Rebecca: 00:00

Big tech has done a great job in marketing themselves as great employers, right? Like, they have lots of people who are paid to tell you why you should go work for them, and then they have all these wonderful benefits. So I think sometimes the benefits of working in public policy or government or in academia, they don't get the highlights that they fully deserve. So I really want to take this opportunity to talk about the really great things about working as a privacy professional in these other areas.

Jamal: 00:28

Are you ready to know what you don't know about Privacy Pros? Then you're in the right place.

Intro: 00:33

Welcome to the Privacy Pros Academy podcast by Kazient Privacy Experts. The podcast to launch progress and excel your career as a privacy pro.

Jamal: 00:44

Hear about the latest news and developments in the world of privacy. Discover fascinating insights from leading global privacy professionals and hear real stories and top tips from the people who've been where you want to get to. We've trained people in over 137 countries and counting. So whether you're thinking about starting a career in data privacy or you're an experienced professional, this is the podcast for you.

Jamal: 01:20

been working in privacy since: 2010

Rebecca: 02:44

Oh, I am still working on German, that is, or maybe Swiss German. I live in Zurich, Switzerland, and the German challenges just go on and on. I'm working on it. I'm officially a B2 level. I'm not fluent yet.

Jamal: 02:58

Right, well, that means you're a lot more advanced than me with your German language skills. I did it when I was in high school, so we had to pick a European language. And I picked German, so that's good.

Rebecca: 03:09

Yeah.

Jamal: 03:10

You've had an impressive career journey, especially as a former manager at Google, and now you're a founder of your own privacy consulting firm. Can you share more information about your personal journey into privacy and specifically what initially drew you to privacy?

Rebecca: 03:25

ne thing that happened was in: 2009

Jamal: 04:43

How close is the nearest cyber cafe from where the clients are likely to be if they're on a remote farm?

Rebecca: 04:48

So we had some advanced users who maybe they weren't the actual farmers, but they were working with the farmers and helping them get information. And so we had some features on our website designed for them. And so the idea was, like, they could occasionally, maybe once a week, come in into the cyber cafe and use the computer to get our information. So we built this feature and I wanted to test it, and I wanted to bring in some folks just to sit behind them and watch and see if they could use this feature. And it didn't work. And it wasn't because of my feature. You have a user who's not always typing and they have to enter their password and they can't see what they're typing. It's the very first thing they type, or one of the first things after the URL, and they cannot even see it. And it was hard because I'm just sitting behind them, wanting to see if they can use the feature and they can't even log in, and it's such a struggle. And I went back to my manager and I was like, we need to make sure that people can see the password because they can't use our product at all without that. And my manager was like, no way. You can shoulder surf in a cyber cafe. Like anyone can look over your shoulder. I mean, it's totally true, and I didn't have a good solution. You have this very constrained user, and how do you give them the security that they need, but at the same time address their usability issues? So jump ahead a year. And I had joined the PhD program at Carnegie Mellon and was really lucky to work with Lorrie Cranor on usable privacy and security. So that's really where I got started, because I love these hard problems. I love these things where there's no obvious answer. We want people to have privacy. We want them to have security. But that human factor is real.

Jamal: 06:36

So I got to ask, because my mind just can't deal with open loops. Did you find a solution to that challenge?

Rebecca: 06:41

't really a potential back in: 2009

Jamal: 07:12

So you've got this technical background. You've come across a challenge that drew you on to go and pursue some academic research into figuring out how we can solve these harder problems. And then you've decided that you want to start a career in privacy, or you want to pivot to a career in privacy.

Rebecca: 07:28

My degree was in engineering and public policy, and really, it's a program where they take people with a technical background and they teach them how to analyse policy issues. And I think the work I was doing in my PhD program was really good for that, because it's like, what do we need to know about smartphone app privacy? Are we giving people the right notices? Should people be making regulation about notices? Do the notices even tell people what's really going on behind the scenes? So that's what I did my PhD on. And then from there, there was this choice of, where do I go? Right? Go into government and work on regulation. Or I could go into industry and maybe help them solve it from the inside, or I could stay in academia and maybe teach more students how to do this kind of research. So I think there's so many choices and so many ways to make an impact. There aren't always, like, guideposts for which one is going to be the right choice for any one person.

Jamal: 08:30

And how did you make that decision?

