh, my God, I used to tell you that, and you know because at first, I was really bashful about it. And then I thought, well, this was a reporter. This is probably a really interesting, fun way to sort of sum up what I do. And it's been very popular. So yeah. So that, so yeah, that's, that's what you've done. You've helped me with that. Definitely. Thank you.
Jennifer Mailander 04:00
That was lovely feedback. So thank you, I appreciate that. And that is very cool. I love, First of all, I love "The Data Diva. And I love you. So this is fantastic. I'm glad that they came together. You never know where your actions are gonna take you, right?
Debbie Reynolds 04:17
That's true. That's true. It's always good to do networking and listen to smart people like you. So I'm glad I was smart enough to do that. Well, I'd love to. I just want to get into some of the questions that I have for you my burning questions. First of all, you know, you've held many privacy roles in public, private, and government organizations. When did you realize that privacy was going to become like an industry unto itself and a key focus for organizations?
Jennifer Mailander 04:49
No, I, for the past 20 years or so I have worked for technology companies. And I think it's really that experience that helped me understand that there's something here, it's you know, it's, and it's, it's privacy, but it's, you know, the power and breadth of technology today that is so impactful. It's the significance of data in general. And I'm speaking to "The Data Diva." So I think you get that. And of course, privacy and security are hugely a huge component of huge components of that. And then, you know, just partnering with your business peers and your technology peers to understand the business and what's being done and all figuring out all of a sudden, while there's a lot of data being collected. So for I worked at Corporation Service Company or CSC, and you know, that is a business company that is a legal service, business services, digital services company, and so they essentially help companies manage information. So they have a lot of data. And I supported sales and technology. So I would, you know, work with external customers and work on contracts. And all of a sudden, we were getting questions like where do you store my data? Where do you do with it? Who has access? And in those days, we didn't have a CISO at that company. We had a technical technology leader, right? And so he would be on the phone, and he'd explain, and then I'd learned from him and a great guy. And those questions rapidly evolved into 300 questions that you had to give. And so then I went to work at a company called Comscore. And so this whole thing got sort of turbocharged for me. Comscore is data analytics and cross-platform measurement. So they measure like they have user panels that tell them what they do and what they do on the internet. They have OTT, or Over The Top, they collect data, which is essentially like your program is an OTT program, right? It's streaming media, movies, movie data. And then GDPR came about. And so all of a sudden, you know, when you're talking about privacy and data, it was no longer just about Social Security number, Passport number, driver's license, you know, GDPR said, You know what, it's not always so clear, it's not always so black and white, it might be a data element by itself is not in what they refer to as, you know, personal data, it's, it might be that three fields together, create something that is personally identifiable. So, you know, there's justice evolving with that evolving definition, and then my interest in technology. That's kind of how it happened. I often say that I stumbled into it. And so I'm pretty lucky in that sense. But it's a great space to be in right now.
Debbie Reynolds 08:00
Yeah, it is. So basically, you're just combining your interests of skill, and it just sort of, you know, snowballed and the good and a good way. Yeah, so in Chicago, snowballs aren't that great, but it was the snowball, right? You did a webinar not long ago about how to keep Data Privacy top of mind, and it's hard an uncertain time. So how has COVID impacted, you know, your focus on privacy, for better or for worse,
Jennifer Mailander 08:32
Probably a little bit of both. I, as a person I try not to think of is it better, is it worse, because I get all wrapped up in the emotion of something I probably have no control over anyway. So my approach in life is just to try to deal with stuff. Right? I think it's obvious there was the personal impact that all of us have gone through and probably still are going through. You know, there's, I remember, the last time I went out to dinner, at a restaurant and had a beverage and so you know, we're coming up on that year anniversary, which is very, I love going out to eat. And then, of course, there's the work stuff, right, like the first few weeks after we were all working from home, you had to understand, wow, we're not the only ones working home, there are third parties that we rely on, they're working from home, are they safe. So there's that sort of interaction that we had to deal with. There was understanding employees are now working from home and that employees have co-workers. In my world, I'm very fortunate to have my husband and the cat. So we and we both cook. So but you know, suddenly, you might be having a fairly private conversation with someone about something rather sensitive, and you could have a child walk in and partner or spouse login. So you know, trying to set up parameters around that so that employees Remember to lock their keyboard if they walk away. You don't want your kids to be playing on your laptop, so setting up parameters for that—even things like telling reminding managers that COVID wasn't just like any other illness. And, you know, when you found out what initially, at least one of your peers might have had COVID, you wanted to remind the manager, that's probably not something you want to be talking about to the team, whereas you had the flu or appendicitis, you know this because we weren't sure what kind of stigma was going to be associated with it. Right. So, and then we've had bursts of okay, we're going to go back into the office. Okay, no, we're not going back into the office. And how do we prepare the office? And what kind of funky new technology can we implement? Like, let's automatic temperature takers, you know, find does social distancing measures, which are not that effective, I think. And then, you know, fun things, trying to entertain employees, but everyone wants to post videos of their family and their kids on your workspace, and you're like, maybe we shouldn't be doing that. So, you know, dealing with those kinds of issues. It's been fascinating. And I think, you know, every day or every week seems to bring new questions related to how we're dealing with this. But yeah, so how was that?
