Privacy Talk with Lourdes M Turrecha, Founder & CEO PIX LLC, “What is the New Wave of Privacy Tech?”
This interview is talking about data protection and startups, e-Estonia and new trend of privacy-driven data economy.

Kohei is having great time discussing with international data protection and privacy expert Lourdes M Turrecha!

This interview outline:

Introduction

What has been changed among California tech companies since CCPA started?

What is the differences from data security and privacy?

New Trend of Tech Company with Data Privacy?

Federal Data Protection Rules will come?

What is the Privacy Tech Community “The Rise of Privacy Tech”?

Message to the Listeners

Kohei: Thank you for taking your time for interview today, Lourdes. You are data privacy expert in the United States, and I am honored to speak in this way.

Let’s move on to the interview. Please introduce yourself at first.

Introduction

Lourdes: Thank you for inviting me this time. My name is Lourdes Turrecha. I’m the founder and CEO of PIX, a data privacy consulting firm in Silicon Valley.

As I am a lawyer and legal expert, and I have been a consultant in the cybersecurity with technology companies. We have been involved in data privacy projects from more than 100 major companies to small and medium-sized, build up data privacy strategy for company strength and security products based on privacy by design.

What has been changed among California tech companies since CCPA started?

Kohei: Thank you for your introduction. As it becomes more awareness of data privacy from large corporations to startups, how does new data protection law affect in California?

Lourdes: The California Consumer Privacy Act, which started in California, which is still in beginning in compare to the European GDPR (EU General Data Protection Regulation). We’re still awaiting legal feedback among data privacy professionals from legislators and general councils in California, and we’re now closely watching what the law will eventually become and how it will be enforced.

At the moment, many tech companies are not ready enough, and it is supposed that will be gradually taken as the direction in accordance with the future determination. Since GDPR has pioneered data protection efforts, GDPR-aligned companies are planning to apply in California similarly.

Kohei: Thank you. I think a lot of startups turn to pay attention with data privacy, especially the fighting Covid-19 app is in serious such as Google and Apple.

My next question is your previous experience at Palo Alto Networks. I found it had very interesting topics to watch your speaking video. What is the difference from a corporate perspective regarding privacy and security?

What is the differences from data security and privacy?

Lourdes: Privacy and security are mutually exclusive and have different roles. Security experts may not have a good understanding of data privacy, and vice versa. I often feel it while I’m working each other.

As a data level, privacy is a way of specific individual, and security is more valuable with a company or organization.

The argument over data privacy is very broad, and more different perspectives on how data is obtained each other, such as how data is used, and how individuals can access it and more.

Security is very different from privacy that means to include not only personal data, but also more comprehensive data levels. On the other hand, security requires a broader definitions with non-personal data in general. It is necessary for both parties to work together besides on understanding their roles and positions.

In my early as a data privacy expert working within the security/CISO’s organization and had to share and explain it to other members, so I learned cybersecurity and information security.

Palo Alto Networks was to work for data privacy from the level of board member who familiar and had a high interest in data privacy itself. In compare to other clients, it was comfortable to work together, because management team is clear to data privacy enhancement.

I was concerned with some data privacy programs related to GDPR, privacy based product design and framework creation.

With the involvement of a developer team, we are making various efforts in the privacy field, and have been preparing for data privacy such as data acquisition, data storage period, granting data access right from the initial stage.

Kohei: What’s a real experience! Data privacy needs to be worked in early days, and it succeeds in business performances. As a next question, I want to know about regulations. It’s been almost five months since CCPA announced officially in California. It was in inspection with several technology companies such as Salesforce and Zoom. How will tech companies change their model with data privacy?

New Trend of Tech Company with Data Privacy?

Lourdes: As CCPA has a legal definition called “Sell”, which means sharing data for any valuable consideration, and this interpretation will be a major dispute. When a company sells data, it needs to follow the regulations. When it compares with GDPR, every data expert says “Sell” is very comprehensive interpretations and hard to settle with one answer.

It is not just meaning for money, but is also interpreted more various reasons. Technology companies are having a hard time to deal with it correctly. A lot of tech and non-tech companies are worried about this unclear definition “Sell” and expect to set the more concrete details in future.

Kohei: It’s obvious that a lot of companies in similar situation at early days to deal it precisely.

Lourdes: Right. I think that it will be one of the major themes regarding data “Sell” regulations.

Kohei: In Covid-19 pandemic many people is in force to work from home. Due to the virus, utilize online conference tools are getting popular such as Zoom and more. Zoom is also very popular option in Japan.

On the other hand, Zoom is pointed out vulnerable capabilities regarding privacy and security, they are working for further improvement in the future.

What’s the biggest problem with Zoom from a data privacy perspective? And if there is any movement in California such as switching to a new service other than Zoom?

Lourdes: I assume that you may be seeing online that many privacy experts pointed out on Linkedin or Twitter, but their critical issue is entire product design and mindset with data privacy.

From CEO interview, he told us with apologies, “he has never considered privacy before”.

Under the GDPR, privacy by design is required step for overall system such as privacy engineering and privacy control.

