um thank you it is such an honor to
receive this award and this talk is for
you HIPAA the e regulation
gramm-leach-bliley the safe harbor data
breach notification laws Fourth
Amendment cases the European Court of
Justice the patchwork us legislative
approach the Omnibus European model for
decades privacy discussion has focused
on laws governing treatment of personal
information privacy on the books what it
says and what it should say but until
now we've had precious little insight
into how those words we've argued so
passionately about actually shape the
behavior of the companies that handle so
much of our data what affects their
understanding of privacy's meaning what
influences the practices they have or
don't have that they put in place to
protect privacy so we looked under the
hood to see what really mattered our
privacy on the ground project looked at
the corporate privacy leaders of five
different countries the United States
Germany France Spain and the UK we did
scores of interviews with chief privacy
and data protection officers with
engineers with lawyers with advocates
and regulators and it turns out that all
of this discussion about privacy on the
books all of these articles these
debates these hearings they missed
something crucial about what really
matters they missed you they missed the
crucial role of the privacy professional
it turns out that privacy professionals
like you your roles your respective
levels of power
an influence within the firm's your
level of access to your boards and
senior management your activities
outside the firm the way you interact
with the broader field of privacy
experts including regulators advocates
professional groups and your peers
communities like these are often the
factors that determine whether firms
have robust processes in place to
protect privacy robustly our book begins
with the story of Yahoo's 2004
disclosure to the Chinese government of
dissident journalists Cheetos identity
as the author of an email critical of
Beijing now that revelation led to she's
imprisonment it spawned widespread
public condemnation and US congressional
hearings these condom nations were felt
in boardrooms throughout silicon valley
and beyond now flash forward a number of
years and we see Yahoo in a pitched yet
secret battle opposing the NSA's demands
to turn over customer information under
their warrantless internet surveillance
program that time the company did the
right thing and was celebrated but why
the change the law on the books looked
remarkably similar but the company the
company had changed dramatically it
empowered and resourced its privacy and
law enforcement staff it had launched a
business and human rights program
covering privacy and freedom of
expression it had built privacy in and
when the government came knocking this
time Yahoo was ready to engage in an
important discussion about the interplay
between privacy and surveillance and
Yahoo's corporate evolution reflects
broader shifts that we found in our
research we got a window into an
incredible time because what you do now
is really special our work documents the
development of
an emerging set of global privacy best
practices arising most robustly in the
United States and Germany and all
centered around a particular type of
chief privacy or data protection officer
the critical attribute of these privacy
officers is that they span boundaries
they do this in three related ways first
their work literally spawns the
boundaries of the firm itself the
leading privacy professional spends as
much of her time outside as inside this
outward focus enables her to translate
the uncertain and dynamic requirements
of privacy as it's repeatedly reshaped
by regulators and advocates and
consumers and it helps mitigate risks
and avoids the firm being blindsided by
this constantly changing privacy
environment having one foot firmly
planted outside the corporation while
the other inside enhances the cpos
independence and importance and it
allows them to be the strategic
interpreter of this very complex and
evolving environment and second because
the cpos role in mediating between
external privacy demands and internal
corporate privacy practices their work
inside the organization also spans
strategy privacy as strategy and
operations privacy as management so on
the one hand they are expertise in
helping the firm translate the external
landscape helps secure a place at the
table when corporate decisions are made
and it helps to ensure a strategic role
for the CP o often from within the C
suite and on the other hand privacy
leaders must operationalize privacy all
the way down
evolving best practices of making you
privacy part of management through
distributed expertise the privacy
function can't just be siloed in one
individual or compliance unit privacy
decision-making must be integrated into
technology design business line
processes and privacy expertise and
responsibility must be distributed to
staff who are embedded within business
units so that it can be brought to bear
from the inside throughout the
development of data intensive processes
and systems third the leaving leading
privacy professionals pounds the
boundary between the firm's expertise
and that of society they bring
specialized expertise and knowledge
about their firms and deep working
relationships within it yet at the same
time they bring privacy commitments from
outside drawn from membership in a
community like this one built from the
knowledge of private sector leaders
government experts advocates and the
public they are in many ways the moral
conscience within the firm literally
bringing the outside perspective inside
to affect firm thinking and this all
raises the question where do we go from
here to be sure the privacy profession
will continue to grow the GDP are alone
is expected to necessitate 20,000 new
privacy and data protection officer jobs
over just the next three years and this
will certainly increase the trend of
making privacy part of management within
firms but this growth also creates
challenges managerial izing privacy is a
positive development no doubt yet as a
more resources are dedicated to making
privacy part of core operations how do
we make sure that privacy leadership the
role doesn't lose its
special character how do we make sure it
doesn't get boring managerial eyes in a
bad way bureaucratized how do we keep it
sexy and cutting-edge and strategic and
as privacy professionals become more and
more integrated into firm management how
do we make sure that they that you
remain boundary spanning independent
fully in the firm but not solely of the
firm some answers can be found in two
changes that began to emerge just as we
finished our research first subjects who
called themselves chief privacy officers
or data protection officers at the
beginning of our research now have it
expanded portfolio and in some instances
new titles reflecting this increased
breadth of responsibilities your
strategic role is evolving it includes
all kinds of information governance and
policy issues fairness ethics machine
learning big data and as the toehold of
societal values within the firm the cpos
portfolio is dynamic and janitor
generative so well equipped to address
these new problems and new challenges to
values seizing the opportunity of this
expanded set of opportunities will
maintain the strategic salience of
privacy other values
and the cpa roll itself second privacy
is becoming more interdisciplinary
senior engineers are partnering with
cpos to create high-level
cross-functional privacy teams privacy
by design is becoming real the
leadership teams expand the voices
speaking for privacy and they expand
your work and the depth of it throughout
your organization's the privacy
professional community has built a
path-breaking model for dealing with the
challenges of the information age
melding strategy and operations spanning
outside commitments and internal
legitimacy bringing the outside in as
the age of information is transformed by
machine learning artificial intelligence
and technologies we've yet to even dream
of these are the models that will serve
us well thank you thank you