Become a Creator today!Start creating today - Share your story with the world!
Start for free
00:00:00
00:00:01
Data, Privacy, and Podcasting: Andy Dale, GC & CPO, OpenAP
106 Plays11 months ago
In an always-changing ad tech industry, how have privacy and data protection emerged as two of the largest challenges that organizations need to face? Whether it’s streaming platforms, engineering AI models, or aligning key industry stakeholders, these topics are evolving faster than the world can keep up with.
OpenAP GC & Chief Privacy Officer Andy Dale has been leading conversations about privacy and data protection for more than a decade. He shares stories and advice from his time as the only privacy counsel at Mastercard, an organizer of some of the first privacy and data-focused industry groups, overseeing privacy at standards-making body OpenAP, and co-hosting his popular and influential podcast for more than 80 episodes, Data Protection Breakfast Club.
Read detailed summary: https://www.spotdraft.com/podcast/episode-25
Topics:
Introduction: 0:00
Predicting the importance of data protection and recalibrating your career: 3:24
Connecting laws and data in the privacy sphere: 6:52
Leading privacy diligence during SessionM sale to Mastercard: 11:25
Identifying your interests to determine your next professional move: 15:26
Working across competitive lines at OpenAP: 19:35
Predicting the data and privacy ecosystem ahead: 24:36
Viewing AI through privacy and data protection: 27:50
Evolving the Chief Privacy Officer role: 30:19
Advice to junior lawyer breaking into privacy: 33:48
Co-hosting a podcast about privacy and data protection with over 88 episodes published: 38:22
Privacy-related book recommendations: 44:06
Advice to younger lawyers: 45:16
Listen to an episode of Andy’s Data Protection Breakfast Club podcast: https://podcasts.apple.com/us/podcast/trevor-hughes-ceo-at-iapp/id1559290322?i=1000514250595
Connect with us:
Andy Dale - https://www.linkedin.com/in/andy-dale-7705b83/
Tyler Finn - https://www.linkedin.com/in/tylerhfinn
SpotDraft - https://www.linkedin.com/company/spotdraft
SpotDraft is a leading CLM platform that solves your end-to-end contract management issues. Visit https://www.spotdraft.com to learn more.
Recommended
Transcript
The Impact of Privacy in Advertising
00:00:00
Speaker
I go right to the CEO and the CTO and I'm like, this is huge. Like this is going to change everything. And they were like, Really? Are you sure? And then I, we started digging in. And it just became so clear that this was going to be fundamental, not just to privacy, but to advertising in general.
00:00:24
Speaker
Before we get started with today's episode, I want to tell you about Spotdraft. If you spend hours every week drafting and reviewing contracts, worrying about being blindsided by renewals, or if you just want to streamline your contracting process, let's talk about an end-to-end AI-powered system that'll save you time.
00:00:43
Speaker
Spotdraft is a contract lifecycle management system that helps in every stage of contracting. From creating and managing templates and workflows to tracking approvals, e-signing, and reporting via an AI-powered repository, Spotdraft does it all. And because it should work where you work, it integrates with all the tools your team already uses. Spotdraft is the key that unlocks the potential of your legal team. Make your contracting easier today at spotdraft.com.
Andy Dale's Journey in Privacy Law
00:01:16
Speaker
Want to break into a privacy role? Where is privacy headed and how does AI fit into all of this? No one knows better than my guest on the abstract today, Andy Dale. And not least because he's done 88 episodes of his podcast hosted with Pedro Pavone, the Data Protection Breakfast Club. In addition to DPBC,
00:01:40
Speaker
Andy is the General Counsel and Chief Privacy Officer at OpenAP. And before that, he was a legal leader, GC at companies like Alice, Session M, Data Zoo, had a couple of transactions in there. Andy, thanks so much for joining us today. Tyler, great to see you. How are you? I'm doing well. I'm coming off of a holiday break, which is a nice place to be.
00:02:05
Speaker
Let's settle something first. It's in the name of your podcast. Is it privacy? Is it data protection? Is it neither? Is it both?
00:02:17
Speaker
Pedro was the one that advocated for data protection breakfast club. And I actually think it's arguably sort of six half dozen, but I think data protection, the idea is that it subsumes a larger surface area than just data privacy. So it potentially pulls in information security. That relationship is really critical between legal privacy and
00:02:42
Speaker
and the infrastructural side of the business. So that's a really critical piece. I think it bleeds into product counseling and those kinds of things. So I do think data protection is probably where I would like to play my role mostly. Privacy is very specific. In terms of the US right now, we have all these different laws that I think are focused on data privacy.
00:03:05
Speaker
But I think it's going to evolve into a more globally expansive idea, which is probably data protection. I'll be curious. I'm going to ask you later on about how AI fits into this and who ultimately should be taking that up, that sort of thing.
