The Data Diva E294 - Nabanita De and Debbie Reynolds

Send us Fan MailPatrick Zeller, General Counsel, Jetstream SecurityIn this episode of The Data Diva Talks Privacy, Debbie Reynolds,  The Data Diva, speaks with Patrick Zeller, General Counsel of Jetstream Security, about artificial intelligence, cybersecurity, privacy, and the evolving risks organizations face as AI becomes embedded throughout their operations. Patrick shares his unique career journey from the Illinois Attorney General's Office into technology law, cybersecurity, and emerging technologies, explaining how his early interest in computers shaped a career that bridges both legal and technical disciplines.The conversation explores how organizations are adopting AI at an unprecedented pace and why many leaders are struggling to understand the risks associated with these technologies. Patrick explains that AI entered many organizations through productivity tools and enterprise platforms before legal, privacy, and security teams had an opportunity to evaluate its implications. As a result, many companies are now working to gain visibility into how AI is being used, what information is being shared, and where risks may exist.Debbie and Patrick discuss AI risk through three primary categories: input risks, output risks, and related organizational risks. They examine how employees may inadvertently expose sensitive information by entering confidential, financial, employee, legal, or proprietary information into AI systems. The discussion highlights real-world examples involving compensation information, trade secrets, attorney-client privileged communications, and sensitive corporate data that may be exposed through unauthorized use of AI tools.The episode explores the growing challenge of shadow AI, where employees use public AI tools outside approved enterprise environments. Patrick explains that organizations must understand which AI tools are being used, who is using them, and which systems and data those tools can access. The conversation also covers SEC reporting obligations, cross-border data transfer concerns, unauthorized access incidents, insider threat risks, and the growing need for organizations to monitor AI interactions with sensitive business information.Patrick and Debbie discuss how organizations must rethink traditional security models because AI is no longer operating outside the corporate perimeter. Instead, AI increasingly functions as an insider with potential access to valuable data and systems. The conversation explores how organizations can improve visibility, governance, and oversight while balancing innovation and business objectives.The discussion concludes with a broader examination of how society is approaching AI adoption. Patrick introduces the concept of a "Galbraithian inversion," in which organizations adopt powerful technologies before fully understanding how they work. Debbie and Patrick discuss why this creates both opportunities and challenges as companies race to deploy AI while simultaneously trying to understand its legal, security, privacy, and governance implications.By popular demand, Debbie Reynolds Consulting is now offering executive briefings on emerging data privacy risks and how companies can avoid them. To learn more, visit the Executive briefings page on my website.Support the showBecome an insider, join Data Diva Confidential for data strategy and data privacy insights delivered to your inbox. 💡 Receive expert briefings, practical guidance, and exclusive resources designed for leaders shaping the future of data and AI. 👉 Join here: http://bit.ly/3Jb8S5pDebbie Reynolds Consulting, LLC

Send us Fan MailMichael Booden, Senior Technology Counsel In this episode of The Data Diva Talks Privacy, Debbie Reynolds, The Data Diva speaks with Michael Booden, Senior Technology Counsel, about the evolving relationship between contracts, privacy, cybersecurity, and artificial intelligence. Michael shares his professional journey from litigation and appellate court clerkships to becoming an in-house technology attorney and adjunct law professor teaching contract drafting and negotiation. He explains how his litigation background shaped his approach to drafting agreements, emphasizing the importance of clarity, precision, and anticipating how contractual language will be interpreted when disputes arise.The conversation explores how privacy and security requirements increasingly appear in technology agreements and why organizations can no longer rely solely on vendor representations regarding data protection. Michael discusses how he developed cybersecurity addenda to establish objective standards and expectations for vendors, including security controls, indemnification provisions, and requirements aligned with recognized frameworks such as NIST and ISO standards. He explains how these contractual protections help organizations proactively manage risk rather than simply reacting to incidents after they occur. Debbie and Michael examine the growing role of AI in organizations and the challenges associated with managing data privacy and security risks when using AI tools. Michael discusses the