[Music]
hey everybody my name is Jedediah Bracy
on the editorial director for the IEP P
here at the lovely Cosmopolitan Hotel in
Las Vegas Nevada and I'm here with our
excellent pubs team staff all the way
down there I have Ryan Kia Vetta or
associate editor anjali Carson our
reporter extraordinaire editor for the
privacy advisor and podcast how would we
say a podcast I call I'll just have a
host host hostess with the mostess yeah
I don't serve baked goods
thanks but Foster and last but not least
our staff writer Jeff Jody ball been a
whirlwind of a week here in Vegas we had
some big breaking news yesterday
Alastair McTaggart who was one of the co
architects of the CCPA
announced a new ballot initiative and
released the text for it just this
afternoon it's called the California
privacy rights and enforcement act of
2020 or supriya I guess oh my isn't
really roll off the tongue like cacti
used to do our old acronym for the CCP
CCPA but that's big news and it was
great to have him here on stage during
our keynote session
Dominic Shelton Leipzig and Travis
la-blank
of the privacy and civil liberties
oversight board and Stacey shrew sir
Chester Chester very hard to say yeah of
the California Attorney General's Office
had a really good conversation this
afternoon or this morning about this new
initiative as well as the forthcoming AG
rulemaking that's gonna be coming out in
October so lots going on of course
beyond that we had lots of practical
topics here from data subject access
requests add tech what's going on with
location data we had an update from
Latin America all kinds of really great
stuff going on here Angelique
I'm gonna toss this up to you what what
what stuck out to you I know you're
going to be reporting on this new
initiative what stuck out to you these
last couple days yeah I mean I think the
big thing certainly and it was it was
kind of a cool opportunity for us here
at the IPP was having Alastair here the
day after he dropped this bombshell
which has everyone buzzing of course
just while we're all in the midst of
trying to figure out what the final
version of the CCPA looks like and what
we need to do as companies to start to
get compliant with that now all of a
sudden were contending with the prospect
of something that could be even more
difficult to comply with and stringent
so I haven't actually looked at the text
of I've been calling up CCPA version 2.0
but I knew that at some point it would
be the true name would be revealed so
it'll be interesting to dive deep but it
was cool having them those force or rock
stars on the stage and you could almost
sense a little bit of tension I think
between Stacy sets every single time
Stacy
Chesser very difficult and Alastair
because she actually said it's cut she
feels like she's at the AG's office
they're sort of playing 3d chess with
Alastair every time they make a move he
makes a counter move and but she did say
that the AG's office is going to stay
laser focus on the task at hand which is
to promulgate the regulations under the
CCPA and and to help to enforce it
I thought Travis LeBlanc made a really
good point that you know we put out a
survey recently with one trust that
found that two percent of companies are
basically ready for a CCP a Travis
actually said talking to people at the
conference I think is probably even less
than that and he said despite that if
you're a company with a big trove of
data if you're a household brand but
really whoever you are but especially
for those companies you really need to
be doing your best to at least try and
comply because even though the AG's
office isn't going to start enforcement
actions until July of 2020 they can
actually enforce retroactively Lee back
to January 1st 2020 when the law comes
into force
so there's City and municipalities have
some with some power yeah so it was sort
of a it was a really fascinating dynamic
talk and I thought some really great
perspectives and nice to have sort of to
hear it from the horse's mouth Alastair
did say that there was a mandatory 35
day comment
on the new version the new citizens
initiative and he does want to hear from
people he did mention that you know he
is pro-business and we hear that from
him frequently and he's trying to walk
that middle line of reasonableness
between protecting consumers who are you
know more than ever calling for their
privacy rights and allowing business to
flourish he did know you know that he
could have I think as sort of defending
himself he could have put a private
right of action into the first version
of the CCPA and he didn't because he
didn't think that was fair so it'll be
interesting to see how people weigh in
and I think we're gonna be grappling
with what this new version of the CCP
looks like for many months to come yeah
you can definitely expect us to be
working in that in the coming weeks like
I said the text just came out it's 51
pages if you follow at daily dashboard
on Twitter you can find it there and
we'll definitely be having more content
on that tomorrow yeah in the coming week
so definitely stay tuned for that
beyond CCPA it's not all just CCPA here
Ryan what did you what did you see this
week well you say it's beyond CCP it's
what I'm talking about is still gonna
tie a lot of into CCPA which is data
subject access requests are just they're
popping up in every almost every session
even if they're not necessarily about
data subject access access requests
there's still a lot of questions that
people have about the best way to handle
them went to one of the sessions on D
SARS yesterday it was a packed room
everybody's asking a ton of questions
questions about whether they should have
