Unlocking data privacy: Insights from the data diva | Guest Debbie Reynolds

Chris Sienko: 1:11

CyberWork and InfoSec would like to introduce you to our new Cybersecurity Beginner Immersive Boot Camps. They're designed to help you gain and enhance your expertise in the cybersecurity field. Join our live interactive virtual classes led by InfoSec's highly skilled instructors, who will guide you through the material and provide real-time support. And, as part of InfoSec's Immersives training, each student will have access to career coaching aimed at helping them start or switch to the cybersecurity field. You heard that right. We aren't here to just teach you the concept of what a security professional does. We want to prepare you to enter the job market with a competitive edge in six months time. Now I've told you about InfoSec certification boot camps, and if you're trying to hit your next career target and need a certification to do it, that's still your best bet. But if you're an entry-level cybersecurity professional or want to be, or you're switching your career and want to experience a career transformation, infosec's immersive bootcamps are designed to make you job-ready in six months. To learn more, go to infosecinstitutecom. Slash cyberwork all one word C-Y-B-E-R-W-R-K and learn more about this exciting new way to immerse yourself in learning with InfoSec.

Chris Sienko: 2:18

Now let's begin the show Today on CyberWork. I'm very excited to welcome Debbie Reynolds, the data diva herself to discuss data privacy. Now Debbie developed a love of learning about data privacy ever since working in library science, and she took it through to legal technologies and now runs her own data privacy consultancy and hosts a long-running podcast, the Data Diva Talks Privacy Podcast. We talk about data privacy in all its complex, nerdy and sometimes frustrating permutations how GDPR helped bring Debbie to even greater attention, how AI has added even more layers of complexity to this puzzle. And Debbie gives some great advice for listeners ready to dip their toes into the waters of a data privacy practitioner career. That's all today on CyberWork. Hello and welcome to this week's episode of the CyberWork podcast. My guests are a cross section of cybersecurity industry thought leaders, and our goal is to help you learn about cybersecurity trends and how those trends affect the work of infosec professionals, and leave you with some tips and advice for breaking in or moving up the ladder in the cybersecurity industry.

Chris Sienko: 3:23

My guest today I'm very excited about this is Debbie Reynolds. She's known as the data diva. She's a leading expert in data privacy and emerging technology. With over 20 years in ad tech, fintech, legal tech and AI. She delves into smart cities, iot and data privacy. She's a sought-after keynote speaker, and Debbie has addressed companies like Coca-Cola, paypal and Uber.

Chris Sienko: 3:45

Her insights appear in the New York Times and Wired, and she is also the host of the number one podcast, the Data Diva Talks Privacy Podcast, which I love. I've listened to about half a dozen episodes already. I'd highly recommend it. She's recognized globally as a top data privacy expert as well. Her leadership roles include the US Department of Commerce's IoT Advisory Board membership and the chair of the IEEE Committee on Cybersecurity for Human Centricity, which is influencing the future of data privacy and emerging technology. So no guesses in terms of what we're gonna be talking about today. It's gonna be data privacy all the way, but I'm looking forward to learning more about Debbie and her journey and how she got here. So, debbie, thank you so much for joining me and welcome to CyberWork.

Debbie Reynolds: 4:27

Thank you so much for having me on the show. I'm excited to chat with you today?

Chris Sienko: 4:39

Oh, my pleasure. Yeah, like I said, I've been listening to your podcast for a while now and I'm even, as someone who's not completely steeped in data privacy myself, it seems like I get at least one really cool insight in every episode. So, yeah, I really appreciate it. So yeah, debbie, to help our listeners get to know you a little better where did you first get interested in, like computers and technology and security and privacy was was there? Was there an initial spark? Was there a moment when you said this is what I want to do with my life, or what got you excited about it?

Debbie Reynolds: 5:01

yeah, well, it is quite a pernicious journey. Uh, it wasn't a straight line, I would say. Um, I was actually a philosophy major in college. I thought I was gonna actually become a lawyer, uh, and I actually my mother was diagnosed with cancer when I was in my senior year of college and so I decided I want I need to do something where I can be spend more time with her. So I started doing, you know, back then it's called desktop publishing, like now. It's like graphic design and different things like that.

Debbie Reynolds: 5:36

And I had a friend that had another friend that was a head of a university library and they wanted to create databases of books and so they asked me to help out and I did and I fell in love with data. So that was kind of the beginning of my data journey. So this was back in the day when libraries had card catalogs and they were trying to create databases of books and you know, you see how rapidly and differently you know library science is now as it was back then. But then, during that time also, I read a book called the Rights of Privacy and Caroline Kennedy was a co. The Rights of Privacy and Caroline Kennedy was a co-author of that book and the book shocked me. Actually it was a book my mother had and she was very interested in it and her interest made me interested and it was all about what's private and what isn't in the US. And I was, you know, very shocked because I think in the US we think, you know, we're the land of the free, the home of the brave, but we don't know that privacy is not like a constitutional right. And that book talks about those legal, you know, areas, those gray areas where people's privacy, you know, may be taken advantage of. So that was around the time of just, you know, like the early internet, right, 1995.