The Evolution of Data Protection
00:03:23
Speaker
But now that we've settled, that we like data protection as the term, let's go back a few steps in your career.
00:03:32
Speaker
You were really, I think, one of the early folks to latch on to data protection, latch on to privacy, carve out a bit of a niche, build a persona around it. Back then, did you have any idea that privacy data protection would become what it is today? Did you see that coming?
00:03:49
Speaker
Not initially. I don't think any, I think people would be lying if they said they could see what it would be, what it is now. I was working on the in-house legal team at TD Ameritrade and I had a boss, David Hill, who was the chief privacy officer. He sat right next to me. And I remember being like, what's the chief privacy officer? What is it? And when he explained it to me back then, he was one of the first people that had like a IAPP certification up on his wall.
00:04:15
Speaker
piece of paper with a thumbtack, basically. And he was like, this is a little organization I joined. But what happened was, at that time, it was really focused on financial data. It was broker dealer. And there was a Gramm-Leach-Bliley Act. So compliance with that. And the GC said to him, like, I don't have anyone to do this. Will you do privacy? And he was the head of IP at the time. And he was like, okay, I guess. And then all of a sudden, within 12 months, it was like over half his job.
00:04:43
Speaker
And I saw that, he told me that eventually I went and worked on his team doing commercial work and privacy, which really was the foundation for me to go be a general counsel, because I think that crossover between commercial work contracts and privacy and data issues, I don't want to say it's the number one thing, but it's a pretty significant moniker to carry if you want to go in-house and want to be an in-house lawyer on a legal team or GC. I think those two things in tech companies really matter.
00:05:13
Speaker
So I was fortunate that that had happened. And I think when I left Ameritrade and went in as the first lawyer at Data Zoo, the CEO was a former lawyer.
Privacy's Influence in Business Strategies
00:05:22
Speaker
And he had been a GC. And he had been a lawyer in Washington, DC, and then a general counsel of a couple tech companies, but had been long past that. But when we met, the first time we met, I was like, look, what's important to this business beyond the day-to-day? I know you need me to do the contracts, and I know you need me to do it.
00:05:41
Speaker
weigh in on an HR issue here or there, but what do we really needed? The first thing he said was privacy. He was like, it's going to be a big thing. It's been something relevant for a while. And so I took that cue and I dug in and what I realized over
00:05:56
Speaker
The first couple of years there was it wasn't just the world around us, but it was critical to that business. So it helped me elevate. It was an ad tech company and there's tons of privacy issues there. So it helped me elevate myself into more things, you know, do more things in the company. And I think that was the moment right around that time when I started to realize, all right, like.
00:06:14
Speaker
It's both growing in the world and it's really like hyper important in this business as well. So let me, let me become an expert. Let me like draw on a thread there, I think, uh, which is part of privacy and data protection is, is about understanding the laws and part of that feeds into contracts and another big piece is understanding data. And that's when you're talking about it being really important to the business and where the product is headed. And, uh, how do you think about those two pieces and.
00:06:44
Speaker
like what you did first and what you eventually grew into in those roles.
Navigating GDPR Compliance
00:06:50
Speaker
Talk a little bit about those two concepts. There was a little bit of a forcing function there from the GDPR. So we had the data protection directive, which we were aware of and complying with generally, but every country has its own
00:07:05
Speaker
you know, law there when it when it's a directive, opposed to a regulation. So the GDPR gets announced, I go right to the CEO and the CTO. And I'm like, this is huge. Like, this is going to change everything. And they were like, really? Are you sure? And then I, we started digging in. And it just became so clear that this was going to be fundamental, not just to privacy, but to advertising in general.
00:07:30
Speaker
And I just said, we got to lean ourselves in here. So the CTO and I started focusing some other folks in product. I got people around the business rallied around the idea. And then I started connecting with all of the GCs and CPOs of the ecosystem companies. So from related players, so like App Nexus, Google, Facebook,
00:07:51
Speaker
Quantcast, just all these other ad role, all the GCs in this area, because it was easy for us to collaborate because it wasn't competitive. It was, how do we get through this? How does the industry get through this? So I think it forced me to get really focused on how we use data, spend time with products, spend time with tech, learn what the ecosystem is doing. And then I could relay some of that back to our company and say, look,
00:08:19
Speaker
the whole supply side of the ecosystem thinks this.
00:08:22
Speaker
the demand side of the ecosystem thinks this. What do we think? And that became ultimately like a pretty valuable mouthpiece. Talk to me a little bit about those other stakeholders and whether or not maybe they saw where the ecosystem was headed or they saw the risk just as well as you did. But were they skeptical at first? Or did you really have to kind of build trust around this? Or was the business case for investing pretty obvious from the start?