Rebecca: 08:34

So I ended up going to a non-profit, partisan analysis firm that provides analysis on policy, but it shouldn't depend on which party you belong to. And honestly, one of the main reasons I did that was just like, sometimes we have family constraints, and I did, and I needed to stay in Pittsburgh, Pennsylvania, and the US. And so it was this actually pretty cool opportunity and allowed me to stay in Pittsburgh. Yeah, sometimes it's not always about whether the career is exactly right, but what else is going on in your life?

Jamal: 09:11

What was the main thing that you took away from that role?

Rebecca: 09:15

That was a really cool opportunity. I did things like advise DHS on how to deal with privacy and bias and face recognition and just coming up with that kind of framework for their use case. It's really high level thinking and thought leadership. And when you're working in public policy or regulation, you have to come up with the principles that are going to work for the most people. You're not necessarily digging into the specific implementation of one border crossing camera and how it uses face recognition or how it stores data. You're going a level up. Honestly, that's something I really enjoyed about working in policy.

Jamal: 09:58

Yeah, it must be quite fascinating. One of the things I love most about the GDPR is how it's principle based and not very prescriptive, which means it's up to us practitioners to put those into practice. But going all the way back to the OECD guidelines and the principles they introduced, it amazes me how they were able to come up with these principles. And like you said, you can't sit there and think of every single scenario in every single industry for every single size of business in every single location. But these guiding principles, 80% of the time they will give you everything that you need. And some of the other times, you need intelligent people like you to say, hey, you need some help here solving these tough challenges, can you come and give us a hand. So Rebecca, what tips or practical advice would you give to someone who's listening? And they're interested in a career in privacy, so they're looking to pivot into privacy, but they're not sure which area is the best fit for them, whether they go down the management side, whether they go down the technical side, whether they go down the engineering side. Given your diverse background in academia, governance, and the insights that you can share about the different opportunities available, so what advice or what tips do you have for our listeners?

Rebecca: 11:01

So, honestly, this was the most frequently asked question I have gotten in my career. So I taught some privacy engineering classes at Carnegie Mellon, and then while I was working at Google, I mentored people. And this is what people are always asking, like, government, academia, industry, where should I go? I mean, those aren't the only options, but the kind of, like, big and obvious options. And yeah, we can talk about different careers within those next. But first, I just want to talk about which type of area, who is going to be your employer. I mean, I worked for Google. I think big tech has done a great job in marketing themselves as great, right? Like, they have lots of people who are paid to tell you why you should go work for them, and then they have all these wonderful benefits. So I think sometimes the benefits of working in public policy or government or in academia, they don't get the highlights that they fully deserve. So I really want to take this opportunity to talk about the really great things about working as a privacy professional in these other areas. So, for example, if you're in public policy or in government, then you're really working at a high level. You are really trying to come up with the principles that are going to have a lot of impact on a lot of people. I think it's really great to see people coming up with that. Actually, I have a little bit of trivia for you. Can you guess what famous politician I cited for their smartphone privacy work in my thesis and in many of my papers?

Jamal: 12:35

When did you do your thesis again?

Rebecca: 12:38

Finished it in: 2014

Jamal: 12:40

2014? Bill Clinton?

Rebecca: 12:43

No, actually, it's someone who's a world leader right now.

Jamal: 12:46

You're going to have to tell me because I don't want to embarrass myself by guesses.

Rebecca: 12:49

No, I mean, most people don't know this, but Kamala Harris, when she was the Attorney General of California, did a lot of work on smartphone privacy. So I'm not saying you have to go read my academic papers, but if you did, you would see her cited there. And it was really good work. It was really good guidelines. At the same time, you see people in government and regulation. They don't stay in government and regulation, but it's really a good place to jump off from. I will probably pronounce her name incorrectly, but Ann Cavoukian came up with the privacy by design principles while she was the I forget the title. The commissioner.

Jamal: 13:27

The something commissioner or Ontario of Canada or something like that.

Rebecca: 13:30

Yeah. And so it can seem like you have to go into tech to be a privacy engineer. But there are really many great opportunities if you stay in government or if you stay in public policy. And then of course, the other opportunity is in academia, and you can really make an impact as a professor, of course. I read a study about bias in computer science in particular. It was like, bias against women that people might have this bias that we're not as technical. And they're like, what's the thing that really lasts? Is there some kind of training that will really convince people that women can be technical too? Which is, like, sad that we have to study that. But one thing they found is, like, if you have a professor or a CS professor who's a woman, it's going to create this lasting impact. And reduce your bias. You know, women, whichever underrepresented minority you might be in, you can do a lot of good as an academic. The other place where I think privacy pros can really make a difference, that's sort of like an under looked field is as staff at universities. I also was like a web developer staff, full time staff at a university. And actually just before this podcast prepped, I went to Jobs Harvard.edu and I was like, how many privacy people are they hiring? And I found multiple positions that either said privacy or data stewardship. We're really talking about how to protect privacy. So academia is also a great option. And one of the things about working in academia is, at least in the US, the campuses have a lot of amenities. If you want a job where there's a swimming pool and probably more educational opportunities, then really consider a university as a place to work.

