Join New York City’s Chief Privacy Officer, Mike Fitzpatrick. Explore the role of a city’s CPO. Cities must balance the interests of personal privacy and municipal operations, while complying with open records and other federal and state laws. Municipalities collect, use, and share vast databases of personally identifiable information (PII). They use PII to deter crime, advance public safety, and serve public health and other needs. Like everyone, cities can be cyber attack targets and victims of data breaches. Consider how one city’s CPO promotes a culture that embraces and protects personal privacy while preserving the essential missions of municipal government and decreasing cyber risks. 

Hear the current challenges facing a city’s CPO. Learn how a CPO can advance responsible data sharing, create a culture of privacy protection, and help a municipal government instill responsible, equitable data practices across its agencies. Check out the Big Apple’s Citywide Privacy Protection Policies and Protocols, issued in February 2023.  https://www.nyc.gov/assets/oti/downloads/pdf/citywide-privacy-protection-policies-protocols.pd, and watch for an upcoming update in early 2025. 

This episode is also available in a five-minute video version on YouTube: https://youtu.be/EI7bSOYwqXI 

Time stamps:1:13 — What does a Chief Privacy Officer do?4:00 — What challenges does a Chief Privacy Officer of a big city face?7:17 — How does a CPO handle equity in data management?10:34 — Are more cities in addition to New York appointing Chief Privacy Officers? 12:43 — How does a CPO measure success?14:22 — What tips does Mike have for other cities as they evaluate their data policies?

The first 155 episodes of Data Privacy Detective can be found on the feed of the Frost Brown Todd Podcast. You can listen on Apple Podcasts (https://apple.co/3IrHUTg), Spotify (https://bit.ly/49XRU2k), or Soundcloud (https://bit.ly/3T8EWrw).  

Subscribe to the show on YouTube for a new video every week! https://www.youtube.com/@DataPrivacyDetective

The Data Privacy Detective returns from a short sabbatical to recommend a New Year’s Resolution for 2025 - make this the Year of the Passkey.

Data privacy best practice moved from passwords to multi-factor authentication. But this has not stopped the increasing online theft of assets and identities. Password-based technology is failing to stem financial and other losses that increase each year. Passkeys are on the rise.

A passkey is a form of authentication technology that simplifies our online experience and increases online safety. This Episode explores why passkeys constitute best practices in 2025, while saving time in connecting with websites of our choice. Consider this great migration and why it’s worth spending time now to use passkeys. For those in the Google and Microsoft worlds, explore how these tech giants are making it easy and essential for users to join this shift in how we protect our online data privacy. Here are helpful links:

https://www.google.com/account/about/passkeys/

 https://support.microsoft.com/en-us/account-billing/signing-in-with-a-passkey-09a49a86-ca47-406c-8acc-ed0e3c852c6d 

Happy new year 2025!

The first 155 episodes of Data Privacy Detective can be found on the feed of the Frost Brown Todd Podcast. You can listen on Apple Podcasts (https://apple.co/3IrHUTg), Spotify (https://bit.ly/49XRU2k), or Soundcloud (https://bit.ly/3T8EWrw). Subscribe to the show on YouTube for a new video every week! https://www.youtube.com/@DataPrivacyDetective

The United States has three major credit bureaus - Experian, Equifax, and TransUnion. How they score individuals has a major impact on their lives. Credit scores can raise interest rates to double what an excellent rating would produce and can result in inability to borrow or have a credit card. How the credit rating system works is hidden to most people. The Detective turns his spyglass to how the big three credit bureaus use false data, employ algorithms that inaccurately report credit risk, and invade personal privacy without consent.

Using a real time example, Episode 186 explores how incorrect information is used by a credit bureau and how its algorithm and data sets wrongly assess a person’s financial circumstances and report a false picture of the individual. This results in more than increased interest on loans. It creates a false profile of a person and exposes the individual to a misuse of private information that invades personal privacy without a person’s consent or advance knowledge.

Learn the inner workings of credit reporting and what individuals can do to protect their personal privacy and correct erroneous information spread by credit bureaus.

The first 155 episodes of Data Privacy Detective can be found on the feed of the Frost Brown Todd Podcast. You can listen on Apple Podcasts (https://apple.co/3IrHUTg), Spotify (https://bit.ly/49XRU2k), or Soundcloud (https://bit.ly/3T8EWrw). Subscribe to the show on YouTube for a new video every week! https://www.youtube.com/@DataPrivacyDetective

October is Cybersecurity Awareness Month. For our personal data this Halloween, will it be trick or treat? In Episode 185, we explore one of the most private of all U.S. organizations - the law firm - to assess the security of private personal information.