Debbie Reynolds: 6:58

And so as I worked more and started getting more in depth into technology and more stuff started getting into digital systems, I started to see, you know, the problems with putting people's personal data in these systems or how the data was shared and different things like that. And so I, as I I was doing this work, I was working a lot of multinational companies that were doing data moves and data transfers around the world, and in order to do that you have to know, like, the laws for different jurisdictions, and back then that wasn't even a job, right, it was just something you just had to know. But as the European Union started to re-examine their data protection regulations, I started getting calls from companies that knew me and they started asking me hey, can you come talk to me about privacy? And so one of the first big companies they asked me to come talk with them was mcdonald's corporation. So I went to their corporate legal department and talked to all their legal folks around the world around privacy, and this is before the big chain and the general data protection regulation came into play in europe. And I was like, hey, this is even though this is europe. This is going to be a huge, big deal and this is why it is and this is how it's going to change. You know your work, and it actually did.

Debbie Reynolds: 8:17

And so, like nobody in the US talked about that around that time, right, this is before it came out. And then I just kept talking about, hey, this is important. You know, I felt like I was like Paul Revere, like, oh, the British are coming. You, the British are coming. You know, you need to pay attention. And eventually, by the time the regulation went into full effect, I got a call from PBS and they asked me to be on TV to talk about germ data protection regulation. It's funny because people still contact me about that interview, so I made some predictions that actually came true. It's pretty funny, but yeah, so that's what I decided. Well, maybe I should just do privacy.

Chris Sienko: 8:56

Yeah, absolutely. I love that. So it sounds like the sort of the roots of the Data Diva experience came from GDPR happening and a lot of people not in Europe or companies that were partly in Europe and partly in the US were like help us understand what the heck's going on here. Is that accurate?

Debbie Reynolds: 9:17

Yeah, absolutely Absolutely. So it's fortuitous. You know, I'm like it's so funny because what? So? The GDPR went into full effect in May 25th of 2018. That's when I was on PBS. But two years before that, the law was passed and I thought, you know, the day that passed became a law, quote-unquote, but not enforceable. I thought, okay, I'm gonna wake up and today everyone's gonna care about data protection and like there was nothing on the news, there was nothing, like nobody cared, right. So I thought, oh god. So I thought, well, I just need to talk about this a lot. There even weren't things written about it, right? Uh, when I was telling people about people like, oh, can you give me a summary?

Debbie Reynolds: 10:00

like there is no summary, you know so I started doing like writing a lot in that time period about it, just so that there'll be some information that people can look back on.

Chris Sienko: 10:10

Yeah, yeah yeah, yeah, I, I remember that that era. It's funny. Yeah, yeahs don't really become laws until they become enforceable, and I know that on your show you talk about you know, if you give your guests one wish, or you know, king for a day, queen for a day, whatever, in terms of making changes, and I over here talk about having a magic gavel and stuff. So we'll talk later about what kind of enforceable things that we want to get into with regarding the data privacy. But to start with here I want to talk a little more about your career. So I like to look around.

Chris Sienko: 10:44

I guess maybe this is an invasion of privacy, but I look at your LinkedIn profile, your experiences, to get a sense of what your history is like and it gives me a sense of you know, your employment story and your your cyber history and stuff like that. So I mean, you've, you know, uh, done a lot of stuff uh in you. You told us a little bit about that in terms of library, science and so forth, but you spent a good portion of your earlier career working in law and specifically legal technology. Uh, and I've had one other guest on who's a law cyber person on the show in the past and it's. I think it's not a common path, but it's an interesting one. So could you talk about how a pivot like this from the legal tech area I guess that was probably privacy related too but like how did that sort of turn into this complete world of data privacy?

Debbie Reynolds: 11:32

Yeah, well, I think people misunderstand that part of my history. I've always been a data person and I've always done consulting around data projects, but I have had situations where I've worked with companies that were involved in legal stuff. But that was not, that was not the whole entire, the whole enchilada of what I worked on, right? So you know I was still working. You know I'm still working like an ad tech. You know people just call me up. I've been very fortunate that people have called me up all types of wacky things that they want to do with data, and so I've been able to.

Debbie Reynolds: 12:12

You know, for me, I think, if people see, oh well, she's done some stuff in legal tech, but I was never always in legal tech Like I was in all these other types of tech spaces. But for me, to me, that's the reason why my work is so unique, because I traverse all these different industries. I think people just didn't know that I knew all. You know people in business intelligence, people in ad tech, people in you know, pharma, all this other type of stuff. Just because you know, when you think of legal, a lot of legal issues around data is around litigation, and so companies have bigger data problems than litigation, so I work with them on all those different things. So before litigation, you know people need to have better governance of everything you know within their corporation and a lot of my talking with people over the years about privacy is about how much bigger it is than any one industry.

Chris Sienko: 13:11

Yeah, yeah. Now I want to sort of break apart how you acquired this sort of tool, belt of private, because I know it sounds like you. You know you learned as as needed on the job and so forth, but for a lot of our, our, our listeners, they're trying to figure out you know where their opportunity is, is going to come from. And one of our past guests, chris Stevens, is, is our InfoSec skills author for privacy and sort of privacy certifications. You know the seven of them or whatever. And I'm wondering if you can talk a little bit about the combination of how you sort of like came to learn, like the different privacy regulation structures around the world, the governance. How did you sort of put all that together? I mean, I know it was kind of on the job and as you were going, but like, well, what are the different pieces of this toolbox that sort of add up to the whole?

Debbie Reynolds: 14:03

Yeah, actually it wasn't on the job. Privacy is my own personal interest.

