The Data Diva E296 - Michael Booden and Debbie Reynolds

Michael Booden, Senior Technology Counsel 

In this episode of The Data Diva Talks Privacy, Debbie Reynolds, The Data Diva speaks with Michael Booden, Senior Technology Counsel, about the evolving relationship between contracts, privacy, cybersecurity, and artificial intelligence. Michael shares his professional journey from litigation and appellate court clerkships to becoming an in-house technology attorney and adjunct law professor teaching contract drafting and negotiation. He explains how his litigation background shaped his approach to drafting agreements, emphasizing the importance of clarity, precision, and anticipating how contractual language will be interpreted when disputes arise.

The conversation explores how privacy and security requirements increasingly appear in technology agreements and why organizations can no longer rely solely on vendor representations regarding data protection. Michael discusses how he developed cybersecurity addenda to establish objective standards and expectations for vendors, including security controls, indemnification provisions, and requirements aligned with recognized frameworks such as NIST and ISO standards. He explains how these contractual protections help organizations proactively manage risk rather than simply reacting to incidents after they occur. 

Debbie and Michael examine the growing role of AI in organizations and the challenges associated with managing data privacy and security risks when using AI tools. Michael discusses the development of AI-specific contractual provisions designed to address issues such as data handling, retention, outputs, transparency, and vendor accountability. The discussion highlights how organizations are increasingly being asked by customers, regulators, and business partners to explain how AI is being used and what safeguards are in place to protect sensitive information. Michael shares how his organization developed client-facing AI disclosures to provide greater transparency and build trust around AI usage.

The episode also explores the importance of selecting enterprise-grade AI solutions rather than public consumer tools, particularly when organizations are handling confidential, proprietary, or personal information. Michael explains how privately licensed AI environments can provide stronger protections against data leakage and unauthorized use, while also enabling organizations to take advantage of AI's productivity benefits. Debbie and Michael discuss how AI is transforming work by helping employees automate lower-value tasks, improve efficiency, and access information more effectively, while emphasizing that organizations must establish clear policies, governance frameworks, and contractual protections to ensure AI is used responsibly.

The conversation highlights a broader trend occurring across industries: organizations are increasingly pushing privacy, security, and compliance requirements down through their vendor ecosystems. As privacy regulations continue to expand globally, companies are using contracts to establish expectations for third parties and create more consistent protections for personal data, confidential information, and AI-enabled workflows. Michael emphasizes that strong contracts remain one of the most effective tools organizations have for managing technology risk in a rapidly evolving environment.

By popular demand, Debbie Reynolds Consulting is now offering executive briefings on emerging data privacy risks and how companies can avoid them. To learn more, visit the Executive briefings page on my website.

Transcript

[00:00] Debbie Reynolds: The personal views expressed by our podcast guests are their own and are not legal advice or official statements by their organizations.

[00:11] Hello, my name is Debbie Reynolds. They call me the Data Diva. This is the Data Diva Talks Privacy podcast, where we discuss data privacy issues with industry leaders around the world with information that businesses need to know.

[00:24] Now, I have a very special guest on the show, a fellow Chicagoan and someone that I've had the pleasure with collaborating with over the years. This is Michael Booden. He is a senior Technology Council.

[00:37] Welcome.

[00:38] Michael Booden: Thank you, Debbie. I'm very excited to be here.

[00:41] Debbie Reynolds: Well, we've known each other for many, many years. We've spoken on panels together.

[00:46] We just run into each other at random events in Chicago. So we saw each other recently in Chicago at an event where both of us were speakers. And I'm like, hey, why don't you be on the podcast?

[00:57] And you're like, oh, I'm happy to be on. So I love your work,

[01:01] the way that you prepare for things, because you and I were speaking that day and you had all your copious notes with you.

[01:08] But also,

[01:09] I think the thing that fascinates me about you is your interest in privacy. So I know that your focus, a lot has been in contracts, but then also you've had to pivot or expand your work as it relates to technology and contracts.

[01:26] And so that may cover data privacy and technology,

[01:29] but give me a picture of your trajectory. How did you get to where you are now? And then how did privacy pique your interest?

