She Said Privacy/He Said Security

Joe Jones serves as the Director of Research and Insights at the IAPP. Previously, he served as the UK Government’s Deputy Head of Digital Trade, where he was responsible for digital policy. Joe also served as a private practice lawyer on international data issues. In this episode… Companies are grappling with the challenges of managing privacy, security, AI, and data governance in an increasingly complex regulatory environment. The IAPP’s Organizational Digital Governance Report highlights the challenges businesses face due to “digital entropy” — caused by overlapping laws, rapid technological shifts, and cultural and socio-technical differences, emphasizing the need for organizations to align their governance structures to address these challenges. How can companies navigate these complexities while maintaining compliance and operational efficiency? The IAPP’s digital governance report provides insights into how companies can adapt their structures and processes to meet the growing demands of digital governance. It outlines three varying approaches companies are using to navigate digital entropy: the analog model, where companies use their current structures while adding more tasks to existing teams; the augmented model, where companies create new committees or cross-functional teams to define overarching terms for digital governance and policy; and the aligned model, where companies have dedicated roles for digital governance. The report underscores the importance of moving toward a more aligned model, where privacy, security, and AI governance are streamlined under cohesive leadership. This involves empowering privacy teams, implementing regular audits, fostering collaboration across departments, and avoiding reliance on ad hoc committees to align with evolving privacy regulations. In this episode of She Said Privacy/He Said Security, Jodi and Justin Daniels chat with Joe Jones, Director of Research and Insights at IAPP, about how companies can leverage insights from the IAPP Organizational Digital Governance Report to improve their digital governance frameworks. Joe explains how companies can stay ahead of regulatory changes by embracing more structured governance models. He also emphasizes the need for privacy professionals to act as enablers within organizations, offering guidance on leveraging data responsibly while navigating the growing complexity of privacy regulations.

Daniel B. Rosenzweig is the Founder and Principal Attorney at DBR Data Privacy Solutions, a boutique data privacy law firm. He advises clients on legal and technical compliance with data protection and privacy laws and counsels clients on the responsible use of AI, AdTech, and privacy-enhancing technologies. Dan’s legal practice is unique in that he also codes and develops technical solutions to enhance his legal services. In this episode… As the AdTech landscape evolves, companies are facing new challenges with cookie alternatives like server-side technologies and alternative IDs. While these new tools offer improved targeting capabilities, they also bring risk, especially when it comes to managing opt-outs and tracking user consent. To preserve consumer trust and drive revenue, businesses need to fully understand how these advanced technologies work while adhering to applicable privacy laws. So, how can companies stay compliant while leveraging these technologies? Adopting alternative IDs, advanced matching, and server-side technologies offers new opportunities for businesses to enhance targeting while maintaining consumer trust. Still, companies need to carefully assess the risks and ensure proper implementation. Establishing a proper governance process, conducting regular audits and testing, maintaining transparency in privacy notices, and avoiding dark patterns are crucial steps for regulatory compliance and protecting consumer privacy. In this episode of She Said Privacy/He Said Security, Jodi and Justin Daniels chat with Daniel Rosenzweig, Founder and Principal Attorney at DBR Data Privacy Solutions, about the challenges of balancing data privacy with AdTech solutions. Dan explains how businesses can implement these technologies without sacrificing consumer privacy by effectively managing consent platforms, auditing and testing technologies, and ensuring transparent data practices that align with regulations. He also emphasizes the importance of regular collaboration between legal, marketing, and technical teams to stay compliant with evolving regulations.

