BusinessManagementEntrepreneurshipExplicit

She Said Privacy/He Said Security

Jodi and Justin Daniels

This is the She Said Privacy / He Said Security podcast with Jodi and Justin Daniels. Like any good marriage, Jodi and Justin will debate, evaluate, and sometimes quarrel about how privacy and security impact business in the 21st century.

Play

Open in

24 episodes
fortnightly
Avg 30 min
English

Episodes 24

Newest Oldest Longest

All20 Unplayed20 In progress0 Played0

Counted on this page — what you have heard stays on this device, so it is not something the list can be paged by.

Thursday · 24 min
Privacy-First Marketing for Healthcare Organizations
Adam Putterman is a Co-founder of Ours Privacy, a HIPAA-compliant CDP and privacy platform used by many of the largest health systems and medical brands across the country. Previously the CMO of a nationwide therapy platform, he is also a published author and university guest lecturer on privacy-first growth, HIPAA-compliant marketing, and analytics. Adam holds an MBA and an MS in Design Innovation from Northwestern University's Kellogg School of Management. In this episode… Healthcare companies shouldn't have to choose between effective marketing and privacy compliance. However, meeting evolving state privacy law requirements can be challenging when marketing technologies share data with third parties without a company's knowledge. Overcoming this hurdle takes diligence and a clear understanding of the cookies, pixels, and trackers on a website, what information they collect, where it's sent, and whether consumer consent choices are enforced downstream. So, how can healthcare organizations market in a more privacy-friendly way? A privacy-first marketing approach starts with a website audit, so companies have an accurate picture of their tracking technologies and data-sharing practices. From there, it's essential to have the right privacy disclosures in place and ensure consent choices flow to third-party advertising and analytics platforms. Organizations also need to account for consent and communication choices beyond website tracking, including marketing emails and sensitive patient care communications. To meet privacy obligations and manage marketing activities effectively, companies should consider investing in a centralized platform rather than using multiple overlapping tools that can create friction for both functions. Companies also need to scan their websites regularly because they are accountable for the tracking technologies third-party agencies install. In this episode of She Said Privacy/He Said Security, Jodi and Justin Daniels talk with Adam Putterman, Co-founder of Ours Privacy, about how healthcare companies can balance privacy with marketing growth. Adam explains the challenges healthcare organizations face as they work to meet privacy requirements in a fragmented ad tech ecosystem. He highlights how a centralized platform can help companies manage privacy compliance and marketing needs and discusses the benefits of server-side tracking. Adam also shares his perspective on dark patterns and offers practical steps privacy, security, and marketing teams can take to reduce risk from website tracking technologies.
October 8 · 27 min
What It Takes to Win Privacy Budget Approval
Adam Binks is the CEO of Syrenis, a company that helps large, data-sensitive organizations turn consent and preference management into a commercial advantage. Not a 20-page notice nobody reads, but a real preference architecture that improves retention, engagement, and audit-readiness. Their customers include Fortune 500 brands across financial services, healthcare, insurance, publishing, and automotive, and they recently launched US operations to support enterprise customers across North America. In this episode… Privacy technology is often treated as a cost of doing business rather than an investment that supports broader company goals. As a result, securing funding can be challenging for privacy leaders because the C-suite weighs their ask against budget requests from other teams tied more directly to revenue and growth. Overcoming this hurdle requires demonstrating to leadership the value privacy software and other initiatives bring to the organization. So, how can privacy leaders build a strong case for the budget they need? Winning leadership budget approval requires connecting privacy investments to how they reduce risk and create operational efficiency. Privacy leaders need to work with marketing, finance, sales, and other business teams to understand their priorities and how privacy tech and other initiatives support those functions. This approach helps leadership understand that approving a budget line item for a new consent management platform, for example, not only supports compliance efforts but also enables sales and marketing teams to communicate better with customers and prospects, increasing opt-in rates and bringing more revenue through the sales funnel. By using company-specific examples and ROI metrics, privacy leaders can make a stronger case to the C-suite that privacy benefits the entire organization. In this episode of She Said Privacy/He Said Security, Jodi and Justin Daniels talk with Adam Binks, CEO of Syrenis, about what it takes to secure privacy budget approval. Adam explains why these requests can stall and how privacy teams can gain leadership's support by aligning their goals with other areas of the business. He shares tips on how privacy pros can pitch software as a marketing and sales enabler and revenue driver, and why it's essential to tie privacy spend to measurable returns on investment to earn funding approval from the C-suite. Adam also discusses how teams can use AI to analyze historical data and strengthen the business case for new technology.