Debbie Reynolds: 14:09

So, these are things that I was interested in back then. As I said, when I read that book in 1995, I just kept seeing, just in general, how more data was being created, more data was being collected, seeing kind of the gaps, and that's what I talk a lot about on my show. So I talk about the gaps in privacy, the gaps in regulation. You know how data plays within data spaces, and so what happened is my personal interests converged with my professional life. So you know, like I see things, like people say, well, let's put chips in pets. And I thought, oh, this is bad, because people are going to put chips in people at some point. Right.

Debbie Reynolds: 14:51

And so for me, I didn't ever think that my personal interest in privacy would turn into a business. But it is because people will start saying, well, we want to do this. Well, you know. Like an example, let's say someone said, ok, we have some data in France and we want to transfer the FTP over to the US, and I'm like, well, you can't do that, yeah. And they're like, well, why't do that? And they're like, well, why? I'm like because they have, you know, this type of data can't be transferred because of you know these blocking standards and those are things you know. That was not something that that was. It was not a job requirement or anything. That was what I brought my knowledge that I had, just because that's something that interests me. So for me it's just been many years of reading, researching, because I guess I'm you know, I'm personally interested in privacy. You know, I want you know what are people doing with my data. So I think my, you know, I think my motivation for being interested in privacy is, is personal.

Debbie Reynolds: 15:52

Yeah, Right, I'm like well what, what you know, what are you doing? And so I, when I had a chance to get involved whether it was, you know, this IOT advisory board, you know I raised my hand. I said, hey, I want to, you know change. You know how can I use my skills to change the way that things are happening in the world? And so that's what I decided. I'm like well, I can go in any direction. Right, I can take off a career like a cult and move into any type of data space, because I've built data systems for over 30 years.

Chris Sienko: 16:27

Can you talk about building data systems Like what does that process look like on sort of a practical day-to-day level?

Debbie Reynolds: 16:34

Yeah, so I guess my early career in library science literally creating the technology that's capturing particular data types, whether that be text or, you know, barcodes or different things that we're using around that. Eventually technology got to a place where people wanted more descriptive information around data. That was put in Because you know, when you think of like libraries and catalogs, it basically would tell you you know here's a book and here where it is and here's the title you know. Eventually people want to know more, right?

Chris Sienko: 17:11

So what's the?

Debbie Reynolds: 17:12

description of the book, what's in the book? You know what books you know cross-reference the same information, so I think you know my background in. That really helped me, especially as other companies were coming to the challenge where they couldn't manage the data that they had manually right, so there were just not enough paper. There were not had manually right, so there were just not enough paper. There were not enough people right. As we see more digitization, especially with the commercial internet, where people were you know, microsoft Office, different things like that People were authoring things more rapidly. There's more data in different forms. It was just difficult to be able to try to manage. I think if it were not for the internet, we'd still be in a very paper world. Especially, we're seeing this escalation again with artificial intelligence, where there's going to be even more data created.

Chris Sienko: 18:12

It's even harder to source where it's coming from, with ai, I imagine yeah, exactly so.

Debbie Reynolds: 18:16

It's creating more data challenges that we're having just because the the volume and the the the speed in which this data is being collected. So for me it was like, okay, so we don't have the right tool, let's build it. Let's build a new tool or let's go. You know is another, another industry using a tool in a different way that we can learn from. So, you know, it's just it's kind of a race, a race to try to keep up with the demands of what people really want and what those technologies end up being used.

Chris Sienko: 18:51

Yeah, now, like I said, I really enjoy the Data Diva Talks privacy podcast here and I encourage our listeners to go check it out and check out some episodes. It obviously comes from a place of real passion for you. Like you said here, you got into data privacy because you have this very vested interest in understanding what our data is being used for and you know each episode. It feels like you know you're asking the guests what is the thing you know, what is the data privacy issue that you're most worried about right now? So I'll turn the question back to you, debbie what is the number one data privacy issue for you at the moment? What's the thing that, if not, keeps you up at night, keeps you kind of thinking about it at the moment?

Debbie Reynolds: 19:35

what's the thing that, uh, if not keeps you up at night, keeps you kind of thinking about it. Yeah well, let's see my big issue. I guess I'm gonna blend it with ai. I guess, uh and this is a concern I've had for many years and so I've seen it play out now uh, probably worse than I even imagined. So I feel like people are abdicating their human judgment technology where we're saying, oh, we don't need humans, we'll just have robots that you know fold clothes and you know pick up eggs and stuff like that.

Chris Sienko: 20:05

We're going to save so much money this way?

Debbie Reynolds: 20:06

Yeah, so it's like, yeah, but you're trying to use technology to make bad decisions and then you're trying to advocate your, your responsibility as a human for that right. So we're seeing a lot of bias in hiring algorithms. We're seeing a lot of problems with, you know, these tools spitting out information that's not correct, things that are harmful people. Um, you know, we're seeing just an over data collection, just too much data.

Debbie Reynolds: 20:33

There was a expose in the New York Times recently about cars collecting people don't even know like your car is collecting data that's going to these secret data brokers to get it sold to insurance companies without their knowledge. And one of my friends who was a data expert didn't know this. His insurance went up 30% and they were like you know, I didn't get any tickets. Expert, didn't know this, and his insurance went up 30%. And they were like you know, I didn't get any tickets, I didn't do anything. You know there was nothing in my quote unquote driving record that was wrong. They were like well, you know, you drove through this neighborhood five times, or you, you know, we think you took these trips, these number of trips in your car, or, um, you, you, you broke, you did like a fast stop, a hard break.

