Tom: 00:00

You got to give some recommendations. You just can't say, here's all the bad stuff or whatever, you figure it out. No, you need to provide a roadmap, guidelines, et cetera. And what I wanted to do is allow customers to connect the dots between the issues that we are facing from society when we have this significant overcollection of data, the increasing ways that AI is being used, and how it can introduce bias or even be exploited with dark patterns, deep fakes things that your listeners care a lot about.

Intro: 00:33

Are you ready to know what you don't know about Privacy Pros? Then you're in the right place.

Intro: 00:38

Welcome to the Privacy Pros Academy podcast by Kazient Privacy Experts. The podcast to launch progress and excel your career as a privacy pro.

Intro: 00:49

Hear about the latest news and developments in the world of privacy, discover fascinating insights from leading global privacy professionals, and hear real stories and top tips from the people who've been where you want to get to.

Intro: 01:05

We're an official IAPP training partner.

Jamal: 01:08

We've trained people in over 137 countries and counting.

Intro: 01:13

So whether you're thinking about starting a career in data privacy or you're an experienced professional, this is the podcast for you.

Jamal: 01:29

ud provider that amassed over: 2000

Tom: 03:01

Well, thank you. Great to be here and yes, great to be joined by a fellow author. I hear really good things about your book as well.

Jamal: 03:09

Thank you, Tom. You're very kind. Now, before we get into the meat of it, we have a question for you. What's one thing that most people would be surprised to learn about you.

Tom: 03:18

I am a huge fan of my alma mater, which is the University of Michigan. Just absolutely love the football team. I live and die by my college's exploits on the football field. So that's maybe something that people may not know about me.

Jamal: 03:37

Nice. And do you play or did you play?

Tom: 03:39

No, I didn't, but been a lifelong fan for many, many years.

Jamal: 03:45

Awesome. Now, how did you first get started in privacy and cybersecurity?

Tom: 03:50

but California had passed in: 2018

Jamal: 05:20

What motivated you to do that?

Tom: 05:22

out. In California we in the: 1970

Jamal: 07:13

That's super awesome story. So from what I've understood, you came across GDPR as part of your business. It was one of the challenges that came up, and you were like, we need to solve this challenge. And you got curious about, what is this GDPR? What do we actually have to do? As a cybersecurity expert, it was quite easy for you to understand the privacy concerns, and then you actually became quite fascinated with it once you sold the company. And you were like, let me take a deep dive into this. So you went and did as much as you could to learn and learn, and then you got so inspired by this protection that Europe has given to all of its citizens as it treats it as a basic human right. And it was like, you know what? We need more of this stuff for people around me, for the state that I live in. So that really inspired you to say, how can I make a difference? How can I leave a legacy? And how can I really help people to protect themselves against these weaponization of data I'm seeing and also, how can I also be part of a future where I'm seeing this trend towards moving towards privacy, where we are seeing this paradigm shift. And that led you to getting involved with the actual privacy legislation and really driving that forward. Is that what also inspired you to write your book Containing Big Tech?

Tom: 08:17

Absolutely. Yeah, no, that was a great summary right there. That was kind of the evolution that I had. Yeah. So it was definitely the combination of my policy work, living and breathing here in Silicon Valley. This is where a lot of the major tech companies come, literally. My house is five minute bike ride from the headquarters of, you know, you drive by the large tech players. A lot of this happened here at Stanford. And so I think it's a combination of the policy work I have done in privacy, my Silicon Valley background in terms of understanding from whence the companies came from that collect the large amounts of data about us, my cybersecurity knowledge in terms of some of the negative consequences of not properly governing, protecting, securing sensitive personal information. All that led me to, yes, wanting to kind of put my collective knowledge and work in a book called Containing Big Tech. And what I'm trying to do is I'm trying to deliver for readers a clear path forward to rein in online surveillance, artificial intelligence, the tech monopolies. I definitely believe that the innovation that some of the larger tech players has been quite positive and I've seen the positive aspects. But increasingly, things in modern day can have a double edged sword and there's corresponding risk associated with this large scale collection of our data. And so what I'm trying to do is put forth together not only identify some of the problems, but also provide guidance to policymakers, but also individuals. What can you do to enhance your security online, enhance your privacy? And I put that in the book as well. So it's actionable and it actually provides solutions and I wanted to do that as well.

