The “Data Diva” Talks Privacy, AI, and Governance

Thank you so much. I cannot tell you how excited I am to be on the show and to talk with you for sure.

Yes. Yes. That's so funny. Oh, when you say it, it sounds so grand. Oh my gosh.

Oh, that's so sweet. Well, I adore you, and I've known you for, like, a billion years.

Can't even say how long it's been that I've known you. But, you know, for me, I've always been a data person. So data data flows have always interested me, and so I kinda follow the data. So for me, it really wasn't about necessarily the tech or the industry.

It was just, you know, if I saw a problem, people would call me up. People call me up with all types of wacky things. So that that's how I ended up working in so many across different sectors or, you know, like, I have a legal base people that I know, you know, all the way from people who are starting in legal all the way up to, like, judges and, you know, GCs. And then I have people in, you know, different tech companies that I know.

So to me, it's fun. To me, it's fun. I think of data as, like, the center of the wheel, and so that's where I am. And so for the last few years, my focus has been privacy.

But the cool thing I love about data is, like, when you're focused on data, your career is like a coat that you could take off and put on something else. So that's pretty much what I did. I decided that I wanted to pivot and focus here on privacy.

That's a brilliant question, by the way. So I feel like records management folks haven't got enough of love from corporations or organizations because they truly do have the keys to the kingdom. Right? And so anything you want to do really in data, you really need to talk with these people.

And so I think part of it, maybe because the word records management doesn't sound jazzy enough. You know, it doesn't sound exciting enough. You know, when you think about records, a lot of times you think about, you know, file cabinets or, you know, this or, you know, servers. That doesn't sound very interesting or libraries and things like that.

But, really, the key, especially as we're moving more into more of AI age where everyone's so gaga about using new technology, I think what we're losing and what I think folks who have this background and records, if they can move their career forward in AI, would be what we're losing now is that we don't have curators. Right? So we have data that's being generated. You know, you don't know if it's good or bad.

You don't know if it's right or wrong. You don't know if it's gonna help you or not. And so what those records people were doing, they were curating. They were telling you, is important, and this is this is good.

This is bad. This is right. This is wrong. Right? And they they helped you choose how you use it.

I think when companies aren't using people as that kind of the data barriers or translators or stuff, companies really lose control of data, and they really can't leverage it the way that they want. So I'm seeing that more and more in AI. As a matter of fact, I think I spoke at a conference or a governance risk and compliance conference. And I was like, if I was, you know, with some of these big companies and I was trying to get, like, a, you know, AI, you know, whoever's the AI person in a company, I will a thousand percent go to those people.

Like, you know, I'm it's the records people. It's the governance people. They know why data's there, what's supposed to be there, what's not supposed to be there, how to basically use it. And so I feel like if having those people more integrated into these newer processes, these newer things that companies are trying to do, then they could truly feel the advantage.

I think what's gonna happen, though, is that a lot of companies will wanna move forward fast in some of these technologies, and they're gonna fail because they don't have that curation layer or they don't have that foundation. So I think it's all gonna come back to records at some point.

That's a big question, and I love to see this evolution happen within companies. I think part of it, and I love Eric's view of this, a lot of times I feel like when people think about records in a legacy way, they think about, okay, well, we talk to the records people upfront about what we're gonna do, and then some process happens, like, in a very predictable way. You know what I'm saying? And then there's an end part that happens with records.

Right? And so the problem with that is that the data is not on a linear path. Okay? We're no longer on linear path.

Right? So we have applications that are you're collecting data. You're not just collecting. It's generating new data.

It's creating new things that you didn't anticipate that it was doing. Right? And so without, I think, having those records people be involved all the way through the data life cycle, even with all the changes that are happening, that's where we're gonna get the most value as opposed to saying, you know, check this box at the beginning or check this box at the end or something like that. It's like the world now is not that way.

So I know we have seen for a billion years the EDRM life cycle. Right? It's it is kind of a linear sort of path. Right?

And they have some cyclical parts, but I think with AI, instead of a straight line, it's gonna be like a squiggly line doing all types of stuff. And it's like, how do you govern that when you were your mind is on a linear path. Like, this is not linear any longer.

It's like the progressive DNA cycle of, like, I helped start the Ethereum. So I agree. It was very linear. And now data is so cyclical and things come back.

Yeah. I know it's not very exciting. I think what we're saying is eat your vegetables. That doesn't sound very exciting.