Rob Black is the Founder of Fractional CISO and has guided numerous companies in enhancing their security postures. With extensive experience in product and corporate security roles at prominent companies like PTC, Axeda, and RSA Security, Rob is recognized as a trusted authority in risk management and cybersecurity innovation. In this episode… As companies face increasing pressure to meet security and compliance demands, many are turning to AI to enhance their governance, risk, and compliance programs. Tools like ChatGPT and Claude can streamline processes such as summarizing reports and generating responses to security questionnaires. While these tools can improve efficiency, they can also produce inaccuracies, underscoring the importance of human oversight. How can companies use AI responsibly to enhance these programs? AI tools can save security teams a ton of time, but they’re not reliable enough to replace human oversight. This means that companies need to establish clear guidelines and governance frameworks on AI usage to protect sensitive information and mitigate risks. By integrating these strategies, companies can build more resilient and compliant programs. In this episode of She Said Privacy/He Said Security, Jodi and Justin Daniels talk with Rob Black, the Founder of Fractional CISO, about integrating AI into governance, risk, and compliance programs. Rob explores the benefits and risks of utilizing AI in these programs, emphasizing the need to blend AI with human oversight. He also emphasizes the need for companies to have a security-first mindset when implementing AI tools to reduce risk and ensure long-term success.

Arsen Kourinian is a Partner in Mayer Brown’s AI Governance and Cybersecurity & Data Privacy practices. He advises clients on data privacy and AI laws and frameworks. Arsen has published numerous articles regarding nuanced issues in these fields, including a forthcoming book entitled Implementing a Global Artificial Intelligence Governance Program. In this episode… The growing number of global and state privacy laws and AI regulations is prompting companies to integrate fundamental frameworks into their AI governance programs. While the US lacks a comprehensive federal AI law, states like Colorado have begun implementing AI regulations that could serve as a model for future state-level standards. With seemingly fragmented regulations, how can companies effectively develop an AI governance program? A multi-regulatory approach to AI governance can be challenging for companies to navigate with regulations like the EU AI Act, Colorado's Artificial Intelligence Act, and international standards like ISO and NIST. While the regulatory landscape is patchy, harmonizing across various regulations and frameworks can help companies meet compliance obligations and reduce risk. This includes forming an AI governance committee, implementing a data governance plan, conducting risk assessments, documenting accountability with policies and procedures, and continuous monitoring and oversight of AI vendors. In this episode of She Said Privacy/He Said Security, Jodi and Justin Daniels speak with Arsen Kourinian, Partner at Mayer Brown, about developing an AI governance program amid emerging global and state regulations. Arsen emphasizes incorporating key components and frameworks from various laws to develop AI governance programs. He also delves into the departments that assume responsibility for these programs and offers guidance on completing AI impact assessments, highlighting the importance of risk mitigation and understanding practical harms.

Darren Abernethy is a Shareholder in Greenberg Traurig's data, privacy, and cybersecurity practice. As an AdTech and data privacy attorney, he is licensed to practice law in California, New York, and Washington, DC. Darren holds seven IAPP Certified Information Privacy Professional, Manager, and Technologist certifications. In this episode… Talks about shifting away from third-party cookies is pushing companies to rethink their advertising strategies and adopt cookieless alternatives. As many companies explore other AdTech solutions like first-party data collection strategies, they need to evaluate their advertising practices to ensure alignment with evolving state and global privacy laws. How can businesses effectively implement alternative AdTech solutions while adhering to evolving compliance requirements? First-party data collection, contextual advertising, and CRM-based approaches present opportunities for businesses to refine their ad targeting strategies. However, these alternatives also require companies to ask probing questions when evaluating new technologies, such as how these solutions fit within evolving privacy laws and what vendor safeguards are needed. In this episode of She Said Privacy/He Said Security, Jodi and Justin Daniels chat with Darren Abernethy, Shareholder at Greenberg Traurig, about the future of AdTech and data privacy in a world transitioning away from third-party cookies. Darren explains how businesses can take a privacy-first approach to implementing new AdTech solutions by proactively managing vendors and keeping privacy programs up to date. He underscores the importance of modernizing vendor assessments, updating contracts regularly, and maintaining proper documentation in case of regulatory scrutiny to build trust and mitigate risks.