The American Bar Association reports that a quarter of all law firms have been the victim of a data breach and that 40% were not aware that they were attacked. What do insurance companies that serve law firms recommend as best cybersecurity practices? Even if best practices are followed, is the vast amount of private information collected by law firms at risk? The Data Privacy Detective discusses the state of law firm cybersecurity, lists the best practices recommended by a prominent law firm insurer, and challenges whether good practices alone are enough to guard information we assume will be kept securely confidential.

The first 155 episodes of Data Privacy Detective can be found on the feed of the Frost Brown Todd Podcast. You can listen on Apple Podcasts (https://apple.co/3IrHUTg), Spotify (https://bit.ly/49XRU2k), or Soundcloud (https://bit.ly/3T8EWrw). Subscribe to the show on YouTube for a new video every week! https://www.youtube.com/@DataPrivacyDetective

Two major data privacy developments from September 2024:  a Staff Report from the FTC and California’s new statute about brain data. 

Tune in to Episode as the Data Privacy Detective provides meaning beneath the headlines. Neither of these was front page stuff. But each is more newsworthy than what company was sued for a data breach or whose privacy was invaded by a hacker.

Staff reports are seldom covered as news. But the FTC staff report of September 19, 2024 is essential groundwork for regulation to follow soon or guidance for the next Congress that may reach across partisan divide towards more federal data privacy regulation. The key highlights are about how video streaming companies are watching us without having secure privacy controls and how there are inadequate safeguards for minors.

California enacted and its Governor signed a new law addressing neural data - unspoken communications from our brains. Neural data joins other sensitive personal information as covered by California’s approach to data privacy protection. But how does it do that, and will it succeed in its objective?

Watch our 5-minute summary on YouTube or listen to our deeper analysis from your favorite podcast platform.

Time stamps:

00:59 — Staff reports

10:46 — California's neural data law

The first 155 episodes of Data Privacy Detective can be found on the feed of the Frost Brown Todd Podcast. You can listen on Apple Podcasts (https://apple.co/3IrHUTg), Spotify (https://bit.ly/49XRU2k), or Soundcloud (https://bit.ly/3T8EWrw).

When clouds gather, we prepare for storms, sometimes hurricanes. In a data world that is increasingly multi-cloud, how can we protect data that is ever more susceptible to attack by mal-actors? Enter Identity Orchestration (IO) and Identity and Access Management (IAM).

Eric Olden, author of “Identity Orchestration for Dummies” - https://www.strata.io/resources/whitepapers/identity-orchestration-for-dummies/ - and CEO of Strata.io, explains IO and IAM and why it is essential that privacy by design be the approach to secure data management. Defeating cybercrime through multi-factor authentication (MFA) and passwords is insufficient in the modern data environment.

Learn in Episode 183 how organizations can protect their data streams and be seamless for their customers and data chain participants. See how proper IAM can be the best insurance against downtime and ranswomware attacks. Consider the challenges organizations face and available opportunities to protect data in our evolving multi-cloud environment. Learn top tips for individuals in protecting personal data privacy in a multi-cloud world.

Time stamps:

1:24 — What is identity orchestration?

8:08 — Challenges for data identity orchestration

20:38 — Tips for maintaining privacy

The first 155 episodes of Data Privacy Detective can be found on the feed of the Frost Brown Todd Podcast. You can listen on Apple Podcasts (https://apple.co/3IrHUTg), Spotify (https://bit.ly/49XRU2k), or Soundcloud (https://bit.ly/3T8EWrw).

Today’s automobiles and trucks are more than transport vehicles. Filled with computer technology,cars and trucks are data collectors and transmitters - and a potential way for hackers to steal personal information and invade privacy. The expansive use of technology in vehicles creates risks of identity theft, invasion of privacy, and even the ability to take over a vehicle’s operation for tragic purposes.

A September 6, 2024 American Automobile Association post, How to Protect Your Car from Cybercrime,describes how modern vehicular technology poses cyberattack risks and offers tips on how to fend off hackers.  https://cluballiance.aaa.com/the-extra-mile/advice/car/can-your-car-be-hacked

The Detective explores what we can do to protect ourselves against these risks and how vehicle manufacturers and dealers can build cyber-data-safety into vehicles rather than leave it to operator choice. Consider steps you can take to prevent your vehicle from being cyberjacked and to limit unwanted leaks of your personal information and privacy from your vehicle’s data stream.