[01:37] Michael Booden: Absolutely. So when I was in law school, I thought that I. I wanted to be a trial lawyer.

[01:44] And. But the one thing that I really enjoyed the most in law school was. Was writing. So whenever I get a chance to. To draft a brief or a motion in a writing course, I got very excited,

[01:56] and it was a way of at least demonstrating your.

[02:00] Your skills.

[02:01] And I was fortunate enough to clerk for two law professors.

[02:05] So somewhere there are two law review articles, and I'm a footnote in each of them for doing research and doing a little bit of writing for the law professors. And that led to me being chosen to be a clerk on the Illinois Appellate Court.

[02:21] And so I clerked for Illinois and Citolatomy Supreme Court Justice Justice Damos.

[02:28] And so my first year after law school, I was writing judicial opinions that are still in the books today. I learned how to think like a judge in that bowl, and that has served me well throughout my entire career.

[02:42] After I finished my clerkship, I joined a firm and would go to court and was very Excited about the potential to be a trial lawyer. But then I found out that these cases were so significant in terms of the complexity and the amount of money at hand, that would take me five years before I actually tried a case.

[03:02] So I ended up going to a smaller firm where I could go to court and represent individuals. And I learned to do commercial litigation and other kinds of litigation. And of course to write, that was always something that was very much desired wherever I went.

[03:16] People wanted me to draft motions for them and briefs because they knew that was a particular skill that I had.

[03:22] And ultimately I was representing companies in employment discrimination suits when I got the opportunity to go in house.

[03:32] And I became general counsel of a university whose biggest school was a medical school. And that's where I got introduced to other aspects of the law,

[03:42] such as drafting policies for the organization,

[03:47] conducting internal investigations,

[03:50] but also drafting contracts.

[03:53] And I remember the day that someone handed me a contract and I thought,

[03:57] this is very interesting,

[03:59] I wonder what you do with such a thing. And all I knew is that the contract shouldn't be vague or ambiguous.

[04:06] And I had learned that from some commercial litigation I'd been involved in where the language was vague or ambiguous.

[04:12] And that was an important thing for me to know.

[04:15] But there was a lot more for me to learn.

[04:18] So over the years, I basically self taught myself how to draft commercial agreements, whether they'd be simple or complex ones.

[04:25] And ultimately this led me to an interest in privacy law.

[04:30] And I became SIP certified through the International association of Privacy professionals, both in U.S. privacy law and European privacy law. Because I realized in drafting negotiating technology agreements, which has become my specialty, that was an essential skill set that I needed to develop.

[04:49] I needed to learn about the laws and weave them into the contracts I was drafting for my clients to protect their employees, to protect the clients that they were serving.

[05:00] And so privacy has just been something that has been on my mind for many, many years and developed my skill set essentially in terms of drafting and negotiating contracts, sufficient that for 13 years I've been an adjunct law professor at the University of Illinois School of Law where I teach a writing course to third year law students on how to draft and negotiate commercial agreements.

[05:27] Now I still use my litigation skills when I'm drafting and negotiating agreements because sometimes have conflict with a vendor, an attorney who's representing a vendor, and he or she will say, well, this is what this means.

[05:42] And I said,

[05:43] well, I know what you think this means,

[05:45] and I know what you think this means, but what is the judge going to think it means?

[05:51] The Language in the agreement can't be vague or ambiguous. It's gotta be something that the judge understands.

[05:58] And I'm a member of what's called the Federal Bar association,

[06:01] and most of the lawyers there are trial lawyers,

[06:04] but I've always liked their coe, and it's the meetings that they have. We have an opportunity to meet federal district court and appellate court judges who sit on the circuit court In Chicago, the 7th Circuit.

[06:17] And I met one of the judges, Rebecca Palmeier. She's, I believe, on senior status now, but at the time, I think she was a chief district court judge. And I told her what I did, and she said,

[06:30] so you don't want the language to be vague or ambiguous? I'm like, yes, you, Honor, that's exactly correct.

[06:36] So the first thing that I knew from litigation is it served me well throughout all this.