Right? But I would say in order to get your dessert, you want the dessert, right, but you have to eat your vegetables first. Right? So I think part of igniting that is letting them know how the innovation that they want to do is tied to these foundational things that we need to be thinking about.

Right? So I had this brilliant woman on my podcast. She's the head of privacy in New Zealand. She's like the privacy commissioner of New Zealand.

And she said something that it just it was like a light bulb moment when she said it. And she was talking about, you know, this whole thing about innovation. Right? Or people like, well, we can't stop because we wanna innovate and stuff like that.

And we were talking about cars as an analogy.

And she said that the reason why we cars can go fast is because we created brakes. And I said, wow. I'm like, I never thought of it that way. And it's so true.

Right? It's like, what would cars be like if their brakes didn't exist? We all be on golf carts, right, on the highway or something like that. So thinking about the fact that companies want to go fast, they want to innovate, they want to impress, But having those foundational things there is what's gonna enable them to do that.

Part of those brakes, in my view, is figuring out why.

Why do you need it? What do you need it for in the first place? And so I think we have been in the mindset, maybe to start with the big data days or even like the early discovery days, where we're like, well, throw everything in, and then there's like this upside down funnel where things kinda get smaller and smaller and smaller. Right?

And so in the AI age now, companies that are really successful at AI, there's curation and there's information, and there's stuff that happens before things get thrown into a big hopper. Instead of assuming that the machine is just gonna work everything out and some magical diamond is gonna come out at the end, a lot of it is thinking about what goes into models to begin with. Right? And so that's a totally different conversation from people.

So we know that when people put in trash, you know, I know we've heard for years people say garbage in, garbage out. But really, an AI system is garbage in, junkyard out. Okay? So you get way more junk than you put in.

And so it gives me like a one for one type of thing. So being able to figure out what data you have, why is it there. And not only that, data has a life. Okay?

So I called I say data has a life from cradle to grave. You need to figure out what that life cycle is. And then also, if you're using AI tools, if you're getting results at the end that you did not expect, then there is a problem. Right?

So you shouldn't be getting unexpected things out. It's like, let's say you went to Costco and you ordered a cake. Okay. So you went to pick up the cake and they gave you a casserole.

And you're like, well, what is this? I didn't order a casserole. And you ask all these questions. Right?

So AI is similar where you're trying to figure out, okay, this is what I want.

At the end, here's the data that I have and see how it's going to solve the problem or answer the question that I have. So in order to do that, you have to have more foresight in terms of what goes into those models, what you're thinking that you wanted to happen, and then what that result is gonna be.

To me, that's a totally different shift in the mindset as opposed to throw everything in and they will see what's there.

You know, I think a couple of things happen. And Daniel, he can tell me whether he thinks this is right or wrong. And this is what I've had seen for many years. So remember a long, long time ago, olden days when it was really expensive to keep data?

Because of that, we had to be better carriers. People are like, oh, it costs so much to buy a server or this or that. So then those prices went down, and people are like, well, just buy another server. You know what I'm saying?

So, like, but it was always kicking the can down the road. Now we're seeing situations where people wanna use AI and use different tools. And because of the massive amount of data that they're using and the compute that they're using is getting more expensive again. So hopefully, we're gonna reach that moment where people say, wait a minute, not everything can work in this system.

You know, we need to be better. Also, you know, bad data in the AI system, you can't take it out. Right? So once you muck it up, you can't undo that.

And so, you know, we're seeing a lot of companies, especially, you know, the big companies that are building these AI systems, they're all wrestling to find ways to clean those systems because it's very expensive to build these AI systems. And so they're like, how do we get bad data out? How do we get the rot out, right, without having to scrap the AI and rebuild it from scratch? So they're doing, like, a lot of different things.

You know, they're doing RAG. They're doing you know, they're inventing things as we speak to try to find ways to be able to, you know, have models be useful, not forget things. You know, I did a video a couple months ago about catastrophic forgetting where a lot of companies are building workflows into AI tools, and then they will forget, like, the foundational knowledge, right, that you have built into it. Or if you're putting stuff in there that is not gonna be helpful in the end, the model can't tell what's important or what's not.

Right? So if you're putting all stuff together, it's kind of like diluting your value that you could possibly have from these systems because it is not gonna do that curation for you.

Yeah. That's a great, great question. But I think it's complex. So the complexity is, you know, even me as a privacy person, I definitely preach, you know, minimization and, you know, curation as we're talking.