00:08:51
Speaker
They were skeptical only in the sense that at that particular company, we didn't have, you know, tens of millions of dollars of EU revenue. We had some and we had teams there and we saw growth there and we had a couple big customers. So it was enough that we felt, okay, we have to focus on this. We don't want to lose these big customers. One of them I think was also an investor. So we had like reasons.
00:09:17
Speaker
to think very seriously about what was going to happen and be smart on it because we knew they would ask us about it. So I think the investment of intellectual capital was easy to get. But the other type of investment is always harder to get. It was like, how do we act? OK, so how much money are we actually going to put into building something against what is really an unknown spec in a lot of ways? So what ultimately ended up happening was
00:09:46
Speaker
The circle of friends that I had helped convene with Pedro and with another guy named Vivek, who was the head of privacy at Rubicon project and has gone on to be a GC at other places. The three of us started connecting people together. We got a group and we started talking and the GC of Quantcast was a woman named Gita who is at Google now on the policy side.
00:10:09
Speaker
But she took up the mantle with her product team of really working on what does cookie compliance look like under the auspices of the GDPR. Plus, we also had another law, the e-privacy directive that was potentially going to become a regulation at the time. It hasn't yet, but it was then.
00:10:27
Speaker
So Gita was like, let me try to solve this. So they came up with sort of a solution for passing signals. She took the mantle on that, raised it at an industry group. The industry group really liked it. And then eventually it got passed off to the IAB, which is the Interactive Advertising Bureau in Europe, the Europe version of it. And
00:10:48
Speaker
They took on that project and pushed it out. And it was in use for several years until it got struck down by a case in Europe. But ultimately, we had to come up with a solution. And luckily, that group helped push it forward. And so at that point, I was able to go, all right, this is what a lot of the folks in the industry are doing. Then I had something that our company could react to. And I think eventually, we went in and honored that signal as well.
00:11:17
Speaker
We're going to come back to this idea of working with industry orgs and privacy and how important that is. I also want to pull on a thread that you just raised, which is around how investors might care about privacy. And I think maybe if folks look at your background, one of the things that might stand out is you, when you were GC of Session M, helped engineer the sale to Master Carton, a pretty big transaction.
00:11:43
Speaker
good accomplishment for you as well. I'm curious for broad lessons from that experience, but also what was the diligence like on the privacy side? Because I think that you're going to see more and more of that in investments, but you're also going to see that in M&A and other transactions.
Privacy in M&A Transactions
00:12:05
Speaker
The M&A diligence, as you'd imagine, was much, much heavier. Yeah.
00:12:12
Speaker
around while I was there. It was a continuation round existing investors and there was a diligence call, one call, and it was me and the CFO. I remember thinking to myself before the call, great, this is going to be like all him. They're just going to be asking about the health of the business and
00:12:32
Speaker
you know, forecast and kind of some of our basic diligence questions. Instead, it was all me. It was the entire thing was privacy. And it was just really focused on it was the law firm kind of driving it. But I think it was also the the investor, you know, needed to know what we were doing with data. So I think there was certainly a heightened awareness of privacy issues at that time. Then when we went on to do the diligence of the for the deal to sell the company,
00:13:01
Speaker
it was exhaustive in terms of the privacy stuff. And in fact, MasterCard has a privacy team that does privacy diligence.
00:13:12
Speaker
There's an info sec team that does info sec diligence. And then there's a data strategy team that does a separate round of diligence on strategic uses of data. So really I was pointed in three different directions on privacy diligence. And at, at session M we sold it relatively quickly. I didn't have time to hire a team. So it was really just, it was just, it was me and outside council, you know, really working on this. Luckily I had.
00:13:38
Speaker
had the ability to have really great outside counsel was a global company. So we had a lot of global privacy issues. It wasn't a big company. And so we constrained resources. But to answer your question more broadly, it's a huge deal for companies. And I think investors, it's something they like to know is being taken care of. I don't know how much it informs their ability to do a deal or not do a deal. But I think they're very happy when they hear that you're on top of it.
00:14:09
Speaker
When you were going through that diligence process, was it possible for you to keep any of the other sort of trains running on time or projects running in the business or is that all consuming?
00:14:20
Speaker
all consuming. Yeah, it's almost impossible. The only thing you're keeping alive at that point is like a deal that's at the finish line. Yeah. It's all I'll tell you a story quickly. Like I have two young kids and I said to my wife like this next these next couple months are probably going to be a little crazy. How can we support each other through it that kind of thing. And there was one night in the throes of the deal when
00:14:48
Speaker
Our CEO emailed me at 11.45 at night. I was sitting in bed about to go to bed. And I wrote him back at 11.45 and then like 11.50 my phone rings. And I just said to her, I got to take this. She's like, what are you crazy? It's midnight. And I was like, yeah, this is what you do when this is the biggest moment for the company. So
00:15:12
Speaker
took the phone call in my bathroom and got through the issues. But that's what it was like. It was all heads down. There were all nighters. We spent a couple super late nights at our law firm's office. Just get the deal done. Yeah. As you sort of moved from
00:15:29
Speaker
those really data-heavy businesses, Data Zoo and Session M, thought about Alice. Now you're more back in ad tech at OpenAP, which we'll chat a little bit about. But how did you think about what interested you next? What would make you curious again? Well, you know this from having spent a little bit of time in advertising. That GDPR period was tumultuous for ad tech and a lot of unknowns.