Debbie Reynolds 11:18
Yeah, that was great. I know that. Obviously, corporations had to deal with it also. So I think this creates a whole new wrinkle in terms of how people deal with OSHA regulations in the workplace. Have you experienced that at all?
Jennifer Mailander 11:35
Well, we follow. Fannie has a large legal department. And so I work very closely with our employment lawyers. So that, so that's their sphere, we follow CDC guidelines really closely, and any opinions that come out of either of those groups. So that's how we've been managing. Thank goodness, there are other teammates that I have that we interact with pretty regularly on that sort of thing.
Debbie Reynolds 12:01
Yeah. So the CCPA has had a tremendous impact, I believe, on organizations. What if anything surprised you about the CCPA? In terms of adoption of operational changes within your organization?
Jennifer Mailander 12:18
Yeah, so I started at Fannie in November of 2018. And literally, like, the month after I got there, we had the business doing outreach, like, okay, we've heard about this law, what do we need to do? And so I think my initial reaction was, I was surprised how on top of it, the business was, they all knew about it, they wanted to be prepared, they knew they had a year at that point. So I was floored at just how big I think GDPR had set the stage for most people if you have global interest, and I was just floored at how, you know, hey, what do we need to know we're ready to go? The challenge, of course, with CCPA was the statute, and the regs didn't get finalized right away.
Debbie Reynolds 13:05
Right.
Jennifer Mailander 13:06
So just finding, doing a lot of presentations, and then representing to those same groups to kind of say, okay, this is what we know, as of now. I think I attended every CLE that I could on this. Fannie Mae has a very great privacy structure. So I work in legal and my team. So we cover the legal components. And then there is a privacy office and the Chief Privacy Officer, the beavers offski, manages the privacy office, and they cover it is under compliance and ethics, that group, so we work really closely together. But they're very good about taking control of the operational components and components. And so I think what was surprising to me was, you know, trying to develop processes and procedures, which I am a part of that process. When you don't really know what the final rules or regulations are, that was really, really challenging. I think there are also challenges or work challenges. Because it's California, you know, you'll get a number of requests from citizens outside of California who want the same governing rules. And so you have to figure out as a company how you want to respond to that if you do want to respond to that. You know, I think with privacy today, transparency is extremely important as it relates to consumers. And so that's the general guideline that we'd like to follow. But some companies may not feel that way and just trying to balance that. And then I think what it shows me too is just amazing how much privacy and data are integrated with every aspect of the business, right? Everything tech because you're using new technologies and everybody wants to collect data, And it's just, you know, you have to, and business doesn't sit still. So you may have a process and a procedure. But if the business changes, which it does all the time, you have to then possibly change your process and procedure. So it's just, it always goes back down to communication, right, which is essential. But it's hard when you're in a large organization, or you're just incredibly busy.
Debbie Reynolds 15:27
That's true. Very true. You've been a champion of women and men in executive leadership and their career development. What advice would you give anyone who wants to pivot into Data Privacy or accelerate their career in Data? Privacy?
