The Data Diva E11 – Beth Winters and Debbie Reynolds

Debbie Reynolds "The Data Diva," talks to Beth Wolfson Winters Marketing Solutions at Aparavi. We discuss the impact of Data Privacy on Marketing, career shifts that involve Data Privacy, consent versus notice for global data privacy approach, data privacy policies, types of data privacy technologies, keeping track of CCPA and CPRA data and compliance issues, the challenge of Big Data and Big Data insights, and her wish for Data Privacy in the future." 

Transcript

Data Diva Beth Winters

https://www.aparavi.com/

36:34

SUMMARY KEYWORDS

data, people, law, understand, privacy, attorney, companies, happening, change, insights, marketing, business, cookie, compliance, organization, big, working, implement, legal, challenge

SPEAKERS

Debbie Reynolds, Beth Winters

Debbie Reynolds  00:00

The personal views and opinions expressed by our podcast guests are their own and are not legal advice or official statements by their organizations. Hello, this is Debbie Reynolds of "The Data Divas Talks" Privacy Podcast, where we discuss Data Privacy issues with leaders around the world for information that businesses need to know now, today, I'm very happy to have a special guest with me today, Beth Winters of Aparavi.

Beth Winters  00:35

Hi everybody. Thanks so much for having me, Debbie. Glad to be here.

Debbie Reynolds  00:39

We collaborate on content related to Data Privacy. And I have been cooking up this podcast for several months. And I thought, wait a minute, we should do something together. Not so we do this.

Beth Winters  00:53

I always love our conversations. And I'm delighted to just have another opportunity to talk with you.

Debbie Reynolds  01:00

So you're in marketing at Aparavi, and maybe you could describe a bit about your role there. And then also I want to talk a bit or have you talk a bit about something you said to me once about being a recovering attorney. So talk about your transition to your career and what you're doing now.

Beth Winters  01:21

Sure, absolutely. Well, I started off going to law school, right out of undergrad, kind of knowing, not knowing what I wanted to do. But I wanted I was interested in intellectual property law, and specifically working with creative people. So in the copyright and trademark space, I did a concentration in intellectual property law at Boston University, and did some work with volunteer lawyers for the arts up in Massachusetts, started doing some webinars and articles on topics in art law, as well as copyright and trademark law related to artists, a little bit of estate planning for artists. And while I really enjoyed the people I was working with, I loved working with creative people and helping them out with their legal issues. I found that the work itself wasn't as engaging to me as the marketing side of things. So I started transitioning into marketing after practicing for four years. I graduated in 2009. So this was the last recession. And that was kind of a difficult time anyway, for me as an attorney trying to find my way. I was kind of glad for the opportunity to obviously follow my passion in terms of art law and copyright and trademark law. But having that easy out as well was was nice. I made that transition into marketing. After about four years, I moved back to New York, moved to New York, so I could do marketing full time. And I was working with I was a healthcare practice doing their marketing, decided I wanted to get back to tech and working with what I had, what I had originally drawn me to the law was, you know, working with creative people working with new innovations, and protecting those innovations. But from this from the marketing side, so starting to promote those innovations as well. To do that, I went back and got an MBA at the University of Texas here in Austin and really was excited to make that pivot into Product Marketing, which I felt took a lot of the skills that I had as an attorney, where you need to be able to make a compelling argument and anticipate objections, think about what your audience is and what they need and try to be specific for them. So right out of the MBA program, I started working with a startup here in Austin called Disco. And that's a legal tech company in the eDiscovery space. I was really enjoying bringing my subject matter background as an attorney, working in working with a legal tech company, as well as my passion for marketing. It's been a great combination for me, and I worked with Disco for a little while, worked with another eDiscovery company, as well. And now I'm with Aparavi, which is more of actually an IT product, but it has a lot of applications within Data Privacy and compliance, some applications for eDiscovery. So it's been a great fit for me to be able to write about those subjects and have them bring in my background as an attorney. But think about the different audiences that our product is geared toward both in the business community as well as legal and compliance.