00:15:58
Speaker
And so I had been doing it for four years at that point, and some of the pieces of the ad tech market were struggling.
00:16:08
Speaker
And I said to myself, I did the same thing at Ameritrade. If I stay here longer, I'm probably going to be thought of as a financial services lawyer. And I thought to myself, if I stay here, I'm just going to be in ad tech forever. What can I do that is a concentric circle around ad tech so that I'm still able to be thoughtfully connected? Because that network I have,
00:16:29
Speaker
was really, really valuable and great. And I didn't want to lose that. So I tried to find something tangential. Sashnam was marketing tech as a customer data platform and had ad elements in it. But it was a martech company, which really helped me focus on something like a little bit different, a different flavor of the same meal, basically.
Return to Ad Tech and OpenAP's Vision
00:16:53
Speaker
And then when I went to Alice, it was the same idea. Alice is a
00:16:57
Speaker
gifting platform that was integrated into CRMs and platforms that are doing sort of account-based marketing.
00:17:07
Speaker
If you've heard of like demand base and sixth sense, I focused company based targeting, they have a big ad component as well. And so it was contributing to the same general business proposition. And so that was why and then I just other other intangibles, I like the team, I like what we were doing there. And so that really was the impetus. But then, you know, after when I started looking for what was next,
00:17:33
Speaker
I missed ad tech and it became a different, it was a different time by the time I was refocused on it. And the TV side is obviously where the action is, no doubt. And I was just like, this is a really interesting opportunity. I had another opportunity at the time as well. So it was like,
00:17:52
Speaker
kicking around two different things, but I was just sold on the opportunity to get back in and do something. Streaming TV needs to have a better ad infrastructure. It will. It just will. Tell us a little bit more about OpenAP and the structure. It's kind of an interesting structure where you've got a number of member companies that sit on the board. Let's start there. Talk a little bit about the structure of OpenAP.
00:18:18
Speaker
Yeah, it's a joint venture owned by NBC Universal, Paramount, Fox, and Warner Brothers Discovery with a small investment in 2021 as well from Snowflake. It sort of started out with most of those members. There was like one change I think Turner was in in the beginning and then it became Warner Brothers Discovery. But for the most part, it's been the same owners. They work together. They work across competitive lines.
00:18:47
Speaker
It's more about rising tide lifting all boats in terms of the technology that's used, how they can do audience creation and measurement that supports what agencies and advertisers are trying to do.
00:18:59
Speaker
and make the publisher inventory more valuable at the end of the day. So all the tools and bells and whistles that you can create that make it easier to get insights into how my ads performed, the more likely the agencies are going to use it, the more likely the advertisers will use it. So that is the basic premise. And as streaming happens, there's just more and more activity in terms of what streaming campaigns look like. So the initial
00:19:25
Speaker
sort of phases, more linear TV, more general standard buys and now moving more into the digital realm, I'd say. And there's not a government affairs component to it today, is that right? Like in the sense of maybe a more traditional industry or association? Not at the moment, although it's not government affairs per se, but we also helped found
00:19:53
Speaker
this thing called the US Joint Industry Committee, which is a committee focused on developing alternative currency ideas for streaming. And by that, I mean alternative ways to measure advertising in a new world, in a new way. This Joint Industry Committee, which is a nonprofit, there are two subcommittees that are working on, you know, basically working groups on issues.
00:20:20
Speaker
And so while it's not a government affairs type situation, it's definitely collaborative work, industry focused, and I think gonna eventually potentially have those types of concerns at some point. Drawing on some of your prior experience, working with folks around cookie consent signals at the sort of industry org level, now the work that you're doing today, can you talk
00:20:48
Speaker
maybe first about the importance of having these sort of standards making bodies and also how you think folks can leverage engagement to help both their companies and also their own careers. I think that actually these groups can really be accelerants for folks that are able to drive value for their businesses through standards making, et cetera.
00:21:12
Speaker
Tyler, that's a very astute observation. And I think you and I both know this personally, that these groups can do this for us. And so I sat on the board of the network advertising initiative. And that was a massive opportunity for me personally. Certainly my company was supportive of that. And it helped us get insight we just would never otherwise have had. Yep.