Jamal: 15:27

Great. So you've given us different areas that we can build careers in and you've given us the kind of benefits to think about of each of those. And I think what you're really saying is when we consider which area we want to go into before we actually go and look for a job, what we should be thinking about is what is actually important to me and why do I want to do this thing? Do I want to make an impact? If so, then policy at the government level is probably going to be the best way for you to do that. Do I want a package that's tailored with a high corporate with all the benefits, but I'm going to be in more of a box? Then you can go and do that. Or do I actually want to inspire other people and have an impact and actually empower the next generation of people who are going to go on to do great things and go into something like academia. So what you're saying is really get in touch with your why. Why do I want to do this? What am I looking for? How do I want to go and serve in the world? And then once you've actually found your why and what you want, then go and find the actual area that is best aligned to help you to fulfil that. And wherever you look, the opportunities are there. Just like you said just before you jumped onto this recording, you had a quick browse on a website and you found multiple jobs. So all of the opportunities are there. We just have to look to find them and seek them out. But before we just start going and applying for anything and having a go is we should be clear on why. And what I found through my mentees is the ones that are more clear on what they want to do, why they want to do it. They're more targeted with the kind of roles they're applying for and they're actually getting those offers, even though they might not have the relevant experience that they're looking for, is because they see that passion. They see, hey, we want you on our team because we can see where you want to take this. We can see the zeal you have for this, and we believe you'll be a great team fit. So I completely resonate with the message that you're giving there. One thing I do want to get a bit more clarity on is, for someone who is never heard of privacy engineering, it's just a concept to them. What does a privacy engineer actually do?

Rebecca: 17:17

Every privacy engineer says something different, right? Basically, a privacy engineer is someone who's on the technical aspect of data protection. So they may be lawyers, but they may also have engineering background, and so they can be at the stage of reviewing a product or reviewing a new feature and saying, you didn't consider these things, or like, the retention time that you're recommending does not match with what the user expectation will be. And also it doesn't match with the way our databases are set up and how quickly they can delete things, right? So a privacy engineer might be able to consider all those things. Privacy engineers might also be the people who are actually writing the code, right? They're building those access controls. They're building the anonymisation methods. Could be a data analyst who's working on privacy. So there's a lot of different things that a privacy engineer can do.

Jamal: 18:24

Sounds fascinating. So essentially, if we were to really break it down and make it easy peasy, privacy engineers are those that are responsible for making sure whatever idea for a feature, for a product, for a service the business comes up with, that the technical solution, the building of that actually works. And not just it works, but it's actually thought about all of those privacy elements of it to make sure that it does actually do the thing that you need it to do whilst keeping the privacy and maintaining the security without having a detrimental impact on the user.

Rebecca: 18:56

Yeah, I think that's a fair definition. Yeah.

Jamal: 19:02

Okay, great. Thank you. Now, specialisation versus generalisation is a common debate across all industries. What are your thoughts on the two approaches and what advice would you give to privacy professionals who are deciding which path to pursue?

Rebecca: 19:17

Yeah, this is a great question, and let's just take it back to what you were saying about knowing your why and also what is your zone of genius? What are you good at? So, to be perfectly honest, I am a generalist. My area where I'm really good is connecting dots between a bunch of different things. I was talking to an engineer in privacy the other day and they were saying, like, I'm happiest when I dive deep into something and a role where I'm going to be maybe like leading a team, but not really diving deep into something and not actually building it and getting down to how much faster is this algorithm? That person's not going to be happy, right? So they're a specialist. I know I'm a generalist. Know who you are and know what you want to do. That being said, it's my impression that having a specialty, it's going to help build your brand, it's going to help get you hired, it's going to help you define where you want to go in your career. So my specialty is like privacy red teaming or privacy testing. That's a specialty. But at the same time, I'm a generalist, and I can pull in a lot of different things into that. Like in a privacy test, I can think about, is this what the user wants? Is this what regulation expects? Is this vulnerable to this known security issue? Right? So I can be connecting all those dots because I'm naturally a generalist, but at the same time, I have a specialty. I'm kind of answering your question with the like know yourself first, which you already said, and then even within knowing yourself, even if you know you're a generalist. Try and frame your specialty in an area where you can be a generalist or if you are a specialist don't try and go for a job where you have to be a generalist and look for your zone. Look for the place where you're going to be happiest.

