Data Privacy Detective
Data privacy is the footprint of our existence. It is our persona beyond ourselves, with traces of us scattered from birth certificates, Social Security numbers, shopping patterns, credit card histories, photographs, mugshots and health records. In a digital world, where memory is converted to 0’s and 1’s, then instantly transformed into a reproduction even in 3D, personal data is an urgent personal and collective subject. Those who wish to live anonymous lives must take extraordinary measures to succeed in that improbable quest, while those who hope for friendship or fame through the spread of their personal data must learn how to prevent theft of their identity and bank account. The first 155 episodes of Data Privacy Detective can be found on the feed of the Frost Brown Todd Podcast. You can listen on Apple Podcasts (https://apple.co/3IrHUTg), Spotify (https://bit.ly/49XRU2k), or Soundcloud (https://bit.ly/3T8EWrw).
info_outline
Episode 188 — Privacy and the Big Apple: Cities and Chief Privacy Officers/CPOs
01/16/2025
Episode 188 — Privacy and the Big Apple: Cities and Chief Privacy Officers/CPOs
Join New York City’s Chief Privacy Officer, Mike Fitzpatrick. Explore the role of a city’s CPO. Cities must balance the interests of personal privacy and municipal operations, while complying with open records and other federal and state laws. Municipalities collect, use, and share vast databases of personally identifiable information (PII). They use PII to deter crime, advance public safety, and serve public health and other needs. Like everyone, cities can be cyber attack targets and victims of data breaches. Consider how one city’s CPO promotes a culture that embraces and protects personal privacy while preserving the essential missions of municipal government and decreasing cyber risks. Hear the current challenges facing a city’s CPO. Learn how a CPO can advance responsible data sharing, create a culture of privacy protection, and help a municipal government instill responsible, equitable data practices across its agencies. Check out the Big Apple’s Citywide Privacy Protection Policies and Protocols, issued in February 2023. , and watch for an upcoming update in early 2025. This episode is also available in a five-minute video version on YouTube: Time stamps:1:13 — What does a Chief Privacy Officer do?4:00 — What challenges does a Chief Privacy Officer of a big city face?7:17 — How does a CPO handle equity in data management?10:34 — Are more cities in addition to New York appointing Chief Privacy Officers? 12:43 — How does a CPO measure success?14:22 — What tips does Mike have for other cities as they evaluate their data policies? The first 155 episodes of Data Privacy Detective can be found on the feed of the Frost Brown Todd Podcast. You can listen on Apple Podcasts (), Spotify (), or Soundcloud (). Subscribe to the show on YouTube for a new video every week!
/episode/index/show/b341df91-8bfc-4e46-ad69-724e582ddfa8/id/34884750
info_outline
Episode 187 — 2025 Resolution: Make it the Year of the Passkey
01/02/2025
Episode 187 — 2025 Resolution: Make it the Year of the Passkey
The Data Privacy Detective returns from a short sabbatical to recommend a New Year’s Resolution for 2025 - make this the Year of the Passkey. Data privacy best practice moved from passwords to multi-factor authentication. But this has not stopped the increasing online theft of assets and identities. Password-based technology is failing to stem financial and other losses that increase each year. Passkeys are on the rise. A passkey is a form of authentication technology that simplifies our online experience and increases online safety. This Episode explores why passkeys constitute best practices in 2025, while saving time in connecting with websites of our choice. Consider this great migration and why it’s worth spending time now to use passkeys. For those in the Google and Microsoft worlds, explore how these tech giants are making it easy and essential for users to join this shift in how we protect our online data privacy. Here are helpful links: Happy new year 2025! The first 155 episodes of Data Privacy Detective can be found on the feed of the Frost Brown Todd Podcast. You can listen on Apple Podcasts (), Spotify (), or Soundcloud (). Subscribe to the show on YouTube for a new video every week!
/episode/index/show/b341df91-8bfc-4e46-ad69-724e582ddfa8/id/34691485
info_outline
Episode 186 — Data Privacy and Credit Bureaus: How false data and algorithms hurt people
10/24/2024
Episode 186 — Data Privacy and Credit Bureaus: How false data and algorithms hurt people
The United States has three major credit bureaus - Experian, Equifax, and TransUnion. How they score individuals has a major impact on their lives. Credit scores can raise interest rates to double what an excellent rating would produce and can result in inability to borrow or have a credit card. How the credit rating system works is hidden to most people. The Detective turns his spyglass to how the big three credit bureaus use false data, employ algorithms that inaccurately report credit risk, and invade personal privacy without consent. Using a real time example, Episode 186 explores how incorrect information is used by a credit bureau and how its algorithm and data sets wrongly assess a person’s financial circumstances and report a false picture of the individual. This results in more than increased interest on loans. It creates a false profile of a person and exposes the individual to a misuse of private information that invades personal privacy without a person’s consent or advance knowledge. Learn the inner workings of credit reporting and what individuals can do to protect their personal privacy and correct erroneous information spread by credit bureaus. The first 155 episodes of Data Privacy Detective can be found on the feed of the Frost Brown Todd Podcast. You can listen on Apple Podcasts (), Spotify (), or Soundcloud (). Subscribe to the show on YouTube for a new video every week!
/episode/index/show/b341df91-8bfc-4e46-ad69-724e582ddfa8/id/33582852
info_outline
Episode 185 — Data privacy and law firms: How secure is confidential information shared with attorneys?
10/10/2024
Episode 185 — Data privacy and law firms: How secure is confidential information shared with attorneys?
