Data Privacy Detective

Calendar scheduling—it can be simplified with third-party apps that schedule meeting times without a lot of back and forth. But third-party apps that do such scheduling entail significant privacy risks and choices. Using Calendly as an example, we explore in Episode 178 what happens when we allow a third-party app to connect through our IT platform, in this case that of Google. Google provides ample information and details about allowing third-party apps to connect through a Google sign-in. https://support.google.com/accounts/answer/13533235?hl=en It warns about the risks and encourages users to check out the websites and privacy choices of the app provider before syncing it with Google. Consider Google's advice about granting permission to third-party apps, including the need to review how the third party will collect, share, use, and have the ability to delete data held within Google. Using Calendly's April 15, 2024 Privacy Notice as an example, we explore the extent to which a third party app can receive, share, use, and delete data that reaches beyond the core function of the app's basic purpose. Learn how the current data environment is not one of privacy by design and how third-party apps represent the spread of personal data beyond what we may assume. The first 155 episodes of Data Privacy Detective can be found on the feed of the Frost Brown Todd Podcast. You can listen on Apple Podcasts (https://apple.co/3IrHUTg), Spotify (https://bit.ly/49XRU2k), or Soundcloud (https://bit.ly/3T8EWrw).

Join Brion St. Amour, Yugo Nagashima, and the Detective to review three top data privacy developments from July 2024. Our monthly review focuses on these topics:

Automobiles - Are they spying on us without our consent? A letter from Senators Wyden and Markey to the U.S. Federal Trade Commission (FTC) asks for transparency and data protection from auto makers and those who share vehicle use data. What's going on here?

AI safety and the search for standards - On July 26, the U.S. Department of Commerce released guidance and software to improve the safety, security, and trustworthiness of AI systems.

https://www.nist.gov/system/files/documents/2019/08/10/ai_standards_fedengagement_plan_9aug2019.pdf This builds on NIST's 2019 Plan for Global Engagement on AI Standards.

https://www.nist.gov/system/files/documents/2019/08/10/ai_standards_fedengagement_plan_9aug2019.pdf The White House circulated a summary of what underlies DOC's release.

https://www.whitehouse.gov/briefing-room/statements-releases/2024/07/26/fact-sheet-biden-harris-administration-announces-new-ai-actions-and-receives-additional-major-voluntary-commitment-on-ai/ Is there a bipartisan approach to the regulation of AI and how it should respect data privacy principles on both a domesti U.S. and global basis?

Surveillance Pricing - The Chair of the FTC wants to investigate "surveillance pricing." What's this about? And what does it have to do with data privacy?

Tune in to Episode 177 to probe meaning beneath the headlines on these major data privacy developments.

Time stamps:

0:40 — AI safety and the search for standards

8:43 — Automobiles

16:15 — Surveillance pricing

The first 155 episodes of Data Privacy Detective can be found on the feed of the Frost Brown Todd Podcast. You can listen on Apple Podcasts (https://apple.co/3IrHUTg), Spotify (https://bit.ly/49XRU2k), or Soundcloud (https://bit.ly/3T8EWrw).

It's time for standards about data provenance. Unless information is reliable and trustworthy - and able to be used properly - datasets hold doubtful value. Yet, datasets are the foundation of Artificial Intelligence. Standards for the provenance of data are thus essential, as Episode 175 explored.

Enter the June 2024 release of Data Provenance Standards of the Data & Trust Alliance, or D&TA. https://dataandtrustalliance.org/work/data-provenance-standards Standards covering the Source, Provenance, and Use of data resulted from extensive cross-industry development, testing, and validation. D&TA's pioneering work offers the opportunity for comment and participation to put version 1.0.0 into widespread adoption and enhancement.

Kristina Podnar, D&TA's Senior Policy Director, discusses with the Detective why standards are needed, what D&TA recommends, why it is important to have an industry approach to setting standards, and how personal privacy interests can be addressed within the use of datasets. Listeners will learn how D&TA standards are already in evolving use and validation and how they can apply to differing types of organizations. Tune in to Episode 176 and learn how you can comment and participate in the creation and adoption of data provenance standards that are essential to AI's expanding use and a successful digital age .

The first 155 episodes of Data Privacy Detective can be found on the feed of the Frost Brown Todd Podcast. You can listen on Apple Podcasts (https://apple.co/3IrHUTg), Spotify (https://bit.ly/49XRU2k), or Soundcloud (https://bit.ly/3T8EWrw).

Artificial intelligence is not new. But now an acronym in common usage, AI is dominating markets, politics, industry, and our attention. And its use affects personal privacy.