Jamal: 21:14

Great. That makes a lot of sense, and I completely agree with that approach because I think first of all, it comes down to how do you best operate? Are you someone that likes to really go deep and go into the nooks and crannies and the nuts and bolts and really go in deep and become a specialist? Or are you somebody who actually works well by finding the people who know more than you and coordinating all of those things and making things happen? And Rebecca, what you've said there sounds like you're one of those people that makes stuff happen. There isn't many people that can make stuff happen. So companies always need people who can build a team together, pull people together, and make the most of the people who specialise. But we need both specialists and we need both generalists to be able to make stuff happen. And it's really for you to look within and say, what do I enjoy more? And where can I add the most value? Where is my zone of genius? And even if you are going to move down the generalise side of the spectrum here, then what you do want to do is still make sure that you stand out for something. Like you can't just be, hey, I just do privacy. What does that even mean? Nobody knows because how general it is. So you have to be really good at something and doesn't mean that you have to really go far and go and do a PhD on it. Although, Rebecca, you have done one. But at least you should have something that makes you stand out from the competition. Otherwise, why would somebody want to work with you? Otherwise, why would you attract higher rates than the average person in the market? There has to be something that makes you stand up. There has to be something that makes you great. So find out what your specific niche is, what it is that you want to be known for. Focus on that. And if you really want to go down the specialization route, then go for it. Because specialists that I know, they make a lot of money, like, they do really well, they have really nice lifestyle. Some they just do one project a year and they travel the rest of the year because that's how great they are at something. And everybody knows this is the person you need for this job. If that's what you want to do, build your niche out as a super specialist on something, then go for it. If you also want to say no, I don't want to just focus on that one thing because I'm very curious and I want to know a little bit about this and a little bit about that and what's going on over there. Then be a generalist, but still have a specific thing that sets you apart from everyone else. So I think that's great advice, Rebecca. Thank you.

Rebecca: 23:19

You've probably talked about this on your podcast before. The benefit of knowing what you're good at and what you enjoy is like the privacy field is so big. There's so many different things you could chase right? There's so much you could learn. It feels like a new law every week. And are you going to be a specialist in every single law? Even if you're a lawyer, you don't have to chase everything. Narrow it down to where you are going to enjoy the work and where you're good at it. And that means even if you see someone else succeeding at something, you don't have to follow them. That might not be your successful path.

Jamal: 23:56

Exactly. You have to do what's right for you rather than compare yourself to somebody else. And one of the things that we talk a lot about to our mentees is don't compare yourself to other people. Don't compare yourself to stuff that you see on LinkedIn. The only competition should be with yourself. Are you better today than you was yesterday? If so, great. If not, what are you going to do about it? And the more you focus on yourself and the more you focus on competing with yourself, you'll find that everything else starts taking care of itself.

Rebecca: 24:22

That's so true. And it's hard to do. Let's just acknowledge that it can be hard not to sort of see other people and think like, oh, I should be doing that. But if you know where you're going, if you know your path, you know what you're good at, you're going to find it in privacy. Like the field's wide open. There's room for you. There's room for your special contribution. We want you here. We want you in this community sharing your story and your skills. We want that. There's room for that. It doesn't have to be someone else's skills.

Jamal: 24:53

Yeah, exactly. You're absolutely right. Some of these things are very challenging, and a lot of people actually, they don't know how to make this decision, how to think about those things, and there's no one really holding them accountable. And they do feel a little bit isolated. In fact, that's one of the most common things I see coming across in my LinkedIn messages, is people feel isolated in their roles. Quite often there will be people in privacy roles, but then they don't have any colleagues or other people in the company that are privacy educated. And so even though they're working as part of a larger company, they still feel very isolated. And that's where having a mentor to help you guide you through those questions, to discover yourself, discover your strengths, figure out a plan for you. That's where having a powerful community of like minded people really helps you to amplify your brilliance and then go and seek out those opportunities that are going to help you to get to that next level of your career. Before we switch to the technical side, one question I have for you while we're talking about career building is what are the key skills that set someone looking to work in privacy or someone who wants to truly be a leader, what are the key skills that they should consider cultivating and developing?