October is Cybersecurity Awareness Month. For our personal data this Halloween, will it be trick or treat? In Episode 185, we explore one of the most private of all U.S. organizations - the law firm - to assess the security of private personal information. The American Bar Association reports that a quarter of all law firms have been the victim of a data breach and that 40% were not aware that they were attacked. What do insurance companies that serve law firms recommend as best cybersecurity practices? Even if best practices are followed, is the vast amount of private information collected by law firms at risk? The Data Privacy Detective discusses the state of law firm cybersecurity, lists the best practices recommended by a prominent law firm insurer, and challenges whether good practices alone are enough to guard information we assume will be kept securely confidential. The first 155 episodes of Data Privacy Detective can be found on the feed of the Frost Brown Todd Podcast. You can listen on Apple Podcasts (), Spotify (), or Soundcloud (). Subscribe to the show on YouTube for a new video every week!
/episode/index/show/b341df91-8bfc-4e46-ad69-724e582ddfa8/id/33389822
info_outline
Episode 184 — September 2024 Data Privacy News
10/03/2024
Episode 184 — September 2024 Data Privacy News
Two major data privacy developments from September 2024: a Staff Report from the FTC and California’s new statute about brain data. Tune in to Episode as the Data Privacy Detective provides meaning beneath the headlines. Neither of these was front page stuff. But each is more newsworthy than what company was sued for a data breach or whose privacy was invaded by a hacker. Staff reports are seldom covered as news. But the FTC staff report of September 19, 2024 is essential groundwork for regulation to follow soon or guidance for the next Congress that may reach across partisan divide towards more federal data privacy regulation. The key highlights are about how video streaming companies are watching us without having secure privacy controls and how there are inadequate safeguards for minors. California enacted and its Governor signed a new law addressing neural data - unspoken communications from our brains. Neural data joins other sensitive personal information as covered by California’s approach to data privacy protection. But how does it do that, and will it succeed in its objective? Watch our 5-minute summary on YouTube or listen to our deeper analysis from your favorite podcast platform. Time stamps: 00:59 — Staff reports 10:46 — California's neural data law The first 155 episodes of Data Privacy Detective can be found on the feed of the Frost Brown Todd Podcast. You can listen on Apple Podcasts (https://apple.co/3IrHUTg), Spotify (https://bit.ly/49XRU2k), or Soundcloud (https://bit.ly/3T8EWrw).
/episode/index/show/b341df91-8bfc-4e46-ad69-724e582ddfa8/id/33305497
info_outline
Episode 183 — Identity Orchestration (IO) in a Multi-Cloud Data World: Protecting Privacy by IO Architecture
09/26/2024
Episode 183 — Identity Orchestration (IO) in a Multi-Cloud Data World: Protecting Privacy by IO Architecture
When clouds gather, we prepare for storms, sometimes hurricanes. In a data world that is increasingly multi-cloud, how can we protect data that is ever more susceptible to attack by mal-actors? Enter Identity Orchestration (IO) and Identity and Access Management (IAM). Eric Olden, author of “Identity Orchestration for Dummies” - - and CEO of Strata.io, explains IO and IAM and why it is essential that privacy by design be the approach to secure data management. Defeating cybercrime through multi-factor authentication (MFA) and passwords is insufficient in the modern data environment. Learn in Episode 183 how organizations can protect their data streams and be seamless for their customers and data chain participants. See how proper IAM can be the best insurance against downtime and ranswomware attacks. Consider the challenges organizations face and available opportunities to protect data in our evolving multi-cloud environment. Learn top tips for individuals in protecting personal data privacy in a multi-cloud world. Time stamps: 1:24 — What is identity orchestration? 8:08 — Challenges for data identity orchestration 20:38 — Tips for maintaining privacy The first 155 episodes of Data Privacy Detective can be found on the feed of the Frost Brown Todd Podcast. You can listen on Apple Podcasts (https://apple.co/3IrHUTg), Spotify (https://bit.ly/49XRU2k), or Soundcloud (https://bit.ly/3T8EWrw).
/episode/index/show/b341df91-8bfc-4e46-ad69-724e582ddfa8/id/33208257
info_outline
Episode 182 — How to stop your car and your privacy from being cyberjacked
09/19/2024
Episode 182 — How to stop your car and your privacy from being cyberjacked
Today’s automobiles and trucks are more than transport vehicles. Filled with computer technology,cars and trucks are data collectors and transmitters - and a potential way for hackers to steal personal information and invade privacy. The expansive use of technology in vehicles creates risks of identity theft, invasion of privacy, and even the ability to take over a vehicle’s operation for tragic purposes. A September 6, 2024 American Automobile Association post, How to Protect Your Car from Cybercrime,describes how modern vehicular technology poses cyberattack risks and offers tips on how to fend off hackers. The Detective explores what we can do to protect ourselves against these risks and how vehicle manufacturers and dealers can build cyber-data-safety into vehicles rather than leave it to operator choice. Consider steps you can take to prevent your vehicle from being cyberjacked and to limit unwanted leaks of your personal information and privacy from your vehicle’s data stream. The first 155 episodes of Data Privacy Detective can be found on the feed of the Frost Brown Todd Podcast. You can listen on Apple Podcasts (https://apple.co/3IrHUTg), Spotify (https://bit.ly/49XRU2k), or Soundcloud (https://bit.ly/3T8EWrw).