[06:43] And also one of my first meetings at the Federal Bar Association, I ran into a magistrate, Judge Kim,

[06:51] and I used to litigate matters before him,

[06:54] and I almost felt that he wanted to hug me.

[06:58] And he's from a different country and is not a very physically demonstrative person,

[07:04] but I used to file motions for summary judgment for him in front of him when he was an administrative law judge with the eeoc.

[07:12] And I would often get emails from him. He would say, Mr. Boudin, please send me the statement of facts in your motion for summary judgment in a word format.

[07:23] Essentially, motion for summary judgment asserts that there aren't any disputed material facts,

[07:29] and therefore, based upon the law,

[07:31] the judge can dismiss the case.

[07:33] There's nothing really for the jury to decide in terms of material facts.

[07:38] And when he would send me that email asking me to send the statement of facts in a word format, that's when I knew I was going to win the motion.

[07:47] And I would then, you know,

[07:49] two or three weeks later, I'd get the opinion.

[07:52] And I have to say, Judge Kim is a better writer than I am.

[07:57] He writes wonderful opinions, which is why he's now a magistrate and was the chief magistrate in the Northern District of Illinois. But I helped him avoid having to try unnecessary cases.

[08:08] And so that's why he's so pleased whenever he sees me, because I made his life easier, which is what I try to do every day.

[08:16] Debbie Reynolds: That's so cool. That's so cool. That's a great story.

[08:19] Well, tell me, how do you see privacy issues bubble up in agreements? I see this a lot, but I just want your thoughts.

[08:28] Michael Booden: Well,

[08:29] my core work is drafting, negotiating technology,

[08:32] and commercial agreements, which really puts me at the daily intersection of data vendors and privacy obligations.

[08:39] One of the first things I did for my company is I drafted what I call a cybersecurity addendum.

[08:46] And the cybersecurity addendum essentially addresses terms that may not be fully fleshed out by the vendor.

[08:54] And it details the data security protections that I expect them to provide from an objective perspective in order to protect the privacy,

[09:03] the information that we're going to be transmitting to that organization.

[09:09] And I also cover when I talk about my expectations of their data security protections. They're all objective ones,

[09:16] so ISIL standards and NIST standards,

[09:18] ones that there won't be any argument about what our expectations are and what we between parties, because again, I want to be clear what we want and what we expect.

[09:30] And if they can't provide it, then we will find someone else. So while it has their own way of vetting vendors from a technology perspective, and I'm not a technologist,

[09:41] but you don't have to be car mechanic to direct traffic.

[09:46] But from an objective perspective,

[09:49] there are all kinds of standards that the law provides to protect personally identifiable information,

[09:56] phi and sensitive personal information,

[09:59] and also the confidential information of our organization.

[10:02] So that's what this document was designed to do and to provide us with indemnity protection if there is a data breach. So we hope for the best, but we plan for the worst, and data breaches happen.

[10:15] So this document allowed me to be proactive in the representations and warranties made by the vendor, but their promises to us, but then to be rather active in asserting what we need to protect our clients, our organization, and our employees.

[10:34] And based upon that, I've now drafted other addendums. For example, I drafted an AI addendum,

[10:41] the same kind of concept where the AI vendors don't always particularly address the concerns that are necessary to protect the privacy and security of the information that we will be sending to that organization for processing and storage,

[11:00] and particularly related to outputs as well, and how that information will be maintained. And for transparency's sake, our clients at the organization. My company is an insurance broker,

[11:12] one of the fifth largest insurance broker in the world with 21,000 employees.

[11:17] Our clients started asking us,

[11:19] what are you doing with our data vis a vis AI?

[11:23] And so I drafted a client addendum that we now then send to clients that explains our policies and procedures in processing their data so there is complete transparency between us and our clients so they understand how we're using AI to process their data and to provide them with adequate data privacy.

[11:46] Protections and data security protections.

[11:50] And the last document I'm going to mention is I drafted an amendment to our outside counsel guidelines that also addresses those same issues.

[11:58] How is the law firm going to utilize AI in providing us services?