an intermediary to handle data subject
ass access requests whether they should
build their own solution or find one of
the many tech vendors that take on that
that capability how much of that process
should be automated and the
considerations around that and verifying
the people making the cross based on the
the research that came out of DEFCON a
couple months ago and some of the
vendors on our exhibit floor are
starting to try to solve that problem
because it's one that will continue to
go on it's real quickly mention what
what that DEFCON research was so a
researcher from Oxford University posed
as his girlfriend to try and get as much
information about her as possible and
it opened up a lot of eyes some
loopholes that could be found with the
data subject access request he's able to
get some of that information yeah so
yeah there's there's still a lot to go
about it I mean it popped up in a
session about reporting to the board it
popped up in the latin-american session
as key use cases so that's just it's
especially with the California consumer
privacy act when you know already you're
tuned to gdpr there's still a lot that
people have to figure out about these
about these requests and I think it's
one of the things that with the
California AG's guy's guidance coming
out that will help inform what happens
when January first comes around
excellent excellent
Joe what did you see this week oh you
know this was again the first go-around
for me in terms was your first big event
the first big event the first big
conference you know the thing that
really stuck out to me was the last
session that I went to today which was a
US DPR and whether you know there was
going to be a federal project could be a
federal privacy law sir it's basically
they're comparing it to the GD P R and
the UV protection so in general the the
message that I got out of it was a lot
of people seem to think that you know
we're seeing a lot with CCPA and
obviously what Alastair came out with
yesterday and we're all talking about
today you know it seems like it's really
starting to push things towards a
federal law but you know talking with
the panel that was there we had Obama
administration officials that were there
kind of mom you know going through
things and they really don't think that
you know it really has pushed it that
much yet they think that it's more of a
listening face still and we're probably
about 10 years out oh wow that's what I
said that's a part of this estimation
I've heard everything everybody was
sitting there and we all raised her
hands in about five years yeah you know
that was the general consensus and they
kind of sat up there and looked at us
and they were like yeah I think you're
you guys might be a little off Wow
so that but I mean beyond that though
what they kind of talked about in that
session too wasn't kind of an underlying
theme that that I heard was again
baseline privacy programs and really I
I wrote about this in the first workshop
that I attended on Monday was it much it
was Monday Jesus we've been here all but
ya know in that workshop it talked about
you know really trying to get a privacy
program going on baseline principles
that can kind of you know again extend
out and be able to you know instead of
having to really overhaul with different
legislation that comes out you're able
to really instead just kind of tweak
things as it goes and you know that's
what really they talked about in that
final session today when they're talking
about a federal law which is you know it
might be foggy in a sense but overall
the the you can kind of prepare yourself
by just kind of getting that baseline
program set lay the groundwork yes carry
on that uh no I mean it's interesting to
hear ten years I in I'm based in DC and
as you guys as you guys know and I and I
frequently hear three years but I even I
I do think that that seems like
optimistic because we have we just have
such a tough time in Congress with any
conversation in general so I I would
also be sort of surprised if we push
something through within three years at
the same time I'd love to see some
action on that I'd love to stop writing
about the if and when and just start
writing about here it is but yeah we'll
see to to countervailing forces at play
here it seems on the one hand the
political reality is a DC right now
right we're starting in a pinch bit
process and we're going into a
presidential election next year right
there's a lot of uncertainty there yeah
I'm saying but at the same time with
Alistair's new ballot initiative this
might put pressure on industry to really
ramp up maybe some more lobbying or more
efforts in DC - maybe you know Trump
this may actually use that word
this this California legislation and try
and get something out of Washington so
it'll be interesting to see how those
kind of countervailing forces play out
yeah there's but I agree I think it's
hard to imagine a federal law in the
next year or two yeah so to be to be
determined better right
yeah what else so what else stuck out to
all of you Angelique yeah we had a
really great session today I always get
super nervous when it's me moderating a
panel I don't know why but I'll just
we'll never get over that I don't think
but we had a great panel today Ryan
actually came and reported on it so
we'll have a story on that this week
which would be great but I've been
hearing from a lot of privacy
professionals that they've been
struggling a little bit to find jobs
from really qualified talented people
that I interact with in DC I have the
pleasure of interacting with in DC so we
wanted to have a discussion about what
are companies looking for are those
expectations realistic should you apply