00:21:36
Speaker
I'm at the table with lawyers from the key companies. I can pull the lawyer from Google aside around the GDPR and say, look, what you do really impacts everybody. What are you thinking? And they were pretty open about
00:21:54
Speaker
directionally, they're gonna tell you exactly what they're gonna do, but pretty open directly about like, what they think is right, and what they think industry norms should be really. So we were able to have conversations and that obviously I've made those connections personally then at that point.
00:22:10
Speaker
that circle was really valuable. And then when I went off to other companies, I didn't necessarily have the industry body. What I did was make sure that I knew the GCs and privacy people directly in our ecosystem.
00:22:26
Speaker
Because that's the next best thing, or better, frankly. So when I went to Session M, I made sure that I got to know the GCF segment, for example. And Mark Kahn became a friend of mine, and they sold to Twilio, and I could bounce ideas off him, and vice versa. He's just an incredibly great human.
00:22:47
Speaker
He was a podcast guest a few episodes ago, actually, yeah, give it a lesson. Well, then you recognize how dynamic of a person he is, certainly somebody that was willing to, you know, bat around issues that are complicated. Yeah. I did that with a couple other folks in that space as well. But then when I went to Alice, the same thing that the general counsel of six cents and demand base became
00:23:12
Speaker
you know, confidence and allies. And we shared ideas and asked each other questions and really, really important stuff. And I've done in a joint venture, I've had to do that even more, you know, because those companies literally own our company. So and then in this company, in the TV and media space, industry committees are, you know, I hesitate to say rampant, but they're, they're very, very important.
00:23:36
Speaker
More importantly than I even had a sense for when I joined, I didn't realize that so much of the collaboration is happening there because it's a safe space to collaborate, I think, as opposed to like collaborating off on the side on your own. I think this provides that place for people to talk about non-competitive issues together and things that lift everybody.
00:24:01
Speaker
It's not a partnership where both sides are thinking about their commercial interest as being sort of the paramount piece. How do we understand where the ecosystem is heading? Let's pull on that.
00:24:15
Speaker
Um, how much of privacy work, data protection work, when it starts to be at sort of a high, higher level is about understanding the competitive landscape or understanding where an ecosystem is headed, trying to predict that as opposed to sort of a strict reading of law and regulation. That's a great question.
00:24:36
Speaker
There's two answers. One is in sort of my role as general counsel, I think that is maybe the most important thing I can do. In terms of understanding the direction that the ecosystem is going, what people want to do and how they want to do it, it helps you in every phase of lawyering. It helps you in negotiations. It helps you in your contract clauses. What should they look like? What matters? What doesn't? Where you can place
00:25:03
Speaker
liability on things and where you can relax. So it certainly has an impact across those things as well as on the privacy side. That is
00:25:16
Speaker
We're in a world of gray area because so many new laws are here. So I think understanding that the ecosystem and what people do and how they do it and how they use data is really, really critical. And then the first thing I'll say is understanding your own data and how you're using your own data is critical as well. So I think you may have caught me on a question where
00:25:40
Speaker
where just I am a person that indexes more heavily on the ecosystem and on what those on the value that I think that brings versus a really technical privacy read. I think I have outside counsel to help me there. And so I do rely on
00:25:57
Speaker
on multiple outside counsel. I'm not somebody that has one privacy counsel. I have four. All with different areas of expertise. You have someone for GDPR, you have someone for California state laws, US laws, you might bring someone in if there's more of a congressional angle. Talk to us a little bit about that.
00:26:21
Speaker
It's a good question. It's not necessarily broken down by legal lines. It's actually, I think, broken down by what people do well. And I think that takes a little bit of trial and error. But I have one lawyer that I think really bridges the gap well between commercial and privacy. So that person helps me on the privacy policy, helps me on, and their firm helps me on how our contract templates should look.
00:26:48
Speaker
key questions around big contracts and big deals. What should this look like? Because there are very few people I think that can span commercial and privacy together. Then I have folks that maybe I'll ask a question more about like
00:27:03
Speaker
hardcore ad tech, industry position, who's doing what, what position should we take on this issue? That person is really good for that. And then somebody else, perhaps on a very heavily nuanced product issue, what should this say when this pop-up happens? And then somebody, as you noted, around Europe, just in general, that's a separate, I think that's a bit of a separate being.
00:27:32
Speaker
I think you can do it with the same lawyer sometimes, but often that other opinion, particularly from someone in the region, I think is really important. So I'll kind of divide it up that way. We've talked quite a bit about understanding where the ecosystem's headed. So we got to talk about AI for better or worse.
AI and the Future of Privacy
00:27:56
Speaker
I guess maybe a place to start is where you think privacy and data protection and AI, like how do they fit together? Yeah, let's start there. And then I wanna ask you about roles and responsibilities around this too. Honestly, no one knows. I think if they're answering that they know for sure, this answer, then they're just not being truthful.