development of AI-specific contractual provisions designed to address issues such as data handling, retention, outputs, transparency, and vendor accountability. The discussion highlights how organizations are increasingly being asked by customers, regulators, and business partners to explain how AI is being used and what safeguards are in place to protect sensitive information. Michael shares how his organization developed client-facing AI disclosures to provide greater transparency and build trust around AI usage.The episode also explores the importance of selecting enterprise-grade AI solutions rather than public consumer tools, particularly when organizations are handling confidential, proprietary, or personal information. Michael explains how privately licensed AI environments can provide stronger protections against data leakage and unauthorized use, while also enabling organizations to take advantage of AI's productivity benefits. Debbie and Michael discuss how AI is transforming work by helping employees automate lower-value tasks, improve efficiency, and access information more effectively, while emphasizing that organizations must establish clear policies, governance frameworks, and contractual protections to ensure AI is used responsibly.The conversation highlights a broader trend occurring across industries: organizations are increasingly pushing privacy, security, and compliance requirements down through their vendor ecosystems. As privacy regulations continue to expand globally, companies are using contracts to establish expectations for third parties and create more consistent protections for personal data, confidential information, and AI-enabled workflows. Michael emphasizes that strong contracts remain one of the most effective tools organizations have for managing technology risk in a rapidly evolving environment.By popular demand, Debbie Reynolds Consulting is now offering executive briefings on emerging data privacy risks and how companies can avoid them. To learn more, visit the Executive briefings page on my website.Support the showBecome an insider, join Data Diva Confidential for data strategy and data privacy insights delivered to your inbox. 💡 Receive expert briefings, practical guidance, and exclusive resources designed for leaders shaping the future of data and AI. 👉 Join here: http://bit.ly/3Jb8S5pDebbie Reynolds Consulting, LLC

Send us Fan MailMarcus Wells, vCSO, Wells Secure IT (Identity Security)In this episode of The Data Diva Talks Privacy, Debbie Reynolds, "The Data Diva" speaks with Marcus Wells, vCSO at Wells Secure IT, about identity security, digital transformation, artificial intelligence, and why identity has become one of the most important foundations of modern technology environments. Marcus shares his career journey through cybersecurity and explains how he gradually realized that identity was at the center of nearly every security challenge he encountered. He discusses how identity extends far beyond traditional access management and why understanding identity requires a broader view of people, devices, systems, applications, and data.The conversation explores how organizations increasingly rely on digital identities to support business operations, cloud services, connected devices, and emerging technologies. Marcus explains his framework for understanding identity, including the ability to access, store, and connect to data and networks. Debbie and Marcus discuss how identity applies not only to people but also to devices, applications, and non-human entities that participate in modern digital ecosystems. The discussion highlights the growing importance of context when making decisions about access, permissions, and trust.They examine how artificial intelligence is creating new identity challenges, particularly as organizations begin deploying AI agents capable of performing tasks, accessing systems, and interacting with data. Debbie shares examples involving AI agents granted broad access to systems, including incidents in which agents reportedly deleted databases or were granted extensive permissions without appropriate controls. Marcus discusses the risks associated with treating AI agents like traditional software or human users and explains why organizations must carefully consider how identities are provisioned, managed, and monitored in AI-enabled environments.The episode also explores the concept of trust in technology and why AI systems introduce new categories of uncertainty. Marcus argues that traditional software is generally predictable and produces repeatable outcomes, whereas large language models and AI systems often generate probabilistic results that cannot be guaranteed. This creates unique governance, security, and risk management challenges that organizations must address as they accelerate digital transformation initiatives. The conversation highlights why identity, context, trust, and governance will become increasingly important as AI systems gain greater access to organizational data and decision-making processes.By popular demand, Debbie Reynolds Consulting is now offering executive briefings on emerging data privacy risks and how companies can avoid them. To learn more, visit the Executive briefings page on my website.Support the showBecome an insider, join Data Diva Confidential for data strategy and data privacy insights delivered to your inbox. 💡 Receive expert briefings, practical guidance, and exclusive resources designed for leaders shaping the future of data and AI. 👉 Join here: http://bit.ly/3Jb8S5pDebbie Reynolds Consulting, LLC