/episode/index/show/b341df91-8bfc-4e46-ad69-724e582ddfa8/id/33106967
info_outline
Episode 181 — Data Privacy Developments from August 2024
09/05/2024
Episode 181 — Data Privacy Developments from August 2024
Tune in for our August 2024 roundtable about three hot data privacy developments. Yugo Nagashima and Brio St. Amour join the Data Privacy Detective to plumb meaning beneath the headlines: The Netherland Data Protection Authority fines Uber 290 million Euros for data transfers of sensitive private information. Minnesota adopts a data privacy code. Data brokers emerge from the shadows after an enormous database hack and a call to action. Consider what happens when the European Court of Justice invalidates a U.S./EU safe harbor, and before the next one is in place, a company transfers data to the U.S. without complying with GDPR requirements - so says a Dutch regulator, levying a 290 million fine. Minnesota adopts a state data privacy code, joining about a third of the states to do so. Is it a copycat or pioneer? After what some claim was the biggest data hack in history - exposing highly sensitive personal information when a data broker’s database was taken and offered for sale on the dark web, one leading commentator issues a call to action for regulation and business self-action. Is the spotlight now on data brokers? Get our 5-minute video update on YouTube or a deeper dive on our audiocast available on your favorite podcast platform. Happy September! Time stamps: 0:40 — Netherland Data Protection Authority fines Uber 7:10 — Minnesota adopts a data privacy code 13:41 — Data brokers The first 155 episodes of Data Privacy Detective can be found on the feed of the Frost Brown Todd Podcast. You can listen on Apple Podcasts (https://apple.co/3IrHUTg), Spotify (https://bit.ly/49XRU2k), or Soundcloud (https://bit.ly/3T8EWrw).
/episode/index/show/b341df91-8bfc-4e46-ad69-724e582ddfa8/id/32898052
info_outline
Episode 180 — Largest Data Breach In History?
08/22/2024
Episode 180 — Largest Data Breach In History?
We turn our magnifying glass to what some August 2024 headlines call the biggest data breach in history. One report said the entire population of the United States, Canada, and United Kingdom was hacked, with up to 2.9 billion people’s identities at risk. On closer inspection, it appears that 2.9 billion rows of data were packaged and posted for sale on the dark web for $3.5 million. Social Security numbers and other personally identifiable information were exposed, including between 100 and 300 million Social Security numbers of Americans. This was not a traditional hack or data breach National Public Data, a data broker, gathered information about many millions of people from public and non-public sources which it used it to offer background checks and other services. The data includes SS#’s, email addresses and other personally identifiable information about between 100-300 million people. Many are deceased, but others are alive. In April 2024, a hacker stole the database. A company then put this massive data trove up for sale on the dark web, eliciting interest from cybercriminals seeking to steal identities and engage in cybertheft. That led to government investigations and a class action lawsuit. The first 155 episodes of Data Privacy Detective can be found on the feed of the Frost Brown Todd Podcast. You can listen on Apple Podcasts (https://apple.co/3IrHUTg), Spotify (https://bit.ly/49XRU2k), or Soundcloud (https://bit.ly/3T8EWrw).
/episode/index/show/b341df91-8bfc-4e46-ad69-724e582ddfa8/id/32677322
info_outline
Episode 179 — Data Privacy Infrastructure 2024: Microsoft Priva in Preview
08/15/2024
Episode 179 — Data Privacy Infrastructure 2024: Microsoft Priva in Preview
Microsoft announced at an April 2024 IAPP conference a preview offering called Microsoft Priva. Described as a platform that helps organizations automate how they handle and deal with personal information, Priva aims to “streamline compliance across on-premises, hybrid and multicloud environments.” Episode 179 explores Priva as a measure of where we are on data privacy infrastructure in mid-2024. Organizations collect, process, use, share, and sell vast amounts of personal data - and are sometimes hacked for it. Legal compliance and minimizing/mitigating data breach and other risks are demanded of businesses large and small. But the system that an organization uses to handle personal data is not just for attention by its attorneys and insurers. It is the foundation of building trust with customers and other members of a company’s community. As Microsoft says, “Building customer trust is about commitment to empowering individuals to have control over their own data,” and “Protecting privacy is not just a legal necessity - but a pathway to value from the wealth of data at an organization’s disposal.” Consider how privacy can be designed into an organization’s IT system and how an offering like Priva can provide a coherent means of taking these steps: Conduct a privacy assessment Assess privacy risks Conduct tracking scanning Manage consents Automate subject rights (individuals) requests. The first 155 episodes of Data Privacy Detective can be found on the feed of the Frost Brown Todd Podcast. You can listen on Apple Podcasts (https://apple.co/3IrHUTg), Spotify (https://bit.ly/49XRU2k), or Soundcloud (https://bit.ly/3T8EWrw).
/episode/index/show/b341df91-8bfc-4e46-ad69-724e582ddfa8/id/32577657
info_outline
Episode 178 — Google, Third Party Apps, and Data Privacy: a calendar scheduling example
08/08/2024
Episode 178 — Google, Third Party Apps, and Data Privacy: a calendar scheduling example
Calendar scheduling—it can be simplified with third-party apps that schedule meeting times without a lot of back and forth. But third-party apps that do such scheduling entail significant privacy risks and choices. Using Calendly as an example, we explore in Episode 178 what happens when we allow a third-party app to connect through our IT platform, in this case that of Google. Google provides ample information and details about allowing third-party apps to connect through a Google sign-in. https://support.google.com/accounts/answer/13533235?hl=en It warns about the risks and encourages users to check out the websites and privacy choices of the app provider before syncing it with Google. Consider Google’s advice about granting permission to third-party apps, including the need to review how the third party will collect, share, use, and have the ability to delete data held within Google. Using Calendly’s April 15, 2024 Privacy Notice as an example, we explore the extent to which a third party app can receive, share, use, and delete data that reaches beyond the core function of the app’s basic purpose. Learn how the current data environment is not one of privacy by design and how third-party apps represent the spread of personal data beyond what we may assume. The first 155 episodes of Data Privacy Detective can be found on the feed of the Frost Brown Todd Podcast. You can listen on Apple Podcasts (https://apple.co/3IrHUTg), Spotify (https://bit.ly/49XRU2k), or Soundcloud (https://bit.ly/3T8EWrw).