00:28:23
Speaker
I think privacy has a role to play like everybody does like the data that's used to build models. I think we need to have privacy considerations there. But frankly, the first issue is IP, I think, you know, in terms of how to focus on
00:28:39
Speaker
the models themselves and what's being created, what content's being created, what kinds of products and services are created, how they're created, what data is used to create it. So there's IP issues for sure. I think the answer to who should own it is a very interesting question because I think what you see is you see this
00:29:00
Speaker
And this is not not exclusive to lawyers. It's probably in other industries. I just I see it because of where I am. Everybody wants to be first. There's a first mover advantage in learning as much as you can about AI.
00:29:16
Speaker
and digging in and being the one that's speaking at a conference about it and the one that's vocal, writing an article, having tech conversations. And so you're seeing both the IAPP lean in really hard on AI governance. I think that's a smart move. Sure. But like they certainly don't own the space. They're going to take it upon them to help create experts.
00:29:39
Speaker
through training and it's going to evolve. That training will evolve over time because AI is going to evolve so rapidly. So they're replicating their model in AI. I think privacy pros can, cause we're technical in some aspects can ish for lawyers. I think can try to jump into AI, but like,
00:29:58
Speaker
I had dinner with some of our outside counsel and one of them was a patent lawyer and he's focused on this stuff too and he should be. What role can he play in that? How can he advise early stage companies that are wanting to use AI and wanting to leverage models? How can they do that?
00:30:18
Speaker
Do you have thoughts on how the CPO role, Chief Privacy Officer role is going to evolve over time? Do you think that these sorts of changes are gonna make it a sort of more technical role? Are they gonna make it a role that's more focused on legal reads? Is it gonna become more strategic? Is there room for all of those? I mean, those are just a few options that I'm coming up with off the top of my head, but where do you think the role is headed? In some part, Tyler, I think it depends on the person.
00:30:47
Speaker
Yeah. If somebody is inclined for strategy and inclined for product development advice and inclined towards how do we grow, they may do that. And some person, somebody else might be inclined to focus on how do I contain our risk?
00:31:05
Speaker
You know, as a large organization, that's a big thing on somebody's mind. How do I contain our risk and innovate? How do I do that? That's hard. So I think it's going to be very, it's going to continue to be variable, which I think makes it fun and interesting for people. Yeah.
00:31:21
Speaker
In my personal point of view, I believe and have been vocal about this in the places where I can be vocal. I think the CPO role in the future and privacy just in general is going to just be elevated into the GCC more frequently. Because I think traditionally, we've seen a couple different areas
00:31:48
Speaker
kind of tend to move into that GC role. Historically, way before, you know, 20 years ago, it was the outside council comes in. Sure. They got to know the team, they got to know the board and the company. And they're like, Hey, it makes sense to bring this person, you know, into our company. I think that probably still happens to some extent.
00:32:08
Speaker
but less so. More people are groomed in house and then somebody comes up and ends up in that role. And so I think the more recent model was that's an internal person and that's one of a couple roles. It's somebody that has done corporate work at the board level and been doing
00:32:32
Speaker
M&A transactions and has been involved in public company work, if they're public, that person. Or it can sometimes be like a deputy GC that's owning a couple functions.
00:32:45
Speaker
maybe it's corporate employment, IP kind of with a large top-down structure, or a litigator. Litigators often have exposure to large areas of the business. The reason I think privacy is that next thing is it touches every aspect of the business. So the privacy lawyer has to know what has to be up on
00:33:04
Speaker
what's happening in the people org has to be up on what's happening in product, commercial, IP. There's no place that we can hide. I think it's a nice window and I've actually seen it happen a bunch of times already.
00:33:22
Speaker
That's a great roadmap of sorts for people who might be thinking, hey, I've got privacy experience. I want to position myself for GC position. What about for those folks who are even more junior, who are thinking I want to break into privacy?
Breaking into Privacy Law
00:33:40
Speaker
Do you have general advice or recommendations for breaking into a privacy data protection role? It's pretty hard right now. I think it's actually an industry problem.
00:33:52
Speaker
right now. And I've talked about this with good friends. Jules Polinetsky is the CEO of Future Privacy Forum. I've talked extensively with him about this problem. I've talked with a friend of mine who is a partner at Goodwin, Omer Tene. He used to be at the IPP. We think it's a problem. It's very difficult to get the zero to three years of experience if you want to go into privacy right away. It's almost impossible.