Send us Fan MailNabanita De, Founder and CEO, Privacy License AIIn this episode of The Data Diva Talks Privacy, Debbie Reynolds, "The Data Diva" speaks with Nabanita De, Founder and CEO of Privacy License AI, about one of the most significant challenges facing the AI ecosystem today: how creators, organizations, and AI developers can establish clear, enforceable rules for the use of content in AI systems. Nabanita shares her background working at Microsoft Research, Uber, and in the fintech sector, where she gained firsthand experience with privacy, AI, and compliance challenges. She explains how those experiences ultimately led her to create Privacy License AI and develop what she describes as a privacy operating system for the AI era.The conversation explores the growing tension between creators, content owners, and AI companies as large language models increasingly rely on content gathered from across the Internet. Nabanita discusses how traditional approaches, such as robots.txt and website terms of service, were designed for an earlier Internet and were never intended to address the scale and complexity of modern AI training systems. Debbie and Nabanita examine how AI systems consume content, how creators often receive little or no attribution or compensation, and why both creators and AI companies face uncertainty regarding rights, permissions, and compliance obligations.They discuss the rise of AI copyright litigation, including lawsuits involving major publishers and AI providers, and the practical challenges organizations face in determining whether content can legally be used for training purposes. Nabanita explains why legal frameworks alone cannot solve these issues and argues that technical solutions are necessary to create scalable mechanisms for communicating rights and permissions across the AI ecosystem. The discussion highlights how machine-readable privacy and usage rules could allow creators to specify how their content may be used, under what conditions, and whether attribution, compensation, or other restrictions should apply.The episode also explores the concept of metadata-driven governance, where information about ownership, jurisdiction, usage rights, purpose limitations, and permitted activities travels with content throughout its lifecycle. Debbie and Nabanita discuss how this approach could create greater legal certainty for AI developers while simultaneously providing stronger protections for creators. The conversation highlights the broader challenge of balancing innovation, intellectual property rights, privacy, and trust as organizations seek to build AI systems that are both effective and responsible.By popular demand, Debbie Reynolds Consulting is now offering executive briefings on emerging data privacy risks and how companies can avoid them. To learn more, visit the Executive briefings page on my website.Support the showBecome an insider, join Data Diva Confidential for data strategy and data privacy insights delivered to your inbox. 💡 Receive expert briefings, practical guidance, and exclusive resources designed for leaders shaping the future of data and AI. 👉 Join here: http://bit.ly/3Jb8S5pDebbie Reynolds Consulting, LLC

Send us Fan MailVeronica Canton, Partner, Pierson Ferdinand LLP and Chief Vision Officer, Optimized LeverageIn this episode of The Data Diva Talks Privacy, Debbie Reynolds, "The Data Diva" speaks with Veronica Canton, Partner at Pierson Ferdinand LLP and Chief Vision Officer of Optimized Leverage, about careers in privacy, cybersecurity, and artificial intelligence, as well as the importance of visibility, mentorship, and continuous learning in a rapidly evolving profession. Veronica shares her journey from commercial litigation into privacy, cybersecurity, and AI, explaining how certifications, networking, and consistently sharing knowledge helped create new professional opportunities.The conversation explores how professionals can successfully transition into privacy and cybersecurity from a wide variety of backgrounds. Veronica discusses the importance of building expertise through continuous learning, developing a public presence, and sharing knowledge with others. Debbie and Veronica emphasize that privacy, cybersecurity, and AI are multidisciplinary fields that require perspectives from legal, technical, operational, business, and governance professionals.They discuss the growing need for talent across privacy, cybersecurity, and AI, including roles that do not require legal training. The conversation highlights opportunities in compliance, data subject rights management, incident response, governance, risk management, and technology implementation. Veronica explains how transferable skills from previous careers can