September 24 · 29 min
How to Govern AI Agents Effectively
Camilo Artiga-Purcell is General Counsel at Kiteworks, where he leads the company's global legal operations across commercial contracts, data privacy and cybersecurity compliance, M&A, litigation, and regulatory strategy. He has advised on seven acquisitions and brings over a decade of experience litigating complex commercial disputes from inception through trial and appeal. A recognized voice on AI governance and data security risk, Camilo regularly publishes on the legal challenges organizations face as they adopt emerging technologies. In this episode… AI agents are becoming more common in everyday business operations, gathering data and carrying out tasks for organizations. Traditional governance policies typically place guardrails around the AI tools human employees can use, what data they can access, and how that information can be used for business purposes. Companies need to extend those same controls to AI agents as they deploy them to reduce risk and meet compliance requirements under a growing patchwork of AI regulations and existing US and global privacy laws. So, what does it take to govern AI agents effectively? Before allowing AI agents to access and use sensitive data, organizations need to establish governance policies that define what they can or cannot do with it. Companies can then use tools like software wrappers to implement these policies on the front end while generating an audit trail on the back end that logs the agent's identity, the prompt, where it went, and what it did. Those records can plug into e-discovery systems to show whether the agent operated in compliance and provide a clear path to reconstruct its activity if it goes rogue. Alongside these controls, companies should also put security measures in place when they adopt AI models, rather than after problems arise. Employees also need training on how to use AI responsibly, with ongoing education that evolves with the technology. In this episode of She Said Privacy/He Said Security, Jodi and Justin Daniels talk with Camilo Artiga-Purcell, General Counsel at Kiteworks, about governing AI agents as their use expands across organizations. Camilo explains why governance policies need to be applied directly to AI agents, with evidence-quality audit trails that document their activity. He discusses the importance of proactively embedding security controls into AI tools, highlighting the risks surrounding certain AI models. Camilo also shares his insights into rising AI costs and how organizations can determine which models are appropriate for different teams, and he offers practical tips for verifying AI outputs and pressure testing the results.
September 10 · 35 min
How to Solve AI's Data Problem
Cillian Kieran is the Founder and CEO of Ethyca, where he leads its product vision, engineering strategy, and growth. A serial entrepreneur and privacy engineer with two decades of experience, he launched Ethyca in 2018 to bring privacy-by-design infrastructure to developers. Earlier, he built the digital consultancy CKSK to 100-plus employees across four countries, serving clients like PepsiCo, Heineken, and PlayStation. He pairs deep technical grounding with a track record of scaling data-intensive businesses. In this episode… As companies expand their use of AI, they need guardrails around how the technology is used by employees and how those systems use enterprise data. Because models are trained on data, bias can be introduced through this information, while systems also continue to use this data to perform different tasks. This creates risk, and managing it requires evaluating what data a model or tool can access, its intent when it uses that data, and the economic, ethical, and regulatory implications of that intended use. So, what controls do companies need to manage AI and company data safely? Because AI wants to satisfy a user's request, it will keep trying to access data unless clear boundaries define what it can use. Using AI responsibly requires managing the data behind it alongside the technology itself. To do this effectively, companies need to know what data they have collected, where it came from, whether they have sufficient consent, and what legal basis applies to its use. Once companies understand those elements, they can give AI access to the information it needs for a specific purpose while limiting what falls outside that use, allowing them to leverage the value of their data while minimizing risk. Governance also needs to move from written policies into controls that can be enforced on a system in real time. And while AI can streamline processes like privacy risk assessments by gathering information and comparing it against policies, past assessments, and relevant requirements, human privacy experts still need to review the output for accuracy and challenge AI when it's wrong. In this episode of She Said Privacy/He Said Security, Jodi and Justin Daniels talk with Cillian Kieran, Founder and CEO of Ethyca, about the importance of unifying AI governance and data governance. Cillian explains how bringing these two areas together helps companies stay in control of their data while allowing the technology to support the business. He discusses why companies are turning to open-source models for greater sovereignty and cautions that bringing a model in-house can still introduce risks. Cillian also addresses the tension between AI's need for data and privacy's data minimization principles, and he stresses why professionals need to think critically, question AI outputs, and avoid relying on AI as a crutch.
August 27 · 30 min
Maintaining Human Intelligence in an AI World
Elise Houlik is the Chief Privacy Officer at Intuit, where she leads the company's global privacy and responsible data innovation and protection strategy, ensuring data is used to safely power innovation across Intuit's ecosystem of financial technology products. Her team is deeply engaged with the business on all matters related to product development, data innovation and governance, and information security. In this episode… Legal and privacy professionals are using AI more often to save time and accomplish more in their day-to-day work. While these tools offer clear advantages, they also generate convincing outputs that are incomplete, generic, or factually wrong. Using AI responsibly requires professionals to apply human judgment and review the output closely to ensure it is accurate and supported before relying on it. As AI becomes more embedded in legal and privacy work, critical thinking skills remain just as important as knowing how to use the technology. Professionals get the most value from AI when they view it as a collaborator, rather than an authority. As privacy and legal teams use AI to kickstart analysis, pull facts together, and hunt for nuances across fragmented laws, they need to compare its answers against actual laws and reputable sources and challenge the tool when an output misses the mark instead of accepting it at face value. Being mindful about the personal information they put into public models is equally important. Professionals should also be comfortable using a variety of different tools and learning which ones fit different purposes. And as companies hire the next generation of tech-savvy professionals, they need to ensure they don't become overly reliant on AI and provide them with hands-on experience and exposure to real conversations that strengthen analytical skills. In this episode of She Said Privacy/He Said Security, Jodi and Justin Daniels speak with Elise Houlik, Chief Privacy Officer at Intuit, about the importance of maintaining human intelligence in the age of AI. Elise shares how AI is changing the skills employers value in legal and privacy professionals and explains why human judgment, curiosity, and a willingness to challenge AI-generated answers are essential as these tools become a standard part of workflows. She highlights why junior professionals still need practical experience and peer-to-peer learning opportunities and shares her perspective on keeping human intelligence at the center of how professionals use AI. Elise also offers tips for building AI skills and experimenting with different tools.
