She Said Privacy/He Said Security

Alan L. Friel is Chair of Squire Patton Boggs’ Data Privacy, Cybersecurity & Digital Assets Practice. He is tier-1 ranked by Chambers, and BTI Consulting Group has named Alan a Client Service All-Star, recognizing lawyers who stand above all others in delivering exceptional client service.

Evolving privacy regulations like the California Consumer Privacy Act (CCPA) are reshaping the way companies approach data management and compliance. CCPA’s proposed draft regulations would require certain businesses to conduct cybersecurity audits, privacy risk assessments, and implement governance surrounding automated decision-making and AI technologies. While these frameworks help protect consumer data, they also introduce operational challenges and increased expenses for companies. How can companies prepare for compliance while effectively managing data and reducing costs?

Privacy compliance is more than a legal requirement — it’s a vital part of sound business strategy. Navigating compliance obligations requires companies to adopt a proactive approach to data governance. Businesses need to implement good data hygiene practices and conduct privacy risk assessments to identify and mitigate risks. These processes help businesses maintain their data inventory, respond to consumer privacy rights requests, and manage information assets. However, the legal landscape remains complicated, with questions about whether some regulatory requirements may conflict with First Amendment protections.

In this episode of She Said Privacy/He Said Security, Jodi and Justin Daniels speak with Alan Friel, Chair of the Data Privacy, Cybersecurity & Digital Assets Practice at Squire Patton Boggs, about the costs, benefits, and legal implications of regulatory compliance. Alan explains why businesses should adopt privacy risk assessments as a best practice, regardless of ongoing legal uncertainties, and discusses the intersection of privacy regulations with free speech rights under the First Amendment. He emphasizes the importance of proactive data management practices and governance to navigate compliance challenges and position businesses for long-term success in a shifting regulatory environment.

Anna Hall is an educator, mother of two, and Co-founder of Embody, a privacy-forward menstrual health and wellness app.

As awareness grows around health data privacy, misconceptions about protecting menstrual health data remain widespread. That’s because menstrual health data is often commodified and can be shared or sold without explicit user consent, exposing sensitive information to third parties. With recent legal changes affecting reproductive rights, there is a greater need than ever for secure, user-controlled solutions. What steps should companies take to prioritize and protect sensitive health data?

In a rapidly changing health tech landscape, most regulations haven’t adapted to cover personal wellness apps effectively, especially those designed for menstrual health tracking. Companies like Embody address this by implementing local encryption and avoiding default cloud storage, which safeguards privacy and encourages a user-first approach. By eliminating the need for logins and accounts, Embody limits data access, allowing users to track personal health information privately and securely.

In this episode of She Said Privacy/He Said Security, Jodi and Justin Daniels talk with Anna Hall, Co-founder of Embody, about developing a privacy- and security-focused menstrual health app. Anna shares the story behind Embody and how the app prioritizes user privacy by eliminating user logins and passwords, keeping user data stored offline and locally on user devices. She highlights misconceptions about menstrual health data privacy and shares how Embody’s design directly addresses these challenges. With features like local encryption and plans to open-source their code, Embody aims to provide secure, user-controlled health tracking that upholds privacy standards.

Christin McMeley is the SVP and Chief Privacy and Data Strategy Officer at Comcast, a role that involves partnering across Comcast's business units and spearheading the execution of enterprise privacy and data governance strategies, focusing on responsible use of data and artificial intelligence. As an attorney, Christin is experienced in privacy compliance, public policy, and government affairs. 

As companies navigate the fast-changing landscape of privacy regulations, many are focusing on integrating privacy practices into business strategies, made more complex by the rise of new technologies like generative AI. To maintain consumer trust and ensure compliance, companies need to understand how to align privacy obligations with business innovation. How can privacy and business teams collaborate to navigate this evolving space?