Let's take a couple examples. Bathsheba was the mother of Solomon in Torah and biblical days. Solomon's father was King David. tIf you ask Google's Gemini what ethnicity was Bathsheba, you'll get an answer that this is uncertain but she probably was Hebrew. We can't ask her, because she died about three millenia ago. But what does Gemini base its answer upon that indicates probably Hebrew? Asking that question is asking about data provenance. And if we were asking about a living person and who the parents of that individual is - example if adopted - that's a very private matter. Let's say the data says a major politician is the mother or father of someone else - and the individual denies it. You can see how there privacy matters are very much at stake when a dataset is being created and then used to provide information.

So what is data provenance? Think about it as the genealogy of information.

Where did the information originate? How was it used and misused and transformed? How do we know if data is reliable and trustworthy or whether it is disinformation or hallucination? This is where the provenance of a dataset comes in.

Datasets are the blood flows of AI. Garbage in garbage out - computer age. And misinformation in disinformation out . This can have major consequences as AI takes over more and more of the roles humans used to play when oral transmission and later hard copy was the way info was shared, stories were told, myths were created, science progressed. In the digital age, it all happens much faster. As AI expands, so does the risk that datasets will be unreliable and invade personal privacy of people.

So - the need for standards of data provenance, rules and standards for determining the lineage of info, the reliability of a dataset. Otherwise, AI will be misused and create harm ad invade privacy and reputations of individuals improperly.

So how are standards for the provenance of data and datasets being created?

Government regulation is one approach. But here govts are catching up with tech change. There is no gold standard, or perhaps any colorable standard, set by govt or govts about data provenance.

There are some efforts under way from the tech and business world to create data prov standards. One is by Data Provenance Initiative, powered by Cohere - aiming to track and trace data sources within data sets. Understand - almost 2000 data sets audited and traced to determine the provenance of data held within. Picture a variety of techniques to do this, so we can measure the origin, accuracy, reliability of data that feeds AI. Check out https://dataprovenance.org.

Another major effort is by Data and Trust Alliance, a nonprofit group of major western companies. Including Walmart, Deloitte, Humanan, Pfizer, Mastercard, others. Goal is to produce voluntary standards for data provenance. Think of this like voluntary standards for safety in other fields. E.g., UL label re elec - not govt. Or food safety standards. Labels about organic or level of whether fish is farm or wild, endangered or not.

We'll talk in next episode with reps of D & T Alliance about standards announced in June 2024 to cover:

Data type, source, legal rights, privacy and protection, lineage, generation date and material, intended use, and restrictions.

Privacy aspects are an essential part of setting standards. Can AI use personal data of individuals gathered without their consent? Can AI use personal identities in formulating datasets about a mass of people? How reliable is data that cannot be traced definitively back to someone who grants consent and has the ability to correct or delete such data? What happens if personally identifiable information is included in a dataset and then is used to broadcast or leak that information, which allows someone to take malicious or unwanted action against that individual. Does anyone truly have a right to be forgotten? A right not to be doxxed? A right not to be maligned because of one's identity, race, national origin, religion?

Tune in next week to Episode 176 as we dig deeper into data provenance and privacy.

The first 155 episodes of Data Privacy Detective can be found on the feed of the Frost Brown Todd Podcast. You can listen on Apple Podcasts (https://apple.co/3IrHUTg), Spotify (https://bit.ly/49XRU2k), or Soundcloud (https://bit.ly/3T8EWrw).

When the Chairs of Senate and House committees, one a Democrat and one a Republican, agree on a comprehensive and thorough federal data privacy statute, one might guess it will be enacted - or at least move forward to votes on amendments and packaged into a final form. Proposed by House Energy & Commerce Committee Chair Cathy McMorris Rodgers and Senate Commerce Committee Chair Maria Cantwell, the APRA offers the most comprehensive bipartisan approach yet to a comprehensive national data privacy statute.

But powerful forces have postponed a mark-up of the bill. What's blocking a deal?

Tune in to Episode 174 for an update on how GOP leaders and civil liberty and pro-privacy advocates threaten to doom this drive to create a national e-commerce code for protecting individual data privacy. Yugo Nagashima, privacy and intellectual property attorney at Frost Brown Todd LLP, and the Data Privacy Detective highlight the obstacles to congressional action.

The first 155 episodes of Data Privacy Detective can be found on the feed of the Frost Brown Todd Podcast. You can listen on Apple Podcasts (https://apple.co/3IrHUTg), Spotify (https://bit.ly/49XRU2k), or Soundcloud (https://bit.ly/3T8EWrw).

The U.S. Defense Department is forcing its contractors and subcontractors to upgrade their cybersecurity practices through CMMC version 2.0. CMMC is shorthand for Cybersecurity Maturity Model Certification. This affects virtually all suppliers to DOD that deal in Controlled Unclassified Information. 2.0 sets demanding cybersecurity standards in an ongoing effort to protect digital data from spies, hackers, thieves, and unwanted disclosures.