The first 155 episodes of Data Privacy Detective can be found on the feed of the Frost Brown Todd Podcast. You can listen on Apple Podcasts (https://apple.co/3IrHUTg), Spotify (https://bit.ly/49XRU2k), or Soundcloud (https://bit.ly/3T8EWrw).

Tune in for our August 2024 roundtable about three hot data privacy developments. Yugo Nagashima and Brio St. Amour join the Data Privacy Detective to plumb meaning beneath the headlines:

• The Netherland Data Protection Authority fines Uber 290 million Euros for data transfers of sensitive private information.
• Minnesota adopts a data privacy code.
• Data brokers emerge from the shadows after an enormous database hack and a call to action.

Consider what happens when the European Court of Justice invalidates a U.S./EU safe harbor, and before the next one is in place, a company transfers data to the U.S. without complying with GDPR requirements - so says a Dutch regulator, levying a 290 million fine.

Minnesota adopts a state data privacy code, joining about a third of the states to do so. Is it a copycat or pioneer?

After what some claim was the biggest data hack in history - exposing highly sensitive personal information when a data broker’s database was taken and offered for sale on the dark web, one leading commentator issues a call to action for regulation and business self-action. Is the spotlight now on data brokers?

Get our 5-minute video update on YouTube or a deeper dive on our audiocast available on your favorite podcast platform. Happy September!

Time stamps:

0:40 — Netherland Data Protection Authority fines Uber

7:10 — Minnesota adopts a data privacy code

13:41 — Data brokers

The first 155 episodes of Data Privacy Detective can be found on the feed of the Frost Brown Todd Podcast. You can listen on Apple Podcasts (https://apple.co/3IrHUTg), Spotify (https://bit.ly/49XRU2k), or Soundcloud (https://bit.ly/3T8EWrw).

We turn our magnifying glass to what some August 2024 headlines call the biggest data breach in history. One report said the entire population of the United States, Canada, and United Kingdom was hacked, with up to 2.9 billion people’s identities at risk. 

On closer inspection, it appears that 2.9 billion rows of data were packaged and posted for sale on the dark web for $3.5 million. Social Security numbers and other personally identifiable information were exposed, including between 100 and 300 million Social Security numbers of Americans.

This was not a traditional hack or data breach  National Public Data, a data broker, gathered information about many millions of people from public and non-public sources which it used it to offer background checks and other services. The data includes SS#’s, email addresses and other personally identifiable information about between 100-300 million people. Many are deceased, but others are alive. In April 2024, a hacker stole the database. A company then put this massive data trove up for sale on the dark web, eliciting interest from cybercriminals seeking to steal identities and engage in cybertheft.  That led to government investigations and a class action lawsuit.

The first 155 episodes of Data Privacy Detective can be found on the feed of the Frost Brown Todd Podcast. You can listen on Apple Podcasts (https://apple.co/3IrHUTg), Spotify (https://bit.ly/49XRU2k), or Soundcloud (https://bit.ly/3T8EWrw).

Microsoft announced at an April 2024 IAPP conference a preview offering called Microsoft Priva. Described as a platform that helps organizations automate how they handle and deal with personal information, Priva aims to “streamline compliance across on-premises, hybrid and multicloud environments.” https://www.microsoft.com/en-us/security/business/microsoft-priva 

Episode 179 explores Priva as a measure of where we are on data privacy infrastructure in mid-2024. Organizations collect, process, use, share, and sell vast amounts of personal data - and are sometimes hacked for it. Legal compliance and minimizing/mitigating data breach and other risks are demanded of businesses large and small. But the system that an organization uses to handle personal data is not just for attention by its attorneys and insurers. It is the foundation of building trust with customers and other members of a company’s community. As Microsoft says, “Building customer trust is about commitment to empowering individuals to have control over their own data,” and “Protecting privacy is not just a legal necessity - but a pathway to value from the wealth of data at an organization’s disposal.”

Consider how privacy can be designed into an organization’s IT system and how an offering like Priva can provide a coherent means of taking these steps:

• Conduct a privacy assessment

• Assess privacy risks

• Conduct tracking scanning

• Manage consents

• Automate subject rights (individuals) requests.

The first 155 episodes of Data Privacy Detective can be found on the feed of the Frost Brown Todd Podcast. You can listen on Apple Podcasts (https://apple.co/3IrHUTg), Spotify (https://bit.ly/49XRU2k), or Soundcloud (https://bit.ly/3T8EWrw).