Rebecca: 25:55

le of the Ghanaian farmers in: 2009

Jamal: 27:41

Just to clarify for you, I haven't memorized the articles. I see no benefit in doing so, especially when it's easily available. You can just pick up where is it? The blue book with the articles. You can pick up my book. You can go on the internet and find it. I don't see any value in memorizing stuff and being able to regurgitate it. What I see the value in is what you've just said is being able to understand the principles and how to pragmatically apply that to solve the problems that the business has. And the other two things that you've added there, which I love, is number one, is to really be empathetic. And I think it's not just for privacy engineers. I think any privacy role or anyone to do well in any career, you have to be empathetic. You have to understand what the different stakeholders want. One of the things that you have to focus on as a privacy engineer is the user's expectations. How are you going to do that if you don't build up your empathy skills and really understand what they want? The other things is stakeholders want different things in the business. Different stakeholders will want different things. So unless you can empathize with them, how are you going to come up with solutions that solve all of the different values that you have to compete with as a privacy engineer to make sure that you get a good balance there? So I really love what you're saying there. And, yeah, it's very important to have some kind of technical skill and whether you want to really get a grasp on just one or you want to know more technical skills on a basic level, that's completely up to you, depending on how much choice you have, how much time you have, how much you want to develop things. But it's important to have the empathy. First of all, it's important to understand the technical side and have some technical skills. And it's also very important to understand the legal side of things and how the actual principles apply for you to be able to provide pragmatic solutions where we get a win-win for everyone involved.

Rebecca: 29:22

Yeah.

Jamal: 29:22

You are a star, Rebecca, you spoke about privacy testing and on your LinkedIn. When I visit your LinkedIn profile, I can see that you've done an article on privacy red testing and you talk about the differences between privacy red testing and security red testing. So testing is something you're very clearly passionate about and something you're great at. For people who are unfamiliar with it, what is privacy testing?

Rebecca: 29:44

Yeah, I think we're sort of at this place right now when it comes to privacy testing that the software engineering community was at, like, maybe 20 years ago. So when I think back to a job I had 20 years ago, no one was writing unit tests. I heard about it, and I tried it, and I was like, this is amazing. It saves me so much time debugging. It helps me define what we want to do right from the beginning, and it also provides the documentation of what I think should happen. Like, I was totally sold on unit testing, and it was out there. It was in the community. People were talking about it, but not everyone was implementing it. But nowadays, I don't think you can get hired as a software engineer unless you know how to write a decent unit test. I do not know any serious software company that does not do testing of all kinds. And I think the privacy community right now is a little bit in that space, too, of people are starting to talk about privacy testing. If you've looked on LinkedIn lately, you might have seen some job ads for privacy red teams, people trying to hire in this space. And I think we're going to get there. I think we're going to realize privacy testing is a way to define in advance what your threats are. You cannot write a test unless you know what you want to test. And so from the beginning, you're like, these are the things I'm most worried about. Privacy testing can save you tons of time in debugging. If you write them well, or if you do them well, then you have a list of, here are some vulnerabilities, here are some things that didn't go well. Privacy programs in some companies are huge. It's not just lawyers, but it's also the security team. It's also the CIO in some companies. I know it's just one lawyer or maybe just a fractional DPO. But once you have that privacy test, you can start sort of saving the time, figuring out where the problems are. And also by writing and formulating the test, you have this documentation of what you expect to happen. And I know you can get a lot of that already with some of the GDPR compliance documents, but it puts it in a framework that engineers, security engineers, software engineers can understand because they know tests. So those are the benefits of privacy testing.

Jamal: 32:06

I think that you laid it as clearly as could be for people who are not technically advanced. It's basically defining and testing the expectations of what it is that we're actually about to test here to make sure it works. And one of the benefits is you can actually save a lot of time because you can pick up some of those bugs earlier down the line rather than wait for it later down the line. And one of the things that I've actually identified from what you're saying is there isn't enough privacy or competent privacy testers out there. And so to solve that problem, companies are going a little bit mad, crazy, saying, hey, how can we find these great people? And I know you have a course that really focuses on providing people, empowering people with the skills to become great privacy testers so we can actually supply that demand that industry has. Can you tell us more about that?