[12:03] And one of the most important things is that you don't use consumer AI tools that don't have the proper data security protections. In processing our data,

[12:16] we only want the data to be inserted into privately licensed tools. Our organization uses Quad, that's our basic general reference AI tool,

[12:28] but it's privately licensed. All the information we provide that our employees provide is protected. There's a ring around the fence. So Anthropic cannot use that data to train its tool.

[12:42] It can only utilize it to train tools that are dedicated solely to the organization.

[12:49] And I know we have those protections in writing because I negotiated the contract with Anthropic.

[12:56] Debbie Reynolds: And I think that's another reason why Anthropic had this massive growth,

[13:01] right? Because people want to use the tools, but they don't want their information to end up in these public tools and be spit out as. Because we saw this early on where people were using the publicly available tools and people were putting their company proprietary and confidential information in there and people were able to prompt it and get that information out.

[13:24] Michael Booden: And so, and we use that tool every day. I mean more and more are,

[13:29] I think 60 to 70% of our employees have used Quad at least once and at least 30% of them are high volume users. And they're coming up with new ways of using AI every day to make their jobs easier.

[13:44] And we're not looking to reduce positions. We want to empower people to be more effective and efficient in doing their job. So the low value work can be work that they can have Quad help them with, whether it's organizing information or providing specific information that has a direct impact on their job.

[14:02] And as a person who's taken a lot of depositions,

[14:05] I'm very good at asking questions.

[14:08] And what I've found using Quad is the more particular I am and describing exactly what I want, the better output I got.

[14:17] So. But it's been a great tool that we've been able to utilize to,

[14:22] to help our employees become more efficient and effective.

[14:26] And that's my hope that more and more people, ordinary individuals,

[14:31] can get to that place.

[14:33] Debbie Reynolds: I agree with that one thing. I just want your thoughts on this and this is my experience, but I want your perspective on this.

[14:42] So I know there are just so many,

[14:45] especially in the US there are so many new states that are passing these privacy laws and they are creating a lot of agita for companies trying to navigate all of that.

[14:57] Right. But what I'm seeing is that because I work a lot with companies on technology and contracts as well, from a technicals perspective,

[15:08] what I'm seeing is that companies like yours are pushing down requirements to third parties.

[15:15] And so these third parties, they may say, well for example, let's say I don't do business in Europe, but you are a third party to a company that does business in Europe or you're a third party to a company that has employees in California.

[15:29] So what I'm seeing from a contract perspective,

[15:32] companies forcing other third parties to align with what they have to do.

[15:39] And for me, I think that's probably even better than a person getting all tangled up in the log. Cause the companies can tell you this is what we expect and they can make it more tangible and plain for them.

[15:51] But what are your thoughts?

[15:53] Michael Booden: Well, the first thing I want to say is that I agree with the sentiments that you've expressed. Exactly. But the first step in this AI journey for me was two and a half years ago I realized that our employees at some point were going to want to utilize AI to help them do their jobs and that we did not have a policy for that.

[16:13] And knowing that there are these public consumer facing tools that have no protections for the information that you're going to be putting in terms of privacy. People put in their names, Social Security numbers, all kinds of information and then that information is available to all others.

[16:33] Somebody I was recently giving a presentation and someone said, well, how is it that the confidential information of my organization is exposed if I put that in an AI tool?

[16:44] And I said, well,

[16:45] think of an AI tool as a book.

[16:48] And now you've put that information on a page in that book and your client's competitor may ask the same question and then get an answer based upon the learnings,

[17:00] the non public information,

[17:01] the strategies of your organization that are now been inputted into that AI tool. So I decided that we needed a policy for our employees to address their use of generative AI in the workplace.

[17:14] And at the time, because this was such a new thing, there weren't any real forms I could just copy off the Internet. So it took me three months of research and two months of writing and the result was a two and a half page policy addressing AI usage, generative AI usage in the workplace.

[17:31] And it was an immediate hit with the head of our IT department.

[17:36] And we adopted it basically as I've written it and I made adjustments as we've gone along,

[17:41] but that's been the first step along our organization's governance process. And now we have an AI generative, AI Governance committee. I'm on that committee.