Jamal: 10:11

What I'm hearing from everything you're saying is you are really passionate about protecting individuals rights. You want those individuals to be protected from harm. At the same time, you can see the benefits of innovation, benefits of technology. But because of your experience, because of your insights, you also know the harm that can happen if this isn't contained. And what you decided would be the best way to serve and add value would be to contain all of that information in a book so anyone can access it. And it's easily available for those who want to understand how to really contain big tech, some of the harms that could creep up and how they can protect themselves as individuals and as business leaders, as professionals, how we can play our part by getting that awareness, so we have clarity on what the harms are. And then we are confident so we know what it is that we need to do to be able to put in the necessary protections and be aware of the things that we need to look out for.

Tom: 11:03

Actually, Jamal, I mean, you obviously did the Easy Peasy Guide to GDPR, right? And that was to make something complex, to be simpler. Obviously, in your case, it's practitioners of privacy that have to ensure that their organizations are meeting the standards of not only what's set forth from a regulatory perspective, but setting forth what customers expect nowadays. Right? And so I kind of took a similar tact, which is, look, there are books about big tech, there's books about privacy and the impact on consumers. There's books on artificial intelligence, but they tend to be very academic and they tend to be very dense. And it's not something you could hand your Uncle Larry, who's curious about this. What I wanted to do is provide something that an informed citizen, someone that cares what's going on, can read and kind of get the easy peasy I'm stealing your motto here, by the way. Unfortunately, you probably yeah, exactly. It's like the Easy peasy guide to the threats and benefits of big tech and what you can do. Right? And that's what I try to do, which is try to take the complexity of like, well, what are they doing with artificial intelligence? And what's algorithmic amplification and what's this ad tech thing and what are data brokers and third party data versus first party data, et cetera. And I didn't want people's head to spin. I wanted to tell a story of like, this is what they do, this is the actual impact. And here's what you can do. Because Jamal, you know, you got to give people solutions, right? You got to give some recommendations. You just can't say, here's all the bad stuff, or whatever, you figure it out. No, you need to provide a roadmap, guidelines, et cetera. And what I wanted to do is allow customers to connect the dots between the issues that we are facing from society when we have this significant overcollection of data, the increasing ways that AI is being used, and how it can introduce bias or even be exploited with dark patterns, deep fakes, et cetera. Things that your listeners care a lot about. And then what's the impact of having such consolidation in the industry with large tech players? Does that exasperate the issues associated with overcollection, the issues associated with AI bias and exploitation? And so that's the picture that I wanted to paint here in a way that's easy peasy for the average consumer to understand. What are the issues that we face as a society as technology comes to the forefront and dominates this ever-increasing digital age?

Jamal: 13:43

Wow, that sounds super insightful and super fascinating. And our listeners are fans of making things Easy Peasy, taking the complexity out of the complex stuff. Where can our listeners get hold of your book?

Tom: 13:53

Yeah, so it's available August 22. So basically, probably by the time this runs, it will be out. You can still pre-order it today. So it's available on Amazon, a big tech platform, but it's also available in other online sources plus go to your local bookstore and ask for a copy, and there's no doubt that they'll order it and give it to you as well. So I'm fully supporter of brick and mortar books, but of course, in today's digital age, a lot of it's ordering online so you can get a physical hard copy. It's also available on eBook, and then it's also available as an audiobook version as well. So all media formats, paper, file, and then files in the form of writing or files in the form of audio. So audiobooks, eBooks and hardcover.

Jamal: 14:39

Awesome. So if you're listening and you're fascinated by this book, it's available in whichever learning style you prefer. If you're like me and you prefer reading books that are physical and hard copy and making notes in them, then you can buy them from Amazon and any major bookstore. If you prefer to have it on your Kindle or your Apple device, or have it mobile and digital, then it's also available there. And if you're someone who learns by listening and you want something while you're taking your dog for a walk or you're out taking your walk or doing some kind of exercise routine, that's how you love listening. Then you can also get the audiobook as well. Now Tom, tell me, did you do the recording for the audiobook yourself?

