Ep. 6 | Privacy vs. Security, are they the same thing? (Guest: Jody Westby)

Show Transcript

[00:00:00] Hello, and welcome to the sixth episode of Privacy Lawls, a podcast where we talk about privacy and have some laughs along the way. I’m your host, Donata Stroink-Skillrud and today we’ll be talking about the differences and similarities between two concepts that are very frequently mixed up, privacy and security.

And today I’ll be interviewing Jody Westby. Jody is an attorney and member of the District of Columbia, Pennsylvania, and Colorado Bars. Jody is the CEO of Global Cyber Risk LLC, where she draws upon a unique combination of technical, legal, policy, and business experience and provides consulting and legal services in the areas of privacy, security, cyber governance, incidence response, and digital asset management.

Jody serves as co-chair of the American Bar Association’s Privacy and Computer Crime Committee, is a co-chair of the ABA Cybercrime Committee, and she serves as a vice chair of the Association of Computing Machineries U. S. Technology Policy [00:01:00] Committee. Jody also hosts the Association for Data and Cyber Governance’s Privacy and Cybersecurity Podcast, which is a must-list for anyone interested.

How did you So Jody, thank you so much for agreeing to be on the podcast today. It’s great to have you here. Can you please tell us a bit more about your career and how you got interested in privacy and cyber security? Donata. Thank you so much for inviting me to be on your podcast. It’s fun to be a guest.

Instead of asking all the questions. Yeah. So I began my career a long time ago and that. IT industry, and I spent 10 years in the IT industry doing everything from operations to programming to systems analysis and then database administration. So then I became a lawyer. And when the internet came about.

Everyone would say, go, [00:02:00] go talk to her. She knows computers. And I was practicing law and lawyers were the last people to get desktops. So they kept their legal pads and the assistants or their secretaries, as they still called them then would you know, have a computer. And, and so I just kept getting pointed back toward what I had done before.

And Then when the internet came out, that was just really fun because then we started getting a lot of legal and policy issues. It took a while, you know, for privacy and cyber security to security to really start happening, happening in the sense of if you’re in the business and looking to do this as a, as a full time job.

There were several of us who stood out there with the wind in our face for quite a while before. Before things really took off, but that’s how I got into privacy and cyber security was, was just starting out in this field that ended up to be when I enjoyed and, and you learn [00:03:00] something new all the time and you get to work with young people and, and people of all ages.

And so it’s been a good fit for me. That’s so interesting. Yeah, you’re totally right. You don’t see a lot of lawyers who are as experienced in the technology aspect of things, right? Most of us are experienced in the law itself, but not the actual technologies that affect privacy and cyber security. So that’s really, really interesting.

And, you know, being part of the ABA, I’ve seen your name absolutely everywhere. And I know you’ve done quite a few publications in terms of articles and books as well. So can you tell us a little bit about your publications on privacy and cybersecurity? Yeah, sure. So the first, four books were all in section of science and technology, and it was international guide to cybercrime, international guide to combating cybercrime, international guide to privacy, and international guide to cyber security.

And then we did roadmap to an enterprise [00:04:00] security program. And those were all done through my privacy and computer crime committee. And we had a multidisciplinary group that helped write them, and I edited them all. Then I was advising DHS for about seven years on what data was it legal for cyber security researchers to use, and I ended up writing two books there with funding from DHS.

The legal guide to cyber security research and the legal guide to botnet research. Those were also both published by the section of science and technology law. And then my last book is the DNO guide to cyber governance fiduciary duties in the digital age. And that was published by the business law section of the ABA in 2021.

And so, so the, that’s all of the books [00:05:00] and you know, then I still I do a column for Council of Insurance Agents and Brokers, their magazine Leaders Edge, and blog for Forbes. So I, I keep writing and I think it’s a way to, to keep my interest broad and keep my skills sharpened. So that’s what I do. Do you have like a separate shelf in your house for your books?

No. No? Over there. They’re just, they’re just on the shelves. And they aren’t even all together. That’s really, really cool that you’ve done all that and the things that you continue on doing it’s, it’s amazing to see all that you do for the industry, for people that work in the industry as well as for the ABA.

So important to be a thought leader. Yeah, you thought later. You definitely do that for sure. So let’s get into our main topic [00:06:00] today. Privacy versus security. So can you please define privacy for us? What does privacy actually mean? So It’s interesting how in the United States, we use the word privacy, and most of the rest of the world uses the word data protection, and I think that’s actually a little bit more descriptive, and privacy means you’re protecting data, but it also, then kind of flipping back to the US side, means that you’re keeping it private.

That you’re not just protecting data, so in a, in a reverse kind of way, when you stop and think about it, data protection, probably it’s a better name for security and privacy because you’re really protecting the data and saying, well, this data is private and this is private to me. And this is information that doesn’t need to be out there shared among everyone.

