Privacy and AI in Practice: Asking Better Questions, Smarter Consent, and Stronger Compliance

Thank you for having me here, and really appreciate the introduction.

That's a really good question. So you're absolutely correct that the two jurisdictions have fundamentally different legal systems. So China has a civil law legal system. And in the United States, we're in a common law legal system. A lot of the things are super different.

I practiced law briefly in China before I came to the United States. Some topics are very different, like for example, criminal law, constitution. Those topics are really different. But contract law is very similar. So the way companies, especially in this global environment, companies are increasingly doing business across different jurisdictions. And they need to use a contract to enable those transactions.

So the way that, for example, M and A attorney does practice law in China is very similar to the way that a US M and A attorney practice law in the United States. And in terms of privacy, so in the last ten years, I have been advising companies in privacy law compliance.

And the GDPR came in force. I graduated from law school in twenty thirteen. So at that time, there was no GDP. There was a GDPR.

There was no CCPA at that time. Then GDPR came in effect later on when I was practicing law in house a global Fortune five hundred company. So that was a really good opportunity for me to help the company, a global company, to transform a privacy compliance framework across different jurisdictions. So for EIPL, just as a background information, China's privacy and cybersecurity law developed in the last since twenty seventeen.

So it's a very recent concept. And it's built on three different frameworks the PIPL, the cybersecurity law, and information security law. And that's a very similar timeline compared to the other privacy laws and data protection laws across the globe. So GDPR came in force in twenty seventeen and CCPA came in force in twenty eighteen.

After reading all those statutes and advising companies in how to comply to get those different statutes, And we can see there are so many different differences across those different frameworks. But there's a common theme and common elements behind all those frameworks. So companies need to pay attention to notice and consent.

There are principles about data minimization. We don't collect more data than what you need. And lastly, I think one important thing is that international data transfers that I'm very passionate about that is to move data across different jurisdictions and how to do that.

And in the last few years, the trend is that more and more regulators across the globe, it seems like they want to keep the data collected in their jurisdiction inside of that jurisdiction.

So GDPR is an example. If you want to move EU data out of EU, there are different mechanisms you need to follow. And China is an example as well. There are specific data localization rules regarding important data for companies that are critical infrastructure operators.

So they need to go through different mechanisms to move data out of China. So in the US, there was a very recent addition that involves cross border data transfer. The executive order of one four one one seven, that says it's basically if you want to move data to countries of concern, including China, or if you have a covered person related to countries of concern that will access your bulk Americans sensitive data, then this transaction could be either prohibited or restricted. So that's a very recent addition to the international cross border data transfer frameworks across the globe.

My takeaway is that there are a lot of differences for sure, but we can find common themes. And for the companies that want to comply, the one important thing, we want to design a compliance framework to be broad enough to cover the different frameworks, but also flexible and adaptive enough to account for the future regulations.

I really appreciate that you're reading my article on the St. Louis Business Journal. I did that pretty recently in December. I shared some stories that were seen as the breach counsel, privacy counsel on incident response cases in the dark market.

Our threat actor is using AI to enable phishing attacks. And they're using AI chatbot to act as like a customer service to take ransom payments. And it seems like their business is doing really well. So I think tabletop is a very important tool to prevent more incidents and reduce the costs of mitigating incidents going forward.

So that's for incident response cybersecurity piece. On the privacy piece, you might want to think about privacy policies and improve your privacy policies every year to adapt to the change of privacy laws in different jurisdictions, both internationally, federally, and federal and state privacy laws. And also consent after so we talked about notice that the consent is very important, too. So how your company collects user consent.

So for example, so many companies have loyalty programs. And I think that's a very brilliant marketing tool to collect consumers' information. And that loyalty programs turns out. That's like a very rich database to understand consumers' behaviors.

On the other hand, you want to be very careful about how you collect consents through your loyalty programs. So for example, lately, the state and federal regulators are increasingly focusing loyalty programs. So FTC has guidance on how to design the loyalty programs to avoid dark patterns. And state regulators have that as well.

Basically, their guidance is that you don't want to ask consumers to give you consent emotionally manipulative ways, for example.

Don't do something like, if you don't agree, if you don't give me your data, then hobbies can freeze. Don't do something like that. And consent needs to be informed and fair to the consumers. But we cover cybersecurity, incident response, and privacy, and notice and consent. And lastly is the cross border transfers I mentioned previously. So I think with those pieces in this game, a company can create a pretty good game plan for privacy compliance.

I appreciate that you saw that quote about why I joined Quarles. Being an attorney is not the simplest, the most easy job on this world. And in this profession, we have a lot of responsibility for our clients, advocate for them to mitigate their legal risks going forward. And we have ethical requirements. So it can be a stressful job sometimes. I think one very important thing is I like to surround myself with good people, people who have passion to change that, improve the legal profession, and generally just make this world a better place. So I think people is absolutely a very important thing that AI now is taking over the world.

I think it's more important now than ever to have good people, to have good soft skills, and to have good people around you. So as a background, I'm part of a network of CIOs. For CIOs, it's like a close networking group.

We have guest speakers to do fireside chat like this. And one question that they ask is, what the most important thing for a company? I thought I'm an attorney and they're tech leaders. So I would think, like, for tech leaders, their answer might be, here, this is one AI product that will absolutely change the company. That's the most important thing is technology. But actually, I think I've heard repeatedly their answers are like people, their team, that's the most important thing. And they want to invest in their people.

Because the technologies change really fast.