Debbie Reynolds  05:29

So I feel like you, you have exposure to privacy in at least two ways that I can think of. So one definitely has a product that can help people with a sort of privacy issues navigating in terms of being able to locate data and be able to take action on data. But then also, from a marketing perspective, where I feel like especially, you know since the GDPR has come out like the marketing folks, I feel you kind of bear the brunt of trying to adjust to all these cookies and all this other stuff. So let's tell me a little bit about your feeling about that.

Beth Winters  06:08

Well, I think it's a really fascinating space to be in right now. Because the landscape is changing so quickly. There's a lot of new laws that you need to be aware of both as a marketer and as an attorney, if you're an in house counsel, so it's been fascinating for me to have that front row seat to see all the changes coming down the pipeline, starting with GDPR CCPA. Now, the CPRA and different states are starting to adopt their own laws. So I love just having that ability to always learn new things. But I think it's also important as a marketer to be flexible and adaptable. So you need to be open to changing and using new technologies. And in my role right now, we are working on a website redesign. And we are starting to make sure that our website is going to be in compliance with these new Data Privacy laws with the ADA accessibility requirements. So it's interesting for me both as an attorney and as a marketer. I think it's. There's a lot to absorb and a lot to a lot to know. And it's hard to piece it all together. But once you do, it's very rewarding.

Debbie Reynolds  07:43

Yeah. I don't know. I think one thing that happened around the time that GDPR came out. I'm a secret webmaster. I don't typically tell people that. But because the backend of how things work and how the data flows work has always interested me. But one thing that has always annoyed me is when GDPR came out, all these companies start throwing out these cookie banners. So mostly, it was because, at that point, a lot of companies couldn't tell whether a person was from the EU or not. So that means that everybody likes all these cookie banners. And they weren't there aren't any laws here to say you have to do that. But you know, I feel like even when I'm in the US, I get way more cookies now. Yeah, alerts than I do when I'm out of the country. Because at least in the EU, they can only ask you some things a certain amount of times. Can I ask you like 20 times?

Beth Winters  08:40

No, it's not. Yeah, now it's every time you go to the webpage, like the homepage, or go to the next page, it's asking you for another cookie alert? Yeah. Yeah, it's, it's, it's pretty annoying.

Debbie Reynolds  08:51

It's very annoying. I wish we can get past that. Because especially in the US, we were more when I talked to my European folks, I have to, you know, explain to them they the US is more of a notice country, as opposed to a consent one. It's like, we had this thing in Chicago where many years ago that some ice fell off a building in Salt Lake now a lot of the big buildings, they have signs like beware of ice falling, you know, so it's like, they don't actually fix the problem. Yeah, they put a sign-up and say, oh, watch for falling ice or whatever. So you can do almost anything here if you give people notice. And it's not really you're not asked to consent. Like you'd opt out like there. There aren't a lot of things where they force you to opt-in, you know, here,

Beth Winters  09:44

right? It's more of an opt-out in the United States, whereas Europe is more opt-in.

Debbie Reynolds  09:49

Yeah, totally. So it's all funny because when I talk to my European people, especially I work with companies that are like in Europe, they're trying to move to different markets. So a lot of I don't understand about oh, we have to get the person's consent like no, you actually don't. You just have to let them know. That's pretty much it. That's how things go. It's like do at your own risk. But yeah, I'm hoping that people that are in the US, we don't need me. Jesus, these ridiculous cookie banners are outrageous. There are no laws here for that.

Beth Winters  10:23

In the US, I think we've always had a lot of contracts. It's like such a contract-based society, where you have to sign away your rights every time you want to do something. And people are kind of used to it here. They're just like, okay, I'll just click this and not even read it. And there's, you know, you have that with any software, like the clickwrap and the shrink wrap notices, it says just to scroll down and read the whole thing, but nobody ever does. So I think it's just like, one of those parts of life that everybody is used to now. So we don't notice it as much until you go to another place that doesn't require it.