Jennifer Mailander 15:45
Wow, that's a great question. So, this is an amazing practice area. It is intense. It's a relatively new practice area, compared to things like tax law litigation. That's great because that's why women of color and like you and me, and that's why we were able to work in this space and, you know, get higher up the scale than we might in traditional legal practice and your kind of in multi-practice areas, I think, outside of legal too, right? It's so rapidly evolving. It's fascinating, and it's huge. So I have a new team member, a new attorney that works with me. And she's like, wow, what do I focus on? Because there are so many tentacles in privacy and Cybersecurity. So I think that you need to find what you like to do. And I think that's always the best way to start and find and make sure you don't try to take it all on, at least for me, but that's where I've found the most success, I think. And then I think understanding technology is really important. Right? So and there are so many programs right now that is great for, especially for lawyers, just trying to get some basics down, you need to be able to understand, and there's actually now we know, an ethical requirement that, that we need to do that as well and understand I think you have to be very comfortable with saying, I don't know, because I will tell you on a daily basis, my stomach gets in a knot, and I have anxiety because I don't know the answer. And I'm like, oh my gosh, and that may happen ten times a day. So I just am very comfortable saying, I don't know, that's a really good question. And then asking lots of questions, lots of questions after that, like, well, what are you trying to accomplish? What, what data are you keeping? Where does it go? Who has access? And then my last thing, and thank you for the lead in because I think this ties in. But with any career, you need to network. So you need to network in your company. But I really think it's important. I think that I've had my most insightful revelations for myself. When I network outside of the company, I get to meet people like you, who call me, you know, five years later and say, hey, let me come on my podcast. But, but I can also call when I have one of those days where I don't know. I can call and say, hey, we talked on that panel X number of years ago, and this is what I'm facing. Have you seen anything like this, right? It just gives you also, I think, a sense of who you are outside of your organization. To me, it's kind of like going outside of your family to get counseling or something, right? You don't. People in your company know you, and they categorize you just like we all do. But if you step outside, you get a chance to sort of be your true self or reinvent yourself, and step away from your day-to-day grind, and just hear and learn from all sorts of interesting people.
Debbie Reynolds 19:03
I agree with that wholeheartedly. And I advocate for people to do that. So a lot of people do think, oh, I'm networking with my company, that's fine. But I mean, you're right, like you, you know, especially you do a certain job within a company. That job is not you as a person. So networking is about you as a person and sort of all the different facets of yourself. And so, for me, I love to get advice from people who are in my industry because I feel like they have more of a clean slate, and they have a fresh eye to things. Even when I'm writing something, or I'm doing a speech or something, I send it to someone who's in a completely different, you know, field because I want to know, you know, does it make sense? Is it easy to understand, or I need to change it in some way and then to you know, you just never know what will happen with you know, your network. You never know, you know, I have so many people call me up, you know, out of the blue, you want to network, and it's amazing. So I, you know, people don't network enough. I don't think some people misunderstand. They think, you know, for me. I think networking is like doing a garden. So you plant a seed, you cultivate that seed over, over time. And you know, you're building relationships over time. You never know where it's gonna take you.
Jennifer Mailander 20:24
Yeah, you know, there's one other component I would add in; you reminded me of this, I'd be interested. But I think mentoring is a phenomenal way. And it does exactly what you just said. So I approach mentoring that I say we have to both understand what we each want out of it. And I expect to learn as much if not more than the person that I am. So supposedly mentoring. And this summer I had this past summer, I had an amazing mentee, who is Fannie Mae has a summer intern program that we split with Venable. So the legal interns work for Fannie Mae. And then they also work for Venable part-time. So it's a really good way to see what do you really want to do when you grow up. Right. And so I had a young African American woman at Michigan, and, you know, wow, what a great what an incredible time to have someone of color mentoring me, because, you know, I'm ignorant. I didn't know what I didn't know. And it was a phenomenal experience. But I think he really has to. I love it because it's about talk. It's to your point. We'll talk to someone who does something different. Because it's amazing what you don't know and what you walk in with our preconceived notions. Right?
Debbie Reynolds 21:46
Yeah, totally. Just open your mind. You definitely helped me with that. Or you introduced me, actually, to someone who's one of my dear colleagues now, which is John Berghoff. I'm gonna embarrass him by mentioning his name on the podcast. He's fantastic, phenomenal—such a nice, smart man. And, you know, we had a great friendship. But he, it was funny, because many years ago, we ended up having lunch, and it was around my birthday. And I'll tell him, I want to, you know, make this trip, and I didn't know what else to do. And he's like, yes. You totally do it. You know, in retrospect, now that we can't travel, I'm so glad I took his advice because I was gonna go to London or something for my birthday. And I just decided to do it because John said to do it.
Jennifer Mailander 22:32
See, he's a good man. He's one of my favorite people—a wise mentor to me. So yeah, and very funny.
Debbie Reynolds 22:40
He is very, very funny. So what is one thing that you've learned, and dealing with Data Privacy at a large organization that you think will help businesses on their Data Privacy journey?