And so to me, privacy is protecting [00:07:00] an individual’s. Own personal information, information about them that is. It’s inappropriate really to just be thrown out into the public space for lots of different reasons, not only to just protect people from scams, but also people should have just like our, our Fourth Amendment guarantees against unreasonable search and seizures.

We should have a space a personal space that is our private space. Can choose then to keep our information private and make those choices ourselves and not have other entities, whether it’s a doctor’s office or a company that you work for or an an outfit that you just bought something from make those decisions for you.

Absolutely. I think that’s [00:08:00] totally correct. And that in privacy, we can kind of choose what information we share with who and what interactions we want to have with who, you know, do I want email marketing or text messages from this company? Or do I want this advertiser to track me as I use different websites?

Yeah. Yeah, I mean, it’s, you’re right. That’s interesting. It’s not only just what you share, but it’s what you want to also be bothered with, you know, don’t take my information and send me these ads that I don’t want, but then it’s also, if I get on your side or I’m just looking around or whatever.

Causes a cookie to form that doesn’t give you the right to start sending me things or to take my information and start selling that in that cookie to other people. And so you’re right. It’s not only keeping my data private, keeping some privacy around my choices and preferences. [00:09:00] Yeah. So let’s look at the other side of this.

Can you define security for us? How is it different from privacy? Well, so I would always say when I first got involved in our section of science and technology law in the ABA, privacy and security and cybercrime are a three legged stool. Without one, you don’t have the others. So without security, you don’t have privacy.

And privacy and security breaches are cybercrimes. And so for the most part, but that’s a nice little soundbite, but to me, security is about securing the systems and the infrastructure and the applications, the operating systems. So back to where I started in the computer industry, you know, I’m used to thinking about [00:10:00] things with, well, you have a network out there and then you have the pipes that come into where that’s connecting to your computer.

And then you have In your computer, you have an operating system that runs your computer that allows the applications to run and then it’s, you know, securing those applications and then ultimately you work your way down, you’re down a few layers. Now into that onion, you work your way down to where the data is.

And so security also means securing the data, but it’s not just about data. It’s about all of that other stuff. So it can’t get to the data. So security. Okay. Is and of course, you know, we’re increasingly where people are mixing up physical security and cyber security, but they really overlap now because with physical security, you’re using biometrics or you’re using a castle key fob or you’re using a card or some digitized.

Means of [00:11:00] access to a facility, but and even all the surveillance cameras and all of those are primarily digital today, not analog. So security to me means securing that whole network infrastructure operating system applications and down into the data so that the information that is secured in the way it’s supposed to be.

So do you think security is more against protecting that information against threat actors, like third parties that were trying to do something malicious versus privacy is more protecting your information against companies that you do business with or the government that may not necessarily be malicious threat actors, but could still take your data and use, use it in ways that you would not like it to be used.

No, I think privacy is more than that. That privacy is really, it’s, it’s [00:12:00] securing the data. It’s, it’s just keeping your preferences, like your online activities, keeping your data that people have about you keeping that with some boundary source, not just thrown out into the public domain or thrown out for others to use and exploit.

So being privacy lawyers and working in cyber security, you know, we do hear a lot about laws and regulations in the field of privacy. You know, as, as part of my job, I track privacy bills and I have to update my privacy bill tracker every other day, which is just an absolute nuisance. But can you tell us a bit about the privacy legal landscape?

Well, there’s 155 countries with privacy laws now, and then the US federal level, we keep saying we don’t have a privacy law, but we actually have quite a basket full from the Privacy Act of 1974, which only applies to government [00:13:00] agencies and departments and to their systems of record. And then we have other federal laws, HIPAA, the health care law, the HITECH Act, which is the HIPAA.

Data breach law Gramlich Bliley Act to protect financial information of financial consumers. FCRA, the Fair Credit Reporting Act, protects data around credit reporting and background checks. COPPA, the Children’s Online Privacy Protection Act, protects You know, children’s data, FERPA for educational records, CAN SPAM which really protects against getting spammed by a lot of well intended merchants, as well as criminals.

Then there’s others, the Data Drivers Privacy Protection Act, the Telephone Consumer Privacy Act, spammed by a lot of well intended merchants. Thank [00:14:00] you. And then you know, we have these 12 states with comprehensive privacy laws that are similar to the EU GDPR, the general data protection regulation.

Plus there’s been the 50 states now all have a breach law. Many have biometric privacy laws, and they also have a lot of laws that have been on the books for a long time, protecting different types of data like financial data, insurance data, criminal records just all, all sorts of different types of, of data.

The states. So different laws protecting that. I used to have a slide with a bowl of jelly beans and I’d put it on that because it was like, you know, it’s like a bowl of jelly beans. We have so many of these state privacy laws. And so that’s just at the US level, but the US can’t just think about itself because this is a global network.