Debbie Reynolds  11:05

Yeah. Well, Apple is rolling out for their people who put apps on their platform that they had to use this nutrition label that's supposed to simplify what their privacy stuff is like. So I would love to see more stuff like that because I don't think anyone wants to read ad pages or privacy.

Beth Winters  11:24

No, I mean, and I've seen that here. And in my job, as the solutions marketing manager will get stuff back from our outside counsel and the contracts that they sign up, they're just so long, and it's a lot of legalese. So they're overly complicated. It's just a lot more complicated than it needs to be. And things are hopefully moving back toward, you know, plain English and making things understandable. That's the whole point of a lot of these laws is, and Data Privacy is to put people on notice. So they have to be able to understand what it is. They are signing. They're signing away,

Debbie Reynolds  12:08

You know, what they agreed to, like, you know, like, I have friends that have kids, and they, you know, let them use phones and apps and stuff like that. And it's like, you know, you just download whatever, play whatever. But like, if your kid told you, Hey, I'm going to go down, I'm going to go down the street and find this 80-page contract that didn't read this gonna possibly impact my life in the future in ways that I don't think about, like, you'd be like, wait a minute, this is not, wait, wait.

Beth Winters  12:37

Right. And I and that's what's interesting about the new unit, the California laws, they have the rights for minors, so you're not supposed to sell the data of a minor under the age of 13, you're not for a minor under the age of 16, you need to have parental consent. I mean, how do you enforce that? How do you really implement that? It becomes really, really challenging for companies.

Debbie Reynolds  13:05

Yeah. So this, I think, is funny. So the CCPA. And now, the CPRA garner a lot of interest internationally. So I have people, and you're talking about the CCPA more than people in the US, because they're very interested in what's happening, especially because Silicon Valley is in California, and a lot of the things we are going to have to deal with privacy regulations, they're their customers are wanting them to make it easier for them to comply. So I think that you know, besides the legal part where people are trying to comply with CCPA, there's also kind of a product part of it, where you're saying, Okay, now because we know we have CCPA people have these requirements, let's make it easier for them to get the data that they need to comply. So what are you seeing

Beth Winters  14:04

In our product, we are all about intelligence and automation. So we want to give you that accessibility into your data, the ability to customize and to take batch action on your data. And because of these new regulations, there's a lot of startups who come forth and say they have all of the answers. And it's hard to compare them on the business side to know what one does versus another and how they help because they're not going to all help with all aspects of all the Data Privacy laws. So there are those cookie companies that you mentioned. There's which is not, and I don't know rocket science, I think. There are also other types of products that are geared more toward it and understanding In your data on being able to search for data to comply with a DSAR request, and that's, that's like what we do, then there are just workflow companies that try to make sure when you get a decent request that it's sent to the correct department. There are those mapping types of programs that we've talked about before that really are more of a manual process where you're visualizing where your data lives. But you have to manually enter what that data is. So it's, it's getting to be a pretty crowded space. And right now, with the pandemic, I think some of these companies are consolidating, and we're seeing a few leaders pull forward. So it's, it's definitely still in flux. And it's still a newer, emerging market. And just since GDPR, really. So when that was, you know, passed in 2018. So it's only been two years that this market has kind of emerged. And I, I love having that front row seat just to see what everybody's bringing to the table.

Debbie Reynolds  16:17

Yeah, I wonder. So CCPA is very, very confusing. So CCPA is funny. So CCPA is extremely prescriptive in ways that people are kind of annoyed with, like it says, Put this button on your website, and it has to say this, where GDPR isn't as prescriptive, and people are upset about that. They said, You know, I don't know, I can't really, like interpret what that is, but from your point of view your clients, because the CCPA, I feel is, you know, to me, it's a tough regulation, because they're just so many parts and pieces. You know you have to figure out, like, you know, does it apply to me? Does it not apply to me? You know, if I make more money, will it apply to me? If I have, you know if a customer moves? You know, they were in Illinois yesterday, now they're in California knowledge type stuff? What what are you seeing as people's biggest data challenge or talent in general with CCPA? Currently,