For businesses to succeed, privacy can’t work in isolation — it needs to be integrated with broader business strategies. Embedding privacy by design principles and fostering a culture of consumer trust are key to achieving this. Educating teams on privacy principles and building strong internal relationships ensures privacy becomes a natural part of the business workflow rather than an afterthought.

In this episode of She Said Privacy/He Said Security, Jodi and Justin Daniels talk with Christin McMeley, SVP & Chief Privacy and Data Strategy Officer at Comcast, about how privacy teams can collaborate with business units to address privacy risks. Christin highlights the importance of practices like privacy tabletop exercises, which allow teams to proactively address privacy concerns during product and service development. She stresses that integrating privacy into the company culture, along with the right mix of automation and human oversight, is key to long-term success.

Nick Kakolowski is the Senior Research Director at IANS Research, where he specializes in the managerial, leadership, risk management, privacy, and regulatory compliance components of the company’s curriculum.

The role of the Chief Information Security Officer (CISO) is expanding. Many CISOs are now responsible for more than just security — they are also managing privacy, AI risk, and other critical business functions. Organizations like IANS are helping security teams navigate these changes by providing critical data on CISO compensation, budget trends, and organizational structures through its research and surveys. So, how can companies ensure their security leadership is equipped to align with broader business goals while managing these new responsibilities effectively?

IANS focuses on helping CISOs and their teams address real-world security challenges through its faculty of industry practitioners. Through its annual CISO Compensation and Budget Survey, conducted in partnership with Artico Search, IANS uncovers valuable insights into compensation disparities, evolving CISO responsibilities, and how security roles are expanding to include privacy and AI risk management. By leveraging real-world data, IANS equips businesses with the information they need to build more resilient security programs and infosec teams.

In this episode of She Said Privacy/He Said Security, Jodi and Justin Daniels speak with Nick Kakolowski, Senior Research Director at IANS, about the CISO’s expanding role. Nick shares valuable insights from IANS’ research, highlighting how CISOs are taking on new responsibilities in areas like privacy, AI, and security governance. He underscores the growing importance of business and leadership skills for CISOs and emphasizes the need for collaboration across teams as boards increasingly turn to CISOs for security governance and risk management.

Jennifer Miller is Grammarly’s General Counsel. She focuses on enabling Grammarly to grow and innovate while carefully managing business risk. Her responsibilities include navigating AI and regulation and scaling the company’s managed business.

Suha Can is Grammarly’s CISO and VP of Engineering, leading global security, privacy, compliance, and identity for the company. He’s dedicated to securing the data of Grammarly’s over 30 million users and 70,000 teams at enterprises and organizations worldwide.

As AI continues to reshape the tech landscape, companies like Grammarly are navigating new challenges in balancing innovation with privacy and security. With advanced AI tools, businesses can improve user experiences, but they also need to manage privacy and security risks that come with it. Grammarly, known for its communication assistant that leverages AI, strongly emphasizes user trust by embedding transparency and user control at the core of its privacy and security strategy. So, how can companies in the AI space adopt similar practices, innovate responsibly, and stay ahead of evolving privacy and security risks?

Grammarly champions transparency and has built a privacy and security program centered on user trust and control. By establishing governance frameworks, regularly reviewing their products for privacy, security, and AI-related risks, and maintaining collaborative communication between legal and technical teams, Grammarly proactively mitigates risks while staying compliant with regulations. The company also offers clear privacy practices through its public-facing web pages and ensures its contracts with customers and third-party vendors reflect the same principles of transparency.

In this episode of She Said Privacy/He Said Security, Jodi and Justin Daniels chat with Jennifer Miller, General Counsel, and Suha Can, CISO, of Grammarly about how the company has built a privacy and security program centered on trust and transparency. Jennifer and Suha discuss how they navigate AI advancements and regulatory challenges by prioritizing user control, conducting privacy and security audits, and fostering collaboration between legal and technical teams. They also emphasize the importance of proactive governance and responsible AI practices to keep pace with evolving regulatory landscapes.