Chris Sienko: 21:23

Uh, you know they're tracking the, the actual drive it, you're driving style and they're like you're too dangerous, wow exactly so mean to me that's problematic.

Debbie Reynolds: 21:34

Right, right I'm like maybe I did a hard stop because someone a kid ran into my pathway and I wouldn't hit the kid Right. A lot of context, a lot of possibilities for context here have with people using technology. I see to me AI should be more of a low-level, low-risk, low-stakes tool as a helper to people. It shouldn't be making decisions about people.

Chris Sienko: 22:07

I agree completely. Yeah, no, there's a lot of space for it, especially in terms of crunching numbers or, you know, gathering, you know data from large sets and stuff like that it's perfect for. But yeah, doing things like that and you know, also sort of replacing sort of human judgment, you know, and allowing sort of decision-making, is pretty wild. Now can you you know, obviously you're a person, a forefront can you speak to support anyone else who is currently working or talking in this space, who is saying especially interesting things about the confluence of AI and privacy right now, that you'd like to shout out?

Debbie Reynolds: 22:39

Yeah, wow, there are so many different people. One person I think that you would love to chat with. His name is Stephen Lawton, so he's a writer. He's a technologist in cybersecurity. He traverses a lot of different areas. He does a lot of writing for publications like Dark Reading Bloomberg. He's a great person to talk to because he knows so much about computers and computing. He talks about the cyber risk and cyber insurance, so he goes the gambit, I think, around technology. He has a deep, deep knowledge of just tech and cyber in general, and so he's a. He's a great fan and he's been on the show as well.

Chris Sienko: 23:25

he's amazing and well, um, let's talk about the show here. Like I said, I've been uh excited about about it for a while now and you've got what almost 200 episodes on there, something like that, or over 200?

Debbie Reynolds: 23:36

Yeah almost 200. Amazing 200 in about I don't know 10 weeks or something.

Chris Sienko: 23:42

So when did you start it? In 2018?

Debbie Reynolds: 23:47

2019, I think, or 2020?

Chris Sienko: 23:51

No, I've been 2020, I think, wow okay, that's an incredible pace of work there. So, um, well, let's tell our our guests, uh specifically about the type of people that you speak, uh speak to and I think, because you know you look at a list of 175, whatever uh past guests and you get a little overwhelmed what is there like one or two episodes that you think our listeners should start with? That really gives like a good idea of like what makes the show great yeah, oh, wow, that's such a great question.

Debbie Reynolds: 24:21

Uh, first of all, we're really happy and proud that people really love the podcast. I think we have last time I checked we've had over 170 000 downloads of those podcasts. Uh, we have listeners in over 112 countries. Um, the guests run the gamut, um, so they're not. I think the reason why people really like the podcast is that it's not just privacy people. Uh, because privacy is such a horizontal issue that impacts like almost any type of company or any type of profession.

Debbie Reynolds: 24:57

I'm able to bring on people from all different areas. So there may I may have lawyers. I have cyber people. I have people in, like you know, biometrics identity. You know, just, you know anyone in a data space that wants to talk with me about privacy. You know we've had, you know, people like Cameron Carey, who's part of the Brookings Institute, who's probably one of the biggest you know people in the US on privacy. We had Johnny Ryan, who's an advocate in Ireland. He works on a lot of those real-time bidding at tech cases. He's been on. I mean, we've had a ton of VIPs.

Debbie Reynolds: 25:38

Probably one of the coolest episodes that I've done recently is with a guy named Jesse Taylor. So Jesse Taylor, he's actually the inventor of the App Store, really, wow, yeah, yeah. So he has a story in the show where he he had a meeting with Steve jobs. They introduced the the app store concept to him, uh, and then they Apple bought it and so that's how the app store started, with Apple, uh. So his episode is amazing because he talks about his trajectory in tech, you know, inventing the app store and then now he's working on identity, right, ok, try to solve a lot of identity problems. So he has like a really cool technology and a really cool way that he thinks about stuff. So for geeky tech people who are really interested in that, you would really love that.

Chris Sienko: 26:34

So it was one of my favorites oh, it's awesome and I think also people love hearing the firsts of things like that, or or where things started. I think one of my my past guests was, uh, the first person to hack an iphone. I think it was like the first, first iphone that came out and they were part of the team that, uh, hacked the first iphone. So everyone wants to hear that story for sure. But so I want to move into sort of the work portion of our show, cyber Work here, because you're giving us lots of awesome knowledge here about data privacy and I wanted to ask you specifically about the role of, say, a data privacy officer.

Chris Sienko: 27:14

You know you learned your skills over a long period of time. You were doing other work, you were doing it as kind of like a thing that excited you and you gathered the skill set over, you know, over time. But for people who are just trying to get into this space now, do you have any recommendations for common educational requirements, qualifications, degrees or certifications or extracurricular learning that would sort of get you up to speed to do this type of work? Like, where would you start?

Debbie Reynolds: 27:43

Yeah, that's a great question. First of all, I would say start with self-learning.