Shanti Ariker is the Chief Legal Officer of JFrog (NASDAQ: FROG), where she leads the company’s global legal policy development and compliance. She is a solution-creator with global legal expertise, leveraging more than 20 years of experience working with high-growth technology companies to act as a trusted business advisor to CEO and executive teams and public company Boards of Directors. In this episode… The rise in cyber risks is placing increased pressure on companies to closely examine their software and codes and integrate security measures into every stage of the software development process. And, with the SEC cyber rule requiring publicly traded companies to report material breaches, there’s an increased need for companies to perform thorough due diligence on their vendors, especially those incorporating AI into their products. So, how can businesses protect their supply chains in such a volatile environment? Supply chain security is not a one-time task but an ongoing process that demands continuous integration of security throughout the software lifecycle. Companies like JFrog, a software supply chain platform, recognize this and utilize a security by design approach to help companies reduce cyber risk by embedding security protocols into every stage of its software design process, securing each piece of code at the binary level before it reaches the end user. In this episode of She Said Privacy/He Said Security, Jodi and Justin Daniels chat with Shanti Ariker, the Chief Legal Officer at JFrog, about the complexities of securing the software supply chain in today’s tech and regulatory landscapes. Shanti explains how JFrog embeds security by design principles into every stage of software development to help companies mitigate cyber risks, while enabling companies to conduct thorough due diligence on their suppliers' cybersecurity, legal, IT, and privacy practices. She also emphasizes the need for companies to implement a robust AI review process, particularly for third-party vendors incorporating AI into their products to gain a holistic review of the cybersecurity, data privacy, and regulatory compliance implications.

Omer Tene is a Partner in Goodwin’s Technology group and Data, Privacy, and Cybersecurity practice. For the past two decades, he has consulted governments, regulatory agencies, and businesses on privacy, cybersecurity, and data management. Omer is also an Affiliate Scholar at the Stanford Center for Internet and Society and a Senior Fellow at the Future of Privacy Forum. Before Goodwin, he was the Chief Knowledge Officer at the IAPP. In this episode… The US privacy landscape is rapidly evolving, as more states enforce privacy regulations similar to California’s comprehensive privacy law. In 2025, eight new privacy laws will come into force — even states without comprehensive privacy laws are imposing regulations to protect consumer data. Notably, New York, where the New York Attorney General recently established guidelines around cookies and tracking technologies emphasizing the need for companies to properly categorize cookies and configure consent mechanisms. The NY AG has also proposed regulations surrounding kids' privacy, like the Child Data Protection Act, that will impact how companies process children’s data. As the US privacy landscape becomes an increasingly complex web of regulations, how can companies prepare for what lies ahead? Beyond New York, privacy regulations around kids' data are gaining momentum across the US, with laws like the California’s Age-Appropriate Design Code aiming to protect minors from harmful content. Regulations on kids' privacy include everything from age verifications that restrict the sale of minors’ data to design codes that protect children from exposure to harmful internet content. These guidelines have garnered pushback in states like California, where businesses claim violation of the First Amendment, consequently delaying enforcement. Regardless, companies should prepare to respond to these regulations that govern the collection, processing, and sale of children's data. In this episode of She Said Privacy/He Said Security, Jodi and Justin Daniels welcome Omer Tene, a Partner at Goodwin, to explore the complexities of evolving privacy regulations, specifically on children’s data. Omer shares his insights on the nuances of various privacy regulations, ethical challenges surrounding children’s data protection, and the potential future of privacy legislation. Omer maintains that although some regulations have not yet been enforced, companies should take a proactive approach adapting to these new regulations as the privacy landscape shifts.