Beth Winters  17:30

In terms of data, I mean, it just knows what you have that's really challenging people to have trouble locating the unstructured data, which you know is the data that sits outside of databases. There are so many different data sources and storage locations that businesses have. So there's not only are there multiple clouds that host their data but then there's the on-site on-prem storage, there are endpoints for all of the employees, each employee has their own computer and workstation where they are probably downloading things that they're not supposed to. So it's really challenging to have that oversight and have that visibility into what you have and where your potential risks are. And I think it's also really difficult to take action on that. Right. So a lot of some companies just will tell you what the problem is, but they don't tell you how to fix it. And that's that that isn't really that helpful. So you need to be able to, yeah, and not just take not just know what the risk is, but know how to fix it.

Debbie Reynolds  18:52

Yeah, it's like, beware, here's a pothole don't fall into it, you know?

Beth Winters  18:59

Like those fault, those falling eyesight?

Debbie Reynolds  19:04

Yeah, I agree. Yeah, so I feel like I don't know when I saw the CCPA came about, you know, in a very unusual way, with it being sort of a threatened initiative, and then they have to create a law, and they sort of tried to win all the law down and now we have CPRA, that was a ballot initiative. So, even though they can change it, they can make it less stringent than it is. So as you know, California has been really interesting over the years.

Beth Winters  19:37

Yeah. And I mean, even like there have been changes to the CCPA just since it went into effect in January. I mean, it hasn't even been a year and changing the law already. So it's a lot to keep track of, and customers are, are having trouble. They don't know what laws apply to them necessarily. Because there's, it depends on the country that they are operating in where they're where their customers are, which is not something that legal, or has access to usually it's they don't always have access and access to the data and to the same business resources that other departments have. So they need to go through it and make a request. And it becomes really complicated to get something done when you're working across different departments in an organization without strong leadership at the top. From a Data Privacy perspective, who really cares about it?

Debbie Reynolds  20:38

Yeah. Well, the CPRA is now going to be in effect in 2023. What big changes do you foresee? Because of the CPRA? We haven't yet seen the CCPA? Is that a hard question?

Beth Winters  20:55

No, no, I, I think one of the new unknowns is this, this new enforcement agency CPPA. So we don't know what they're going to do they have the ability to make new laws and give new guidance, which I think will be helpful. I mean, I think we were we like having a more prescriptive approach here. Knowing you know what we can do and what we can't. So the other concern is that a Federal law will come along and replace CPRA. And then we're going to have to throw that out the window. And all of the other state laws so so it's, there's, it's, it's really a lot of unknown. And that's, that is a big challenge. How do you stay flexible? And how do you implement a solution that can adapt to all of these new changes that are possibly coming down the pipeline? But from my perspective, I think the CPRA it's clarifying a lot of things that CCPA didn't get right the first time, or that was too vague. It's also, especially in terms of litigation, right? How can you bring a lawsuit under this under the CCPA? It hasn't been clear that it's still making its way down the pipeline. If that's a little bit clearer and CPRA, they talk about what some of the definitions are more or this there's a new definition for sensitive, private information, sensitive personal information. So I like that there's more, there's a little bit more clarity. But like I said, there's more complexity and an additional unknown. Yeah. But then it was very

Debbie Reynolds  22:55

eye-opening or eyebrow, raising the CPRA, to me was the ability for a person to be able to request the edit, update to their record, right? I tell someone else about that. They were like, oh, this is insane. So, people who are under GDPR, they're familiar with it because they're already in there. And for the California law was purposely left out, because they knew it was like super hard, like, it's easier to delete something and to say, here's the data, how can you change it and a lot of companies don't have like the staffing and the process and procedure in place to actually be able to serve up that data in a way that person can edit it. So to me that that's all the more reason to go through your data right now and be able to get rid of things that you don't need. Because you know, I asked a cybersecurity person to say this made perfect sense is like, you know, the less stuff you have, the less stuff we have to protect, right, less stuff can have less. They are privacy issues that you have, especially, go ahead.