[17:52] I'm also an AI champion for the organization.

[17:55] And we have conducted training for employees on how to use Quad as well as on the policy, the do's and the don'ts to protect our clients, their employees and their clients sensitive information,

[18:10] whether it be PHI or personally identified information.

[18:15] And then based upon that,

[18:17] I use that as a starting point to draft those other policies that I talked about, the AI addendum and the outside council guidelines for using AI, as well as the client AI addendum, which we provide if our clients request it.

[18:33] And so when we're asking our outside counsel, we're asking other AI vendors,

[18:39] whether it be Anthropic or OpenAI or hundreds and thousands of other AI vendors or SaaS providers that have an AI component, we're asking them to meet certain restrictions and goals and guidelines.

[18:54] These aren't things that we're not doing ourselves. We're just flowing down from our organization. We're flowing these restrictions, these guidelines, these requirements to comply with all these various laws, we're just flowing them down to those organizations that are supporting us and helping us provide services to our clients.

[19:13] But it's a very difficult process to put together policies and addendum like this because there are, as you mentioned, so many different laws.

[19:24] There's an email I get every day that keeps me up to date on all the new laws that are being introduced in all of the state legislatures. And because my client, my company,

[19:33] has operations in Canada as well as the US I have to pay attention to the privacy laws in all the Canadian provinces, whether it's British Columbia or Alberta.

[19:44] And I learned something I did not know, which is that if you want to buy auto insurance in Canada, you have to almost be almost forced to buy it from the government.

[19:54] And the government policies often have these tools that you have to put in your car that.

[20:00] And so the government knows when you got in your car, how fast you drove, where you went to,

[20:06] all these details,

[20:08] very intimate, private information.

[20:11] And they have rules that dictate what you can and can't do with that information.

[20:16] And the challenge for us is because we often will have input into Quad from our employees in Canada about Canadian residents.

[20:27] Most of these laws have restrictions that say that either prohibit you from sending this kind of sensitive personal information about Canadian residents outside the country or have significant restrictions on them.

[20:41] Well, Anthropic is in the United States.

[20:44] So if you're typing an input into quad, it's going to America, it's leaving Canada.

[20:51] So in trafficking policies for our organization, we have to take into consideration not only all of the state laws, whether it's Colorado or Oregon or Illinois or California, the country of California, as lawyers call it, we have to write these policies and procedures to that highest level so that we're able to protect ourselves from a compliance perspective and by organizations considering issuing an ipo.

[21:18] So investors are asking us, well, what is your AI policy?

[21:24] What is your governance structure like? How do you protect the information that you're inputting into AI tools?

[21:30] So this is something that not only that your customers want to know about and your private investors, but public investors. This is now a check mark that 10 years ago didn't exist.

[21:42] Everyone wants to know what you're doing to protect their information and how you're using AI when you're involved in that process,

[21:50] using it.

[21:50] Debbie Reynolds: And it's funny because I think a lot of people say, well, we don't have AI laws in the us I say, but we have data laws and AI uses data. So data is the food of AI.

[22:04] Michael Booden: So exactly.

[22:06] Debbie Reynolds: That means, yeah, there is regulation. You may not think of it the same way.

[22:11] And actually I think it's smart the way that you're approaching it. And this is the way that I advise companies to approach AI. Early on I saw a lot of companies like we're doing prohibitions like you can't use AI at all.

[22:23] And for me, I don't think abstinence is education.

[22:29] Michael Booden: It is. And the reality of it is that unless you're a one person company,

[22:33] your employees are going to want to use AI. I use it every single day.

[22:37] And honestly now I don't know what I would do without. It just saves me so much time. But without careful restrictions on your employees data, your client's data particularly, that's already protected by state and federal laws,

[22:52] you're in danger of violating rights and not being compliant and nobody wants to be in the penalty box.

[22:59] Debbie Reynolds: Totally.

[23:00] So what in the world is happening right now that's concerning you? Like in the privacy or data space that you see, you're like, oh wow, I'm kind of concerned about this.

[23:09] Michael Booden: This.

[23:10] Well, I think you touched upon it that there is such a disconnect and variability between all the different laws in each of the different states.