Shoshana Rosenberg is the Senior Vice President, Chief AI Governance and Privacy Officer at WSP, one of the world’s leading engineering and professional services firms. She is also the Founder of SafePorter, Co-founder of Women in AI Governance, and a Strategic Program Advisor at Logical AI Governance. Shoshana is a seasoned attorney with over 16 years of experience in international data protection law, a US Navy veteran, and a passionate advocate for social entrepreneurship and inclusion. In this episode… In the ever-evolving and largely unsettled AI landscape, one certainty remains — the need for companies to develop governance programs to navigate and address the organizational impacts of AI. Such governance accounts for client, stakeholder, and employee expectations for AI use, as well as risk management and overarching visions for innovation. But the process involves more than simply understanding AI tools and vendors. So where do companies begin when developing AI governance programs? AI governance isn’t another compliance program where decisions are made in a vacuum. Instead, it’s about building a centralized intelligence function across various teams to identify and understand AI tools, use cases, and vendors. A sustainable AI governance program evolves with the changing regulatory and technology landscape and is monitored and evaluated by the governance committee and other organizational stakeholders. In this episode of She Said Privacy/He Said Security, Jodi and Justin Daniels sit down with Shoshana Rosenberg, the SVP, Chief AI Governance and Privacy Officer at WSP, to talk about how companies can build an AI governance program in an evolving landscape. Shoshana emphasizes the need for a proactive approach to AI governance and recommends regularly evaluating AI tools and use cases while creating and adapting associated risk profiles. This establishes a foundation that allows companies to keep moving forward, regardless of how business needs change and the AI landscape shifts.

Amy Bogac is the Chief Information Security Officer at Elevate Textiles. As a seasoned security leader, she has over 20 years of experience in information security, IT governance, and compliance. She holds an MBA from Lake Forest Graduate School of Management and a CISSP certification from ISC2. Previously, Amy was the CISO for The Clorox Company during a significant cyber incident. In this episode… The concept of disaster recovery has evolved significantly in recent years, urging companies to evaluate their security capabilities and infrastructure to plan for cyber events and specific scenarios. While publicly traded companies have some measures in place to restore data and minimize disruptions, privately held companies may not be as prepared. And, as new SEC cyber disclosure rules target third-party risk management, this places pressure on privately held companies to disclose breaches. How can companies maintain strong data resilience and incident response planning? With cyber events becoming increasingly disastrous, having a business disaster recovery plan that can recover data and resume operations is more critical than ever. Yet, sometimes the affected data isn’t always trustworthy, especially if the breach occurred among third-party vendors. In this episode of She Said Privacy/He Said Security, Jodi and Justin Daniels chat with Amy Bogac, the CISO at Elevate Textiles, about the critical need for businesses to revisit their disaster recovery plans and integrate data resilience strategies. Amy stresses going back to the basics by regularly reviewing and updating DR plans and ensuring that all business processes are documented and tested. She also explains the magnitude of risks companies face today, highlighting the need for stakeholder and company-wide involvement in training and incident response planning.

Ralph Pasquariello is a Senior Partner at The Tech Collective, a technology solutions company. He works with the FBI, GBI, and US Secret Service on the Atlanta Cyber Fraud Task Force. Ralph is also the former Executive Committee Chairman for the Tech400 Cyber Symposium and an advisor to the Georgia Tech Research Institute. He has served and chaired on numerous boards and organizations. Ralph’s cyber liability expertise has qualified him to present at over 100 events. For the past 14 years, he has moderated and spoke at dozens of conferences and panels on cyber liability and data breach risk management. He’s hosted educational seminars on cyber exposure for professional associations of all industries, including operational technology and intellectual technology. In this episode… When a company undergoes a cyber attack, the repercussions are costly. From remediation and replacement costs to third-party damages and operational interruptions, cyber insurance aims to cover expenses businesses incur and help them stay afloat after a cyber event. Cyber insurance is a crucial part of security, yet many businesses remain underinsured, believing that compliance with third-party vendors and/or client contracts is sufficient. What coverage might your company be missing, and how can you ensure it’s optimal? Cyber insurance coverage may include more than basic security provisions, encompassing additional elements such as commercial crime, social engineering, ransomware, and fraudulent transfers. As cyber insurance requirements have become increasingly strict over the years — The Tech Collective helps companies navigate complex insurance applications, analyze optimal insurance coverage based on business-specific needs and risks, and perform a comparative industry analysis. In this week’s episode of She Said Privacy/He Said Security, Jodi and Justin Daniels welcome Ralph Pasquariello, Senior Partner at The Tech Collective, to talk about how companies can ensure optimal cyber insurance coverage. Ralph emphasizes that business security measures and contractual compliance are not equivalent to proper cyber insurance coverage. He also shares instances where insurance companies may deny claims and provides insight into carriers changing requirements.