Debbie Reynolds: 27:48

So before you, spend any money on it you know, look into it, look into what's being written, follow people who are talking about things that you're interested in. You know there was a lot of. You know, back in the olden times you had to go to the library, but now you have the Internet, so go on the Internet. You know, I tell people they're interested in privacy stuff. Put like a Google alert for yourself for these things you're interested in, so that you can get like a reading list every day without having to go out and search for things to see. Like, is this something I'm interested in? Like, do I really want to go into this area? Um, also, I think, especially for people who are young in their career, who aren't established and they are not known, I recommend that they try to decide maybe get some type of certifications, maybe a variety of them. So, for privacy people, you know, I tell people anyone who's in a data job can, can add privacy to their toolkit. Right, so, you know, get a certification and read a book. You know there's something you know privacy is something that all companies have to deal with at some level. So having just a little bit of knowledge may give you that leg up where you're invited to be on a team within your company or you can volunteer. There's no one in your company say, hey, I'm really interested in learning about this. You'd be surprised how companies may invest in you. And you know, I I do. I don't have certifications because I think people kind of know me already yeah, yeah, yeah, no, what, what I am and what what I can do. Um, but for people who are not as well known, I think those certifications help because it it really demonstrates maybe a future employer that you have taken time there to be able to get those things. Then I also you know as much as I love privacy.

Debbie Reynolds: 29:41

Because there's so much AI out there, I highly recommend people start to learn stuff about AI too. So whether that be like I tell people, if you read one article let's say you spend 10 minutes a day for 30 days to learn something new about AI, you'll probably know more than anybody around you. Right, right, we're at the beginning of the beginning around what AI will be in the workplace. So anything that you can do to read on your own, you know a couple of. There are a couple of different places that have free certification classes that you could take in AI. You know just the basics and, again, having the basics will make you better than most people.

Debbie Reynolds: 30:23

Most people don't, you know, unless they're data geeky people like me Just doing it for fun. Yeah Right, yeah Right, you'll probably know more than other people. That'll give you a huge leg up and it helps you differentiate yourself. I think too right, yeah, you say, hey, I'm a cyber person, but then I also have this, you know, interest in privacy and those things can come together. You can probably be, maybe, maybe the translator between those legal and technical people within organizations. So I highly recommend people kind of diversify a bit. You know, maybe, maybe not. I wouldn't. I would not recommend people go into debt to be able to do that there are so many free resources out there but just a little

Debbie Reynolds: 31:04

bit. You know, even if you took one, even if you took one little class or something, you know that'll be better than nothing. Or if you read one article a day, that'd be better than nothing. Or if you read one article a day, that'll be better than nothing. So I'll say, you know, I highly recommend self-learning. You know, I'm a self-taught person. I was. I did not go to school for technology. My first computer, you know, back in the day, when computers came with books, you know I would read the whole book or I would, you know, learn as much as I could. And that's how I ended up in technology, because I was interested and I could prove that I was capable of doing things. And so myself, my journey a lot, is around self learning.

Chris Sienko: 31:46

Yeah, that's, yeah, that's awesome advice. I want to ask a little bit. You mentioned already about differentiating yourself from other people, especially at entry level position, sort of floating you to the top of the resume pile and so forth and I, like you said, I think having these kinds of like niche skills, certain aspects of privacy or or things in addition to your cyber skills, is probably a really great way. Now you run Debbie Reynolds Consulting. You're a, you're a consultant for companies. Is consulting uh something that you can, uh someone new can do to get their job in the door? You know their foot in the door, like if you wanted to uh volunteer your time, say, for some local organization that needs to know you know what their privacy requirements are and stuff like that. Is that something that companies or you know places in general would be willing to entrust to, like a newcomer who's trying to get their feet wet?

Debbie Reynolds: 32:44

Yeah, I highly recommend. That's one of the top things. When people contact me, like how do I get my foot in the door? No, or for some people, some people say, you know, I went to this school, I got a degree, I've maybe got a certification, but no one will hire me because I don't have any experience, right, and I tell them, like, do you have family members that have to have businesses? Do you have like a local business that you can go to and say, hey, you know here's privacy thing, it's a big deal. Maybe I volunteer or you do it like for just a nominal fee, not a ton. You know, maybe just help them with their website privacy policy.

Debbie Reynolds: 33:24

All that is experience and you don't have. You can put that on your resume, right, absolutely, I was the data privacy officer for blah, blah, blah, whatever, whatever that is, and they don't need to know that you didn't get paid for it, right, it's still experience, right, that you can put it on your resume and it's something that you can do at your own pace, right, because a lot of companies, especially the smaller companies, they don't know what to do and they'll be happy to talk with you because a lot of them think, well, I need a lawyer to do this, so you actually don't right Most of these. I'm not a lawyer. A lot of people who do this work are not lawyers. A lot of us are tech people, data people who are, who have a background in governance and know what you should and shouldn't do with data and that's really all that.

Debbie Reynolds: 34:04

Privacy is like you can do or you can't do this with data or the things you need to look at. So I highly recommend people do that and that's been something that's been very beneficial to people who've actually taken that track. So you know, even let let's say, for instance, you have a job, maybe you're a cyber, you know, see if there are projects in the company around privacy that you can say can I, can I be a part of this project? Can I help do this? You know you may be able to. You know I've had people say well, you know, can you? I'll be your data privacy officer, but you know I'll just. Maybe you just get a new title or something. Yeah, that says privacy.