[23:22] It really makes it when it touching upon not only just privacy, but AI obviously as well,

[23:27] that it's making it almost impossible for individuals, even lawyers, to figure out what the jigsaw puzzle looks like on a day to day basis in order to be in compliance with all these different various state laws.

[23:43] And there's old joke that privacy lawyers talk about how there's going to be this federal privacy law someday and we don't even talk about it anymore because we've talked about that joke so many times.

[23:55] It's just not even relevant because we know it's just never ever going to happen.

[24:00] And EUAI Act I think has a lot of strengths and our state laws have been highly influenced by it and our practices as corporations as well,

[24:13] we don't have that. And I think that it's impacting individuals on a daily basis. They don't know what their rights are.

[24:22] And because their rights are so disconnected, it's almost solely based upon where they live. They don't know how to protect themselves.

[24:31] And AI should be an empowering tool.

[24:35] I know that from talking to some of my colleagues at the Federal Bar Association.

[24:40] Judges are using AI to draft opinions and many of them are excited by the fact that there are pro se complainants using AI to previously do things that they couldn't do because they don't know lawyers or they can't afford one,

[24:56] that they can use AI to draft a complaint and other court documents that they need in order to litigate a matter and represent themselves in court and then get redressed for valid claims.

[25:10] But many people don't really know how to use AI. I think AI should be something that is taught in elementary school as part of reading and writing.

[25:20] Both the good,

[25:21] the dangerous,

[25:23] but then the beneficial aspects of it. How it can empower people to become artists and writers and scientists and in whatever profession individuals decide they want to explore during their lives.

[25:36] But without any teaching about both the dangers as well as the benefits,

[25:43] we're really creating this wormhole, which is very scary to me.

[25:47] Debbie Reynolds: I agree with that. I think education,

[25:50] both of us are educators, so the education and knowledge is key for people to really be able to understand it. And I am personally excited about the fact that pro se litigants now can help themselves better than they were before.

[26:05] Because I know especially with the formatting of documents that go to judges, it makes their jobs easier.

[26:12] Those things are formatted in a way that the judge expects. So I think that's very important.

[26:18] Michael Booden: Yeah. So I. And. But again, every day you read about somebody being influenced by an AI tool to do something that's reprehensible and it's just very Sad. And I know children who, they're glued to their phones and their computers.

[26:34] And you just say, you know, you don't have no idea, God knows what they're doing and how they're interacting with these games and tools. How does that affect them?

[26:44] And that's why lots of schools are saying, well, you've got to put your phone in bag and you can't use it during,

[26:51] during the time you're in class.

[26:54] And even the class that I teach at a law school, I tell my students,

[26:59] you can use a laptop. I understand that you want to take notes.

[27:02] And I'll have typically 14, 15 students in my class.

[27:06] But I'll tell them, if you're not, if you're, if you're doing something else on that,

[27:10] on that computer,

[27:12] I will know I'm paying attention.

[27:15] And when you're laughing and I haven't told a joke or done something,

[27:18] you know, crazy,

[27:20] it's kind of a tip off.

[27:22] So quest participation means you're focused. Not only you're focused in the class, not only to help yourself, but to help others. Because this is an interactive enterprise. We're all learning from each other.

[27:34] Debbie Reynolds: I want your thoughts here now.

[27:37] Especially when generative AI first burst out into the scenes with people.

[27:41] I know a lot of educators were concerned about people using AI in their class. And for me, I was never concerned because I was like,

[27:50] the things I'm going to ask you, AI cannot help you with. So I'm not asking you if George Washington chopped down the cherry tree. Right.

[28:01] So that never concerned me. But what are your thoughts or what do you tell your students? I'm curious.

[28:07] Michael Booden: I discuss this the first day of class.

[28:10] We talk about basically everything they're going to learn and how they can succeed and how I'm going to grade them and what we're going to cover from a subject matter perspective.

[28:20] But I spent a significant amount of time talking about the use of AI to answer homework in class at my school. The use of AI in producing homework. It's an ethical violation.

[28:37] And I'm very clear to them that this is something that is not acceptable.

