Send us Fan Mail

Michael Booden, Senior Technology Counsel 

In this episode of The Data Diva Talks Privacy, Debbie Reynolds, The Data Diva speaks with Michael Booden, Senior Technology Counsel, about the evolving relationship between contracts, privacy, cybersecurity, and artificial intelligence. Michael shares his professional journey from litigation and appellate court clerkships to becoming an in-house technology attorney and adjunct law professor teaching contract drafting and negotiation. He explains how his litigation background shaped his approach to drafting agreements, emphasizing the importance of clarity, precision, and anticipating how contractual language will be interpreted when disputes arise.

The conversation explores how privacy and security requirements increasingly appear in technology agreements and why organizations can no longer rely solely on vendor representations regarding data protection. Michael discusses how he developed cybersecurity addenda to establish objective standards and expectations for vendors, including security controls, indemnification provisions, and requirements aligned with recognized frameworks such as NIST and ISO standards. He explains how these contractual protections help organizations proactively manage risk rather than simply reacting to incidents after they occur. 

Debbie and Michael examine the growing role of AI in organizations and the challenges associated with managing data privacy and security risks when using AI tools. Michael discusses the development of AI-specific contractual provisions designed to address issues such as data handling, retention, outputs, transparency, and vendor accountability. The discussion highlights how organizations are increasingly being asked by customers, regulators, and business partners to explain how AI is being used and what safeguards are in place to protect sensitive information. Michael shares how his organization developed client-facing AI disclosures to provide greater transparency and build trust around AI usage.

The episode also explores the importance of selecting enterprise-grade AI solutions rather than public consumer tools, particularly when organizations are handling confidential, proprietary, or personal information. Michael explains how privately licensed AI environments can provide stronger protections against data leakage and unauthorized use, while also enabling organizations to take advantage of AI's productivity benefits. Debbie and Michael discuss how AI is transforming work by helping employees automate lower-value tasks, improve efficiency, and access information more effectively, while emphasizing that organizations must establish clear policies, governance frameworks, and contractual protections to ensure AI is used responsibly.

The conversation highlights a broader trend occurring across industries: organizations are increasingly pushing privacy, security, and compliance requirements down through their vendor ecosystems. As privacy regulations continue to expand globally, companies are using contracts to establish expectations for third parties and create more consistent protections for personal data, confidential information, and AI-enabled workflows. Michael emphasizes that strong contracts remain one of the most effective tools organizations have for managing technology risk in a rapidly evolving environment.

By popular demand, Debbie Reynolds Consulting is now offering executive briefings on emerging data privacy risks and how companies can avoid them. To learn more, visit the Executive briefings page on my website.

Support the show

Become an insider, join Data Diva Confidential for data strategy and data privacy insights delivered to your inbox.

 💡 Receive expert briefings, practical guidance, and exclusive resources designed for leaders shaping the future of data and AI.

 👉 Join here: http://bit.ly/3Jb8S5p

Debbie Reynolds Consulting, LLC