Tom: 15:14

No, I decided to leave it to the professionals. I wrote the book 100% myself. I didn't have a ghost writer. It's all my heart and soul that I put into it. But when it came time to actually having someone read it for the listeners, I decided to go with a professional and it sounds great. So I'm sparing the listeners having to hear my voice for 7 hours.

Jamal: 15:40

Well, I think you have a great voice. I think you have a great voice. But yeah, I mean, the thought of reading my book out and having it recorded is also something that I've been putting off. So it might be a good idea just to get a voiceover artist to do what they do best.

Tom: 15:54

Absolutely.

Jamal: 15:55

So you've got the book, you were part of the privacy legislation. What are some of the challenges that came about with getting this legislation together, especially in the US. And what's the way forward?

Tom: 16:04

a came forth with the CCPA in: 2018

Tom: 18:16

And so I think the next step, what we're trying to do and what we're thinking about from a legislative process is how can we make privacy easier? One thing that people have in Europe is cookie fatigue. You know, it's cookie, cookie, cookie. So that's not easy because by default, even though you have the rights, people don't exercise it because who has time to go through and kind of like do I want marketing cookies, do I want analytics cookies, et cetera. And that involves obviously first party data. But what do you do in the US? We have this third party data from data brokers who you don't even have a direct relationship with. So I think the fundamental challenge that exists for consumers is that privacy is too hard. Right? And I urge if your listeners that work at corporations that don't put the dark patterns out there, make it easier, customers will actually in the end appreciate it and they get frustrated, et cetera. It's a short term win that if you make privacy hard. Right? And so I think the big challenge that we have across the globe is that, yes, we now have some of these rights. Obviously GDPR being first, California and California has influenced eleven other states to come out with privacy laws. So the US has twelve of the 50 states has privacy laws. Yes. Does it make it very difficult for privacy practitioners to figure out what do I need to do in Colorado versus California? Yes. And hopefully the US will get a federal standard. But I think really, once we get in the US at least a consistent standard, I think the next wave is how can we make it easier for consumers to take advantage and not have to do the cookie fatigue, not have to individually make requests to hundreds of companies to delete because no one has time for that. And that's just terrible. And so I think the next wave, next phase of what needs to be done is simplification and make it easier for consumers to actually have their rights be implemented.

Jamal: 20:11

I love that. I'm all about simplification and when I'm working with clients on the consultancy side, that is exactly what we're trying to do. We don't just want to tick the box and be compliant. We want to go beyond compliance to really earn trust. Because big forward-thinking companies understand that when you earn the trust, those customers are more open and they have longer relationships and actually you have better customers for longer. And that's exactly what all businesses should be seeking to create rather than think how can I trick them into giving me some cookies? Which is only going to be a short term game. What I've realized about you, Tom, from speaking to you for the last half an hour or so is you have this really big vision and you can see the future and that's probably what's really helped you to do really well. But you seem to have this gift of we can see where things are going and you automatically see the bigger picture rather than getting lost in some of the detail. But from your background, I know you have the ability to go into that fine tune and you understand the detail. But having that higher lens, future proof perspective, that's amazing. How did you develop that?

Tom: 21:09

In Silicon Valley there's a lot of focus on user interface for the products. The gold standard in technology is Apple and it's the user interface and that's kind of the mindset right here, just making products that delight consumers. That's kind of the background that I have and what I'm trying to focus on. And so what I think we need to do is apply that to privacy as well. It's that simplification, Jamal, that you talk about. It's delighting your customers. Privacy should be a selling point. You know when you work at a corporation and you're a privacy technologist, make it a differentiation, make customers love you. And I think that's the mindset that I have coming from Silicon Valley where we try to delight people with technology, but now when it applies to these issues that we have to address from a regulatory perspective, we should really also focus on trying to delight the actual end user as well, because that generates significant amount of goodwill. And so if your company puts forth dark patterns that basically trick people, people will resent that. That's flat out not good if you make it burdensome to the consumer or if you collect data and then they find out that you're using the data for another reason. Like you say, give me your phone number and we'll use it for multi factor authentication but then all of a sudden you start spamming people text, you're going to lose customers. And I know, Jamal, you probably say you talk about data minimization, you talk about the usage of data.