August 13 · 32 min
Navigating the New Era of Data Broker Laws
For 30 years, Ben Isaacson has been a leading privacy professional and trusted counsel. During the "Internet 1.0" era, he was instrumental in launching the first self-regulatory guidelines for email marketing, addressable TV, and mobile marketing. Ben was one of the first privacy professionals to get certified as a CIPP/US with the IAPP in 2005. In this episode… Data broker laws are pulling a once-hidden industry into the light. For years, consumers generally had no idea which companies were compiling and selling their personal information, what those companies were doing with it, or how to opt out. States are responding with data broker laws that require brokers to register and disclose information about their businesses and data-selling practices. Seven states now have these laws on the books, with some providing consumers with a centralized mechanism to request deletion of their data or to opt out of its sale. So, how can companies that purchase or license data from brokers manage the downstream risks that come with using it? Companies buying or licensing data from data brokers need to know where that data comes from, how it's used, and what their third-party contracts permit. Legal and privacy teams should work with marketing and sales to identify which adtech vendors they buy or license data from and scrutinize their licensing relationships. They also need to map how purchased data flows through the business and ensure their privacy notices disclose its use. California's Delete Act makes this downstream visibility especially important because it requires data brokers to apply deletion requests before that data is used. Companies also need to consider whether their activities qualify them as data brokers, particularly because New Jersey's data broker law extends registration requirements to data collectors, potentially affecting businesses that fall outside the traditional data broker definition. Companies should seek a legal opinion to determine where they stand based on the nature of their business and its commercial terms. In this episode of She Said Privacy/He Said Security, Jodi and Justin Daniels speak with Ben Isaacson, Principal at In-House Privacy, about the rise of data broker laws and what they mean for companies that buy, license, or sell personal information. Ben discusses the evolution of these laws and how data broker definitions and legal requirements vary across states. He highlights what companies can do to mitigate risk when using data purchased from brokers and provides tips on how companies can determine whether they are considered data brokers under these laws. Ben also shares his perspective on how California's Delete Act could influence future state and federal regulation.
July 30 · 36 min
The People-First Approach to Building Effective Privacy Programs
Chris Tarbell is a leading privacy, cyber, and data strategy executive. He currently serves as the Chief Privacy Officer for VERSANT Media LLC. Prior to his current role, Chris was an associate general counsel for Fanatics and the Walt Disney Company, where he advised global businesses on compliance with domestic and international privacy, data security, and related consumer protection laws. Most recently, Chris served as Senior Counsel at the leading law firm of Kelley Drye and Warren, where he also supported clients in numerous regulatory investigations related to marketing and advertising. In this episode… Building strong privacy programs relies on human connection and a deep understanding of organizational dynamics and business goals. To be successful, privacy professionals must participate in the business rather than just focusing on meeting legal requirements. This approach enables leaders to advocate for the tools, budget, headcount, and other resources to move the program forward. Because privacy impacts many business functions, it is very much a people business, requiring strong relationships, cross-functional collaboration, and the ability to build trust with stakeholders and internal teams. So, what steps can companies take to achieve this? Putting this into practice starts with assembling a people-first privacy team and hiring individuals with the soft skills to step into unfamiliar situations, assess what is needed, and work across departments to move the program forward. By bringing curiosity and enjoyment to privacy work, they create an environment where other departments are more willing to involve privacy early and often. This approach is especially important in the media industry, where privacy pros may need to work with news colleagues to balance the right to be forgotten with First Amendment considerations or partner with intellectual property teams to protect personal information during piracy investigations. And while collaboration is essential, teams must also determine what can realistically be achieved with the time and resources available without allowing perfection to stall progress. In this episode of She Said Privacy/He Said Security, Jodi and Justin Daniels speak with Chris Tarbell, Chief Privacy Officer at VERSANT Media, about building effective privacy programs through relationships and collaboration. Chris explains how his experience as both in-house and outside counsel shaped his ability to understand business objectives, advocate for resources, and communicate the value of privacy. He shares insights on the cross-disciplinary nature of privacy work in the media industry, lessons from building a program during a major corporate spinoff, and the importance of creating a people-first privacy team capable of handling unfamiliar business challenges. Chris also explains why bringing some fun to privacy work can make a program more effective.