Rebecca: 32:55

Oh, yeah. Thank you for asking. So my website is https://www.privacyengineer.ch/courses/ is the Swiss domain. So if you go to https://www.privacyengineer.ch/courses/ you'll see some courses. And I have two courses on offer right now on adversarial privacy testing. So this is a specific kind of privacy test. When you want to understand what to do about motivated attackers, how do you prevent a data breach, and what are the privacy specific things that you might not get from a security test? So there's some courses on adversarial privacy tests. I offer them about once a quarter. You can find the dates on https://www.privacyengineer.ch/courses/. And for anyone? Well, for the first 20 people listening to this podcast, you can use the promo code PrivacyPros. So all one word, and you'll get a 25% discount on that class. It's a live class. It's 90 minutes. I'm the one teaching it, so it's hopefully very interactive, and you get to talk to an expert directly. So I’d love to see you there.

Jamal: 33:56

Wow. So basically, let me get this right. I get to spend 90 minutes with you, learning directly from you. It's a live class, right? So it's not pre-recorded or anything that's going to put me to sleep, and I get to learn about how to deal with these motivated attackers while empowering my mindset and adding more value to my CV and employers. And you're giving me, what, 25% off as well?

Rebecca: 34:19

Yeah, 25% off, and it comes with pre-approved IAPP credit. So if you are an IAPP member, you get credit too. So bonus and a certificate if you complete my assessment at the end, we don't just give away certificates for free.

Jamal: 34:33

All right, and how is this assessment? Is it open book? Is it multiple choice questions?

Rebecca: 34:39

So I am trying different frameworks, and I have tried some open ended assessments. People have to apply what they learn to a case study for their own business. I'm not sure if I'll keep that framework or not yet.

Jamal: 34:54

Okay, great. So I love assessments because it gives me a chance to prove to myself that I've actually understood and grasped what I've actually spent all of this time and energy and effort learning. And then to be able to actually validate that with an open-ended exam is the best way to do it. Because one of the challenges and one of the criticisms people have with some of the multiple-choice questions is the answers there. So you've got 25% chance of getting it right anyway. But when you actually don't give them the answers and people have to think for themselves, it's a real test of do I know what this is all about? And employers and other people in the industry actually find those a lot more credible than some of the multiple-choice questions. So that's really exciting. So it means that I can come into your course, I can spend 90 minutes with you, learning all of this stuff directly from you, and then I can go and test that I've actually retained and know how to apply what I've learned with you. And that will also help to enhance my employability prospects. And I can actually go and focus on a specific niche on privacy testing that is up and coming, where there is a massive demand but not enough supply for, and get in there now. So in 5,10 years time, I can become a thought leader in that particular niche if I want to specialize in that area.

Rebecca: 35:58

So I want to be honest, it's a huge topic and 90 minutes is not going to get you to expert. There are two different courses. One is the fundamentals, like how do you even know if it's the right thing for you and what do you need to set up to make your test successful? And then there's another course that's going through. Let's do some case studies, let's walk through, let's see how it would play out in real life. There's two different courses. I think they do a great job in getting you started, knowing how to talk about it, knowing whether it's the right thing for your organization, knowing how it fits in, and maybe being able to try it out and see if you end up loving testing just as much as I do. If you see the values, if you're like, oh, this is great, everyone should do it.

Jamal: 36:40

I love that and one of the challenges I see from a lot of my mentees and people who are connecting with me on LinkedIn and other places is hey, I've memorized GDPR, I understand the articles, I've read all the guidance notes. But when people ask me questions, I feel like an imposter. I feel like a fraud. But I know this stuff, but I just can't explain it to them. Or I just don't know how to operationalize that. So the fact that you're actually offering a solution that not only gives a theory, but provides that practical know how to actually go and implement it, I think that's so valuable. And I think that's one of the main reasons why people actually choose the privacy Pros academy is because we help them to operationalize that privacy, which is one of the things a lot of people struggle with, especially the lawyers. They're really great at what they do. They're always lost in legalese, but that doesn't always translate into requirements for stakeholders in the business, and that's where they find the challenge, and that's where we've really been able to add that value. So to hear that you're doing the same thing in the privacy testing space is music to my ears. And I'm going to go and check out the website and put in place the discount code and see if I can come and spend some time with you to get more of an insight into all this fascinating area of privacy testing.

Rebecca: 37:47

Great. I'd love to have you. It would be my honour.

Jamal: 37:50

I look forward to seeing you there. Now, what do you love most about working in privacy?