/episode/index/show/b341df91-8bfc-4e46-ad69-724e582ddfa8/id/32489877
info_outline
Episode 177 — Autos, AI safety, and Surveillance Pricing: July 2024 Data Privacy Developments
08/01/2024
Episode 177 — Autos, AI safety, and Surveillance Pricing: July 2024 Data Privacy Developments
Join Brion St. Amour, Yugo Nagashima, and the Detective to review three top data privacy developments from July 2024. Our monthly review focuses on these topics: Automobiles - Are they spying on us without our consent? A letter from Senators Wyden and Markey to the U.S. Federal Trade Commission (FTC) asks for transparency and data protection from auto makers and those who share vehicle use data. What’s going on here? AI safety and the search for standards - On July 26, the U.S. Department of Commerce released guidance and software to improve the safety, security, and trustworthiness of AI systems. This builds on NIST’s 2019 Plan for Global Engagement on AI Standards. The White House circulated a summary of what underlies DOC’s release. Is there a bipartisan approach to the regulation of AI and how it should respect data privacy principles on both a domesti U.S. and global basis? Surveillance Pricing - The Chair of the FTC wants to investigate “surveillance pricing.” What’s this about? And what does it have to do with data privacy? Tune in to Episode 177 to probe meaning beneath the headlines on these major data privacy developments. Time stamps: 0:40 — AI safety and the search for standards 8:43 — Automobiles 16:15 — Surveillance pricing The first 155 episodes of Data Privacy Detective can be found on the feed of the Frost Brown Todd Podcast. You can listen on Apple Podcasts (https://apple.co/3IrHUTg), Spotify (https://bit.ly/49XRU2k), or Soundcloud (https://bit.ly/3T8EWrw).
/episode/index/show/b341df91-8bfc-4e46-ad69-724e582ddfa8/id/32364152
info_outline
Episode 176 — Data Provenance: It’s Time for Standards | Data & Trust Alliance’s June 2024 Version 1.0.0
07/25/2024
Episode 176 — Data Provenance: It’s Time for Standards | Data & Trust Alliance’s June 2024 Version 1.0.0
It’s time for standards about data provenance. Unless information is reliable and trustworthy - and able to be used properly - datasets hold doubtful value. Yet, datasets are the foundation of Artificial Intelligence. Standards for the provenance of data are thus essential, as Episode 175 explored. Enter the June 2024 release of Data Provenance Standards of the Data & Trust Alliance, or D&TA. Standards covering the Source, Provenance, and Use of data resulted from extensive cross-industry development, testing, and validation. D&TA’s pioneering work offers the opportunity for comment and participation to put version 1.0.0 into widespread adoption and enhancement. Kristina Podnar, D&TA’s Senior Policy Director, discusses with the Detective why standards are needed, what D&TA recommends, why it is important to have an industry approach to setting standards, and how personal privacy interests can be addressed within the use of datasets. Listeners will learn how D&TA standards are already in evolving use and validation and how they can apply to differing types of organizations. Tune in to Episode 176 and learn how you can comment and participate in the creation and adoption of data provenance standards that are essential to AI’s expanding use and a successful digital age . The first 155 episodes of Data Privacy Detective can be found on the feed of the Frost Brown Todd Podcast. You can listen on Apple Podcasts (https://apple.co/3IrHUTg), Spotify (https://bit.ly/49XRU2k), or Soundcloud (https://bit.ly/3T8EWrw).
/episode/index/show/b341df91-8bfc-4e46-ad69-724e582ddfa8/id/32273742
info_outline
Episode 175 — Data Provenance and Privacy: Personal Privacy and the Rise of AI
07/18/2024
Episode 175 — Data Provenance and Privacy: Personal Privacy and the Rise of AI
Artificial intelligence is not new. But now an acronym in common usage, AI is dominating markets, politics, industry, and our attention. And its use affects personal privacy. Let’s take a couple examples. Bathsheba was the mother of Solomon in Torah and biblical days. Solomon’s father was King David. tIf you ask Google’s Gemini what ethnicity was Bathsheba, you’ll get an answer that this is uncertain but she probably was Hebrew. We can’t ask her, because she died about three millenia ago. But what does Gemini base its answer upon that indicates probably Hebrew? Asking that question is asking about data provenance. And if we were asking about a living person and who the parents of that individual is - example if adopted - that’s a very private matter. Let’s say the data says a major politician is the mother or father of someone else - and the individual denies it. You can see how there privacy matters are very much at stake when a dataset is being created and then used to provide information. So what is data provenance? Think about it as the genealogy of information. Where did the information originate? How was it used and misused and transformed? How do we know if data is reliable and trustworthy or whether it is disinformation or hallucination? This is where the provenance of a dataset comes in. Datasets are the blood flows of AI. Garbage in garbage out - computer age. And misinformation in disinformation out . This can have major consequences as AI takes over more and more of the roles humans used to play when oral transmission and later hard copy was the way info was shared, stories were told, myths were created, science progressed. In the digital age, it all happens much faster. As AI expands, so does the risk that datasets will be unreliable and invade personal privacy of people. So - the need for standards of data provenance, rules and standards for determining the lineage of info, the reliability of a dataset. Otherwise, AI will be misused and create harm ad invade privacy and reputations of individuals improperly. So how are standards for the provenance of data and datasets being created? Government regulation is one approach. But here govts are catching up with tech change. There is no gold standard, or perhaps any colorable standard, set by govt or govts about data provenance. There are some efforts under way from the tech and business world to create data prov