Beth Winters  24:09

No, I think attorneys are becoming more understanding of that there has historically been this mentality around big data, that the more, the better, that you know, let's keep everything forever because we never know when you're going to need it. But being able to winnow that data down into what is necessary, what is usable, what suits your business purpose, makes, makes a lot of sense to me. So there's this now, this proportionality requirement under the CPRA, which you have to make sure that you're the data that you are collecting for a specific purpose. It's proportional to the need of the business need. That makes you know that that makes sense to me. And I think it speaks to this change in perspective about data. It's not something that you should be hoarding. It's about something that you should be using intentionally to some sort of end, like, what are you going to do with the data? Why? Why else? Would you collect it?

Debbie Reynolds  25:12

Yeah, I feel like this really hits on an issue in the legal space. I feel like we have that kind of eDiscovery all the time. That's like keeping stuff away way too long. Even though people make a lot of money from that, because you store stuff, and you have to pay for it, obviously. But, you know, the idea that it's just sort of open and I don't know, you know, legal holds go on for years and years and years. No, really good reason. And then just the cost associated with that, I think, people, it's funny. So it's like, like, you have someone who has a case that is really hot and heavy in the discovery stage. And then they like to go on to like, whatever the next case is. So it's almost like a case that has a lot of data. It's like an abandoned amusement park. Right. So it's still all stuff still there. But no one's actually using it. So

Beth Winters  26:09

right, they put it into cold storage. You know, you have it in this different tier storage, but it's I think it's it's there was a there is this fundamental shift that's, that's happening with the mentality around big data because the technologies emerging that makes it easier to have insights into that data, mean, big data analytics, that that term has been around for a while, but it didn't mean a lot when you really couldn't when the data wasn't clean. Do you know? And they'll, big companies will hire data analysts, they're concerned about big data, how can we use it? How do we make that into a competitive advantage? How do we monetize it, and even large companies that you think have their data act together? Because they're all about data? That's like what they do. They don't. They don't. They don't know. They don't understand it. They don't know what they have. And only now are some solutions coming out that actually give you those insights that you can use that are that are useful to you. Yeah,

Debbie Reynolds  27:20

I always say that my European counterparts don't like this phrase. But people say like the data, so new goal, because to them data, especially data about themselves is very personal, and spouse or human. They don't like the idea, like the commoditization of data, you know, that's exactly what's happening. But I like to say that insight is a new goal. Because if you have a lot of data, you can't make insights from it. It's worthless. It's just junk,

Beth Winters  27:48

Right. And if you are not capturing all of your data sources, if you're not capturing all of the data that you have, then it's an incomplete picture, then you're, you know, here, your projections are going to be wrong. I mean, when, when I went to business school, I was surprised that you can make the data, say what you want it to say, there are so many different ways to manipulate it, that you can always make kind of an upward line going up into the right. And just by changing the inputs, changing the messaging somewhat, you can really change the message that comes through change the insight. So data is only as good as your ability to draw insights from

Debbie Reynolds  28:42

it. Yeah, I hope that people are not, or try not to be digital packrats. So I like to call sometimes we talk corporations, like hoarders, the corporate edition, like, you know, yeah, then on top of data on top of data copies on top of copies, you know, stuff and backroom stuff, and especially the cloud now, you know, it's easy, so easy for someone to like, go into the cloud, but they enter there. And a lot of companies are having problems like shadow IT where their data sources they don't even know about people created, or they thought, you know, all the data is deleted. Oh, well, marketing has like, you know, they have all the emails or whatever, that's like always a challenge. I would love to know what your thoughts are about the possibility of there being a Federal Data Privacy law in the US isn't gonna happen? Not gonna happen?