Jamal: 22:54

Purpose limitation.

Tom: 22:55

Exactly, purpose limitation. And that's part of your job is telling people that this is the reason why they put this forth. And it's good that if I sign up for multiple factor authentication and I give my mobile number right, ten minutes later, I don't want an ad being texted to me from the company. That's not good. And that's how you lose customers. And so it's really about having that mindset. That's where I come from.

Jamal: 23:24

That's a great place to come from. I'm exactly where you are. I love all that. I'm really passionate about making sure that companies do the right thing to go beyond compliance and actually inspire trust and cultivate confidence in them. And you said is exactly right. That's exactly what we should all aspire to do, is make it easy peasy for them, not have all of this legalese and pages and pages to understand what you're going to do with the data that you're asking them for. Make it easy, one, two sentences. That's all people want to know to make informed decisions. The challenge is sometimes you might be thinking you're not doing anything wrong, but if you make it difficult for people, you're not managing their expectations. So they might not actually know what they're signing up for. And because their expectations are one thing and you believe you've managed their expectations and you haven't, that's what's going to cause that distrust. That's what's going to cause that breakdown in relationship. And I know there's some stuff going on with the FTC and Amazon, the prime membership, with all of these dark patterns and things right now. So this is why it's super relevant and super helpful right now. Now, AI is the new hot topic. ChatGPT has put that into everyone's minds. Are there any specific areas where you believe regulation needs to step up to make sure that we have ethical use of AI moving forward?

Tom: 24:36

First of all, most people didn't think too much about AI until just recently. But clearly we're now in a situation with ChatGPT, it's come to the forefront. But we've had AI for a number of years, right? We've had automated decision making, stock trading, et cetera. And AI has so much promise, especially in the medical field. For example, in terms of better detection of diseases, clearly I actually drive a Tesla. And it's just amazing, the sensors and integration and recognizing a bike versus lamppost. And there's just so many good things about it. And then obviously, with ChatGPT, it's now about text to images, it's about text to full text, and just the ability to get executive summaries based on simply asking a question. It's amazing technology, right? And it can be used in a lot of positive ways. But there are some concerns. And so the first concern actually is reflected in GDPR, which is, hey, if there's an automated decision making process happening driven by AI, I should have the right to object, to say, wait a minute, I got denied this loan. It appears there was no human intervention right there. So I think we should have some fundamental rights as it relates to that. I know GDPR references it vis a vis profiling. We don't have something like that in the US. But then it also goes to transparency that we as humans should have the right to know if this actual image, this text, was generated via AI, or are we interfacing with an entity that's human or AI. Because sometimes it's confusing when you're on a chat bot or talking to someone you just don't know. So I think there needs to be the ability to object, but I think there also needs to be privacy, food labels, as well as better transparency of whether or not this image, this text, this content was generated by human or by machine.

Jamal: 26:37

I love that. So essentially, if we was to sum it up, what we're saying is we need more control to the individual about what happens with their information and when they're actually interacting for transparency to know if they're actually interacting with a human or if they're interacting with something that is not human Artificial Intelligence. Now, one of the things that I want to go back to, which I completely forgot to ask you before we moved on to AI was you said that you've introduced a CPRA and in California you also now have a regulator. What I was thinking was the Adequacy decision. So yes, it's great that we have something in place. I'm not sure how long till Max Schrems comes and has some fun with that, but do you think the way you are in California right now with the regulator, with independent oversight, with the level of protection that you have, that you could potentially be a candidate to be granted an adequacy decision by the European Union? And was that part of the goal as well?

Tom: 27:28

I mean, it wasn't the driving goal of why we did this, but it clearly was a thought through after effect of coming out with this. And I know that folks from the EU have recently met with the Privacy Protection Agency. There have been some discussions with various board members, with the appropriate people in Europe. So it's clearly something that being discussed. And this is all public information in terms of news articles have reflected that. But at the end of the day, California is just a state. We do have a federal government that has a national security agency where oftentimes data flows through from overseas. And I know that they've put in place just recently the Biden administration and the EU have put together a framework and Max Schrems said we're going to go after that. So we may still be in the same position or situation as we were before. But yes, I think California, if we could resolve any legal battles that may occur as it relates to the framework that has been recently set forth, then I think California would probably be the first state in the US to have the Adequacy, and I think that would be a great thing across the board. But unfortunately, we're in a situation. We're not a country, not unfortunately, but it is what it is, is that we're a state and we have a national security apparatus and we have an administration that has negotiated something and I do get the sense that it will be challenged like the prior two attempts were challenged as well. So we may be back to square one on this.