July 16 · 36 min
AI Governance Built to Scale
Andrew Burt is a lawyer, entrepreneur, and former national security official widely recognized as one of the world's leading experts in the intersection of law and artificial intelligence. Over the last decade, he has built companies, law firms, and software systems that have revolutionized how AI is managed for legal risks, and his work has impacted hundreds of millions of people around the world. As a pioneer in the field of legal engineering, he founded and led the world's first legal engineering team focused on automating data governance in 2016. In 2019, he co-founded and later sold the first-ever law firm run by lawyers and data scientists solely focused on artificial intelligence. He is co-founder and CEO of Luminos.AI, the first AI governance company focused on legal risk, where he currently serves as CEO. In this episode… Companies are adopting AI faster than they can set guardrails around it. Privacy and legal teams can review an AI model or approve a vendor contract, but AI governance doesn't stop there. Risk varies by use case, including whether the system is internal or customer-facing and the level of human oversight involved. As organizations connect new AI tools, chatbots, and agents to more business processes and systems, AI governance has to move from policy to a scalable structure. One of the biggest challenges companies face is making governance work at the same speed as AI adoption. Andrew Burt knows this well as a co-author of the NIST AI Risk Management Framework, where he helped shape how companies identify, document, and manage AI risk. Turning frameworks into action is where organizations often get stuck. Implementing AI guardrails requires involvement from legal, privacy, security, compliance, engineering, and other business teams. Yet when too many people share responsibility without a lead decision-maker, it can create what Andrew calls "governance debt." Effective governance starts with accountable leadership and a working connection between the teams writing the rules and the teams building the AI systems. This means moving beyond policy-heavy approaches so governance can scale with the business and the technology. In this episode of She Said Privacy/He Said Security, Jodi and Justin Daniels talk with Andrew Burt, Co-founder and CEO of Luminos.AI, about the challenges of scaling AI governance. Andrew explains why traditional governance models struggle to keep up with how quickly AI systems are built and deployed. He breaks down the differences between managing risk at the model level and at the use-case level, including why the same AI tool can carry different risks depending on its use. Andrew also shares his prediction for the future of AI regulation in the United States and offers practical steps companies can take to strengthen AI governance.
July 2 · 36 min
Lessons Learned From a Decade of FTC Privacy Enforcement
Aaron Alva is a Harvard Berkman Klein Center fellow and the Founder of Alva Strategy Center, advising organizations and enforcers on privacy, security, and AI governance. Previously, Aaron was a lead tech advisor at the FTC, where he was instrumental in driving the agency's approach to privacy and security enforcement. In this episode… Privacy risks often hide in how companies collect, use, and share personal information. Smart TVs, health-related websites, and location data have all drawn regulatory scrutiny when data is used in ways consumers did not reasonably expect. A decade of FTC privacy enforcement shows companies what regulators consider unfair or deceptive. So, what can companies learn from these cases to strengthen their privacy practices? Reducing privacy risk starts when companies understand the data they collect, where it goes, why it's being used, and whether that use is necessary in the first place. Companies should pay close attention to handling sensitive data with care, including health information, location data, children's and teens' data, and driver behavior data. Embedding stronger privacy practices often comes down to establishing clear purpose limitations, thoughtful data minimization measures, limited retention, and privacy-enhancing defaults. It also requires a regular and thorough review of AdTech tools, like pixels and tags. Getting these practices right can help companies reduce regulatory risk. Yet when companies fall short, the FTC and state privacy regulators can impose remedies that reach beyond fines, requiring companies to delete data, stop certain data uses, change platform default settings, or build a stronger privacy program. In this episode of She Said Privacy/He Said Security, Jodi and Justin Daniels talk with Aaron Alva, Founder of Alva Strategy Center, about what companies can learn from a decade of FTC privacy enforcement. Aaron explains the role technologists play in helping enforcement agencies work through technically complex privacy issues during investigations. He delves into lessons from major enforcement actions involving smart TVs and social media platforms and shares insights on the FTC's privacy remedies. Aaron also explains how companies can strengthen their privacy practices by setting clear limits on data use, treating sensitive data with care, and aligning privacy controls with consumer expectations.