standards. One is by Data Provenance Initiative, powered by Cohere - aiming to track and trace data sources within data sets. Understand - almost 2000 data sets audited and traced to determine the provenance of data held within. Picture a variety of techniques to do this, so we can measure the origin, accuracy, reliability of data that feeds AI. Check out . Another major effort is by Data and Trust Alliance, a nonprofit group of major western companies. Including Walmart, Deloitte, Humanan, Pfizer, Mastercard, others. Goal is to produce voluntary standards for data provenance. Think of this like voluntary standards for safety in other fields. E.g., UL label re elec - not govt. Or food safety standards. Labels about organic or level of whether fish is farm or wild, endangered or not. We’ll talk in next episode with reps of D & T Alliance about standards announced in June 2024 to cover: Data type, source, legal rights, privacy and protection, lineage, generation date and material, intended use, and restrictions. Privacy aspects are an essential part of setting standards. Can AI use personal data of individuals gathered without their consent? Can AI use personal identities in formulating datasets about a mass of people? How reliable is data that cannot be traced definitively back to someone who grants consent and has the ability to correct or delete such data? What happens if personally identifiable information is included in a dataset and then is used to broadcast or leak that information, which allows someone to take malicious or unwanted action against that individual. Does anyone truly have a right to be forgotten? A right not to be doxxed? A right not to be maligned because of one’s identity, race, national origin, religion? Tune in next week to Episode 176 as we dig deeper into data provenance and privacy. The first 155 episodes of Data Privacy Detective can be found on the feed of the Frost Brown Todd Podcast. You can listen on Apple Podcasts (), Spotify (), or Soundcloud ().
/episode/index/show/b341df91-8bfc-4e46-ad69-724e582ddfa8/id/32190652
info_outline
Episode 174 — The American Privacy Rights Act: Are we getting closer to a U.S. federal data privacy code?
07/04/2024
Episode 174 — The American Privacy Rights Act: Are we getting closer to a U.S. federal data privacy code?
When the Chairs of Senate and House committees, one a Democrat and one a Republican, agree on a comprehensive and thorough federal data privacy statute, one might guess it will be enacted - or at least move forward to votes on amendments and packaged into a final form. Proposed by House Energy & Commerce Committee Chair Cathy McMorris Rodgers and Senate Commerce Committee Chair Maria Cantwell, the APRA offers the most comprehensive bipartisan approach yet to a comprehensive national data privacy statute. But powerful forces have postponed a mark-up of the bill. What’s blocking a deal? Tune in to Episode 174 for an update on how GOP leaders and civil liberty and pro-privacy advocates threaten to doom this drive to create a national e-commerce code for protecting individual data privacy. Yugo Nagashima, privacy and intellectual property attorney at Frost Brown Todd LLP, and the Data Privacy Detective highlight the obstacles to congressional action. The first 155 episodes of Data Privacy Detective can be found on the feed of the Frost Brown Todd Podcast. You can listen on Apple Podcasts (), Spotify (), or Soundcloud ().
/episode/index/show/b341df91-8bfc-4e46-ad69-724e582ddfa8/id/31980682
info_outline
Episode 173 — U.S. Defense Department’s version 2.0 for Contractor Cybersecurity: CMMC 2.0
06/13/2024
Episode 173 — U.S. Defense Department’s version 2.0 for Contractor Cybersecurity: CMMC 2.0
The U.S. Defense Department is forcing its contractors and subcontractors to upgrade their cybersecurity practices through CMMC version 2.0. CMMC is shorthand for Cybersecurity Maturity Model Certification. This affects virtually all suppliers to DOD that deal in Controlled Unclassified Information. 2.0 sets demanding cybersecurity standards in an ongoing effort to protect digital data from spies, hackers, thieves, and unwanted disclosures. Learn CMMC 2.0 basics and how it may be setting a 2024 gold standard for digital data protection. Consider how it blends with NIST and other standards to upgrade digital info-architecture. Srikant Rachakonda, Founder/CEO, and Jody Stoehr, Co-founder and Chief Revenue Officer, of SMPL-C () explain CMMC 2.0. What was once aspirational is becoming compulsory. The first 155 episodes of Data Privacy Detective can be found on the feed of the Frost Brown Todd Podcast. You can listen on Apple Podcasts (), Spotify (), or Soundcloud ().
/episode/index/show/b341df91-8bfc-4e46-ad69-724e582ddfa8/id/31721412
info_outline
Episode 172 — May 2024 Data Privacy News: Vermont / Illinois Biometric Changes / Trends Report
06/06/2024
Episode 172 — May 2024 Data Privacy News: Vermont / Illinois Biometric Changes / Trends Report
Vermont joined the “we have a data privacy code” group - almost a third of U.S. states now with a statute devoted to personal data privacy. Illinois modifies its code on biometrics to soften business costs of compliance. DataGrail’s 2024 Data Privacy Trends report focuses on a surge in data subject requests. Join Yugo Nagashima of Frost Brown Todd, Brion St. Amour of the Wabash Marketplace, and the Data Privacy Detective for an update on May 2024 developments. Tune in to see how Vermont provides a specific private right of action and details compliance requirements beyond what first adopter states specify. See how Illinois is balancing the interest in personal privacy about use of biometric information against what became a heavy class action defense cost per individual violation. And consider the rising tide of Data Subject Requests (DSR’s) from the important April 30, 2024 report by DataGrail - and what it means for organizations and individuals. Time stamps: 01:11 — Vermont adopts a privacy code 11:26 — DataGrail’s 2024 Data Privacy Trends report 17:53 — Illinois modifies its biometrics code The first 155 episodes of Data Privacy Detective can be found on the feed of the Frost Brown Todd Podcast. You can listen on Apple Podcasts (), Spotify (), or Soundcloud ().