Rebecca: 37:54

I love the privacy community. I have found it to be so open, and everyone's voice is valuable, and everyone has something to contribute. And I also want to be someone who welcomes people to the privacy community, and I want everyone to know how important their voice is. Privacy is a fundamental human right. Come tell your story. Come help us protect this human right. I think that's something I really love about privacy. And if you're not into that kind of community, go work on something else. I think the other thing about privacy is it's so interdisciplinary. There's so many different aspects of it that are important that it makes it really interesting and it makes it a really hard problem. There is no one answer. Yeah, it's not a multiple-choice question. This is why people have a hard time, because there's no one right answer most of the time. Sometimes it's hard to answer, which I love.

Jamal: 38:50

I love those challenges, too, and I think that's what really makes me feel energized. And yes, it's all about community. And we have an amazing community on LinkedIn, on the Privacy Pros network in our Signal community. So I'd love to welcome more people to be part of that community along with you, Rebecca. Now, at the end, we always give the guests an opportunity to ask me a question. So what would you like to ask me, Rebecca?

Rebecca: 39:11

So I want to hear about your favourite success story or your favourite student. Give me an example of someone who really turned around and where are they now? Maybe you don't want to reveal personal details, but in broad strokes.

Jamal: 39:26

Yeah. So the one that stands out for me the most is a gentleman called Tahir, right. And he's done a podcast, so he's shared his story as well. So when he first came to me, he had never had a professional job in his life. In fact, all his life, he'd worked in a family restaurant. And then when he left, finally got away from the family restaurant, he was an Uber driver. And so he came to me and he said, look, I've seen you help my cousin Fayaaz, who's gone through your program, and he's now doing really well for a top firm in the city doing all this privacy stuff. And the more I speak to him, the more fascinated I become. And I've been looking at all of your posts, I've been reading about it, but I just need some help to get a break and get into it. So he came and joined what we call my accelerator program and I spent about six months with him to help him. So there's five things that we focus on. The first thing is the mindset. So he had all of these limiting beliefs. He'd been told all of this stuff and he really held himself in a box that he didn't belong in. So the first thing we focused on was having that growth mindset, that abundance mindset, and saying that with effort, anything is possible. So once we went through the mindset, then we started focusing on the subject matter expertise, understanding the actual requirements of the GDPR, understanding how the law actually works, how to interpret those principles. Then we started focusing on the practical understanding and application of all of those things. So it's very great. He's got the right mindset, he knows what to do in theory, but he needs to be able to walk the walk and not just talk the talk. So that's why we started focusing on the exercises of how do we create privacy notice that are clear and transparent and what actually needs to go in there. How are you going to write a privacy notice if you haven't actually done the data mapping and the records of processing activities that feed into that? So we got him some hands on experience with those things, data protection impact assessments, how to put together subjects, rights processes and really understand when they apply, when they don't, what the exemptions are, and really empowered him to do those things. And then we focused on actually focusing on his personal brand. So you've never had a professional job. You need to get into this role, you need to understand the culture, how do we do all of those things? So we really helped him focus on his personal brand, become someone that is outstanding, rather than that someone that blends in with everyone else. And the final thing we did was create a powerfully, supportive environment around him and put him into a community of great people who want to support him, who want to see him do well. And now he is a data privacy manager at a multinational company and he's been there thriving in the role for over a year. And he's getting more and more people coming to him in the business asking questions and he's getting more and more responsibility. So that is a super inspiring story of somebody who had no experience whatsoever, didn't even have a CV when he first met me, to somebody who is now inspiring so many other people and doing a great job protecting people's privacy in lots of different countries, in the catering tech industry.

Rebecca: 42:08

That's fantastic. That's really inspiring. I love that.