Jamal: 29:10

It'll definitely be interesting. And I can see a lot of people are actually approaching this with a pinch of salt because they're worried that they're going to have to go back to SECs anyway. So they're just deciding just. To make life easier and just to stick with that wherever possible. Now, you've had some amazing successes throughout your career. What's been the mindset that's really helped you to be as successful as you are?

Tom: 29:31

It starts with the fact that any entrepreneurial undertaking is a team sport. And so you need to have teammates around you if you're going to play the game of basketball. You just can't put one person on the court, which is you. You need to have co-founders, you need to have colleagues, and you need to be respected as a person that gets things done, that's trustworthy, et cetera. Because oftentimes in your life, in your career, that the people that you interact with for the first few years of your career, they may go off and they may join other companies, and they may become the hiring managers, or they may be the potential customers down the road. When I was at Centrify, it was great that some of our original customers, we delighted them, right? And then when they left their current companies and went to a new job, they just called us up and said, hey, come on in, I had such a great experience before with your product and your company. I want to use it again. And that just significantly reduced the sales cycle. So I think the first bit of advice is in business and in life, it's a team sport, right? You can't be on an island unto yourself. You need to be looked upon as someone that gets things done, is competent, is ethical, is not someone that you can't rely on, and that builds confidence in you. And so as you kind of move up the food chain, that you have a network of people that support you. And I think that's so critical in a career, because as an investor, I do a lot of seed stage investing. It's called angel investing in Silicon Valley. And I'll sometimes I'll have an entrepreneur come to me and say, hey, can you invest in my company? And I'm like, who's the team? It's just like, oh, it's just me, right? And if you give me money, I will then hire people. And I'm like, well, the problem is, if you get hit by a bus, there's nothing in the company. You're like the intellectual property. And if you can't convince someone else at this early stage to take this journey for you, how are you going to convince customers? So it's so important to understand that it just can't be about you. It's got to be about the team and being successful. And if you look at the great companies that formed, there were multiple co founders making it happen. I mean, if you look at Google, Larry and Sergey, it wasn't just Larry. If you look at Microsoft, it was Paul Allen, it was Bill Gates, et cetera. All the great companies Steve Jobs and Wozniack and it provides yin and yang and provides balance. That's so critical in one's career is to understand that you have to work in the framework of a team and you need to be a good team player.

Jamal: 32:23

Wow, super insightful. And one of the things you mentioned there is as you're moving up the ladder or as you're progressing one of the things I've noticed is with some of my mentees is when they progress in their roles, one of the things I've noticed personally, very recently, actually, is as I'm progressing and growing and having more of an impact and getting more success, you also start attracting people who, for whatever reason, are very unhappy about your success, to the point where they start trying to attack you and defame you and just doing all sorts of unethical things. How do you deal with those? And for anyone who is suffering or experiencing that, what tips do you have for them?

Tom: 32:59

That's a tough question because at the end of the day you want to surround yourself with people that are positive, right, and that they're working towards a collective goal as opposed to making it about themselves. And if you're in a situation where people are at the end of the day that it's about them, et cetera, then you should just don't worry about it because haters going to hate. You got people that are eating hater tots, drinking hater aid and in the end people will eventually see that they'll stifle them in their careers. I think the key thing is that, keep the positivity and seek other people that encourage you and not discourage you and have healthy relationships. And so I do understand that as people move up in life and in career, there are going to be people that are just haters or just going to be jealous. The key thing is looking yourself in the mirror and say, hey, throughout this process I've been a good team player, I've done it and I bubbled up to the top based on doing things in an ethical manner and treating people well. And so yeah, at the end of the day you are going to see situations like that and so you just say, hey, actually I feel sorry for these people but I'm just going to focus on being positive and continuing to be a good team player. And, yeah, at the end of the day, if you are good at something and you have those ethics or whatever, that's going to take you far. And in the end, there always will be some noise out there, but they're going to be in that noisy land, and you're going to be with the type of people that appreciate excellence and appreciate hard work and ethics and treating people well. And that's critical. If you become a CEO of a company or whatever, there is some baggage with it, but you get a big chunk of the awards as well. So if you want to play in the big leagues. If you want to play in the Premier League, you're going to have people booing you, but at least you can say, hey, I'm in the Premier League, and I did it through hard work.