As you can see from the CEO’s statement, Zoom’s fundamental problem is that it has not designed a system that assumes data privacy from scratch.

Kohei: So many people switch to Google, Facebook, or Microsoft?

Lourdes: For example, government initiated. They are starting to show some concern, in addition to the measures being taken by Zoom itself at the moment. A counsel with security experts has been announced, and privacy experts have also entered there for discussion.

Personally, I think it is necessary to design a privacy program as an in-house organization as well as strategy building.

It is essence to consider the responsibility for compliance, and design with privacy protection in mind as a basic etiquette with business strategy.

A survey on the investment effect with privacy orientation, has already been conducted by Cisco and EY, and we are looking at how successful companies that implement data privacy strategies in B2B sales.

Apple and Microsoft have introduced data privacy as a competitive strategy. It shows the important change in society, and the awareness of data privacy.

In order to build data privacy strategy, in-house team is most comfortable to run it for long -term business, rather than hiring external experts. It is better to establish a system that can make an overall design based on data privacy and security.

Kohei: I think companies will need to tackle data privacy issues in accordance with online activities and spend more. It means that current software model will be changed drastically.

The next question is a bit about grand design, but I would like to ask you about the data protection law in the US federal level, the topic was from your Medium blog. I think there are some movements including the FTC, and many discussions about data protection in each state. How will the government move toward in the future?

Federal Data Protection Rules will come?

Lourdes: I think the influence of this pandemic is gradually raising awareness of lawmakers towards data privacy. We have already applied for some bills, but so far none have actually passed. We anticipate that there will be some new movements when the current pandemic subsides.

The point to be noted from now on is whether any privacy requests and claims will be upon from individuals and consumers, and whether federal law will have preemption on each state law. Preemption is the structure whether federal law supersedes state law or not. It ups to case-by-case, but it can be imagined with the case of a health insurance interoperability and accountability law called HIPPA.

HIPPA is federal law and preemption on state to state. In California, enacted their regional HIPPA law. Therefore, federal HIPPA is a baseline, and the higher level of the HIPPA law in California applies at once.

This is an example, and other states have different levels of exclusion rights has been designed. Therefore, complicated design is existed, but each company strongly advocates the preemption under federal law and expects the direction to respond only to federal law without each state law preparation.

In addition as another major reason, companies is in solicit to i consolidate into one, because there are 48 or 49 laws related to data breaches such as California and Washington.

My personal concern is that many of the applications that have been filed so far. Even it is not similar to GDPR, it does not define with privacy requirements at the government level.

Data privacy need to be protection more than the private sector, but for government surveillance. In particular, in the event of an emergency such as Covid-19, it is hard to stand against government surveillance quickly but I think that it is necessary to reconsider public data privacy.

Kohei: There are similar problems in Japan as well. It exists over 2000 local data protection rules, which is a very complicated mechanism. In the current Covid-19 situation, even government has announced that it will use data anonymously, but the issue of transparency needs to be solved such as how it is actually used.

I think that data privacy and data utilization should be dealt with an appropriate balance.

The next, I want to know “The Rise of Privacy Tech” community. What is this activity like?

What is the Privacy Tech Community “The Rise of Privacy Tech”?

Lourdes: A community we started recently because we found during to talk with colleagues, and need to broaden and develop privacy-related technologies. Until now, online interaction was the main focus, but we have often received requests from investors to learn about data privacy-related movements, start-ups, etc. Therefore, we are expanding the community that connects both parties as an evangelist.

We plan to launch a website in the near future, and we hope to create a flow of funds for privacy technology by making it a place for entrepreneurs, engineers, investors, etc. who are familiar with privacy technology to gather.

We plan to host a virtual summit this June and would like to announce more on The Rise of Privacy Tech website. We are working with the development team to hold this event.

Kohei: That’s a very good initiative. Privacy technology will be come out more including major technology companies, and startups cooperation will become more important.

Lourdes: Silicon Valley’s legal movements have lagged behind technology, and I think the new legal efforts around the world are very slow. By establishment of the community is the way to pursue efforts that can be solved by technology rather than waiting for the law.

Through the community, we would like to create an environment where startups with privacy technology can work on solving problems.

Kohei: Great announcement, please give a message to everyone listening to this interview.

Message to Listeners

Lourdes: Business executives, lawyers, technologists and individuals with an interest in data privacy would love to address this area. Pew Research has announced at annual report, more than half of Americans say that they will only use services that are sensitive to privacy. That means to be raised awareness of privacy is now.

On the business side, there are moves to use privacy as a competitive strategy, and not only the impact of changes in the law, but also new measures such as measures against competition and changes in consumer awareness are gradually emerging.

Kohei: Thank you for your wonderful message. I think it will be important to hold hands and work together. Thank you for the wonderful interview.

Lourdes: Thank you very much.

Thank you for reading daily Collabogate overview and please contact me if you want to be writer of research blogging.

Looking for Collaborator to start working with global network! Please register below the link for business collaboration together.
['Blockchain Project Research Study']
['Law', 'Data', 'Privacy', 'Business', 'Technology']