/episode/index/show/b341df91-8bfc-4e46-ad69-724e582ddfa8/id/31615022
info_outline
Episode 171 — A Global Privacy Statement: How to Draft One
05/30/2024
Episode 171 — A Global Privacy Statement: How to Draft One
Privacy statements - how can one be written that applies globally? That seems like an impossible, even hopeless, challenge. Laws change regularly, even within countries and groupings like the EU. Rules differ. There are no “international” laws making data privacy a commonly regulated matter. This episode presents an approach to a comprehensive data privacy statement that can be used globally. Consider the essential elements. Express principles and practices that encompass the diversity of regulation while respecting commonly accepted rights of individuals whose personal information will be collected, processed, stored, and otherwise used when an organization operates cross-border. Using an effective example for reference, this episode can serve as a checklist for adopting a state-of-the-art global personal data privacy statement. The first 155 episodes of Data Privacy Detective can be found on the feed of the Frost Brown Todd Podcast. You can listen on Apple Podcasts (https://apple.co/3IrHUTg), Spotify (https://bit.ly/49XRU2k), or Soundcloud (https://bit.ly/3T8EWrw).
/episode/index/show/b341df91-8bfc-4e46-ad69-724e582ddfa8/id/31520757
info_outline
Episode 170 — E-Skimming at ATM’s, Stores, and Gas Pumps: What we can do about it
05/23/2024
Episode 170 — E-Skimming at ATM’s, Stores, and Gas Pumps: What we can do about it
Skimming—once defined as an internal business fraud of insiders taking money off the top of a company’s cash flow. E-skimming - the growing theft of personal digital information to steal funds and benefits from individuals. A May 22, 2024 New York Times report focused on how food stamp holders are victimized by crime rings when their benefit cards are hijacked through e-skimming. Episode 170 explores how thieves collect card and PIN numbers to steal what the FBI estimates to be $1 billion a year. Learn steps we can take to protect our benefits and funds and what organizations can do to combat this growing threat to personal finance. For further commentary, see the FBI’s guidance at Time stamps: 05:44 — Dangers of ATM skimmers 07:51 — Dangers of fuel pump skimmers 09:29 — 16 tips for keeping your debit card information secure
/episode/index/show/b341df91-8bfc-4e46-ad69-724e582ddfa8/id/31420292
info_outline
Episode 169 — Privacy, Artificial Intelligence, and the Sales Industry
05/09/2024
Episode 169 — Privacy, Artificial Intelligence, and the Sales Industry
How do organizations convert leads into revenue? How can they do this effectively while being privacy-conscious, not bombarding people with unwanted cold calls or messages? In Episode 169, the Data Privacy Detective converses with Thomas Ryan, CEO and founder of Bigly Sales. . Learn how the sales industry is undergoing rapid transformation, how it is beginning to use Artificial Intelligence to shape conversations that turn leads into customers, while being respectful of individual privacy. Explore how enormous information is available publicly (or at minimal cost) to sales industry channels. Consider whether privacy is “dead” and what can be done to stem unwanted phone calls and messages. Get Tom Ryan’s top tips for businesses and individuals about the sales process. Hear how AI tools can be both efficient and low-cost for marketing and how they can be more privacy respectful than traditional sales efforts. The first 155 episodes of Data Privacy Detective can be found on the feed of the Frost Brown Todd Podcast. You can listen on Apple Podcasts (), Spotify (), or Soundcloud (. Time stamps: 01:08 — Overview of today's sales environment 07:31 — How much information can companies learn about individuals from the data they purchase? 11:01 — Top tips for businesses who want to generate leads but still keep their consumers' privacy in mind? 15:21 — Top tips for individuals in keeping their information private from companies
/episode/index/show/b341df91-8bfc-4e46-ad69-724e582ddfa8/id/31176667
info_outline
Episode 168 — April 2024 Data Privacy Developments
05/02/2024
Episode 168 — April 2024 Data Privacy Developments
Progress towards a U.S. federal data privacy code? Consider the APRA, a bipartisan congressional effort in that direction - and its hot spots and chances. Learn about the Maryland Online Data Privacy Act and how it challenges big tech’s preferences. Discover what Max Schremms, AI, and birthdays have in common. Episode 169 explores these topics from April 2024 in fifteen minutes. Join Yugo Nagashima of Frost Brown Todd LLP in conversation with the Data Privacy Detective for this monthly update on major data privacy developments. Time stamps: 00:48 — APRA 07:58 — Maryland 15:41 — Schremms, AI, and birthdays
/episode/index/show/b341df91-8bfc-4e46-ad69-724e582ddfa8/id/31075078
info_outline
Episode 167 — Colorado act to guard our brains: the Privacy of neural data
04/25/2024
Episode 167 — Colorado act to guard our brains: the Privacy of neural data
In April 2024 Colorado became the first U.S. state to declare neural data - what goes on in our brains - to be “sensitive data” subject to its Privacy Act. Neural data will be treated the same as medical and other sensitive data such as fingerprints and facial images. The law will permit individuals to access, delete and correct their neural data. It will require organizations collecting neural data to obtain prior consent and disclose what they will do with it . Explore why this pioneering data privacy act is timely and how it will be used. Consider why the Colorado legislature voted almost unanimously in favor, though opposition was strident, including from academia. Learn whether regulating neural data this way is enough to protect the privacy of our brains and whether Colorado’s action is likely to be the start of a wave of brain data protection. The first 155 episodes of Data Privacy Detective can be found on the feed of the Frost Brown Todd Podcast. You can listen on Apple Podcasts (), Spotify (), or Soundcloud ().