provide a strong foundation for success in emerging technology fields and why diverse viewpoints improve decision-making and organizational resilience.The episode also examines the relationship between privacy, cybersecurity, AI governance, and global regulatory trends. Debbie and Veronica discuss cultural differences between the United States and Europe, including how historical events have influenced privacy laws and attitudes toward personal data. They explore how organizations can build demonstrable compliance programs, prepare for regulatory scrutiny, and create governance structures that support innovation while managing risk.By popular demand, Debbie Reynolds Consulting is now offering executive briefings on emerging data privacy risks and how companies can avoid them. To learn more, visit the Executive briefings page on my website.Support the showBecome an insider, join Data Diva Confidential for data strategy and data privacy insights delivered to your inbox. 💡 Receive expert briefings, practical guidance, and exclusive resources designed for leaders shaping the future of data and AI. 👉 Join here: http://bit.ly/3Jb8S5pDebbie Reynolds Consulting, LLC

Send us Fan MailIn this episode of The Data Diva Talks Privacy, Debbie Reynolds, "The Data Diva" speaks with Rowenna Fielding, Director of Miss IG Geek, about data ethics, privacy, governance, and the human impact of how organizations collect and use data. Rowenna shares her unconventional path into privacy, beginning in theater and information technology before eventually specializing in information governance, data protection, and data ethics. She explains how her work evolved as she became increasingly interested not only in legal compliance but also in the broader consequences of the way organizations make decisions about people using data.The conversation explores the distinction between compliance and ethics, and why organizations often assume that following policies, regulations, or technical controls automatically leads to ethical outcomes. Rowenna argues that data is not neutral or objective but is instead the product of human choices, incentives, and assumptions. Debbie and Rowenna discuss how organizations frequently collect and use data without fully considering whether the data is appropriate, whether it should be collected at all, or whether its use could unintentionally cause harm.They examine the challenge of defining harm in the context of privacy and data protection, particularly when the effects are psychological, social, reputational, or otherwise difficult to measure. The discussion includes comparisons to health and safety frameworks, highlighting how organizations can build systems, governance structures, incentives, education programs, and cultures that make responsible data use the default rather than the exception. Rowenna explains how GDPR's foundation in fundamental rights provides a useful framework for evaluating ethical questions and why organizations must think beyond legal compliance to consider the broader impact of their actions on individuals and society.The episode also explores corporate social responsibility, ESG, organizational values, and how leaders can establish meaningful ethical boundaries in environments where technology is advancing faster than regulation or societal norms. Throughout the conversation, Debbie and Rowenna challenge organizations to think critically about what it means to use data responsibly and how privacy programs can move beyond box-checking exercises to become part of a broader commitment to reducing harm and protecting people.By popular demand, Debbie Reynolds Consulting is now offering executive briefings on emerging data privacy risks and how companies can avoid them. To learn more, visit the Executive briefings page on my website.Support the showBecome an insider, join Data Diva Confidential for data strategy and data privacy insights delivered to your inbox. 💡 Receive expert briefings, practical guidance, and exclusive resources designed for leaders shaping the future of data and AI. 👉 Join here: http://bit.ly/3Jb8S5pDebbie Reynolds Consulting, LLC

Send us Fan MailIn this episode of The Data Diva Talks Privacy, Debbie Reynolds, "The Data Diva" speaks with Eric Null, Director, Privacy & Data Program at the Center for Democracy & Technology, about the current state of privacy in the United States and the ongoing effort to establish comprehensive federal privacy legislation. Eric shares his unique journey from studying classical clarinet performance to becoming a leading advocate for privacy and consumer rights, explaining how his work in technology policy, net neutrality, broadband privacy, and consumer protection shaped his perspective on privacy as an issue fundamentally connected to power and control.The conversation explores how information functions as a source of power in the digital age and why the collection, processing, and use of personal data can create risks ranging from manipulation and profiling to broader concerns about autonomy and control. Eric discusses his early work involving children's privacy, broadband privacy, and consumer protection, including