Joe Jones serves as the Director of Research and Insights at the IAPP. Previously, he served as the UK Government’s Deputy Head of Digital Trade, where he was responsible for digital policy. Joe also served as a private practice lawyer on international data issues.

Companies are grappling with the challenges of managing privacy, security, AI, and data governance in an increasingly complex regulatory environment. The IAPP’s Organizational Digital Governance Report highlights the challenges businesses face due to “digital entropy” — caused by overlapping laws, rapid technological shifts, and cultural and socio-technical differences, emphasizing the need for organizations to align their governance structures to address these challenges. How can companies navigate these complexities while maintaining compliance and operational efficiency?

The IAPP’s digital governance report provides insights into how companies can adapt their structures and processes to meet the growing demands of digital governance. It outlines three varying approaches companies are using to navigate digital entropy: the analog model, where companies use their current structures while adding more tasks to existing teams; the augmented model, where companies create new committees or cross-functional teams to define overarching terms for digital governance and policy; and the aligned model, where companies have dedicated roles for digital governance. The report underscores the importance of moving toward a more aligned model, where privacy, security, and AI governance are streamlined under cohesive leadership. This involves empowering privacy teams, implementing regular audits, fostering collaboration across departments, and avoiding reliance on ad hoc committees to align with evolving privacy regulations.

In this episode of She Said Privacy/He Said Security, Jodi and Justin Daniels chat with Joe Jones, Director of Research and Insights at IAPP, about how companies can leverage insights from the IAPP Organizational Digital Governance Report to improve their digital governance frameworks. Joe explains how companies can stay ahead of regulatory changes by embracing more structured governance models. He also emphasizes the need for privacy professionals to act as enablers within organizations, offering guidance on leveraging data responsibly while navigating the growing complexity of privacy regulations.

Daniel B. Rosenzweig is the Founder and Principal Attorney at DBR Data Privacy Solutions, a boutique data privacy law firm. He advises clients on legal and technical compliance with data protection and privacy laws and counsels clients on the responsible use of AI, AdTech, and privacy-enhancing technologies. Dan’s legal practice is unique in that he also codes and develops technical solutions to enhance his legal services.

As the AdTech landscape evolves, companies are facing new challenges with cookie alternatives like server-side technologies and alternative IDs. While these new tools offer improved targeting capabilities, they also bring risk, especially when it comes to managing opt-outs and tracking user consent. To preserve consumer trust and drive revenue, businesses need to fully understand how these advanced technologies work while adhering to applicable privacy laws. So, how can companies stay compliant while leveraging these technologies?

Adopting alternative IDs, advanced matching, and server-side technologies offers new opportunities for businesses to enhance targeting while maintaining consumer trust. Still, companies need to carefully assess the risks and ensure proper implementation. Establishing a proper governance process, conducting regular audits and testing, maintaining transparency in privacy notices, and avoiding dark patterns are crucial steps for regulatory compliance and protecting consumer privacy.

In this episode of She Said Privacy/He Said Security, Jodi and Justin Daniels chat with Daniel Rosenzweig, Founder and Principal Attorney at DBR Data Privacy Solutions, about the challenges of balancing data privacy with AdTech solutions. Dan explains how businesses can implement these technologies without sacrificing consumer privacy by effectively managing consent platforms, auditing and testing technologies, and ensuring transparent data practices that align with regulations. He also emphasizes the importance of regular collaboration between legal, marketing, and technical teams to stay compliant with evolving regulations.

Rob Black is the Founder of Fractional CISO and has guided numerous companies in enhancing their security postures. With extensive experience in product and corporate security roles at prominent companies like PTC, Axeda, and RSA Security, Rob is recognized as a trusted authority in risk management and cybersecurity innovation.