/episode/index/show/b341df91-8bfc-4e46-ad69-724e582ddfa8/id/30966613
info_outline
Episode 166 — Digital Identity Systems: Estonia
04/18/2024
Episode 166 — Digital Identity Systems: Estonia
For about ten years, Estonia has pioneered a digital ID system for its 1.3 million citizens. Every Estonian receives a digital identity at birth or later. Estonians use this e-ID for a host of interactions with government and the private sector. The e-ID is not guarded zealously like a U.S. Social Security number. Instead, it is a kind of public key, with personal information about the individual held separately and securely. Is Estonia’s e-ID system helpful or hurtful to individual privacy? This Episode explores Estonia’s ongoing experiment. We consider how the system works and how digital identities can be useful in protecting personal information, increasing convenience, and preventing cybercrime. Here’s the government’s site about its e-ID program - Analyses of Estonia’s e-ID system can be found here: ; The first 155 episodes of Data Privacy Detective can be found on the feed of the Frost Brown Todd Podcast. You can listen on Apple Podcasts (), Spotify (), or Soundcloud ().
/episode/index/show/b341df91-8bfc-4e46-ad69-724e582ddfa8/id/30862568
info_outline
Episode 165 — Health data, HIPAA, and Privacy
04/11/2024
Episode 165 — Health data, HIPAA, and Privacy
Our medical and health data are valuable - both to promote public health and to enrich data brokers selling our sensitive personal information without our consent. HIPAA is the U.S. federal statute intended to safeguard our medical information - but it does not cover many of the ways our information is released and shared, with unintended consequences and risks. Episode 165 considers the difference between PI and PII and how organizations and individuals can safeguard our health information. Learn the de-identification process of organizations that aim for both HIPAA compliance and privacy-centric reputation. John Cook, President of Kingwood Data Privacy is our guest - John offers top tips about how our medical information can be protected, while sharing this essential information to battle disease and advance public health. Time stamps: 01:00 — Who is covered by HIPAA? 03:00 — What are the risks we take on when we share our medical information? 06:19 — How do businesses securely handle medical data? 08:31 — Where might health data privacy be headed in the US in the future? 10:31 — Top tips for organizations dealing with sensitive medical data 11:22 — Top tips for individuals in keeping their medical data secure The first 155 episodes of Data Privacy Detective can be found on the feed of the Frost Brown Todd Podcast. You can listen on Apple Podcasts (), Spotify (), or Soundcloud ().
/episode/index/show/b341df91-8bfc-4e46-ad69-724e582ddfa8/id/30781578
info_outline
Episode 164 — March 2024 Data Privacy News
04/04/2024
Episode 164 — March 2024 Data Privacy News
Episode 164 covers three March 2024 developments: Florida bans social media platform accounts of children under 14 - and more; Illinois modifies its pioneering biometrics laws; and President Biden and the House of Representatives act together about the sale of personal information to countries “of concern.” Consider how social media platforms are affected by Florida’s new effort to limit social media use by most minors - and how this creates privacy risks in an unintended way. Explore how and why Illinois’s legislature first-in-the-States code regulating biometrics is considering changes to limit class action recoveries for failure to get consent from those whose biometrics are used. Learn how an Executive Order and the House of Representatives’ unanimously passed act would stop data brokers from sharing personal information of U.S. persons with specified countries “of concern.” The first 155 episodes of Data Privacy Detective can be found on the feed of the Frost Brown Todd Podcast. You can listen on Apple Podcasts (), Spotify (), or Soundcloud (). Time stamps: 01:00 — Illinois modifies biometrics laws 08:00 — Executive action and legislation targeting the sale of personal information to countries "of concern" 14:00 — Florida bans social media platform accounts for children under 14
/episode/index/show/b341df91-8bfc-4e46-ad69-724e582ddfa8/id/30645148
info_outline
Episode 163 — You and Your Data Identity: How data private can we be?
03/28/2024
Episode 163 — You and Your Data Identity: How data private can we be?
Identity Orchestration - the difference between Identity and ID. Join Gerry Gebel, IT veteran, now Head of Standards at Strata Identity - . Gerry leads an effort to develop Identity Query Language, a policy orchestration standard. Strata Identity pioneered the concept of Identity Orchestration, which helps organizations integrate and control incompatible identity systems. Consider the state of data privacy today in a dizzying world of information flows. Can separating credentials from identity create more secure, private ways for us to participate in the digital universe? Will passwords become an historical relic? Is anonymity possible? If not, what limits can we hope to set on how our personal information is collected and used? Explore these intriguing questions in Episode 163. The first 155 episodes of Data Privacy Detective can be found on the feed of the Frost Brown Todd Podcast. You can listen on Apple Podcasts (), Spotify (), or Soundcloud (). Time stamps: 01:34 — What is identity orchestration? 06:45 — Are we heading toward a passwordless future? 07:54 — Is anonymity possible?