efforts to strengthen privacy protections through the Federal Communications Commission and the Federal Trade Commission. He explains how the growth of the "free" Internet business model has created an environment in which individuals often exchange large amounts of personal information in exchange for access to online services, incentivizing extensive data collection and monetization.Debbie and Eric examine the current U.S. privacy landscape, including the sector-specific approach taken by laws such as HIPAA, the Gramm-Leach-Bliley Act, and COPPA. They discuss the Federal Trade Commission's role as the primary federal privacy regulator and how the agency's authority has historically relied on preventing deceptive and unfair practices rather than establishing broad data rights. The discussion explores the limitations of the notice-and-choice model, in which organizations disclose their practices through privacy policies that consumers rarely read or meaningfully negotiate, and how network effects can limit the practical choices available to individuals seeking to participate in modern digital platforms.The episode also covers the repeated attempts to pass comprehensive federal privacy legislation, including the American Data Privacy and Protection Act (ADPPA), the American Privacy Rights Act (APRA), and more recent proposals. Eric shares insights into the legislative challenges that have prevented these efforts from becoming law and discusses the policy debates surrounding data minimization, consumer rights, enforcement, and the relationship between privacy and broader concerns about the power of large technology companies. The conversation highlights why privacy remains one of the most important policy issues facing organizations, regulators, and consumers, and why meaningful reform continues to be difficult despite widespread public concern.By popular demand, Debbie Reynolds Consulting is now offering executive briefings on emerging data privacy risks and how companies can avoid them. To learn more, visit the Executive briefings page on my website.Support the showBecome an insider, join Data Diva Confidential for data strategy and data privacy insights delivered to your inbox. 💡 Receive expert briefings, practical guidance, and exclusive resources designed for leaders shaping the future of data and AI. 👉 Join here: http://bit.ly/3Jb8S5pDebbie Reynolds Consulting, LLC

Send us Fan MailDoug Austin, Editor of eDiscovery TodayIn this episode of The Data Diva Talks Privacy, Debbie Reynolds, The Data Diva speaks with Doug Austin, Editor of eDiscovery Today, about how eDiscovery, data governance, privacy, and artificial intelligence are increasingly interconnected in modern organizations. Doug explains how eDiscovery has evolved from a litigation-focused discipline into a broader framework that supports investigations, audits, incident response, and privacy-related workflows such as data subject access requests.The conversation explores how AI is generating entirely new categories of data, including chatbot interactions, meeting transcripts, automated summaries, and AI-generated content, all of which may become evidence in legal and regulatory contexts. Debbie and Doug discuss how organizations are struggling to manage this expanding data landscape, particularly as employees adopt AI tools without fully understanding the implications for privacy, confidentiality, and data exposure.They examine real-world scenarios involving AI note-taking tools and meeting recordings, including cases where sensitive information is captured and shared beyond its intended audience. The discussion also highlights risks associated with uploading confidential information into public AI systems and the lack of awareness around how these tools handle and retain data.The episode further explores key legal developments, including litigation involving AI companies and disputes over data retention and production, as well as emerging questions around privilege and work product protections for AI-generated content. Debbie and Doug discuss how courts are beginning to address whether interactions with AI systems can be protected and the implications for both represented and self-represented individuals.The conversation emphasizes that AI is fundamentally reshaping how data is created, stored, and used, and that organizations must adapt their governance, legal, and privacy strategies to manage these risks effectively while maintaining defensible and compliant data practices.By popular demand, Debbie Reynolds Consulting is now offering executive briefings on emerging data privacy risks and how companies can avoid them. To learn more, visit the Executive briefings page on my website.Support the showBecome an insider, join Data Diva Confidential for data strategy and data privacy insights delivered to your inbox. 💡 Receive expert briefings, practical guidance, and exclusive resources designed for leaders shaping the future of data and AI. 👉 Join here: http://bit.ly/3Jb8S5pDebbie Reynolds Consulting, LLC

