The Privacy Advisor Podcast

As organizations race to adopt AI, connected technologies and increasingly data-driven business models, the challenge is no longer simply managing privacy or cybersecurity in isolation. It's understanding and governing digital risk across the enterprise.

Long before digital risk governance became a mainstream topic, John Deere was building a program designed to bring together cybersecurity, privacy, data governance, third-party risk, product security, and AI oversight under a unified framework. To learn more about the company's approach, IAPP Editorial Director Jedidiah Bracy spoke with John Deere Vice President, Digital Risk Officer and Deputy General Counsel Jason Stanley and Director of Digital Risk Brett Leighton.

In this in-depth conversation, Stanley and Leighton discuss how one of the world's most recognizable and technologically advanced manufacturers approaches digital trust; the lessons they've learned from nearly a decade of building an enterprise digital risk program; and how they're navigating everything from AI governance and shadow AI to regulatory uncertainty and intellectual property risk.

The worlds of privacy, AI governance, and digital regulation are evolving faster than ever. States continue to consider new legislation and pass new laws, regulators are expanding their focus, and organizations are working to make sense of a compliance landscape grows more complicated every year. Many of these challenges and topics were discussed at the IAPP Privacy. Security. Risk. and AI Governance Global in Seattle, Washington.

While there, IAPP Editorial Director Jedidiah Bracy sat down with Seattle-based Hintze Law Partner Mike Hintze, who has been on the front lines of these issues for more than two decades. Together, we discuss a variety of issues digital governance pros are facing, from keeping up with emerging legislation, children's online safety, health data privacy, international data transfers, the growing role of AI in the legal profession and what that means for young professionals.

For those following along with digital policy in Canada, the last few weeks have been chock full of developments. In early June, the Canadian government introduced its AI for All strategy, aimed at driving economic growth, bolstering digital sovereignty and increasing trust and safety. The government also released Bill C-34 - the Safe Social Media Act, which would ban children under age 16 from accessing certain social media platforms, and Bill C-36, which would reform the nation's privacy laws, including a significant restructure of its enforcement framework. Kris Klein is the IAPP Country Leader for Canada and partner at nNovation. I recently caught up with Kris to discuss these converging policy developments and what we can expect from the AI strategy and privacy reforms.

As artificial intelligence marches its steady pace into our day-to-day lives, the safety and privacy of children online continues to be a major concern for several governments and legislatures around the world. Australia became the first country that requires platforms to take reasonable steps to prevent children under 16 from accessing social media platforms; nearly a dozen nations have since considered similar age-based restrictions. In the U.S., a landmark jury verdict found Meta and Youtube liable for negligently designing systems that were addictive and caused mental health distress to a minor. Another child safety case in New Mexico indicates a growing legal shift in accountability for children's online safety. Alyson Stoner is an actor, singer, dancer and author, whose work goes back to early childhood. Their roles can be found in the Cheaper by the Dozen films, voice work in Phineas and Ferb, and background dancing for the likes of Missy E and Eminem. Stoner is also the author of the memoir "Semi-Well-Adjusted Despite Literally Everything," which details their mental health struggles as a child star and draws a powerful parallel between what they call child stardom's "toddler to trainwreck pipeline" to the impact social media is currently having on all child users. Stoner has since become a mental health advocate and was a keynote speaker at the IAPP Global Summit in 2026. While there, I sat down with Alyson to chat about their memoir and the significant effect social media and emerging AI systems play on children's neurological development.

The complexity and significance of international data flows have long been one of the major issues for privacy and digital responsibility professionals. In the last decade, two major frameworks - the EU-US Safe Harbor and EU-US Privacy Shield agreements - were both invalidated by the Court of Justice of the European Union. The EU-US Data Privacy Framework, however, remains intact, though it has faced one legal challenge in the last year.

Bill Guidera, who serves as deputy assistant secretary in the U.S. International Trade Administration, leads a team that helps drive policy conditions for US digital, financial, supply chain and other service industries to innovate domestically and abroad. The team plays a significant role in administering and overseeing the DPF and plays a key leadership role on behalf of the US in the Global Cross-Border Privacy Rules Forum.