Beth Winters  29:39

Gosh, I mean, having anything, you know, get through legislation on the Federal level has been a challenge over the past four years. Like there's just been so much conflict. I think it'll really depend on, you know, the elections that are still pending. Know what the senate makeup is going to be if we can, you know if Democrats can push through more legislation, but I think the Democratic house is more interested in those types of laws, and they've put forward some proposals in that space. What I think is interesting, too, is I mean, you see that, from the hearings that, that they did with Facebook and Mark Zuckerberg that they don't really understand data or social media. I mean, they're like, what is Twitter? It's they have no idea. So they need that type of education first, I think for that they know that it's an issue, right, because of the elections because of things that have been happening with Cambridge Analytica that are very newsworthy, but it's bridging that like education gap. And that's very much true for attorneys in general and general counsel in-house. They don't always understand the full scope of the issue. They don't always understand the full scope of the technology. And it's not something that you that might be something like typical legislation where you kind of negotiate both sides of the table, right? You're going to want to be prescriptive. You're going to want to understand all of the facts and make sure that you're protecting the interests of the public. Because if you if there's a loophole, and that doesn't, that doesn't serve anybody.

Debbie Reynolds  31:43

Yeah, yeah. So if you had your wish, it was the world, according to Beth, and everyone wants to know everything you said. What would your wish be for like Data Privacy, either in the US or in the world?

Beth Winters  31:58

I would really enjoy everybody understanding the importance of, Data Privacy and how everybody within an organization needs to be a data steward. Everybody within an organization is or should be responsible for their own data. And keeping a clean house that not all of the responsibilities, responsibility can fall on it, because they don't have the legal background, they don't have the compliance side of the house, and not everything can fall on legal and compliance because they don't know as much of the technical side they can't implement. There really needs to be a bridge between all departments so that you really can work cross-functionally, at a high level to implement change, and to make sure that you change the culture of your organization and society in general to be more understanding of the risk and the potential benefits of data.

Debbie Reynolds  33:10

That's a fantastic answer. I love that. It's funny. So I asked everyone on the podcast this question. I don't think I've ever gotten the same answer they are. We need to put you guys in Congress or something.

Beth Winters  33:25

But I'll let you know when I'm running.

Debbie Reynolds  33:27

That's right. That's right. I don't know, I feel like so many organizations have all these silos, you know, so there's like it silo, there's a legal silo, there are compliance and privacy can't be siloed. In that way, you can't solve this problem unless you're connecting and you're communicating. And not everyone can know everything. But you need to be able to have people who can talk to those issues and talk work across all these different groups of boxes made sure there's more cohesive, you know,

Beth Winters  34:02

that leadership has to come from the top. I mean, it's not going to be anything that you can implement. From the bottom, everybody can be a data steward. But if the leadership within an organization doesn't understand the importance of that doesn't value it, then you know that that culture is not going to be there, and it's not going to support that program.

Debbie Reynolds  34:23

Wow, that's great. Look at you. Well, little pearls of wisdom that you put down there. I love that. Well, we're coming to the end of our show. This is great. I'm glad we have this conversation. You know, we end up collaborating on a lot of stuff. And it's interesting to see. I like your pragmatism, which I'm very pragmatic as well. But then just understanding these issues and how you really need to what you need to do to actually make a positive change, right. So we're all about getting you from From where you are now to getting to a better place. So I think that's really great.

Beth Winters  35:05

Yeah, absolutely. And I mean, I think that it really speaks to the purpose of, you know, our product. And our organization is just that we care about data intelligence and automation. We care about, you know, making meaningful insights and bridging all of those gaps within an organization, making sure that the data is usable and helpful to multiple players in an easily accessible way that even an attorney like me could use.

Debbie Reynolds  35:36

Tell people how they can contact you to contact Aparavi.

Beth Winters  35:40

Yeah, absolutely. Well, you can go to Aparavi.com and click Get Started. You can also follow us on LinkedIn. And we have some BrightTALK webinars that we do pretty frequently. So if you're interested in more continuing education, check that out. We also have a free version that you can download on the Microsoft Azure Marketplace. So lots of ways to get started with a free trial and free data assessment. And hope, we hope you'll take advantage of it. Great. Well, thank

Debbie Reynolds  36:17

you so much. I really appreciate this, and we'll be talking very soon.

Beth Winters  36:21

I look forward to it.

Debbie Reynolds  36:22

Thank you.

Beth Winters  36:23

Thanks so much. Bye