And then from a legal perspective, especially if if a lawsuit has been filed or anticipation of litigation, you know, some of that goes out the window. But, you know, that's another reason why organizations really need to lay heavily on records, folks, because a lot of times once litigation is anticipated, you can't do anything. Like, you can't delete anything. You can't you know what I'm saying?

So you're just stuck with whatever you have at that moment. And so that makes sense, but, you know, I'm always trying to get companies to be more mature in how they handle data before a crisis comes out because you can't save money then. Right? So there's no money to be saved once the lawsuit hits your mailbox.

Right? And so being able to have things in the best way or to be able to manage your data in the best way, I think, is important. I'll give you an example. I know I work with a law firm, and I have put together, you know, a cradle of grave system for them about records and stuff, especially, you know, like, say, after litigation and stuff, getting rid of things.

A lot of times, a lawsuit is like a ban and amusement park. Right? So after a case is over, a lot of people, they don't really care about what happens to the date after they go to the next case. And I'll be like, okay.

So this case is over, you know, can we get rid of this data? And I was like, tough on that. And I know people kind of annoyed that I did that. But there was one situation where there was a law firm.

They had gotten a third party subpoena or something for something. So I guess some other company thought they had this data. And, you know, I said, well, we had destroyed it. Like, I have the certificate of destruction, and literally, the GC could have done a somersault.

They were, like, so happy that they didn't have to produce this data because we had taken that step. And so that's a lesson, you know, that brings it full circle. So use the data for what you need it for, but know that data has a life beginning to end, cradle to grave life. And if you do those things, you know, minimizing, making sure you have the right stuff, use it for what you need it for, and then make sure it's not, you know, around forever, especially in the data privacy field.

You know, what we're saying is, you know, certain data about people should not live forever in data systems. So this is a very different concept than the big data days where, like, well, let's keep everything because data is so valuable and blah blah blah.

This is a very interesting question. I talk a lot. I rage a lot about duplicates and why duplicates are, like, the bane of the existence of companies and how they deal with it. I think in terms of duplication, I would consider it a record.

So I give you an analogy. Okay? So and this is where the records people come. So let's say you had a hundred copies of your insurance policy.

Right. Okay. So you only need one copy to save for the company. And so those ninety nine copies, even though they represent that one copy, you don't really need those ninety nine.

And so that's basically what we're saying. But the problem is that companies create those ninety nine. How do you manage those ninety nine? And how can you know, there's a push with some technologies where they're trying to do the one copy thing.

You know, maybe there's a reason. Like, someone scribbled something on it. And so, okay. So because someone scribbled on it, now it's a new document.

Or someone did something else with it or they attached it to something else, and now it's a part of a corpus of things, and now it has a different meaning. You know, that's its own kind of document. So, you know, we can go on and on with these different analogies, but I think duplication in data is a huge problem. And so, you know, I remember back in the days when deduplication didn't exist.

Right? And so people are dealing with that. So that was a very important technology. But, obviously, duplicates can have many different forms depending on, you know, who's using it, who sees it, where that data is.

And so I think it just it is a complex question, I think.

I tell people AI systems are not databases.

So a database performs a very different function than what you're doing in a in a AI tool or AI model. They are transformers. So they take stuff, and they make things up, and they put things together in different ways. And sometimes it's not the right way, especially from a legal perspective.

You wanna make sure that any assistance that that is giving you, that you make sure that it's accurate is based on accurate information. And so you can put accurate information in. They could still hallucinate or do different things. And we're seeing a lot of cases around the country where lawyers are getting in trouble because it's like they're citing cases that didn't exist or something that's, like, incorrect.

And part of that goes back to you need to really consider the source. And so, you know, read cases. Say, for instance, you've been in antitrust law for thirty years, and all of a sudden you have this case and it has thirty new cases that you never heard of before. You know what I'm saying?

Like, you've been quoted the same cases for fifty years, and then you have thirty new cases you've never heard about. That's probably, like, you know, a red flag moment for you to know, hey. These don't exist. This is not true.

Right? You didn't hit the jackpot in that type of way. So I think it's always gonna have to go back to what are that initial source of truth, but then there has to be you know, you can't trust these tools to be accurate. And, you know, the laws are about people, and they're about companies.

So the AI tool isn't gonna be put on trial. They're not gonna get in trouble based on the input that they gave you. So we still have to be responsible as the people who are, you know, using these tools. So we can't abdicate our responsibility because of that.