Jennifer Mailander 22:54
There are resources. That, you know, that's, that makes a big difference, right. And so I think it's, it's also very good about helping you elevate yourself because there are resources. In midsize or small organizations, you're very often tasked with doing it all. So, you know, if I, in my previous jobs, I did, there wasn't a privacy office to handle implementation monitoring that often fell to the legal department alone, you know, being responsible for the legal component. So and those are legal components. But it's nice when you've got a team whose job is to go set up the processes and procedures to implement something. So I think that's the biggest thing is, I think it's a constant reminder to step up your game. I think they're sort of this because they're, the people that I work with are incredibly talented. And there's healthy competition. And I think it's just a reminder to step out again, out step outside of the weeds. I hear a theme that I've been talking about here, but I think it's so easy to get entangled in the day-to-day because there's too much of it for all of us. It's a way to step back and really focus again, like, get to your priorities, what are they really that works for any size organization, I think you really have to know, what are your objectives for the day? What are your objectives for the week, the month, etc.?
Debbie Reynolds 24:37
Right? So it's so much you can get in the weeds, and it can be overwhelming. So that makes sense. It totally makes sense. So after the GDPR passed, you know, we're seeing many different countries starting to enact, you know, Data Privacy regulations, and obviously, the CCPA came after that. Do you think that move toward more Data Privacy regulations around the world will have an impact on a possible Federal Data Privacy legislation in the US?
Jennifer Mailander 25:10
A girl can dream. Yeah. You know, I am certainly hopeful. Again, I go to my example. When I walked into Fannie Mae, I had business people asking me about CCPA because they had heard about GDPR. So, so yeah, I think it does. Absolutely. When we see other countries doing smaller countries are doing passing significant legislation with protecting privacy protections for consumers. Yeah, I think absolutely. Well, I think we've got, you know, with Vice President Harris, I think we've got she's got strong chops in this space in terms of the work that she did in California as the Attorney General. And so yeah, I am certainly hopeful. I think we live in a global economy, and the sectoral approach of the US may have served its purpose at one point, but it's really too many of the laws conflict. And we need something to help us. I'm not saying it will be a panacea, but yeah, it would definitely help us, I think.
Debbie Reynolds 26:16
I think so too. I think as you said, you know, we do have a global economy. And I think a lot of the action that will happen will be around commerce because I feel like that moves the needle the most when you're talking about this is my kind of hearts and minds and feel-good stuff is like, you know, cannot do business x, y, and z. So I think the pressure is rising, and I'm hoping that there'll be things put in place where, as I said, things are conflicting, or things are outdated. And then, too, I don't want us to be so in love with the past. You know, maybe it worked in the past, but you know, being able to have things that are more modern is pretty important, I think. Yeah. What, um, so we've been watching kind of the Schrems cases, Schrems I and II cases play out in the EU over the years and do you imagine that, that these cases will have even a larger impact on the way people think about, like data transfers internationally?
Jennifer Mailander 27:24
Yeah, I think so. I think that well, I mean, they sort of have to when I look. Fannie Mae is a US-based company, right? So so I'm not dealing with international stuff in the way that I would have in a previous job or two. So but I think that you know, this goes to, again, our server comments that we've already made. We need that foundational federal law. And I think that will then hopefully flow over to helping us figure out how to work internationally, because like you said, it's all about commerce. And we need the ability to exchange data back and forth comfortably. I think, for the international audience, they need to understand better what The Cloud Act means to them. And we might be able to put around that because that's the real concern, right? The federal government's going to come in and grab our data, even if it's not in the US. So, right, that expanded it and took it off. But every contract I see, you know, because everyone used uses third parties, and most third parties now have entities outside of that do work outside of the US. So, you know, there's, there's always the standard contractual clauses now. Right now, that's about Fannie Mae is a single entity. We don't have subsidiaries. So that for us is, you know, that's there. But so, yeah, it's definitely I had a meeting a couple of weeks ago with a larger company that does International. Internet, like things and, you know, they're very concerned, right, because this, this has huge implications for them about every data transaction. Right. So.
Debbie Reynolds 29:10
Yeah, that's definitely something to keep our eyes on. That's for sure. So your role is interesting at Fannie Mae, so you cover Cybersecurity and privacy. So I'm wondering, how do you find kind of this dual responsibility and, and how is it in terms of collaboration between the kind of these different groups?