[28:44] And if I believe that they've used AI to produce homework, then I will alert the dean and they will have a very, very uncomfortable and difficult conversation.

[28:55] And that is not something that I want for them as well as failing my class,

[29:01] AI, at least in my profession,

[29:04] for me, it's a great tool.

[29:06] But I developed instincts and I've learned a few things in drafting and negotiating thousands and thousands of agreements.

[29:16] And an attorney who hasn't developed those instincts,

[29:20] hasn't sorted out what's best for their client to fish from the foul,

[29:26] the AI tool.

[29:28] They have no idea how to evaluate that output.

[29:31] When you're riding a bike,

[29:33] you're going to slip and you're going to fall, you're going to skin your knee. It's an experience.

[29:38] You learn from that experience.

[29:40] And the same as a law student learning how to draft and negotiate contracts for a partner or for a corporation. When they're asked to do so,

[29:50] they may get a great answer from quad, but they won't necessarily know why that is a great answer and they won't know when they're getting an answer that isn't correct because they haven't developed that instinct themselves because they haven't jumped on the bike and fallen off and learned how to ride and ride the bike the right way.

[30:10] And I also tell them because they may be marking up and negotiating a non disclosure agreement or a master service agreement, a statement of work, an agreement that a corporation or a corporation is asking a vendor to provide services.

[30:24] The final is even interesting. I have them, they have to negotiate a G suite agreement.

[30:30] So I pretend that one student represents the university that's interested in getting to G Suite, Google Docs and Google Sheets from Google and the other attorney represents Google.

[30:43] And I utilize a template that I get off of the Internet from Google. I could learn how to negotiate those kinds of agreements by just getting an answer.

[30:53] And I also tell them, I run all these assignments, the documents that I've given to you,

[30:58] the questions that I'm asking of you.

[31:01] I've utilized all these tools so I know what the tools are going to say.

[31:05] So when you give me an answer that's produced By Claude or ChatGPT or Gemini,

[31:12] I'm going to recognize every single word of it. So that's. If you're just looking for an answer,

[31:17] you're wasting your time taking this class. We're here to learn, right?

[31:21] And utilizing these tools at this stage of your career. This is not appropriate and it won't help you other than perhaps get a better grade or perhaps not get a grade that you don't want.

[31:35] Debbie Reynolds: One thing that you touched on that I wanted to talk with you about a little bit more depth and it's actually something that I've seen over the years a lot in privacy and that is the influence of the European laws and frameworks on us.

[31:53] In the US even though we don't have a comprehensive privacy federal law,

[32:01] the European laws are influencing us about how States are looking at things how corporations or companies looking at things,

[32:09] because in my view, it's like if someone has a choice to look at a framework or look at nothing, they will look at a framework as a starting point. But what are your thoughts?

[32:21] Michael Booden: I think the facts speak for themselves. I mean, the concept of a controller and a processor comes from gdpr.

[32:29] And without that concept of who controls the information and then the party or organization that processes that information, we wouldn't have that without gdpr.

[32:42] So just as GDPR has influenced California and other states and federal organizations in drafting and legislation that we all must comply with the different sectors,

[32:55] like the Department of Financial Services, which affects our organization because we're considered as an insurance broker, a finance organization,

[33:03] they have all kinds of guidance on adequate data security protections to protect your client's information.

[33:10] And we have to notify them within 72 hours of a data breach.

[33:14] So there's a whole regime.

[33:16] All these structures, whether from California to New York and all the states in between,

[33:24] they've been influenced by gdpr.

[33:27] And the same with the EU AI Act. I believe that has had a significant influence on the laws that legislators are proposing and those laws that have been. That have passed.

[33:39] Debbie Reynolds: I think so too. So that. That's the irony of it, really.

[33:43] So I know there have been a lot of talk about, oh, we don't want AI regulated because we don't want to stop innovation.

[33:51] And it's like, well, it is regulated in some places. And because there is no other place to look for a framework, people are heavily looking at the EU AI act as they had with the gdpr.

[34:06] So I think it'll just continue that way for now.

[34:08] Michael Booden: Well, I think the facts speak for themselves.