Send us Fan MailRoss Saunders, Head of Ross G. Saunders ConsultingIn this episode of The Data Diva Talks Privacy, Debbie Reynolds, The Data Diva speaks with Ross Saunders, Head of Ross G. Saunders Consulting, about privacy engineering and the challenges organizations face when translating legal requirements into technical implementation. Ross shares his background in infrastructure, DevOps, and software architecture, explaining how his experience working with SaaS environments and data breaches led him to focus on bridging the gap between legal, security, and development teams.The conversation explores how privacy is often treated as a legal or compliance exercise, while in practice it requires integration into system design and development workflows. Debbie and Ross discuss how developers frequently receive requirements that do not align with legal intent, leading to inconsistencies in implementation and increased risk for organizations.They examine real-world challenges in applying privacy regulations, including age verification requirements and the classification of IP addresses, where technical realities may conflict with regulatory expectations. The discussion also addresses the limitations of focusing on specific technologies, such as cookies, rather than addressing broader issues related to data sharing and potential harm.The episode highlights practical examples of risk, including loyalty applications that collect extensive financial transaction data and the potential consequences if that data is exposed or misused. Debbie and Ross emphasize the importance of shifting toward harm-based approaches to privacy and ensuring that organizations understand the real-world impact of their data practices.The conversation also explores emerging risks associated with agentic AI and autonomous systems, including scenarios where systems are granted excessive access and cause unintended damage or data loss. Organizations must implement governance, oversight, and clear controls to ensure that innovation in AI does not introduce unnecessary risk.By popular demand, Debbie Reynolds Consulting is now offering executive briefings on emerging data privacy risks and how companies can avoid them. To learn more, visit the Executive briefings page on my website.Support the showBecome an insider, join Data Diva Confidential for data strategy and data privacy insights delivered to your inbox. 💡 Receive expert briefings, practical guidance, and exclusive resources designed for leaders shaping the future of data and AI. 👉 Join here: http://bit.ly/3Jb8S5pDebbie Reynolds Consulting, LLC

Send us Fan MailTerri Lewis, Founder of Planet ConnectedIn this episode of The Data Diva Talks Privacy, Debbie Reynolds, The Data Diva speaks with Terri Lewis, Founder of Planet Connected, about privacy, data governance, and risk in smart cities and connected infrastructure. Terri shares her background in digital strategy and her work supporting collaboration between cities and technology providers, emphasizing the importance of building trust and transparency into smart city initiatives.The conversation explores how everyday systems such as water utilities, parking applications, and license plate readers collect and process personal data, often without individuals fully understanding the scope of that data collection. Debbie and Terri discuss how data from smart meters, for example, can reveal occupancy patterns and behavioral insights, and how location-based services and parking systems can introduce privacy risks through the collection of personal and financial information.They examine the role of third-party vendors and the challenges organizations face in managing data across multiple providers, including concerns about overcollection, lack of transparency, and unclear data ownership. Real-world examples highlight how individuals may be required to provide more data than expected for routine activities, raising questions about proportionality and necessity.The episode also explores broader IoT risks, including long device lifecycles, evolving capabilities through updates, and the increasing use of cameras and image-based technologies. Debbie and Terri discuss how advances in image recognition and facial recognition can enable identification of individuals in public spaces, creating new risks that existing legal frameworks may not fully address.The discussion emphasizes that organizations must take a proactive approach to data governance, anticipating potential misuse, addressing unintended consequences, and aligning technology deployment with public expectations and trust. As cities continue to adopt connected technologies, leaders must ensure that innovation is balanced with strong privacy, security, and accountability practices.By popular demand, Debbie Reynolds Consulting is now offering executive briefings on emerging data privacy risks and how companies can avoid them. To learn more, visit the Executive briefings page on my website.Support the showBecome an insider, join Data Diva Confidential for data strategy and data privacy insights delivered to your inbox. 💡 Receive expert briefings, practical guidance, and exclusive resources designed for leaders shaping the future of data and AI. 👉 Join here: http://bit.ly/3Jb8S5pDebbie Reynolds Consulting, LLC