I hope I answered your question.

We're in a new day and age. But what I want to ask you about is tell me not necessarily about all the successes, but what do people need to know about how a privacy practice can be set up incorrectly and what are the exposure and risks if you don't have a good map or a good practice for understanding how to extract and transform a model? Like, what happens in that context besides getting a whole bunch of trouble? That's a good question.

A lot of privacy is around context of data and who is using it and what they're doing with the data. Right? So let's say for instance a hospital. So a hospital, you have a doctor, your doctor has your medical records, and so that's proper context.

Right? Let's say the receptionist somehow sees your medical record. So now this is not the right context. And so that's what privacy laws are really trying to do, especially now the example I gave you is around kinda unauthorized access.

And I call it unauthorized access like the cousin of data breach. So it's not really a breach, quote, unquote, but it could be a reportable incident for companies. And then two, from a privacy perspective and this goes back to your records management thing about those schedules. So the difference is our retention schedules based was typically about how long you should keep things.

It was never about when you delete stuff. Right? So the records management, for example, for tax records, let's say I don't know. Maybe it's forever.

I can't remember. But let's say you're there, say, okay. You should keep your tax record for seven years. It didn't say that you must delete it in seven years.

Right? That's the difference. So in privacy, we're also not saying, you know, delete stuff after x years unless it's biometric. That's a whole different episode.

But, you know, they're saying at some point, the purpose for which you had it may expire, and then you have to take action of some sort. And so that is the thing that's new for companies because they never had to do that. So they could keep stuff forever, and it didn't matter. But now we're seeing a lot of, for example, data breaches.

So a lot of data breaches that you see are because companies have kept data too long. They no longer had a purpose for it. It just creates more risk for them. So, you know, people say, like, data's the new goal.

I'm playing off Daniel's name or whatever. Actually, I say data is like a lump of coal if you're keeping it for the wrong purpose or keeping it too long. So that's the tension that we have, and that's why we see a lot of people get in trouble for privacy. And a lot of times, it's around not believing or getting rid of things.

So, you know, there was a big company. There was a news. I shall not name it, but they had a phone that was recording people, and it was only supposed to only record when a person said like a wake word or something. Right?

And so they got in trouble because the thing was recording more than that and those recordings were being used by other people and they were not happy about it. And so this thing is settled out of court quite a few million dollars. But I think what people don't understand about data systems is that they're made to remember data and not forget it. So if you're not taking some conscious step to do that, you know, deletion, purge, anonymization, pseudonymization, you're gonna be stuck with more risks.

So I tell companies data that has a low business value has a high privacy or cyber risk. So there should be some trigger events and some triggers in companies. You know, maybe they're looking at schedules or creating, like, deletion schedules or something on a regular basis to see kinda what that, you know, has our purpose been extinguished? What are we doing with this data?

You know, who needs to take action and when?

I think companies have to change in the future. I feel like a lot of organizations are kinda like Sam's workshop where everyone works on their little bit of things. But when you're talking about data, you're talking about data life cycle and stuff like that, someone needs to have more of a bird's eye view of data from cradle to grave all the way through a process. And you need to have points where you ask questions.

Right? Where questions can be asked about data, what you're doing with data. Because a lot of times that purpose can be lost. Right?

That context can be lost. So there is an example of a company. They asked consumers to give them their phone number so that they can set up multifactor authentication. So they did the proper thing from a privacy perspective.

They asked, they told them what they were gonna use the data for, which is fine.

Then later on, somehow that data got in the hands of marketing and they just started using it for marketing purposes. So they weren't approved to do that, and so they got in trouble for that. And so this happens a lot in companies where the purpose for which something was collected gets lost and people lose control of the context by which they have collected something, and that really is the danger in companies. So a lot of times, organizations are extremely good at collecting stuff.

Very, very bad at the leading, figuring out what that noise strategy needs to look like for data. So a lot of companies, because they don't have a good analyze strategy, they keep the data. Sometimes they put it on, like, old server, you know, in the back room where no one they think no one's, like, looking, but hackers love it. You know, that data may not have a good value to you, but hackers love it.

You know, someone who's trying to do something nefarious or, you know, even not nefarious. A lot of things that happen when the companies are not nefarious. They just, you know, make mistakes. There may be some oversight that wasn't there.

That's typically how companies get in trouble with privacy.