Chris Sienko: 34:49

Negotiate extra responsibilities and yeah.

Debbie Reynolds: 34:51

Yeah, exactly, so there are ways to be able to get in. I would say, you know, to me it's a wide path, so I think you know. I think in the future it's going to become even more important, especially as things with AI come about. Yeah, because a lot of lawyers don't you know they weren't, they didn't, they're not experts in tech or they're not experts in data. So having people who are experts in data and also know the privacy part, I think really can elevate someone's career.

Chris Sienko: 35:23

Yeah, that's really good advice too. A portion of our listenership is also people who are trying to transition into cyber-related roles, maybe after having another career, maybe in their 30s or their 40s, and I think that's a you know, if you're already at a company like a really good starting place is to you know, on your next job evaluation, ask for more responsibility, say, is anyone doing data privacy for this company? Can I do that in addition to what I do, or can I get a few things taken off my plate in order to concentrate more on this? You know, I think there's a lot of talk about professional development and companies want you to be, you know, constantly growing. I think that's such a great piece of advice in terms of that.

Debbie Reynolds: 36:03

And one thing I will add that you should really know about kind of the job market and in privacy right now. So much so when I was interested in privacy in the US, there were like hardly any lawyers doing it. It was just all data people like me, right, Right. But over the years, as the regulations came about, there are more lawyers now in privacy. Some people think of it as like a lawyer-only job and it isn't so. There's a lot of people like me who are in privacy, but then also, you know, it's employers. Now they're looking for more of the people who understand privacy, who understand data.

Debbie Reynolds: 36:48

All right, Because at some point you know, unless you're a super big company, it's always changing. Once you know what the regulation is, you know you need to figure out how to change your operation, how you work, and so what we're seeing is more emphasis on companies trying to recruit more data people in privacy. So people who understand the data part of how companies work because they have to. Companies are struggling really with operational change, not like the regulation, so, uh, so to me it's like a very good area to put yourself in, is a good way to differentiate yourself.

Chris Sienko: 37:31

Yeah, I love that. Um, yeah, that that reminded me of, of, uh, something I was going to ask. Oh, this is so. This is kind of a a sideways question here. Uh, but you know, like I said, um, in learning about, you know, possible new career tracks, if you're just, you know, fresh out of school or not even out of school or not, didn't go to school, you know, or whatever you're thinking like data privacy, this is it, this is my career track, and you're all excited, can you talk about? Is there a certain aspect of the job that is you know that people should be warned of? You know, in the sense that, like, this is, this part of it is is way more boring than you're expecting, or this part is, you know, makes you want to pull your hair out because you know people are not going to, you know, take your advice, or whatever. Are there certain sort of undersides of data privacy that is, as long as you know them coming in? Uh, you know, you got to be ready for them oh, that's a good question.

Debbie Reynolds: 38:26

So underside I will say if you don't like, reading like this is not like the job for you yeah, there's lots of reading.

Debbie Reynolds: 38:32

You're constantly researching, I imagine, right constantly, constantly, like I do several hours of research every day. Wow, so's just the only way you can keep up. The European Union has the AI Act that came out. That's like 500 pages, even though it's in Europe. It's going to be like the GDPR was, where it's going to be very influential for different jurisdictions. If you learn that, then in the future, when more laws come out, you'll start to see shades of that that regulation there. So learn on reading that understanding that will help you navigate what that future is and that's what companies really want.

Debbie Reynolds: 39:18

I would say I don't know, maybe I'm just nerdy. To me, I think that's probably the only downside. It's just a lot of reading and there's a lot more stuff in the press around privacy. I remember when I first, over a decade ago, maybe like 15 years ago, I put out a Google alert for privacy and there was nothing like not one thing for years, like I want to say like almost like six or seven years, it was like no articles. And then now, like you know, my Google alert may have 10, 10 or 12 every day.

Debbie Reynolds: 39:59

Yeah, right, so it's changed a lot, a lot, lot, and so I think for me being able to look you know people call me a futurist because I'm good at predicting what's going to happen next. But you know I'm always looking at the technology because the technology um, you know law follows technology. So law, you can't lead with law. Law, law is like backward looking, yeah. So if you're thinking about the new thing, like you know, like when the Vision Pro headset came out, oh wow, well, what could be the privacy issues with that? Right, and so it may not be on your desk today, but if you're thinking about those things ahead, when it comes up, then you're already in a good position to be an advisor or being a trusted person in that area.

Chris Sienko: 40:44

Yeah, this is a little off script here, but you mentioned that you do about five hours of research today. Could you tell us a little bit, like, what is your? What is your, your sort of your regimen? What's what do you? Where do you start each day when you're trying to do research? It sounds like you're. You're also the the Google alert diva here as well, but like what are some of the other? Like go to sort of news sources that you you check every day, or like what is your? You know I jump from here to here, to here to here each day. Do you have like a routine at all?

Debbie Reynolds: 41:15

Yeah, I have an app that I use called Flipboard, and Flipboard allows you to collect articles and stuff and it makes it, you can make it a magazine. So I have a research magazine and every time I see something that I think is of interest, I have like a research file that I save it to and then every night for a couple hours I go through my research file and I just read, you know, just read through stuff, and so and of course it was like bigger things. Another thing I do like these bigger laws. Sometimes I use an app called Speechify where I have it read it to me so I can be like washing dishes or doing something.