June 18 · 27 min
How to Build and Implement AI Systems That Businesses Can Trust
Myles McNamara is Tarkenton's lead technical architect and full-stack developer, specializing in building secure, scalable software solutions. He oversees infrastructure, code, and system design, serving as the team's in-house expert. Previously, he worked with Fortune 500 government contractors and ran his own software and hosting companies. In this episode… Integrating responsible AI tools and systems into business operations depends less on the model itself and more on the privacy and security controls a company embeds around it. "We need AI" is often where the conversation starts, but turning that need into a safe and controlled environment requires a clear understanding of where data lives, who can access it, and what the AI system is allowed to do. Those considerations shape whether AI can support the business without creating unnecessary risks. How can organizations design and implement AI in a way that is secure and grounded in real business needs? Before companies implement a new AI system, they need to set guardrails around how it will operate in practice. Governance needs to be built into the system from the beginning, not left in a policy or bolted on later. Establishing clear data boundaries, access controls, and system-level permissions defines what the AI tool can access and which actions it can perform. Logging and audit trails give companies visibility into how the system is functioning, so if something goes wrong, they can understand what happened and why. AI will continue to evolve, and companies also need to ensure that their privacy and security controls keep pace through regular monitoring and continued improvements. In this episode of She Said Privacy/He Said Security, Jodi and Justin Daniels talk with Myles McNamara, Principal Software Engineer at Tarkenton, about designing and implementing AI tools and systems responsibly. Myles shares what it takes to build AI agents and systems in a secure, controlled way, including how companies should think about whether AI is needed and how much autonomy it should have. He emphasizes the importance of integrating governance into system design and offers advice for safeguarding data. Myles also shares how engineering teams can balance business expectations with privacy and security concerns and discusses why AI governance might get overlooked in practice.
June 4 · 45 min
How a Georgia Lawmaker is Tackling Kids' Online Safety
Sen. Sally Harrell was elected to the Georgia State Senate in 2018, representing DeKalb and Gwinnett counties. Prior to serving in the Senate, Sen. Harrell earned a Master of Social Work and worked as a non-profit executive. Recently, Sen. Harrell co-chaired a legislative study committee on Kids' Online Safety. She and her husband are proud parents of two young adult children. In this episode… Keeping kids safe online has moved beyond screen time limits and reminders about what not to click. From social media and gaming platforms to AI companion chatbots, lawmakers are focusing on features that can manipulate children or expose them to harmful interactions. Parents want stronger protections for their children, and lawmakers on both sides of the aisle agree more must be done. As lawmakers push to regulate harmful design and AI-driven risks, balancing child safety with innovation remains a challenge. Protecting kids online takes more than one policy or parental control setting. Georgia State Senator Sally Harrell knows this well. She introduced a resolution to create a bipartisan-led Senate Study Committee dedicated to keeping kids safe online. The committee's work helped advance the bell-to-bell cellphone ban for high school students, building on the K through eight ban previously signed into law in Georgia. Their efforts also led to bills addressing addictive social media and gaming design and AI companion chatbot safeguards. The legislative process revealed how lobbying pressure and buried bill language can weaken broadly supported protections. Yet call to action matters. Parents and constituents need to stay engaged, get involved, and speak up to ensure legislators are held accountable for protecting children online. In this episode of She Said Privacy/He Said Security, Jodi and Justin Daniels speak with Georgia State Senator Sally Harrell about the realities of advancing kids' online safety legislation. Senator Harrell explains how the bipartisan-led Georgia Senate Study Committee on kids' online safety turned parent concerns into legislative action. She shares a behind-the-scenes look at what it takes to keep bills moving, including the constraints of short legislative sessions, Big Tech lobbying, and the role public advocacy plays. Senator Harrell also provides privacy and security tips for families navigating children's online activity.
May 21 · 31 min
Navigating Opt-Out Challenges and Strategies for Getting It Right
Max Anderson is a seasoned product executive with a proven track record of bringing successful technology products to market in the consumer privacy, data management, and marketing space. Prior to Ketch, Max was the Director of Product Management at Krux. After joining Salesforce as part of the Krux acquisition, Max ran data privacy and consumer identity products at Salesforce, including the rollout of their industry-leading GDPR solution set. Prior to Krux, Max was a Product Manager at IPG Mediabrands, where he was responsible for multiple successful advertising measurement products. In this episode… Getting consent and opt-out compliance right requires more than adding a cookie banner or standalone webform. It requires consent tools, consumer identifiers, and downstream third-party systems to work in concert. Regulators are looking closely at whether a consumer's choice follows them across devices, browsers, and the systems where their data is collected and used. When those pieces do not connect, an opt-out can be incomplete, putting companies at risk of regulatory enforcement. So, what does it take to build a complete and compliant consumer opt-out experience? Identity management is central to effective consent and opt-out compliance because consumer choices need to be honored at the person level, across devices and browsers. Privacy rights forms and consent tools also need to connect, so an opt-out request reaches the CMP controlling tag firing on the site. When data has moved to third-party advertising and marketing vendors, companies need to understand whether they can flow that opt-out downstream. Yet many third-party platforms do not provide privacy APIs or consent-related controls, and building integrations with them can be challenging. Companies should test the process by submitting an opt-out through the webform, returning to the website, and checking whether browser data collection events still happen that could facilitate cross-context behavioral advertising. In this episode of She Said Privacy/He Said Security, Jodi and Justin Daniels talk with Max Anderson, Co-founder and Head of Product at Ketch, about navigating consent and opt-out compliance gaps. Max explains why identity management matters when honoring consumer choices across devices and browsers, and how disconnected privacy rights forms and consent tools can leave opt-outs incomplete. He also describes the challenges companies face when flowing opt-outs down to third-party advertising and marketing vendors and shares practical steps companies can take to assess vendor controls, cross-device exposure, and the areas that may create enforcement risk.