Alexandria (Lexi) Lutz is the Senior Corporate Counsel at Nordstrom, where she advises the company on legal matters related to privacy, cybersecurity, and AI. Prior to Nordstrom, Lexi worked for a large national hotel brand and an international food service company. She is a Certified Information Privacy Professional in the US and Europe and holds the Charlotte Business Journal award for Outstanding Corporate Counsel in a large company. In this episode… 19 states have passed privacy laws, fundamentally altering how companies collect, share, and sell consumer data. And, as consumers become more aware of their privacy rights and how companies and their third-party vendors handle their data, retailers are at the forefront adapting their privacy programs, due diligence processes, and third-party contractual agreements to meet compliance requirements and maintain customer trust. What’s more, the new SEC cyber rules place even more security requirements on retailers’ relationships with third-party vendors, further complicating expectations. How can retailers navigate this complex regulatory landscape while providing the best experiences for their customers? Adapting privacy programs to evolving regulations is an intricate process requiring a company to evaluate its operations, size, and resources. No matter the circumstances, it’s crucial to maintain control over consumer information and ensure all third-party vendor contracts are up to date and transparent. And as retailers incorporate generative AI into their online and in-store shopping experiences, they should take extra steps to ensure personalization, efficiency, and protection are not lost. In this week’s episode of She Said Privacy/He Said Security, Jodi and Justin Daniels chat with Alexandria (Lexi) Lutz, the Senior Corporate Counsel at Nordstrom, how retailers can navigate privacy challenges, leverage AI, and maintain consumer trust in an increasingly complex regulatory environment. Lexi highlights how these regulations — including the SEC cyber rules — impact everything from third-party vendor due diligence and contractual requirements to in-house privacy programs and consumer data sharing and selling. She also discusses the implications of generative AI in retail, maintaining that it should enhance the shopping experience rather than replace human input.

Julie Rubash is the General Counsel and Chief Privacy Officer at Sourcepoint, a data privacy software company. She coordinates legal efforts for Sourcepoint and ensures that the product suite innovates and expands to meet the demands created by the ever-changing regulatory landscape. Julie brings over 15 years of legal experience and has worked at both law firms and as internal counsel in the media, technology, and advertising sectors. Prior to Sourcepoint, Julie served as the VP of Legal at the advertising platform Nativo. In this episode… As companies head towards a cookieless future, advertisers are devising clever ways to target consumers, some of which may risk infringing on privacy laws and privacy rights obligations. While companies are creating universal solutions to comply with evolving privacy laws, they may overlook nuanced targeting methods that use consumer data differently than cookies. The stakes are high for any company engaging in these emerging targeting methods, as businesses must recognize the privacy risks and carefully blend legal requirements with their marketing efforts to protect consumer data. Some of the most innovative companies have embraced privacy considerations as a marketing touchpoint, working with consumers to build trust and provide clear options to manage their preferences. Companies like Sourcepoint recognize this need and that privacy obligations and consent solutions are not one-size-fits-all, so they offer flexible privacy software solutions that allow companies to tailor privacy programs based on their unique business goals, circumstances, and legal requirements. In this week’s episode of She Said Privacy/He Said Security, Jodi and Justin Daniels speak with Julie Rubash, the General Counsel and Chief Privacy Officer at Sourcepoint, about the ins and outs of managing consent as new targeting methods emerge. Julie stresses the need for customized consent solutions that align with company principles and privacy regulations while allowing consumers to manage their preferences. She also discusses how privacy professionals can recognize and mitigate the risks of new targeting methods, the importance of understanding the data you’re collecting, and why combining marketing and privacy goals is paramount in this evolving ad tech landscape.