/episode/index/show/b341df91-8bfc-4e46-ad69-724e582ddfa8/id/30564488
info_outline
Episode 162 — Public Records and Privacy: Rethinking what’s public about us
03/21/2024
Episode 162 — Public Records and Privacy: Rethinking what’s public about us
From the day of birth, and perhaps even earlier, we become public data subjects. Without our express consent, our personal information is collected and poured out like salt from a shaker because of public records laws. There has been little federal attention to this for 50 years, and state laws vary. Tune in for an exploration of many ways in which we are data public beyond our personal control. Is it time to consider a change? Whether it’s to document major life events, property purchases, voting, and other things, laws require the collection and public release of vast amounts of personal information. While these laws have their reasons, in a digital age such information becomes the basis for unacceptable privacy invasions. Consider in Episode 162 whether there’s a public data overreach that requires rethinking about what is collected and shared freely about us, regardless of our choice or our best interests. The first 155 episodes of Data Privacy Detective can be found on the feed of the Frost Brown Todd Podcast. You can listen on Apple Podcasts (https://apple.co/3IrHUTg), Spotify (https://bit.ly/49XRU2k), or Soundcloud (https://bit.ly/3T8EWrw).
/episode/index/show/b341df91-8bfc-4e46-ad69-724e582ddfa8/id/30464158
info_outline
Episode 161 — Privacy and the Online Onslaught
03/07/2024
Episode 161 — Privacy and the Online Onslaught
Privacy - “freedom from unauthorized invasion,” says Webster’s Collegiate Dictionary, or “the quality or state of being apart from company or observation.” The Detective did not authorize an online onslaught. But every day my computer and phone are bombarded with unsolicited ads and messages. My digital space is invaded by demands for my attention. I’m forced constantly to declutter. I try to swat away these pests, like waving arms at mosquitoes in a smarmy jungle. Advertising, promotions, social media I don’t belong to clamoring to connect me with friends I’ve never met, strangers grasping to claim my time and money. And this happens without my request or consent. Were this torrent of messages a stream of phone calls, I’d claim rights under the Do Not Call list - or if it gets worse, turn off the phone. Were this a noxious stream of knocks on my door, I’d post a No Trespassing sign out front or call the police. But what can an individual do to avoid the onslaught that the digital age has spawned? Consider how unwanted data has infected our world and invades our privacy. Ponder how digital ads and unwanted messages are more toxic than highway billboards or ads on TV or radio. Think about defenses to this increasing attack on our privacy and take action about what we can do, both as individuals and as a society. The first 155 episodes of Data Privacy Detective can be found on the feed of the Frost Brown Todd Podcast. You can listen on Apple Podcasts (https://apple.co/3IrHUTg), Spotify (https://bit.ly/49XRU2k), or Soundcloud (https://bit.ly/3T8EWrw).
/episode/index/show/b341df91-8bfc-4e46-ad69-724e582ddfa8/id/30257318
info_outline
Episode 160 — Data Privacy News from February 2024: California and Florida
02/29/2024
Episode 160 — Data Privacy News from February 2024: California and Florida
Join Yugo Nagashima, data privacy and technology attorney at Frost Brown Todd, as he and the Data Privacy Detective discusses two major topics from February 2024. Learn how DoorDash and California settled a dispute under California’s privacy law that raises important issues for business and consumers. DoorDash was accused of failing to inform customers about its providing their personal information to marketing co-operative members, which then sent targeted advertisements to the customers. California claimed that DoorDash did not inform its customers about this and treated the sharing as a sale of personal information banned under the CCPA. When DoorDash tried to cure the problem, its contracts did not provide for adequate corrective measures and the ability to track and monitor how its customers’ personal information was used by third parties. In addition to paying a $375,000 fine in settlement, DoorDash agreed to change its privacy policy and post a clear and conspicuous notice about its selling or sharing information through the marketing co-operative. And perhaps even more important, DoorDash will need to revise its data sharing agreements so that it can track, monitor, audit, and control what happens to its downstream sharing of personal information. On February 23, the Florida legislature sent to the Governor a bill about social media and minors, with major privacy implications. Going beyond what several other states enacted in 2023, Florida could outright ban social media uses by people under age 16, require deletion of personal information of those minors on their request or that of their parents, and require age verification measures before allowing social media to sign them up as subscribers. The enacted bill would call for “anonymous” age verification methods to augment other common means of asking about someone’s age. This would require sharing of personal information about the minors in order to increase the reliability of age verification. Consider the privacy implications of social media’ and its impact on youth. Whose privacy is at stake? Whose data is it that would be protected? And who will control decisions about these matters - youngsters, parents and guardians, or the state? Time stamps: 00:45 — California/DoorDash privacy dispute 08:27 — Florida’s social media legislation
/episode/index/show/b341df91-8bfc-4e46-ad69-724e582ddfa8/id/30153018
info_outline
Episode 159 — Data Privacy and Cookies: Why we should rename Cookies as the Collectors that they are
02/22/2024
Episode 159 — Data Privacy and Cookies: Why we should rename Cookies as the Collectors that they are
Who doesn’t like cookies? When a website posts a notice about cookies, that sounds like a free offer for something good. But cookies on the internet are not good or bad. They aren’t cookies at all in any real sense. They are simply embedded technology that attract and use information about us and what we do on a website. Aside from software that enables a website to function, many “cookies” - let’s change their name right now to “Collectors” - grab, share, sell, and use our personal information. This leads to an invasion of our time and space - an invasion of our privacy. Tune in to Episode 159 to explore how Collectors pose a threat to our privacy and how we as individuals should have a true and ready choice about how our personal information is collected, used, shared, and sold without our conscious awareness or approval. Consider the recent history of Avast, a leading anti-virus software provider, as we learn how “Collectors” work and how each of us can choose to avoid Collectors if we wish to have a more private, calm existence in a digital world.
/episode/index/show/b341df91-8bfc-4e46-ad69-724e582ddfa8/id/30038903