May 7 · 39 min
From Gatekeeper To Architect: How General Counsel Are Shaping Innovation in the AI Era
Smrithi Mohan is General Counsel at Awesome, the parent company of SmugMug and Flickr, where she oversees all legal, IP, privacy, and compliance matters for two of the world's most recognized photo-sharing platforms. She previously spent a decade at Dun & Bradstreet, where she built the company's first global IP and innovation practice. An elected Board of Education member and recognized Top Woman Leader, she speaks and writes on legal operations, IP strategy, leadership, and building legal functions from the ground up. In this episode… When a new AI feature ships or a new product is designed, general counsel may not be looped in until after key decisions are made. This creates risk because most product decisions have legal implications, especially around data use, user rights, and consent. That changes when legal teams are brought into the product development cycle at the outset, helping design outcomes that align with legal obligations and business goals. How can general counsel and legal teams move from being seen as gatekeepers to business drivers? Shifting how general counsel and legal teams are viewed starts with building strong relationships across business teams. When legal leaders understand how product, engineering, and other teams operate, they are more likely to be included as ideas take shape. Early involvement enables general counsel to explain regulatory requirements and legal frameworks across different jurisdictions, thereby improving products and making them more defensible. It also creates space to ask fundamental questions in AI development upfront, including what data is being used, whether the company has the right to use it, who owns the outputs, and whether user information is collected with proper consent flows. Vendor relationships require the same level of attention, as older contracts may not address AI and often need audits, addendums, and updated terms. In this episode of She Said Privacy/He Said Security, Jodi and Justin Daniels talk with Smrithi Mohan, General Counsel at Awesome, about how legal teams can integrate into AI and product development. Smrithi explains why general counsel needs to act as business architects and not just legal advisors, and what it takes to make that shift. She outlines the core legal questions teams should address when developing AI tools and other products, how to manage third-party vendor contract risks, and the evolving legal gray areas surrounding AI-generated content and platform liability. Smrithi also offers practical advice on building genuine, collaborative relationships across teams.
April 23 · 21 min
The Accountability Problem Behind AI Adoption
Kristin Calve is the Editor & Publisher of Corporate Counsel Business Journal and the Co-founder of Law Business Media. She leads editorial strategy focused on AI governance, legal operations, and board-level risk, and convenes forward-leaning legal leaders through interviews, events, and industry analysis. In this episode… Controlled AI deployment is one of the most pressing challenges legal and business leaders face right now. New AI tools are often adopted quickly without the full understanding of how they're being used, where data goes, and who's accountable for the outcomes. Some teams explore AI without direction or intention. Others prescribe it with guardrails, defining who can use it and how. The gap between those two approaches is where risk lives. So, how can organizations deploy and use AI without losing control? Legal operations teams are often accountable for how AI is used in practice. They understand the regulatory landscape and manage contracts and deadlines. They're often involved in operations across finance, HR, sales, and other business functions, so they know how those processes work and why they were built that way. That institutional knowledge matters as AI is introduced into those systems. At the same time, prompt documentation, AI notetakers, and recordings are introducing new risks. Teams may not know what is being captured, where it is going, or how it could become discoverable. Supply chain exposure adds another layer of risk. Vendors might embed AI into the tools organizations already rely on, potentially affecting an organization's overall privacy and security posture. In this episode of She Said Privacy/He Said Security, Jodi and Justin Daniels talk with Kristin Calve, Editor & Publisher of Corporate Counsel Business Journal and Co-founder of Law Business Media, about how organizations are navigating AI deployment and risk. Kristin explains how companies are deploying AI inconsistently and the challenge of controlling its use. She shares how regulatory requirements shape accountability and why legal operations teams often bear responsibility for what's permissible. Kristin also explains the risks of prompts and recordings becoming discoverable and discusses how AI increases speed and capacity, but does not replace the need for judgment.
April 9 · 31 min
Advancing AI Fluency With Grit and Growth Mindset
Gabrielle Kohlmeier is a lawyer, tech whisperer, and transformation executive in a lifelong love affair with growth mindset and sustainable innovation. From building a Fortune 30 legal and policy approach to antitrust, to navigating retail risk, to leading global legal AI adoption and outperforming teams. She helps organizations rightsize risk and turn disruption into strategic value. In this episode… Many companies are rushing to adopt AI tools and publish AI policies, yet far fewer are investing in AI fluency across their workforce. Knowing how to use an AI tool is not the same as understanding what it is doing, what data it collects and uses, and the privacy, security, and compliance obligations that come with using it. Without that level of understanding, organizations risk using AI without fully grasping its impact. So, what does true AI fluency look like in practice? Organizations spend time creating AI governance policies, and sometimes those policies are not operationalized. Governance then becomes "precious" when it is documented and published but not embedded into how teams actually work. That gap becomes more pronounced when teams lack the AI fluency needed to apply governance to their day-to-day use of AI tools. To be effective, governance needs to be lived, with clear accountability, ongoing feedback loops, and policies and processes regularly revisited as AI use cases evolve. It also requires establishing privacy and security guardrails that allow teams to experiment with AI responsibly, while right-sizing risks. In this episode of She Said Privacy/He Said Security, Jodi and Justin Daniels talk with Gabrielle Kohlmeier, Legal and Innovation Executive, about building AI fluency and operationalizing responsible AI use. Gabrielle explains why AI fluency goes beyond simply using AI tools and requires a deeper understanding of the ethical and legal obligations that come with them. She shares how AI governance often breaks down in practice and what it takes to truly operationalize it, while enabling responsible AI experimentation with clear guardrails. Gabrielle also highlights numerous curated resources to help companies stay grounded as AI evolves and offers a practical privacy tip that applies to everyday internet and AI use.