IAPP Editorial Director Jedidiah Bracy caught up with Mr. Guidera to discuss how the DPF is faring, the Latombe legal challenge to the framework, as well as the latest updates to the CBPR Forum, recent reciprocal trade agreements with Argentina and Bangladesh, and the ITA's work in artificial intelligence. Here's what he had to say.

It's no secret that large language models and artificial intelligence systems require massive amounts of data, which often runs up against fundamental privacy principles like purpose limitation and data minimization. Privacy and data protection laws - like the EU General Data Protection Regulation - feature concepts like the right to be forgotten and data subject access requests. But these are often in tension with modern AI systems. Some tools, however, are emerging. One of those methods is "machine unlearning," a suite of approaches to help remedy deletion requests of information that's already been used to train an AI model. Jevan Hutson, acting assistant professor and director of the Tech-Law Clinic at the University of Washington School of Law, recently co-wrote a law review article on machine unlearning and its implications for privacy law. In this episode, Hutson explains the concept of machine unlearning and how its suite of techniques can add to the tool belts practitioners and regulators alike.

The Asia-Pacific region is home to more than half the world's population - at 60% - with approximately 4.75 billion people. In recent years, India and Vietnam, to name just two, have enacted comprehensive data protection laws. Near the end of 2025, India finalized its highly anticipated regulations for the Digital Personal Data Protection Act and Vietnam's Personal Data Protection Law became effective on the first of January this year. Hogan Lovells Partner Charmian Aw has long practiced in the region, specializing in APAC data protection, privacy, AI governance and cybersecurity law and offers developments of the region in the IAPP's Asia-Pacific Dashboard Digest. She also joined the IAPP Publications Advisory Board this year. While attending the UK Data Protection Intensive in London, IAPP Editorial Director Jedidiah Bracy sat down with Charmian Aw to discuss the latest developments in the region, specifically regarding India and Vietnam. Here's what she had to say.

The California Privacy Protection Agency was formed six years ago as mandated by the California Privacy Rights Act. As the first dedicated privacy regulator in the U.S., CalPrivacy - as it's called colloquially - implements and enforces both the CPRA and California Consumer Privacy Act. Under the state's Delete Act, it also oversees California's data broker registry and the Delete Request and Opt-Out Platform, known as DROP. Tom Kemp serves as executive director for CalPrivacy and is almost a year into his tenure after taking on the role in April 2025. On 1 January 2026, the DROP system went into effect and now boasts more than 215,000 registrants with more than 500 registed data brokers. The agency is also implementing a number of regulations in the state, including for automated-decision making, risk assessments and cybersecurity audits. IAPP Editorial Director Jedidiah Bracy caught up with Tom Kemp to learn more about the DROP system and the agency's priorities in the year to come.

Goodwin Partner Omer Tene has long had his finger on the pulse of privacy and AI governance developments and trends. He advises clients on a wide range of issues, from data protection, artificial intelligence, technology, cybersecurity and beyond.

As we head into a brave new 2026, IAPP Editorial Director Jedidiah Bracy caught up with Tene to discuss the big issues he sees playing out this year, from a changing geopolitical environment to US state privacy and AI legislative activity, from kids privacy and safety issues to digital reform in the EU.

On November 19, the European Commission unveiled two major omnibus packages as part of its European Data Union Strategy. One package proposes several changes to the EU General Data Protection Regulation, while the other proposes significant changes to the recently minted EU AI Act, including a proposed delay to the regulation of so-called high-risk AI systems. Laura Caroli was a lead negotiator and policy advisor to AI Act co-rapporteur Brando Benifei and was immersed in the high-stakes negotiations leading to the AI regulation. She is also a former senior fellow at the Center for Strategic and International Studies, but recently moved back to Brussels during a time of major complexity in the EU. IAPP Editorial Director Jedidiah Bracy caught up with Caroli to discuss her views on the proposed changes to the AI Act in the omnibus package and how she thinks the negotiations will play out. Here's what she had to say.