Craig Schwartz is the Head of Legal at Covariant, an AI and robotics company out of Berkeley. He is a veteran tech lawyer with 20 years of experience at the intersection of emerging technology and regulated markets. Craig previously worked for Palantir Technologies, where he led the USG Partnerships team and served as Lead Counsel for the Intelligence Community business. Now at Covariant, Craig is part of a team building foundational models for the physical world, focusing on automation and AI integration in industrial settings. In this episode… Europe's aging workforce is fueling a growing demand for automated labor solutions, with US-based AI robotics companies stepping in to fill the gap. But this trend isn't just about technological innovation. For US-based companies entering the European market, success in this landscape requires a deep understanding of product capabilities and the global regulatory environment. To stay ahead, companies must make informed decisions on ethical AI use and on how to handle data — from collection to storage to use — without stepping on any global regulatory toes. With emerging regulations like the EU AI Act and Internet of Things (IoT) legislation, it's now more important than ever for companies to integrate privacy considerations into product design from the start. By adopting privacy-by-design principles early on, companies like Covariant can meet anticipated global compliance requirements and create operational efficiencies, demonstrating their proactive approach to these regulatory challenges. In this week's episode of She Said Privacy/He Said Security, Jodi and Justin Daniels chat with Craig Schwartz, the Head of Legal at Covariant, who shares invaluable insights on navigating the complex intersection of AI, robotics, and international privacy regulations. Craig explains the steps Covariant takes to stay ahead of global privacy regulations. He also discusses the critical need for legal professionals in tech to immerse themselves in technical product knowledge, the challenges of applying existing global privacy laws, such as GDPR, to cutting-edge technologies, and the potential impact of antitrust policies on innovation in the AI space.

Award-winning data ethics and responsible media luminary Arielle Garcia is the Director of Intelligence at Check My Ads. In her role, she partners with businesses and organizations to lead research and develop standards and solutions that foster a healthier market, protect civil and human rights, and promote industry accountability. A steadfast advocate for transparency, trust, and fairness in the digital ecosystem, she has advised 100+ marketers on the evolving digital landscape, driving the development and adoption of trustworthy and effective media and data strategies for the benefit of brands and their customers. She was previously the Chief Privacy and Responsibility Officer at UM Worldwide, and she holds a J.D. from Fordham University School of Law.. In 2021, Arielle was inducted into the AAF Advertising Hall of Achievement. She has also been recognized by Crain's New York Business "20 in their 20s," a Cynopsis “Top Woman in Media” in 2021, and a “Top Woman in Media & Ad Tech” by AdExchanger in 2023. In this episode… In the intricate world of ad tech, the exchange of data has become as common as trading stocks on Wall Street. Marketers now have advanced tools to pinpoint their target audience, but this data trove also brings significant privacy concerns. Brands are often challenged with the privacy implications of tracking, data selling, and sharing. And that’s understandable - it’s a complex web of information, and it’s not always clear where consumer data ends up. With the imminent demise of third-party cookies, companies are exploring new methods to sustain behavioral targeting like data clean rooms, conversion APIs, and alternative identifiers, raising questions about their privacy implications. That’s why Check My Ads is on a mission to keep the ad tech ecosystem in check by calling out false narratives and defunding bad actors that spread misinformation to drive systemic change. In today’s episode of She Said Privacy/He Said Security, Jodi and Justin Daniels welcome Arielle Garcia, the Director of Intelligence at Check My Ads, to discuss some of the biggest privacy challenges facing the ad tech ecosystem today. Arielle highlights the fundamental conflict between ad tech business models and business privacy obligations, emphasizing the need for a shift toward consumer-centric approaches. She also shares the implications of third-party cookie deprecation, critiques current and emerging advertising business models, and discusses the critical need for implementing secure and effective media and data practices to benefit companies and their customers.