Debbie Reynolds: 41:56

So, I'm not reading, I'm just listening. You know doing different things, just taking it in and stuff like that. So those are two things that helped me a lot, and so I do videos every week. I've actually been doing those for over five years, so I do one video a week that I release. And so, uh, because I what I found that it was too hard to start and stop research. That's why I always do it, yeah no yeah continue to do it.

Chris Sienko: 42:21

And then when people call me, they're like oh, you need to look at your notes, like no, no, really yeah, for for those of us with uh, you know I have adhd and I know other people as well but like, sometimes the prospect of like, okay, learn all the privacy now feels like you know that old like game show thing where you're in like a wind tunnel and there's dollars flying everywhere and you're just constantly trying to grab. So I I think that's a that's a really good advice, especially the uh, uh, the flipboard thing and sort of making the magazines Cause. Again, I think, if you're like, well, I'm grabbing this, I'm grabbing this, but what am I going to get to it. But if you sort of like slap it all together and say, okay, two hours a night, I'm just going to go through this that you know you're going to read, I think that's a really good way to kind of like get your head around what all this is, because there's, you know, there's a million options and there's a billion ways to do it, right and wrong and so forth. So, yeah, that's great advice.

Chris Sienko: 43:16

Now I want to ask one more thing regarding, like, careers and stuff Are there particular skills gaps among people trying to get hired in data privacy positions you see on a regularly, regular basis that you know you wish were more common, like are there things that you know people are like I'm a data privacy person? You're like well, why aren't you doing this? Or I wish you did more of this. I wish you had more of this skill. Is there anything like that that people should be aware of?

Debbie Reynolds: 43:47

That's a great question, I would say, and you probably wouldn't think this was typical. But you know, the gap that I see the most are technology people who don't know how to talk in ways that anybody can understand, and legal people who also have the same problem. Yeah, so you know, we have, like legal people who want to do alphabet soup in acronyms and shorthand and stuff, and then the tech people have their own acronyms and shorthand and so the problem is in a privacy role, you have to be able to communicate across all levels of the organization and with anybody. So if you're saying some acronym soup thing, you know people are going to pay attention to you, they are going to listen to what you have to say. So to me, that gap really is understanding how to be a great communicator. Understanding how to be a great communicator, right? So the person that you're talking to like, let's say, you're being asked to brief the CEO of a company about a particular issue and this happened to me before where I talk with maybe the legal people like, hey, you all need to do this, and then I talk to the technical people, hey, and they're like well, I need you to explain it to the CEO. So I know that the CEO doesn't understand the legal, he doesn't understand tech stuff in the same way, so I have to be able to communicate that to him differently. Or even people when I'm doing training, like for a whole organization, like I've done trainings for, like you know, coca-cola, johnson Johnson, like all types of companies, right, and so you have to make it easy enough for anyone, regardless of where they are in the organization, to be able to understand what you're trying to say, and so that's a skill, just in general, that I think is going to be highly relevant in the future, not just for privacy, but all jobs.

Debbie Reynolds: 45:36

You know, ai is very complex, right? So if you can break down what AI systems are doing in an easy way, you can elevate yourself in your organization, because very few people have honed those skills. It's so funny because even when I was asked to talk on PBS about privacy, they don't tell you what they're going to ask you. They just put you on TV and they start asking questions. But I had to think in my head. I kind of stopped for a second. I thought, wait a minute, I have to be able to explain this to someone's grandmother, you know, or someone who's 10, you know so I can't explain it in a way that a legal person or a technical person, so I had to break it down as easily, as simply as possible, and so that's a skill that I think will help anybody in any type of career. So if you're a good communicator you can communicate not in legalese or not in technical jargon you'll go far in any career that you want to go into.

Chris Sienko: 46:37

I completely agree. Now you mentioned, obviously, the sort of alphabet soup and the sort of talking past each other between you know, legal and tech and so forth Is is there. Is it ever a case where, like, the privacy person is asking the company to make difficult changes and I imagine there's gotta be some element of like persuasion involved right as well where you're saying, like look, I know you really don't want to put in this extra money to like or lose this data that we were otherwise going to harvest this way, that way and the other way or whatever. So I imagine you're also having to sort of like patiently explain, like no, we don't get to do that. Is that? Is that the case as well, or is that someone else's job?

Debbie Reynolds: 47:16

Yeah, absolutely Right.

Debbie Reynolds: 47:18

So I guess it's the art of saying no, in a way, you're like, oh, you can't do this or you shouldn't do this, right, but you know, when you're an advisor, you know, I say consultant, but you know, advisor, yeah, uh, interchangeably, uh, you know, and it may be frustrating or you say, hey, here's the law here, this is what you're doing, this is what we recommend that you do. But you know, companies even though privacy is important, it's not the only consideration, and so companies have to make their own choices. But you want to make sure that they're making an educated decision, right? So you don't want them to make a decision because they don't know something. You want to be able to say, hey, here's the lay of the land, this is what I think. You know that here will be my advice for what you do.

Debbie Reynolds: 48:01

But then you have to decide as an organization. You know what is your culture, what is your standard, what are you going to do? You know, maybe you're somebody like Facebook, you're like, well, we don't care, because we're going to do what we want. We're going to pay a billion dollars and that's fine.

Chris Sienko: 48:16

You know that's their choice Right.