00:34:19
Speaker
And so that problem has to be solved at some point. Everybody wants experienced people. And then it's equally difficult to move into privacy from areas that even might feel adjacent like product counseling or IP or something. I think it's easier there if you've done that, but I can't tell you how many times, you know,
00:34:41
Speaker
someone will reach out and they'll be like, I'm so interested in privacy. I love it. And I've been litigating, you know, criminal matters. You know, it's like, how do you, how do we figure this out? Because it's just so unrelated and somebody's not gonna, it's very hard to get someone to lean in. So the advice that I've given in that case is just show as much interest as you can, in general. And, and
00:35:11
Speaker
Do it outside of work, write articles, show up at privacy events. Just be in the scene. Start to show publicly that that's your thing. You love it. And that will help you position yourself to have someone take a chance on you. I met somebody just like this a couple years ago. She was a lawyer in a law firm in New Orleans. And she had done a tiny bit of privacy work, but not very much. And I could tell she was like,
00:35:40
Speaker
just great, loved it, was passionate about it, willing to work really hard at it. And I had an open role and I was like, I would hire you. I would hire her in a heartbeat. But I ended up converting the role to a more experienced level and hired someone with 12 years experience that was doing other things. So I essentially shelved the role, but I would have hired her for it.
00:36:04
Speaker
And what ended up happening, I said, let's stay in touch. And we did. And a role came along at a company where I happened to be able to tell a couple of people about her. And she got the job. She's a full, as strong a privacy lawyer as you'll come across now. And because they took the time to let her have a chance and train her. And that story, we need more of that story. And it's difficult to replicate.
00:36:31
Speaker
I mean, this podcast is about you, not about me, but to a certain extent, that was my experience. I didn't have privacy experience. I was public policy and I was hired and given great resourcing with outside counsel and VP of finance who had been sort of moonlighting on privacy. And they said, look, like, you know,
00:36:52
Speaker
Spend three to six months and learn this and we'll train you and we'll provide you with resourcing. I'm very thankful for that. It was great. It was huge. I didn't expect this was right when GDPR was about to come into play. I didn't expect it would grow into anything that it has. What's a tremendous example, Tyler? On our podcast, we've talked with GCs so many times about getting stuff done.
00:37:18
Speaker
And the person that stands up and gets stuff done, people notice. We had, do you know the former chief legal officer of Block, used to be Square, Sivan. Sivan's described it as run towards piles of shit. I love that description because what she means is take on the stickiest, nastiest problem that no one wants to touch,
00:37:46
Speaker
Get in there and make an effort at trying to solve it. And inevitably, that will pay dividends for you. So it's the same idea. Privacy, it's not a pile of shit, but it's complicated, right? It's really difficult right now. So if someone is willing, as you were, to say, I'll get in there. I will figure out what makes sense for this company. Or I'll at least give us a read on it. People are totally receptive to that.
00:38:15
Speaker
That's another way somebody internally, if they're already in a company but doing something else, they can take on a project that helps them evolve.
Podcasting During COVID
00:38:22
Speaker
As we start to wind down a little bit, I've got to ask you about the podcast, your podcast. 88 episodes is really impressive. I know it's sponsored by or helped organize by Tech GC now. Tell us a little bit how you got started. How did you and Pedro decide to do this?
00:38:44
Speaker
And I met him in like 2014, 13 or 14 at a conference we were speaking together. And it was one of the first times I ever spoke at anything and I met him. We were both early and unprepared. We ended up talking just the two of us for two hours straight. We were purportedly working, but we just ended up, we were so interested in one another. You know how you just meet someone and right away you're like, this person is my friend.
00:39:10
Speaker
Yeah, he and I just clicked and we we kept having these conversations and I mentioned the sort of triumvirate of Pedro Vivek and myself around these complicated issues together and and then over time he just he moved I moved to different companies, but we kept finding ways to to connect and sometimes work together and work on things and um It just became this really really valuable friendship and relationship
00:39:37
Speaker
When COVID started, maybe a little bit before, when I started working at Alice and a little bit before, he and I had been sort of batting around like, would anyone else enjoy these conversations? You know, we don't, we convened a group of people to have similar conversations, but we were often
00:39:56
Speaker
kind of pushing the conversation along. And so we thought, maybe we should try to do something. And my company, Alice, was all for it. They were like, go do it. They had a guy, shout out to Gons, who produced it for us in the early days. It made it look awesome.
00:40:13
Speaker
And it just came out really well. And then eventually, Chris Sands called us up and was like, I love what you guys are doing. It needs to sound better. And so really, it's been this really nice evolution, friendship with Chris, partnership with TechGC. They gave us the equipment to make it sound better, and they helped us produce it. And it's an extremely low amount of work, given the value that I hope
00:40:42
Speaker
people are getting from it. It's just fun. So it started out Tyler is as a way to like, connect with our friends, see people during a time when everyone was remote and kind of produce something that felt fun. And we've just been having a blast doing it. I never thought we would do 80. We're gonna we're gonna get to 100. Like that's our milestone for sure. We're gonna get to 100 to 100 this year. And we're gonna we're gonna celebrate and we've created unwittingly
00:41:11
Speaker
created a little community around it of the people that have been on it and people that have been on multiple times that someone should be very proud if they've been on multiple times. I think Julia Shulman I think is the leader. I think she's been on three or four times.