Learn CMMC 2.0 basics and how it may be setting a 2024 gold standard for digital data protection. Consider how it blends with NIST and other standards to upgrade digital info-architecture. Srikant Rachakonda, Founder/CEO, and Jody Stoehr, Co-founder and Chief Revenue Officer, of SMPL-C (https://smpl-c.com/) explain CMMC 2.0. What was once aspirational is becoming compulsory.

The first 155 episodes of Data Privacy Detective can be found on the feed of the Frost Brown Todd Podcast. You can listen on Apple Podcasts (https://apple.co/3IrHUTg), Spotify (https://bit.ly/49XRU2k), or Soundcloud (https://bit.ly/3T8EWrw).

Vermont joined the "we have a data privacy code" group - almost a third of U.S. states now with a statute devoted to personal data privacy. Illinois modifies its code on biometrics to soften business costs of compliance. DataGrail's 2024 Data Privacy Trends report focuses on a surge in data subject requests. Join Yugo Nagashima of Frost Brown Todd, Brion St. Amour of the Wabash Marketplace, and the Data Privacy Detective for an update on May 2024 developments.

Tune in to see how Vermont provides a specific private right of action and details compliance requirements beyond what first adopter states specify. See how Illinois is balancing the interest in personal privacy about use of biometric information against what became a heavy class action defense cost per individual violation. And consider the rising tide of Data Subject Requests (DSR's) from the important April 30, 2024 report by DataGrail - and what it means for organizations and individuals. https://www.datagrail.io/blog/privacy-trends/privacy-trends-2024/

Time stamps:

01:11 — Vermont adopts a privacy code

11:26 — DataGrail's 2024 Data Privacy Trends report

17:53 — Illinois modifies its biometrics code

The first 155 episodes of Data Privacy Detective can be found on the feed of the Frost Brown Todd Podcast. You can listen on Apple Podcasts (https://apple.co/3IrHUTg), Spotify (https://bit.ly/49XRU2k), or Soundcloud (https://bit.ly/3T8EWrw).

Privacy statements - how can one be written that applies globally? That seems like an impossible, even hopeless, challenge. Laws change regularly, even within countries and groupings like the EU. Rules differ. There are no "international" laws making data privacy a commonly regulated matter.

This episode presents an approach to a comprehensive data privacy statement that can be used globally. Consider the essential elements. Express principles and practices that encompass the diversity of regulation while respecting commonly accepted rights of individuals whose personal information will be collected, processed, stored, and otherwise used when an organization operates cross-border. Using an effective example for reference, this episode can serve as a checklist for adopting a state-of-the-art global personal data privacy statement.

The first 155 episodes of Data Privacy Detective can be found on the feed of the Frost Brown Todd Podcast. You can listen on Apple Podcasts (https://apple.co/3IrHUTg), Spotify (https://bit.ly/49XRU2k), or Soundcloud (https://bit.ly/3T8EWrw).

Skimming—once defined as an internal business fraud of insiders taking money off the top of a company's cash flow. E-skimming - the growing theft of personal digital information to steal funds and benefits from individuals. A May 22, 2024 New York Times report focused on how food stamp holders are victimized by crime rings when their benefit cards are hijacked through e-skimming.

Episode 170 explores how thieves collect card and PIN numbers to steal what the FBI estimates to be $1 billion a year. Learn steps we can take to protect our benefits and funds and what organizations can do to combat this growing threat to personal finance. For further commentary, see the FBI's guidance at https://www.fbi.gov/how-we-can-help-you/scams-and-safety/common-scams-and-crimes/skimming

Time stamps:

05:44 — Dangers of ATM skimmers

07:51 — Dangers of fuel pump skimmers

09:29 — 16 tips for keeping your debit card information secure

How do organizations convert leads into revenue? How can they do this effectively while being privacy-conscious, not bombarding people with unwanted cold calls or messages?

In Episode 169, the Data Privacy Detective converses with Thomas Ryan, CEO and founder of Bigly Sales. https://biglysales.com. Learn how the sales industry is undergoing rapid transformation, how it is beginning to use Artificial Intelligence to shape conversations that turn leads into customers, while being respectful of individual privacy. Explore how enormous information is available publicly (or at minimal cost) to sales industry channels. Consider whether privacy is "dead" and what can be done to stem unwanted phone calls and messages. Get Tom Ryan's top tips for businesses and individuals about the sales process. Hear how AI tools can be both efficient and low-cost for marketing and how they can be more privacy respectful than traditional sales efforts.

The first 155 episodes of Data Privacy Detective can be found on the feed of the Frost Brown Todd Podcast. You can listen on Apple Podcasts (https://apple.co/3IrHUTg), Spotify (https://bit.ly/49XRU2k), or Soundcloud (https://bit.ly/3T8EWrw).

Time stamps:

01:08 — Overview of today's sales environment

07:31 — How much information can companies learn about individuals from the data they purchase?

11:01 — Top tips for businesses who want to generate leads but still keep their consumers' privacy in mind?

15:21 — Top tips for individuals in keeping their information private from companies