Jamal: 35:06

Awesome, awesome. Great tips. Great tips. Thank you so much for sharing, Tom. Now, Tom, at the end of the podcast, we give our guests an opportunity to ask me a question. So what would you like to ask me?

Tom: 35:16

I'll take that same question that you asked me. What is something that people don't know about you that they may find really super interesting?

Jamal: 35:23

So I have this phobia of heights, so I don't like getting anywhere past, like, the second floor kind of thing. I will stay away from the air, so if there's a balcony, I will stay back, especially glass buildings when you get to the top, it makes me feel a little bit nauseous. So I decided to tackle that and decide I'm going to do that for charity. So I jumped onto a plane and jumped out and just, oh, my gosh. If you watch the video, you can see me closing my eyes and praying as I'm about to jump out, saying, no, I don't want to jump.

Tom: 35:49

Jamal, that's incredible. Actually, that's a very brave of you and I'm glad you did that for charity. I think that's a reflection on you, a very positive reflection on you that you decided to make it public and tackle it head on and do it in a way that people can. They may laugh when they see your facial expression, et cetera, but you were the person that faced that head on, and that's great. And I think that's a great life lesson, is that try to make a weakness into a strength. If there's a failing or if there's areas of weakness, that it's okay to admit it and to try to move on and address it. And that's amazing.

Jamal: 36:30

Thank you very much, Tom. You're very kind. So we've had an amazing podcast. We spoke about Tom's background at Centrify. We learned about how Tom first got started in privacy and cybersecurity and what sparked his curiosity to really take a deep dive and then come back and say, I want to really make a difference and leave my legacy behind. And he got involved in privacy legislation in the US. And that also inspired him to write his book, Containing Big Tech, which is released on August 22. You can pre-order that at any major bookstore. It's also available in digital format as well as audiobooks, so make sure you all go and grab a copy of that before you forget. So that's the first thing I want every single one of you to do is go onto Amazon or go onto your local bookstore wherever you love getting your books, look for Containing Big Tech by Tom Kemp and go and pre order a copy and let's show him some support because he's doing everything he can. I know how much hard work goes into authoring a book and the revisions and the endless feedback. And if you're anything like me, and you probably asked everyone you know to say, how can this be better, then you put some real effort into it. And you've also actually taken the time to get it done in an audiobook so everyone can learn. If you have a neurodiverse mindset, then you can approach that in any format. And the one thing Tom has been saying throughout is, it's all about delighting the customers. And Tom, I guarantee you, has been thinking about you and every single person that's going to pick up this book and said, how can I make sure this individual is delighted by the time they start reading my book all the way through to the end and beyond. So I'm going to go and grab a copy. I might even grab a couple of copies from my team. Tom, I will send you a selfie when mine arrives next month. It's been an absolute pleasure having you on the show.

Tom: 38:08

I just want to say I really appreciate what you've been doing and also appreciate the opportunity. It's a great honour to be on your show here. Thank you so much.

Outro: 38:18

If you enjoyed this episode, be sure to subscribe, like and share so you're notified when a new episode is released.

Outro: 38:26

Remember to join the Privacy Pros Academy Facebook group, where we answer your questions.

Outro: 38:31

Thank you so much for listening. I hope you're leaving with some great things that will add value on your journey as a world class privacy Pro.

Outro: 38:39

Please leave us a four or five star review and if you'd like to appear on a future episode of our podcast or have a suggestion for a topic you'd like to hear more about, please send an email to team@kazient.co.uk

Outro: 38:53

Until next time, peace be with you.