Episode 7: Getting started with privacy

Inspiring Legal

Thank you for listening to Inspiring Legal.

Full episode transcription:

[00:00 - 00:09]: Welcome to Inspiring Legal, the podcast for in-house legal.
[00:10 - 00:16]: Get insights, learn from peers, life lessons from some of the most influential GCs.
[00:16 - 00:19]: If it's related to in-house legal, we cover it.
[00:19 - 00:31]: For more inspiration, go to openli.com slash community.
[00:32 - 00:36]: So this is a new episode of Inspiring Legal.
[00:37 - 00:43]: My name is Stine and today we're going to talk a little bit about privacy.
[00:43 - 00:56]: Often when you're sitting in-house, a part of your responsibilities are related to privacy, GDPR, CCPA, and the various privacy legislations that are out there today.
[00:57 - 01:00]: You might also have a privacy team.
[01:00 - 01:12]: But regardless of whether or not you're sitting in privacy, if you're sitting in legal, you need to figure out how you want to work with privacy.
[01:13 - 01:23]: What is your privacy vision, mission, goals, and how do you get that ingrained across the organization?
[01:23 - 01:41]: Well, I think the first thing we should talk about is getting management to stand by the support, the insights, and the power that is needed for you to succeed with working with privacy.
[01:42 - 01:47]: Because if you don't have management, it's going to be very difficult to get this implemented.
[01:47 - 02:02]: So what I would do first is I would start by figuring out just at my own desk, where are we in my understanding of our compliance level related to privacy?
[02:02 - 02:23]: Once I've gotten that, what I would do is I would at the next management meeting go and introduce them to just generally privacy, where we are as a company, and also what is needed for us to be at an acceptable level.
[02:23 - 02:34]: I'm not talking about going into details about whether or not you have your Article 30, if your DPA is up to date, your privacy policies. I'm talking just in general.
[02:34 - 02:57]: And then I would go to management and say, I think this is important for reasons A, B, and C, not focusing on the fines per se, but focusing on how we can leverage privacy as a revenue generator, just one example,
[02:57 - 03:07]: or as a way to build trust with our users, or if we can see that we're getting a lot of requests in the sales process, or from users.
[03:08 - 03:19]: So let's say that we're a B2C company. If we can see that a lot of users are starting to ask questions about how we're doing things related to privacy, well, that is always good to have on file.
[03:19 - 03:40]: Because as soon as you make it tangible, as soon as you make it visible to management, how this is impacting the company, not only because of high fines, but how you're operating as a global company, as an example, well, then it makes a difference.
[03:40 - 03:50]: So this is where I would start. Then I would ask for a mandate to go and take a further look into how we're working with privacy.
[03:51 - 03:59]: And what I would do then is simply start classifying GDPR and privacy into different buckets.
[03:59 - 04:17]: There is how we're doing in terms of sales, how many requests are we getting, how we're doing in terms of end users asking us questions, how we're doing in terms of internal, it might be your employees that have questions, and then how we're doing on the overall compliance level.
[04:17 - 04:33]: In my own personal view, I've not done any digging at this point in time. And I then have a good understanding of the impact that I'm able to maybe have with running and implementing a privacy program.
[04:33 - 04:57]: What I would do then is simply start mapping out how we're doing, what data are we getting, are we a data processor? Well, some of the things that I would start looking at first is how, let's call it, risky are the data processors that we're using to deliver the service to our company.
[04:57 - 05:04]: So let's imagine that my company, it's not, by the way, just emphasizing, it is not, but built on Google Analytics.
[05:05 - 05:16]: If it's built on Google Analytics, I know, not good, right? Because if you've seen all the many different types of decisions coming from the regulators, well, then you would know.
[05:17 - 05:20]: Google Analytics aren't doing super well.
[05:20 - 05:30]: So we do that mapping and seeing, okay, just on a general level, how we're progressing in that regard. And once I had that, well, I would start doing more mapping.
[05:30 - 05:55]: Then I would figure out overall what impact do I anticipate that working with privacy will have on my company? Because it might have an impact. In some scenarios, it probably will. Marketing might not be able to do the same type of lookups in Facebook that they were doing before, you know, lookalikes.
[05:55 - 06:15]: It might be that some of the processes for buying tools will drag out a little. I'm not talking necessarily about a lot, but before you start buying a tool, figure out whether or not your data processor is GDPR compliant and working with privacy and have the appropriate security measures.
[06:15 - 06:33]: Well, that's important. Because as soon as you open up, you start to share data, and then you're relying and hoping on their compliance level. So you might want to introduce your process when it comes to buying tools, which might have an impact on the product teams.
[06:33 - 06:50]: Because also the product teams, they like to buy tools, just like marketing. And if all of a sudden they just can't go out and buy the tools as they were normally doing, well, then you would need buy-in. So getting that overview before you start implementing it.
[06:50 - 07:19]: And then what I would do is I would go to each of the business owners, and I would have a conversation about it, telling them why it's important, showing them how many requests we're getting from customers, how many tools we're using in the organization, how much data we're sharing across, or maybe also how many of our prospects have questions about the subprocesses we're using.
[07:20 - 07:38]: And how it's impacting sales. So I would go to, for example, my CPO, which is the chief product officer, and I would say to him, well, this is how the world is. Many product officers are really dedicated to privacy. That's my experience.
[07:38 - 07:51]: So when you're talking about, we need to keep data safe, you need to make sure that we're working with the right companies, well, they typically buy-in. Especially if you're asking them also about how can we improve the process.
[07:51 - 08:07]: It's all about stakeholder management. But it's also about figuring out a balance. And then creating your vision and mission together with these decision makers.
[08:07 - 08:26]: Because if you can get the CPOs buy-in, well, a part of your maybe goals would be that we contract with tools, platforms, and services out there that have a certain standard when it comes to private security.
[08:26 - 08:44]: And if you get that buy-in, that's an easy goal. It's also easy to get incorporated into the business. And then you go to management and say, well, me and the CPO, we are here to talk a little bit about our vision and mission when it comes to privacy and working with vendors.
[08:44 - 08:57]: So we've agreed that we've set the bar to be, we want to work with contractors, platforms, services. That meets these basic criteria.
[08:58 - 09:12]: So we will be implementing this and that would really help increase our compliance, make sure that our product is safe, maybe minimizing the amount of potential data breaches because we're working with these more maybe secure companies.
[09:12 - 09:21]: And at the same time, by the way, my CCO, Chief Sales Officer, I can tell you that we can see that a lot of the customers have had questions about subprocessors.
[...