Angeline Corvaglia is the Founder of Data Girl and Friends, where she is committed to helping young people thrive in an AI-driven digital world. Her strategy encompasses three key pillars: privacy and security awareness, critical thinking skills, and balancing the benefits and risks of AI. Angeline is on a mission to equip young minds with the tools they need to navigate and succeed in the ever-evolving digital landscape. In this episode… With rapid advancements in technology and AI, it is now more crucial than ever to protect children, particularly girls, online. Many parents are unaware of the full extent of digital and social media threats, such as AI-driven chatbots used by predators to manipulate children. How can parents protect their children, especially their daughters, and educate them about online risks? To combat these risks, parents should activate privacy settings and restrict information sharing on electronic devices. Parents should activate enable privacy settings and restrict information sharing on electronic devices. And with resources like Data Girl and Friends, parents can engage in meaningful conversations with their children, empowering them to become digitally savvy and take charge of their online privacy. In this week’s episode of She Said Privacy/He Said Security, Jodi and Justin Daniels chat with Angeline Corvaglia, the Founder of Data Girl and Friends, about protecting girls online. She shares actionable insights on shielding kids from intrusive data practices and online predators and discusses the underlying societal pressures that amplify these risks especially for girls.

Christina Shannon is an accomplished Chief Information Officer (CIO) in the CPG chemical manufacturing sector. With a career spanning over two decades, she transitioned from senior security leadership roles in Fortune 100 companies to executive technology leadership positions in mid-to-large-sized, private equity-owned firms. Christina's journey includes serving as a Chief Information Security Officer (CISO) four times, in which she gained deep experience in developing effective strategies to address enterprise cyber risk across various industries. As a CIO, she focuses on leveraging technology to drive innovation, improve operational efficiency, and secure critical digital assets in the CPG chemical manufacturing industry. In this episode… Understanding the multifaceted role of a CIO offers valuable insights into the synergy between technology and business operations, highlighting the importance of operational efficiency, robust cybersecurity measures, and comprehensive privacy controls. How does one effectively navigate these complex responsibilities? As a Chief Information Officer for the chemical manufacturing company, Christina Shannon emphasizes the need for strategic alignment between technology and business objectives. To be effective, CIOs must grasp the broader business implications of their decisions, not just the technical and security aspects. This involves developing a framework that integrates effective AI policies, ensures privacy compliance, and addresses operational security risks. Christina Shannon, CIO at KIK Consumer Products, joins Jodi and Justin Daniels on this week’s episode of She Said Privacy/He Said Security to discuss her role as a CIO, offering practical strategies for leveraging technology to drive innovation while safeguarding digital and physical assets. Christina describes the process of shifting from a technical mindset to an operational viewpoint to align technology with business goals, understand risk exposures, and manage privacy and security initiatives effectively. The conversation also covers how organizations can derive value from their security measures beyond checking off compliance requirements.

Aaron Mendelsohn is currently Director - Privacy Officer at the LEGO Group in Denmark, where he leads data protection and privacy compliance within the Digital Technologies teams, including LEGO.com, LEGO Insiders, LEGO Marketing, and LEGO Retail. Prior to joining the LEGO Group, Aaron held leadership roles in data protection, privacy, and information security, including creating and managing global data protection and privacy programs at two Fortune 500 companies In this episode… Establishing a functional privacy framework within an organization is crucial for maintaining compliance and safeguarding data. It goes beyond simply adhering to legal regulations. Effective privacy management involves understanding how privacy laws and privacy initiatives work together to impact overall business operations. So, how can companies seamlessly integrate privacy into their day-to-day activities? Customizing privacy objectives to align with a company's individual needs, culture, and risk profile is imperative. To be successful in this approach, privacy professionals must be flexible and strategic, tailoring their strategies to align with organizational priorities through comprehensive policies, privacy-by-design programs, training, and other initiatives. In today’s episode of She Said Privacy/He Said Security, Jodi and Justin Daniels welcome Aaron Mendelsohn to discuss practical strategies for operationalizing privacy within organizations. Aaron emphasizes integrating people, processes, and technology to achieve effective privacy management. The discussion also underscores the value of targeted privacy training tailored to specific business roles and how privacy professionals can successfully adapt and evolve privacy strategies as business needs change.