As companies face increasing pressure to meet security and compliance demands, many are turning to AI to enhance their governance, risk, and compliance programs. Tools like ChatGPT and Claude can streamline processes such as summarizing reports and generating responses to security questionnaires. While these tools can improve efficiency, they can also produce inaccuracies, underscoring the importance of human oversight. How can companies use AI responsibly to enhance these programs?

AI tools can save security teams a ton of time, but they’re not reliable enough to replace human oversight. This means that companies need to establish clear guidelines and governance frameworks on AI usage to protect sensitive information and mitigate risks. By integrating these strategies, companies can build more resilient and compliant programs. 

In this episode of She Said Privacy/He Said Security, Jodi and Justin Daniels talk with Rob Black, the Founder of Fractional CISO, about integrating AI into governance, risk, and compliance programs. Rob explores the benefits and risks of utilizing AI in these programs, emphasizing the need to blend AI with human oversight. He also emphasizes the need for companies to have a security-first mindset when implementing AI tools to reduce risk and ensure long-term success.

Arsen Kourinian is a Partner in Mayer Brown’s AI Governance and Cybersecurity & Data Privacy practices. He advises clients on data privacy and AI laws and frameworks. Arsen has published numerous articles regarding nuanced issues in these fields, including a forthcoming book entitled Implementing a Global Artificial Intelligence Governance Program.

The growing number of global and state privacy laws and AI regulations is prompting companies to integrate fundamental frameworks into their AI governance programs. While the US lacks a comprehensive federal AI law, states like Colorado have begun implementing AI regulations that could serve as a model for future state-level standards. With seemingly fragmented regulations, how can companies effectively develop an AI governance program?

A multi-regulatory approach to AI governance can be challenging for companies to navigate with regulations like the EU AI Act, Colorado's Artificial Intelligence Act, and international standards like ISO and NIST. While the regulatory landscape is patchy, harmonizing across various regulations and frameworks can help companies meet compliance obligations and reduce risk. This includes forming an AI governance committee, implementing a data governance plan, conducting risk assessments, documenting accountability with policies and procedures, and continuous monitoring and oversight of AI vendors. 

In this episode of She Said Privacy/He Said Security, Jodi and Justin Daniels speak with Arsen Kourinian, Partner at Mayer Brown, about developing an AI governance program amid emerging global and state regulations. Arsen emphasizes incorporating key components and frameworks from various laws to develop AI governance programs. He also delves into the departments that assume responsibility for these programs and offers guidance on completing AI impact assessments, highlighting the importance of risk mitigation and understanding practical harms.

Darren Abernethy is a Shareholder in Greenberg Traurig's data, privacy, and cybersecurity practice. As an AdTech and data privacy attorney, he is licensed to practice law in California, New York, and Washington, DC. Darren holds seven IAPP Certified Information Privacy Professional, Manager, and Technologist certifications.

Talks about shifting away from third-party cookies is pushing companies to rethink their advertising strategies and adopt cookieless alternatives. As many companies explore other AdTech solutions like first-party data collection strategies, they need to evaluate their advertising practices to ensure alignment with evolving state and global privacy laws. How can businesses effectively implement alternative AdTech solutions while adhering to evolving compliance requirements?

First-party data collection, contextual advertising, and CRM-based approaches present opportunities for businesses to refine their ad targeting strategies. However, these alternatives also require companies to ask probing questions when evaluating new technologies, such as how these solutions fit within evolving privacy laws and what vendor safeguards are needed.

In this episode of She Said Privacy/He Said Security, Jodi and Justin Daniels chat with Darren Abernethy, Shareholder at Greenberg Traurig, about the future of AdTech and data privacy in a world transitioning away from third-party cookies. Darren explains how businesses can take a privacy-first approach to implementing new AdTech solutions by proactively managing vendors and keeping privacy programs up to date. He underscores the importance of modernizing vendor assessments, updating contracts regularly, and maintaining proper documentation in case of regulatory scrutiny to build trust and mitigate risks.