for that job even though you don't check
every single box should you kind of go
for something that seems a little bit
out of your reach strategies for having
solid interviews so we had a
representative from the public policy
team at Facebook we had a job recruiter
who works in the privacy in recruiting
space who told us that privacy is his
hottest industry to recruit for right
now of all the industries and then we
also had Callie Schroeder who is a good
friend of ours a former West and fellow
at the IPP who recently went through the
job search the very frustrating process
of job search and could provide that
perspective so we had a really nice
conversation about from kind of those
three diverse perspectives about how to
approach getting your next and you know
hopefully best gig and had some really
great audience participation some real
practical questions and some takeaways
about you know making sure your LinkedIn
profile is updated and being prepared
for that question specifically the
Facebook representative was saying the
question that he often asks people is
what's one thing we've done wrong and
that you should go in and I think that
probably applies to any job you're
applying for anywhere you should go in
knowing the company knowing what you
know public steps they've taken or maybe
missteps and having an answer for that
so I thought it was a really like robust
conversation that we had a good session
and hopefully people came away with some
ideas about how to approach you know
their next gig in the privacy and
three great yeah certainly a universal
thing like just even in any industry
yeah I felt I felt myself going back to
coming out of college me like oh man how
do you get all this experience and how
do you get your foot in the door right I
think with such a it's such a you know
new industry that these uh these issues
are coming up but I think they're gonna
be salt quicker because of the need that
people need for these people right
you're gonna have to start letting
people in the door and training them up
eventually because there's such great
need for the marketplace one of the
things I noticed this week I don't know
if you all experienced this as you talk
to people here attending here was seemed
to be a lot of new faces a lot of
first-time conference attendees yeah a
lot of folks kind of finding their way
into privacy I talked to a few different
attendees who have kind of come into
privacy through security which I thought
was interesting
mm-hmm so I don't know if any of you
found that this week as well just a lot
of crossover I felt like to you know
Utah again if you're sitting here and
you're saying oh you know you think of
an IEP conference and it kind of comes
back to the privacy angle but you're
seeing a diverse amount of people from
different branches that are trying to
bridge the gap in some departments which
I thought was kind of interesting and
again the just the age limit as well I
mean there wasn't you know you're seeing
people of all ages trying to to get this
it's not an older crowd it's not a
younger crowd everyone is trying to get
behind this yeah and that's one of the
things that Callie Schroeder on the
panel today was saying was that it kind
of works to her advantage sometimes when
she's applying for jobs because everyone
pretty much has the same amount of
experience with CCPA readiness right
because like it's only been alive for a
couple of years and sort of the same
thing with the GD P R so if you're
coming into the market as a newbie like
a lot of people are grappling with
grappling with all of these new
regulations and so you can kind of be
competitive even if you are a
fresh-faced
you know excellent yeah while I happen
to lead a panel on Tuesday talking to
some journalists which was pretty
interesting we had a Kashmir Hill who
also spoke or a keynote stage today and
it was really interesting to hear her
talk about her experience quitting the
big five
Bernie's Google Microsoft Facebook Apple
and Amazon and she said Amazon was the
hardest by far for her hmm to quit and
we also on this panel earlier had Alex
Kingsbury the editor of the privacy
project
the New York Times opinion page that's
really exploring different privacy
issues throughout the world and Joseph
Cox who is a reporter for motherboard
and vice talking about how they're
reporting on privacy these are really
complex issues that you know all of you
our members are dealing with that we're
trying to cover and that they're trying
to cover in helping the average consumer
understand the complexity of you know
the ad tech and ecosystem and what
different laws are meaning for their
lives so there's a really interesting
conversation it was funny right before
going up on stage Alex who not only had
it's the privacy project has a broader
role at the New York Times had just
gotten word that Nancy Pelosi was going
to be announcing on PA proceedings for
Trump right as we went up on stage that
was pretty interesting he was able to
still maintain a good conversation with
us so it's been quite a quite a week for
all of us are in Vegas and the US as a
whole outside and you know just you know
out of Europe that see Ju the Court of
Justice the European Union ruled on the
right to be forgotten the long-standing
canal Boogle case so it's it's it's
never a dull moment here as a privacy
reporter at the ia pp not at all any
closing thoughts I'm ready for a beer
yeah yeah let's let's uh grab a beer
cheers and catch up on our Aziz I think
XO well thanks for all your great work
and thanks for tuning in all
we'll see it the next conference
hopefully will next be at the data
protection Congress in Brussels I hope
to see it
[Music]