Kabir Barday’s career journey illustrates the power of innovation in privacy. As the Founder, CEO, and Chairman of OneTrust, he has transformed the landscape of privacy automation. He holds a Fellow of Information Privacy with the IAPP, the highest designation of a privacy professional, and is a Henry Crown Fellow at the Aspen Institute. With a BS in Computer Science from the Georgia Institute of Technology, where he serves on the Georgia Tech Advisory Board (GTAB), Kabir continues to lead OneTrust in setting new standards for privacy automation and responsible AI. In this episode… Many companies struggle with responsible use of data, AI, and creating privacy programs. From ethical data use to complying with evolving privacy laws and using new AI tools, it can be challenging for companies, especially with manual processes. How can businesses and privacy professionals ease the burden of manual privacy work and keep up with regulations? Trust has become a fundamental societal trend, so businesses must facilitate trusted interactions with customers and stakeholders by embedding privacy controls into the user experience. Fortunately, there is OneTrust, the company revolutionizing responsible use of data, AI, and privacy management with its proprietary software that automates privacy processes, helps organizations comply with regulations, and builds trust with customers. Kabir Bardy, Founder, CEO, and Chairman of the Board at OneTrust, joins Jodi and Justin Daniels on this week’s episode of She Said Privacy/He Said Security to discuss OneTrust’s innovative approach to privacy, automation, and AI. Kabir shares AI and privacy trends from Trust Week 2024, how OneTrust champions responsible use of data and AI, and how companies can evolve their privacy programs at various maturity levels.

Charlotte Baker is the CEO and Co-founder of Digital Hands, a leading cybersecurity services provider. Under Charlotte’s leadership, Digital Hands has won numerous industry awards, with the most recent in 2023, which includes “Most Innovative MSSP”: at CyberDefenseCon and Inc’s “Power Partner of Privacy and Security.” With a 100% US-based delivery model, Digital Hands’ clients received unparalleled speed in threat detection and incident response. In this episode… The recent security regulations and SEC cyber rules have shifted companies’ focus from risking fines to maintaining mandatory compliance. While these regulations force businesses to adopt stringent security and ethical data privacy practices, some privately held companies are turning a blind eye. What strategic measures can businesses implement to comply with these regulations? Many privately held companies don’t understand that regardless of their size, they must adhere to new SEC rules and thoroughly review security contract addendums to avoid breach response hijacks by publicly traded companies. Companies also need to understand that compliance involves more than just reviewing security addendums or publishing a privacy policy on their website. They must prove they follow these policies. Even when companies have cybersecurity solutions, follow the rules, and achieve compliance, they may still get breached. That's why companies like Digital Hands aim to get ahead of every threat. With its “get there first” approach to security, Digital Hands maintains speed and flexibility to execute security solutions, taking a proactive approach to compliance. In today’s She Said Privacy/He Said Security episode, Jodi and Justin Daniels welcome Charlotte Baker, the CEO of Digital Hands, to discuss the strategic measures businesses can implement to comply with security regulations. Charlotte emphasizes the need for multi-factor authentication, the benefits of avoiding point solutions, and the importance of having a strategic roadmap for security maturity.

Gretchen Herault is Chief Privacy Officer at Randstad USA and the global job board Monster.com. She has held several privacy leadership roles, including Chief Privacy Officer at Haven Healthcare, HIPAA Privacy Officer at GE Healthcare, and Chief Privacy Officer of Nuance Communications. In this episode… Since the introduction of CCPA and as of this recording there are just under two dozen privacy laws either signed or about to be, altering how companies manage consumer data.As compliance becomes increasingly urgent, how can businesses structure their privacy programs around these laws? Gretchen Herault manages Randstad USA's privacy program, collaborating with a cross-functional team of legal and business professionals to develop comprehensive strategies and operational solutions. As a result, Randstad's privacy program takes a proactive approach and adapts to new regulations by aligning with California's strict privacy standards. This simplifies compliance efforts and prepares the company for upcoming laws. In today’s She Said Privacy/He Said Security episode, Jodi and Justin Daniels engage in a thought-provoking conversation with Gretchen Herault, the Chief Privacy Officer of Randstad USA and Monster.com, about building and operationalizing privacy programs. They discuss how to develop privacy programs under a growing number of privacy laws, regulating company AI use, and Gretchen's advice for evaluating and building privacy teams.