Jennifer Mailander 29:35
So I don't know how they're not connected. Because everything, you know, anytime if we have a privacy event that, you know, the first thing we need to do is, is it paper? Is it online? Anytime there might be a technology blip or some sort of, you know, a question about whether or not something has happened, which of course, you and I know that happens every day and every company and you have to figure out how is this significant or is this just a blip that happens every day and every company so, so I don't they are so interrelated, which I again, love that sort of my passion. In my past life, I was the CISO, and I walked arm and arm on everything. We did presentations together. We had regular meetings. And again, I think this can be done really at any size company, but we would have monthly meetings between legal, infosec. And we tie in the business, and I might do a presentation on contracts and what they mean, and they still might do something on software as a service or, and then the business might do one on here's how our products, this is what companies love about our products. So in my company, now, again, it is all about communicating and connecting with your peers so that you can get stuff done and keep it moving. And so I know I interact with the CISO regularly. And so we but my day-to-day activities are with his direct reports. And we connect, have lunch I just had me I'm just starting to have meetings to find out what their goals and objectives are for the year and how we can better support them. But you know, it's hard. When we're remote by it's setting up a time and just chatting and trying to connect where you can because seriously, I can't do my job without them. Right and so important. You know, you're talking about threat detection and response and cloud security. And those are all pieces of what we do every day. So that answer.
Debbie Reynolds 31:43
Yeah, definitely, definitely. I'm sure the Cybersecurity people will love to hear an answer. Because I think, you know, a lot of us have existed in organizations where things are very siloed. And I feel like privacy can't thrive unless we break down those walls. So I'm happy to hear that you're doing that.
Jennifer Mailander 32:04
Yeah, I can't do my job otherwise. Because when I moved into Fannie, I don't have a financial services background. So I needed people to tell me what I needed to know because I didn't really understand what the company did. So it's always helpful to ask people for guidance because most people like to help. I
Debbie Reynolds 32:24
I think that's true. That's true. So if it weren't a world, according to Jennifer, and you could maybe wave your magic wand and decide how data privacy regulation goes either here in the US or anywhere around the world. Well, what would be your wish?
Jennifer Mailander 32:43
So there are like four components to this. Okay, so this is what I rule the world kind of question, which I love. So we've touched on that we need a Federal law governing privacy because we just got, you know, the data breach notification requirements are crazy. They're so nuanced. And it's, you know, you need charts to be able to make sure you know who you have to give notice to and when privacy state privacy laws are now headed in that same direction. And that's, you know, it's, it's silly, it's a waste of good effort. And we can, we can make it better. And we can make privacy better and security better if we had one standard for both privacy, data breach notification, and infosec. Standardization, right, like what, what constitutes a security. I think this would also then help us align better across borders because I don't think we'll have a law across the world. So I think we need to, if we can shore up our own, our own house here, it will make it easier to do that cross-communication across the globe. And that's very important for our companies to survive. It is a global economist who said, as I get more greedy, I'd like to live in a world like much many other parts of the world where privacy is an individual right, right on par with our Bill of Rights, because I think it's important. I think that has grown. I've seen that more now in the past few years than I realized. And I think that would help our society recognize the importance of privacy sometimes. I hear way too many people dismissive about, oh, so what I don't care, they signed up for an app and followed me, I don't really care. But I do care. And I think we need better controls around that. So if we had that privacy, right? I think we need to understand this emerging technology world that we live in because if we don't, I certainly don't. And that is going to have huge ramifications for privacy and data and uses in a way that I don't think we have any concept of. One of your podcasts a couple of weeks ago that I listened to was about, you know, it's not even data about an individual at this point. We are profiling large classes of society, and that that's really concerning. And then my last piece of not as well, I'm still figuring this out. But we need to address privacy for our marginalized members of society. Because we have different privacy standards, we enforce privacy in neighborhoods of poor people, minorities more aggressively than we do in a white neighborhood. And not, that's wrong. So I want to, I want to I want that answer in particular, and I think it's something that if you if, you're granting my wish, that you should address that, for me.
Debbie Reynolds 35:50
This is definitely the most comprehensive answer I've gotten. And that's fantastic. I love that you're thinking along those lines. But I agree with you wholeheartedly. And the last thing you thought you brought up is really interesting because I feel like with data in a way, you know, who has access to Data, who could do what data sort of like, we're creating, like a new caste system in the world. So the people who have data or have access to Data will have more access to opportunities where people who don't won't have it. So I think just sort of, like I said, thinking about communities that are more marginalized, trying to figure out how can we, you know, even a playing field that makes sure they have access, you know, to the same things are the same, like you said, more of a human right, as opposed to just a consumer. Right. So that's fascinating. I, you know, I love this question, because nobody has ever answered it the same way twice. So I may have to do it like a show just about these answers. That's fantastic. Well, thank you so much for being on, so I was so excited. We've been planning this for months. So I'm glad we finally got a chance to do this.
Jennifer Mailander 37:06
I was honored to be asked, so thank you. It was fun.
Debbie Reynolds 37:09
Yeah, this is fun. Well, we'll definitely talk soon for sure. And I'll always be looking out for your great sage advice and wisdom, as always. Take care. Alright, take care. Bye-bye.