Jamal: 42:11

It's very inspiring. And every time I tell the story, it makes me feel truly humbled and privileged to be part of somebody's journey like that because those things are truly life transforming. And he is giving permission to so many other people who might have otherwise had a limiting mindset and said, oh, I don't have the experience, I don't have a legal qualification, I don't have formal education, I can't do these things. You can. Everybody can. You just need to have the right mindset. You need to find the right guidance. You need to go and get the right training. Like Rebecca was just talking about with the privacy testing stuff, we have so many options, and it's not just myself or Rebecca. There's so many options out there for you. All you need to do is get in touch with your why and then find a mentor who can help you create that path and just go and find the person that resonates with you. So I resonate well, with a lot of people. There's other people in the industry. We've had them on the podcast that also offer programs and mentoring. Find the person that connects with you the best and just go and be your best self. Don't put yourself into a box. Don't shrink yourself into a box in which you don't fit in. The world is so big. You just need to open up your eyes and see what's out there. And there are infinite capabilities and potential avenues to go and reach out to those things. And Rebecca, one of the things you said earlier was one of the roles that you did wasn't because that's the role that, you know, dreaming of, but it's the role that actually helped you to stay and balance some of the other things that are going on. So we need to understand that, yes, there are balances and constraints, but we need to make the decision that's best for us. And the thing I find with a lot of people is everybody waits for the conditions to be perfect to make a decision or to make a move. But successful people make a decision and they create the conditions around them for success to take place. And that is the thing that we love doing at the Privacy Pros is get action takers to make a decision and then create the strategy, create the environment for them to attain that success. Thank you for that. Great question, by the way.

Rebecca: 44:06

Yeah, that's really great. And someone that is really going to be valued in the privacy community because they have their own special story, they have their own way of seeing people's needs and how different people are going to interact with technology or whatever it is it's needed. We need everyone.

Jamal: 44:26

Yeah, exactly. And if you're sitting there listening and thinking there's something okay, but that worked for him or other people who have come and they have lots of experience, but they’re struggling with their personal branding, or there's this one thing that's holding you back. Come and have a chat with us. We'll help you to take that one thing that's holding you back and reframe it to become your positive, because this was a thing that Tahir came with, and saying, this is holding me back. The fact that I've been in a restaurant all my life, the fact that I've been an Uber driver, and we said, okay, how do we turn that into a strength? What are the things that you learn from that? And how can we now use that technology to get you into the privacy catering tech space to show that you can add value from that instead of saying, that's the thing that's holding you back? This is the thing that set him apart from other people, that actually had privacy experience, that had certifications, that had legal education. It's his actual understanding of this. He spent a lifetime in it. So let's bring all of those things to the table so that's all we have to do is focus on what you've done up till now, find where we can pull the gems from that, and then see how we can use that to add value to organizations to add value and really do what Rebecca's saying and uphold that basic right to privacy.

Rebecca: 45:29

Privacy, I'd like to add one more thing to support you on that is we all have those things that we feel are going to hold us back, right? I'm not sharing mine on this podcast. Right? Some of those things feel, like, private and vulnerable, and we're not going to share them. But every single person you encounter is going to have something that they think it's either holding them back or that they had to overcome. If you're focusing on your own, yeah, you don't see what's going on for everyone else, but it's there. We all have something that we have the valuable things, and we have the obstacles. And like you said, figuring out how to turn that obstacle into something of value, it's possible.

Jamal: 46:09

It is. Thank you, Rebecca, for sharing that. Okay, guys, we've had a great episode. We've been fortunate enough to listen to Rebecca for the last 45 minutes or so, and we've learned so much about privacy testing. We know what kind of things to look for. We know how to make decisions about which kind of area we want to focus on. And we also know what shouldn't be thinking about when we're thinking about whether we want to specialise or generalise to have a thriving career moving forward. And Rebecca also shared an amazing opportunity for us to learn more about privacy testing and also be able to accredit that we have actually understood it through a certified assessment, which we can then use to go and support organisations to see if this is something that could be the next big thing to support them and add lots of value from that privacy testing point of view. Rebecca, thank you so much for all of the valuable gems that you've dropped. I look forward to staying in touch with you, and I look forward to seeing you on the program. And I'm curious to see how many people are going to listen to this, use the discount code and join me and you on that program too.

Rebecca: 47:06

I'll let you know. And so, once again, the website is https://www.privacyengineer.ch/courses/ really honoured to be on the show. Thank you so much. And for all the listeners who are thinking of joining the privacy community, you're welcome. We want you here.

Jamal: 47:19

We do. Until next time, guys. Peace be with you.

Outro: 47:24

If you enjoyed this episode, be sure to subscribe, like and share so you're notified when a new episode is released.

Outro: 47:32

Remember to join the Privacy Pros Academy Facebook group where we answer your questions.

Outro: 47:37

Thank you so much for listening. I hope you're leaving with some great things that will add value on your journey as a world class privacy pro.

Outro: 47:44

Please leave us a four- or five-star review.

Outro: 47:46

And if you'd like to appear on a future episode of our podcast or have a suggestion for a topic you'd like to hear more about, please send an email to team@kazient.co.uk

Outro: 47:58

Until next time. Peace be with you.