[34:11] I think if you look at organizations that are part of the AI pipeline,

[34:17] from the companies that make the processing chips to the data centers,

[34:22] to the companies themselves, like OpenAI and particularly anthropic,

[34:28] and even Google with their Gemini tool, they're thriving.

[34:32] And organizations are adopting and utilizing their tools every day.

[34:38] With 21,000 employees, we are one of Anthropic's largest single clients,

[34:43] and we are thrilled to have them as part of our team.

[34:47] And so the facts really speak for themselves. Individuals are using AI,

[34:52] organizations, corporations are using AI, the government is using AI.

[34:57] So on one hand, the government might say, well,

[35:00] we don't want to use Anthropic because of some security issue.

[35:03] And then you have other parts of the government saying, oh, no, we need this in order to do our jobs.

[35:10] And the Department of Defense has been using Anthropic, and I expect other AI tools in the conflict in Iran.

[35:18] So the facts speak for themselves. We're not the government,

[35:22] individuals, corporations. We're using AI and the lack of regulation hasn't stopped us, and nor has the regulations that we have to comply with. We just have to follow the roadmaps that we're given.

[35:36] And because there's no universal law, which is, I think, is the big hole, that would really be a next big step forward for all parties.

[35:46] Debbie Reynolds: Well, that's a good segue to my next question.

[35:49] So if you're in the world according to you, Michael, and we did everything you said,

[35:54] what would be your wish for privacy anywhere in the world, whether that be regulation, human behavior, or technology?

[36:02] Michael Booden: Well, I really think it's the same that I've already mentioned. I think the use of AI in particular,

[36:08] it has great benefits for individuals and for organizations,

[36:15] but particularly for people on the street. We really need to provide them with education so they can utilize AI to their benefit and find ways to avoid the negative influences that it has, particularly on our children, who can be easily influenced by a tool that really, really, really, really,

[36:37] really wants you to like it.

[36:39] Every single time you ask a tool to provide you with output, it's going to ask you, how can I help you in other ways?

[36:47] And it'll suggest ways,

[36:49] but they really want you to be connected to it.

[36:52] So there are dangers in that.

[36:54] And there are no parents that are monitoring this sort of thing hanging over children's shoulders 24 7.

[37:02] So if it was the world according to Michael, we'd have consistent regulation that would apply to all individuals in the United States.

[37:10] Congress could get their act together and come up with reasonable compromises that are comfortable with industry and corporations and with individuals and rights groups,

[37:21] as well as having education of our children on how to utilize AI in the best manner possible and regulate the AI tools so that there has to be ways for these AI tools to sense when an individual is in real trouble and seeking answers in ways that are going to harm other people.

[37:44] The first rule as a physician,

[37:47] and it also applies as a lawyer, is do no harm.

[37:50] So that really has to be a guiding post for the organizations that are providing these AI tools. And I'm not sure that it is.

[37:59] I certainly haven't seen it articulated anywhere.

[38:03] Debbie Reynolds: That's a good wish.

[38:04] I wish that as well. Oh, my gosh.

[38:07] Well, thank you so much, Michael, for being on the show. This is fantastic. I really enjoy your work and enjoy collaborating with you and you're wonderful. So, so thank you.

[38:17] Michael Booden: Well, the feeling is usual, Tabby.

[38:19] It's been a real honor to be on your show, and I'm a huge fan.

[38:24] I listen to it all the time and I learn things, which is fantastic,

[38:29] entertaining, and educational. You don't get better than that.

[38:33] Debbie Reynolds: Oh, my gosh. Thank you. Thank you for your high compliment. I really appreciate it.

[38:39] Michael Booden: Well, it's well deserved. You know, I'm a straight shooter. You are?

[38:43] Debbie Reynolds: Totally, totally, totally. Well, yeah. Thank you so much for.

[38:47] For being on the show. And I love the deep dive on the contract stuff. I think it's fascinating. But thank you again.

[38:53] Michael Booden: Thank you, Debbie. My pleasure.

[38:55] Debbie Reynolds: All right, talk to you soon. Bye. Bye.