00:41:26
Speaker
I did an episode with her as well. And she's, yeah, that's a good one. Another good one. If, if, uh, if you like this one, um, and shout out to Chris too, who within about two episodes of, of me starting to release this called me up and was like, I have a bunch of tips for you on sound. Let's hop on a call. Salt of the earth.
00:41:48
Speaker
you know, excellent person and really just wants to make great content. Yeah, absolutely. I'm not going to ask you for your favorite episode because I wouldn't be able to answer that question either. But if you think there's an episode or two, folks who just want to get started listening to DPBC, where should they, where should they go? Man, I love this question. Let's see.
00:42:14
Speaker
I think the sound quality is not great, but I think the first episode that we did with Vivec was really excellent, really fun to get the three of us together. Everybody was, again, remote and nobody was really going to offices. It was really great to spend time with those guys. And that's sort of in the way back machine on the episode. More recently, the one I mentioned with Sivan Whitely from Block, that's an excellent episode.
00:42:41
Speaker
We had the chief privacy officer of Uber, Ruby's FO. That was a really, really excellent episode. We had Adam Markey, who is the director of the ad product team at Roku, talking about the relationship between Formula One and product management. I like that one because it's a little bit different than what we would normally talk about, more product focused.
00:43:06
Speaker
And then we did one with Julia, which was really excellent, called Privacy BFFF's Best Friends Forever, I think. That's a really nice one. And then a bunch, like the Omer Tene episode is great. The old Trevor Hughes episode, who was the CEO of IPP, is great because it was right after the January 6th insurrection. So we were talking a little bit. We had a really great episode
00:43:33
Speaker
Uh, way back with Jules Polinetsky. Like I think the second episode we ever did, there's too many to keep going heavy hitters, Mark Cockrell, the, uh, VP of legal edge service. Now some really great, interesting guests from a wide variety of areas. And as you can tell, it's exciting. And I really liked doing it. We will be sure to link to it in the, in the show notes. People can find it on Spotify, Apple podcasts, all the rest. Yep. Of course.
00:43:59
Speaker
Um, I've just got a couple of couple more fun questions for you.
Recommended Reading: 'The Privacy Engineer's Manifesto'
00:44:04
Speaker
Uh, I I'm sure you're super busy, but is there a good privacy related book that you might recommend for our listeners? This is a really nerdy one. So this is, this is for the side of the business.
00:44:20
Speaker
that is very technical. So like if you, cause you sort of alluded to like the very technical focus CPO, if you're a technical focused CPO or you want to gross up in that area, the sort of landmark book in my view is the privacy engineers manifesto. It's written by Michelle Dennedy and her father who she calls privacy engineers zero. The first one and Michelle was the chief privacy officer at
00:44:50
Speaker
Sun Microsystems when it was acquired by Oracle, Intel, and one other company, Cisco. So she's been head of privacy at multiple large organizations. She has her own company now. And so that book, if you want to get really technical, I think is an excellent book.
00:45:08
Speaker
I'm going to have to get that for my bookshelf. I, I've not heard of that or read it. That sounds really interesting. Um, a last question for you, something I like to ask a lot of our guests. Um, you think back maybe when you were baby lawyer in financial services or at a firm, what's something that you know now that you, you wish you'd known back then? So many things.
00:45:36
Speaker
I think in the early days, I thought I came out and did a clerkship and then I worked in a law firm. And I think I thought, well, when you graduate law school and you become a lawyer, the expectation of the client is that you know the answer. And I just think that's just not true. And so I think you need to know how to figure out the answer or you need to say when you don't know the answer and that it's complicated and we need to figure it out and ask questions.
00:46:04
Speaker
I think I didn't know that I should free myself from that burden. It took me a few years to get to a place where I felt really comfortable being like, good question, I don't know. That's great advice. That's great advice for anyone in a company, not just at a firm. I think there's a lot of power in telling people when you don't know the answer. Yeah, it feels really good to be able to feel like you can say that.
00:46:32
Speaker
Yeah. Well, Andy, thank you so much for joining today and creating this episode with me. This has been a lot of fun. It's great to see you, man. Thanks for having me.
00:46:44
Speaker
Thanks for tuning in today. If you enjoyed this episode, I'd recommend that you give my interview in season two with Julius Schulman, CLO and Chief Privacy Officer at Telly a listen. We go deep on careers in privacy and where the profession is headed. You can also subscribe so you get notified as soon as we post a new episode. And if you liked this one, I'd really love to hear your thoughts. So please leave a rating or a comment.
00:47:09
Speaker
If you'd like to reach out to me or Andy, our LinkedIn profiles are in the description. See y'all next week.