March 26 · 26 min
Why Every Company Needs a Trust Center
Kelly Peterson is the Chief Privacy and Compliance Officer for Yobi AI, a company dedicated to building models based on consented data to democratize access to data in an ethical and privacy-respecting manner. As CPO, Kelly establishes the strategy for the company's compliance programs and advises on product development utilizing PbDD. She collaborates cross-functionally with key internal stakeholders and external partners to explain Yobi's unique approach to AI development. In this episode… Building trust around how companies collect and use consumer personal information has become a defining challenge. Companies need to be upfront with the types of personal information they collect from consumers, why they collect it, and how it is used. Making that information easy to access can help people better understand a company's privacy and security practices. And one way to do that is through a trust center. Trust centers do more than build credibility. They can also serve as an efficient sales and marketing tool that quickly answers questions about an organization's privacy and security practices. Building one often starts with an internal advocate. That advocate can work with sales and marketing teams to demonstrate how having privacy and security information in one place enables more effective responses to requests from organizations evaluating potential business partnerships. When building AI tools or other new products and features, companies should treat trust as a design choice and be transparent about how behavioral data is used and the benefits consumers receive from it. In this episode of She Said Privacy/He Said Security, Jodi and Justin Daniels talk with Kelly Peterson, Chief Privacy and Compliance Officer at Yobi AI, about building trust-centered approaches to privacy and security practices. Kelly explains the role trust centers play in demonstrating transparency to consumers and business partners. She shares how businesses benefit from building new products, features, and AI tools with trust in mind, and why demonstrating the benefits of using consumer behavioral data helps build trust. Kelly also discusses the challenges companies face when navigating overlapping privacy laws, AI regulations, and other privacy-adjacent regulations.
March 12 · 38 min
Behind the Curtain With Tom Kemp: New CCPA Rules, Enforcements, and What's Next
Tom Kemp is the Executive Director of CalPrivacy. Previously, he was a Silicon Valley tech entrepreneur and CEO. He volunteered on the California Privacy Rights Act campaign and has advised on major tech policy legislation nationwide, including the Delete Act (SB 362) and AI Transparency Act (SB 942). He is the author of Containing Big Tech. In this episode… California's privacy law evolves once again as its new regulations push companies to move from policy to proof. Privacy risk assessments, cybersecurity audits, and automated decision-making technology requirements introduce new obligations for businesses that process personal information at certain thresholds. Alongside recent CCPA enforcement actions, these new rules reinforce the importance of establishing governance, ensuring technical compliance, and demonstrating accountability. So, what do businesses need to do to stay ahead? CCPA enforcement actions do not happen in a vacuum. Consumer complaints, website and data flow reviews, and media reports influence investigations that can trigger enforcement actions. Tom Kemp, Executive Director of CalPrivacy, knows this firsthand as he oversees these efforts, along with the rollout of the new CCPA rules. Companies are being evaluated based on real-world user experience. That's why they need to establish governance and strong operational processes that ensure compliance as regulations and consumer expectations evolve. Companies also need to walk a mile in a consumer's shoes and test their websites and mobile applications to ensure they are free of dark patterns and that access, deletion, and opt-out rights function without friction. And when it comes to AI use, companies need to keep in mind that existing CCPA obligations still apply whenever personal information is involved. In this episode of She Said Privacy/He Said Security, Jodi and Justin Daniels talk with Tom Kemp, Executive Director of CalPrivacy, about the new CCPA regulations, enforcement, and what's next for businesses. Tom explains why the California Privacy Protection Agency transitioned to the CalPrivacy name and how the agency focuses on raising privacy awareness and making it easier for consumers to operationalize their privacy rights. He outlines key timelines and thresholds tied to risk assessments, cybersecurity audits, and automated decision-making obligations and discusses how businesses can leverage existing processes to meet the new requirements. Tom also shares how California's collaboration with other state attorneys general and international regulators is shaping enforcement coordination and privacy oversight.