Debbie Reynolds: 48:18

You may not like that, but you know, and I feel like sometimes I see on LinkedIn people like slamming people who work for certain companies. I can't believe your company does this. It's like you know you just have one job Right, so you're not the CEO. You don't get to pick and choose what companies do. All you can do is tell them like this is what is going on, this is what our obligations are, this is what I think you should do. This is how you know and this is where, to me, the cyber data people come in. How do you do it?

Debbie Reynolds: 48:49

Yes, so it's one thing to say okay, you need to comply with this law. Okay, Well, how do you do that? Yeah, I don't know. Like, how do I change the way that we operate to to be able to get in line with?

Chris Sienko: 49:03

this. So that's that's the gap way that we operate to be able to get in line with this.

Debbie Reynolds: 49:05

So that's the gap you have to sort of show the entire pathway there, then, yeah, exactly, like you know, it's easier to say, okay, this law came out and you have to comply with it, but then how do companies change? And so that's the problem that they're having. That's why they need data people, because they need to know operationally, on a you know, hands-on basis, what do you need to do to change your behavior in that organization.

Chris Sienko: 49:29

Yeah, awesome, yeah, and I I think that's probably another one of those sort of underside things worth noting is like you can make recommendations to your company and and I also have to understand that they might they might not take all of your advice, right.

Debbie Reynolds: 49:43

Yeah, absolutely. It's part of the advisory that you do.

Chris Sienko: 49:48

Yeah, I can only tell you what you need to do. I can't put it into your hand and make you do it, that's right.

Chris Sienko: 49:54

So this has been an amazing conversation. We're bumping up against an hour here. I would love to have you back on, if you're available, to talk Internet of Things and especially AI and sort of drill into those topics better. But I really enjoyed getting your insights on sort of career related questions around data privacy. But before I let you go, debbie, can I ask what's the best piece of career advice you ever received, whether it was from a mentor or a teacher or a colleague or just something you learned along the way?

Debbie Reynolds: 50:22

Oh, wow, I think probably the best career advice I received, maybe from my parents. So my parents were very into education, they were very much in the learning and they never put limits on what we could do or what we can learn Right. And so I would say don't put limits on yourself, don't? You know? I learned not to put myself in a box because I don't fit in a box, right. You know, I have a lot of different interests and so I'm lucky that I have a company where I can exercise all the things that I'm interested in, even though they may not even seem related.

Debbie Reynolds: 51:01

Right, like I one of my early jobs when, when I said I was doing desktop publishing, like I do a lot of graphics. You know I have a media company as well, so I do a lot of graphic design. For that, I mean, that's just because that's something that I've done forever and that's kind of a fun artsy thing. You know, gets me out of the, gets me out of the. You know the privacy, you know the privacy, you know wonky world and I can kind of do more creative stuff. But I would say for people, don't put yourself in a box, and you'd be surprised how much maybe skills that you have in different areas may come together at some point.

Chris Sienko: 51:35

Yeah, fabulous advice, thank you, so I'm gonna let you go here. But one last question. If our listeners want to learn more about you, debbie Reynolds, the Data Diva, the Data Diva podcast or the other 150 things you got going on, where should they look for you online?

Debbie Reynolds: 51:49

Yeah, well, people can always connect with me on LinkedIn. You just type in Data Diva Debbie Reynolds and connect with me, happy to. Or they can look at my website, debbiereynoldsconsultingcom. I have all my videos and newsletters and events and everything on that, the website.

Chris Sienko: 52:07

Yeah, and don't, and don't forget to check out the data diva talks privacy podcast. I I got mine on my regular podcatcher and, uh, highly recommend it. So, uh, well, this has been great, debbie. Thank you so much for joining me today. I really enjoyed learning from you.

Debbie Reynolds: 52:19

Thank you so much. I love the show, I love your flow, very good flow of the show.

Chris Sienko: 52:24

I really appreciate that. Thank you, and to everyone out there, I'd like to thank you everyone who's watching and listening and writing into the podcast with feedback, as usual. If you have any topics you'd like us to cover or guests you'd like to see on the show, drop them in the comments. We've been adjusting our content accordingly so you are getting heard, adjusting our content accordingly so you are getting heard. Before I go, I don't want to forget to have you check infosecinstitutecom slash free, where you can get a whole bunch of free and exclusive stuff for CyberWorks listeners. This includes our security awareness training series, work Bites, a smartly scripted and hilariously acted set of videos in which a very strange office staffed by a pirate, a zombie, an alien, a fairy princess, a vampire and others navigate their way through age-old struggles of yore, whether it's not clicking on the treasure map someone just emailed you making sure your non-nocturnal vampiric accounting work at the hotel is VPN secured or realizing that even if you have a face as recognizable as the office's terrifying IT guy Boneslicer, you still can't buzz you in without your key card. So go to the site, check out the trailer. I love it.

Chris Sienko: 53:24

Infosecinstitutecom slash free is still the best place to go for your free cybersecurity talent development ebook. You'll find our in-depth training plans and strategies for the 12 most common security roles, including SOC analyst, penetration tester, cloud security engineer, information risk analyst, privacy manager, a secure coder, ics professional and more. One more time, that is infosecinstitutecom. Slash free and yes, the link is always in the description below. One last time. Thank you so much to Debbie Reynolds and thank you all for watching and listening Until next week. This is Chris Sanko signing off, saying happy learning.