The one sustainable resource of the company is people that can use the technology and that can adapt to changes. So I think that's looking back. And I think that's one thing that's really important for me, for my career choice. I want to work with good people and in a good culture.

IWCA, the International Women's Cyber Alliance, you're absolutely correct, Eric. I started this organization with a group of people I met on LinkedIn. Initially, it was just about ten people, mostly privacy attorneys, incident response attorneys, and cybersecurity professionals and IT professionals. We started that by doing Google Meetings and to chat about what's the most important thing in the cybersecurity industry, the trends in the security industry, starting from right after COVID.

So that was like informal group of women.

In twenty twenty two, we decided we want to form a formal nonprofit with this group of people. And I incorporated them in Delaware, I helped them to apply for a five zero one(three) status. So now this group is charitable organization focusing on educating and empowering women professionals in the cybersecurity industry. Now the group has more than about one thousand Wow. Members across different jurisdictions. And we have chapters in we're based out of United States, and we have chapters in UK, in France, and looking to expand in into Asia and Australia.

That's very interesting. And I'm so proud of this group's progress over just seeing the last two years.

To answer your question about the woman, I'm a data privacy attorney. A lot of them, they're like ransomware negotiators. They're regulators. They're IT persons, female IT persons. And it's just like a very aspiring, and I feel out by being part of this group.

And it's hard and challenging to succeed as a woman. I am a mother of three kids at home, so a lot of times I find myself it's really hard to balance professional obligations and household responsibilities.

And I think this is a real struggle for a lot of female colleagues and also for other mothers. So we discuss those topics a lot on different IWCA, International Women's Cyber Alliance, educational calls. And we have different programs about the trends in privacy and cybersecurity. We also talk about the personal development topics, including how to balance work and life and how to do personal finances. So those are the things we're trying to promote other female leaders.

And in addition to that, so last year I joined a program called CHIEF, which is an organization for female executives in the United States. I got assigned to my CHIEF's core group and with several other executives that are not in the legal industry, but in the other business functions. So we do core meetings to help each other and talk about different topics. And the core theme is that woman is taking a lot of household responsibilities, and it's really hard to do time management to balance work and life. We're trying what we can.

And I think it's really notable.

I think the ripple effect is a power for term, especially in this age of Internet. Something you put on the Internet, a small phrase, a post, Instagram that can reach so many people and can actually impact so many lives. I think thinking back maybe like in thousands of years ago, we all live in small villages and all we interact is fifty or a hundred people.

We can impact at most this five to fifty people. And now with internet and with AI, a small decision or a small phrase can really impact so many lives, can reach so many lives. So I think it's really important to make sure that you're making positive changes instead of inactive ones. I have been practicing law in about ten years, and I think one of the most fulfilling.

So going back to the contracts, I think, Daniel, the loss of business of contracting you shared, It's quite insightful, I think, with your other podcast speaker. So for example, I write contracts every day. There are those clauses that are really typical in contracts. Those are limitation of liabilities, indemnifications, and those are reps and warranties, those clauses.

And they write so many of them. And sometimes I forget, like, those words actually can be really powerful.

If things go wrong, the first thing the companies will look into is the contract. What does the contract say? Whether there's an indemnification obligation or not. That can impact how much the companies need to pay to indentify a bucket of liabilities or not.

I think that's just one example of contracts. So as an attorney, I have a colleague of litigators. I have a colleague of other IP attorneys that do patents and trademark and copyrights. In the litigation context, we're seeing small decisions can really impact the defense strategy of company.

And that can really impact what the settlement were diverted. So I think to summarize, it's important for me to try to make my decisions correct. I try to live by that every day.

Thank you for this question, Eric. And I think for the young generation, it's a unique challenge for them right now, the adoption of AI technologies. In the past, advice to law school students are reading and writing. Those are the important skills that you absolutely need to learn in law school.

From law school, those are the two important skill sets that law school students need to develop to succeed as a lawyer. But now, since twenty twenty three, with this adoption of AI and the emergence of CHET GPT and other very specialized legal tech, a lot of that is being replaced by AI technology. So AI can read so much faster, can go through large volume of documents in a minute and generate a response in several minutes, in like under five minutes. And in the past, we would have taken like forty hours of associate time to generate the similar response. So with that challenge, I think one thing is utilizing AI tech. It's very important for law school students to learn. I think a lot of several law schools in the country are already creating courses on how to use AI to practice law.

One other thing I think that's very important for young attorneys is actually, I think there are two very important things related to use of AI. So one is you need to know how to ask the right questions. So designing the prompts are really important. You want to take a legal question, parse it through to different parts, and then identify the issues and ask the AI to do the legal research.

And you need to understand how to judge whether AI is hallucinating or whether AI is on the right track. And then you need to converse with the AI and direct the AI to the right direction.

So that skill is really important for young attorneys. And the third one, I think, is the skill is especially important in the age of AI. You want to be able to analyze a large volume of data and water it down to be able to design a strategy for your client. So I think those are the three important things I'm hoping the young attorneys can have in order to keep competitive.

I absolutely agree with that. I think it's so important to have people that are creating different disciplines.

So I think that's the future world will need in the future to advance in technology.

Just for example, we want policy makers that understand how technology works. We also need lawyers that understand basically what the tech does instead of only knowing the contract terms. We also want to have engineers that, in addition to code, understand what the policies are and where things are heading. So I think it's so important to have people that knows different things, like the word you used, a well rounded professional.

Thank you for having me.