February 26 · 32 min
Governing AI and Privacy Without Becoming the Bottleneck
Brittney Justice is the Global Head of Privacy at Valvoline Inc., leading the company's privacy strategy. She works at the intersection of data privacy, technology, and AI, advising on governance and risk at scale. Brittney also serves on the IAPP Privacy Law Advisory Board, shaping the future of privacy law. In this episode… Privacy and security leaders operate in an environment where innovation moves quickly, and risk evolves just as fast. That's why global companies need to maintain one consistent privacy program and layer in jurisdiction-specific requirements as privacy laws evolve. At the same time, organizations are adopting new AI tools while deepfakes and executive impersonation threats introduce new reputational challenges. How can companies enable innovation while staying ahead of emerging privacy and security risks? When privacy and security teams are pulled into projects early, relationships strengthen, and teams no longer hesitate to involve them in new initiatives. Instead of being seen as gatekeepers, they become part of the conversation, strengthening trust and collaboration across business teams and prompting proactive issue spotting. That same discipline applies when evaluating and managing AI tools, where privacy leaders need to coordinate with business teams to understand what the tool will accomplish and how it could affect the company. This requires asking: what problem is being solved, what data is involved, and what the real impact would be if something goes wrong, especially when third-party vendors and model training are involved. That same mindset is critical to educating employees about AI deepfakes and executive impersonation risks, as coordinated response planning can reduce impact. In this episode of She Said Privacy/He Said Security, Jodi and Justin Daniels talk with Brittney Justice, Global Head of Privacy at Valvoline Inc., about building a globally consistent privacy program while supporting business growth and managing emerging AI risks. Brittney explains her approach to building and maintaining one strong global privacy program without creating separate versions for every applicable jurisdiction, and the importance of embedding privacy and security teams into projects early to identify risks. She also shares tips on evaluating new AI tools, managing third-party and AI model training risks, and using executive deepfake simulations to strengthen employee awareness and establish clear escalation paths.
February 12 · 20 min
Optimizing Privacy, Cybersecurity, and AI Governance for Growth
Amy Worley is a seasoned executive and thought leader in cybersecurity, privacy, and AI governance. She is the Managing Director at BRG and leads its Privacy Compliance Advisory Practice. With a unique blend of legal, technical, and strategic expertise, Amy brings a multidimensional perspective to digital risk management and value creation. In this episode… Digital trust has become a commercial imperative. As companies move quickly to adopt new AI tools and systems, privacy, security, and governance efforts often remain fragmented. Teams continue to operate in silos, without a shared framework for managing data and AI across the business. Without governance and core privacy and security controls in place, AI initiatives are more likely to fail or create risk. So how can organizations move forward with AI while building digital trust? The best path forward often starts with structure, not speed. Rather than jumping straight into new tools, organizations need to have clear processes in place before implementation. Developing a competitive advantage through the confidence by design framework means building evidence-based programs grounded in transparency, data minimization, and core privacy and security controls. Taking time upfront to anticipate where projects might fail can help teams scope governance work more effectively before moving forward. In this episode of She Said Privacy/He Said Security, Jodi and Justin Daniels talk with Amy Worley, Managing Director and head of the Privacy Compliance Advisory Practice at BRG, about building digital trust by aligning privacy, security, and AI governance frameworks. She explores how organizations can integrate these disciplines into one unified approach rather than operating in silos. She shares insights from her book, The Confidence Advantage, and explains how evidence-based programs, metrics, and governance fit into the confidence by design approach. Amy also discusses why governance must precede companies' implementation of AI tools and offers practical ways to strengthen everyday privacy and security habits.
January 22 · 30 min
How Safe Are Kids' GPS Trackers and Smartwatches?
Steve Blair is the Senior Privacy and Security Test Program Leader at Consumer Reports, where he evaluates connected devices and digital products to uncover privacy and security risks. With a background spanning early internet technology, mobile hardware, and product security, he helps consumers better understand how their data is collected, used, and protected, especially in emerging technologies designed for families and children. In this episode… Connected devices designed for kids play a growing role in how families stay connected and informed. GPS trackers, smartwatches, and other apps and tools often promise safety and convenience, yet they also raise questions about how children's data is collected, used, stored, and protected. The challenge is not whether these tools function as intended, but how they handle personal information once they are in use. How can parents gain confidence in the technology their children use every day while avoiding privacy and security risks? A practical starting point is to read privacy notices and product descriptions, then examine how devices and apps behave in practice. Reviewing default settings, questioning app permissions, and noting how easy privacy controls are to find can help parents manage risk and better understand how a company collects and handles kids' data. These considerations become especially important when children are required to use certain apps or connected devices to participate in school activities or other events. In this episode of She Said Privacy/He Said Security, Jodi and Justin Daniels talk with Steve Blair, Senior Privacy and Security Test Program Leader at Consumer Reports, about privacy and security risks in kids' GPS trackers, wearables, and apps. Steve explains what Consumer Reports found when testing GPS trackers and wearables designed for children, and how hands-on testing helps parents better understand device privacy controls. He shares practical ways parents can assess app privacy and security protections, even without deep technical expertise. And Steve also shares practical privacy and security tips parents can use every day, like keeping devices updated, removing apps when they are no longer needed, and requesting data deletion when app use ends.

Showing 1–20 of 24 episodes