So then there’s the European Union general data protection [00:15:00] regulation, which is the big Kahuna globally. But we did just get put back in place the EU US data privacy framework is to replace privacy shield. We’ll see how long that lasts. And we’ll see how many companies really use it because, you know, when privacy shield got invalidated, they really had to jump over and, and turn to standard contract clauses.

And when they’ve done that, why go back? But then there’s the EU e privacy directive. It’s pending as a regulation that has confidentiality of electronic communications, including like non personal data, such as machine to machine data. That’s IOT data and data on. public Wi Fi and cookies. So that directive covers that.

Canada has a law similar to the GDPR, so does Brazil. And then there’s outliers like China, who has a bunch of laws that well, they have three main ones, personal [00:16:00] information protection law, civil code, and data security law. And the personal information protection law though has it says unique extraterritorial jurisdiction, and it says unique informed consent to transfer data abroad.

The civil code even has. Additional requirements for laws or regulations for specific industry sectors. And then their data security law requires policies for data categorization and classification, which is fine. Those, you know, those good best practices and standards. But it says security assessments have to be performed before data is transferred out of the country.

And those security assessments are done by the Cyberspace Administration of China. And then also China says data stored in China can’t be provided to any foreign government without China’s approval. So even a U. S. company operating in China couldn’t give data to the U. S. government if it was stored there in China without [00:17:00] China’s government approving.

So That is, you know, that is a snapshot look kind of at the global framework, there’s 100 plus countries that have data localization laws that restrict data out of the country where it was generated, or it may require it to be stored in the country where it was processed. And some of the strictest of these are China, Indonesia, Russia, Vietnam, Nigeria.

And so the privacy legal framework globally, no wonder privacy lawyers are continually having busy practices. This just continues to get more complicated and the US states are now on this path toward the EU, and it looks like there’s no let up in that and it looks like Congress is still so fragmented that it can’t figure out how to.

Pass legislation, much less stay open. We’ll see what happens with the shut down. [00:18:00] That’s so true. You know, I think we have this state patchwork and it could be resolved by Congress potentially, but there seems to be very little to no hope of that. But let me kind of circle back really quickly to what you said is the EU US data transfers framework.

How long do you think that will last? I remember I when it first came out, I made this meme of basically Max runs just looking from a bush, coming out from a bush and rubbing his hands because he’s excited to, to get that stripped down again. So how long do you think it’ll last before there’s a true challenge to it?

Oh, how long will it take for him to? I make file another suit and how long will it take for the court of justice of the European Union to deal with that. And I don’t know. I mean, look, it’s not all our deficiencies. They were making hay over. [00:19:00] And the things Snowden revealed and the capabilities of our intelligence agencies, but they’ve never asked their own countries what they do, how they comply.

So that’s kind of the joke is the EU regulates the US because our Congress can’t pass any laws. So, so we have. A lot being pushed on us from overseas, and they have become quite good at it. And, and so I, I don’t know what the Court of Justice of the European Union would do with the third Schrims case, but they’re pretty savvy on this, and Schrims is very good, obviously, at making his arguments, and so it’ll be closely watched by the privacy community.

We’ll see. Yeah, absolutely. So what about security laws and regulations? Well, there’s a plethora of those as well. Again, on [00:20:00] the federal level, we have, it’s a blend of laws and regulations. So, for the laws, the Federal Information Security Management Act, which governs private excuse me federal agency and department systems, and it applies to contractors if they’re running those systems for, on behalf of an agency.

The HIPAA security rule, and the Grammage Bliley safeguards rule. We have also the Electronic Communications Privacy Act, which is our wiretap law, our Stored Communications Act, and our Pin Register Trap Trace laws. And so those are old telephone terms that we shoved the internet into. And but that’s a very important law.

And then on the… Before I leave the legal side, there’s a cyber incident reporting for critical infrastructure act that was passed and we’re waiting for[00:21:00] regulations, which won’t come until 24, but that’s to have reporting on critical infrastructure incidents. And supposedly, then DHS will help facilitate government assistance if needed.

So we have that, but this, we also have the FTC, which has enforced its Fair Trade Act. And that is an interpretation of deceptive or unfair acts or practices in commerce. And they’ve, you know, for example, they’ve said, you’re not following your own privacy policy, and that’s a deceptive trade practice.

You have, just a moment, pardon me, you have you, you’ve said you’re protecting these digital wallets, but we don’t think you really are, and they look and find out they aren’t, so then they, they would get either an order or a consent decree. But, but these. Have been coming that out since, [00:22:00] oh, since the late 90s, if not early 200s.

And they have been very effective in helping push out enterprise security programs because the FTC has always required in those orders detailed steps of what you need for an enterprise security program. Well, not so detailed because with the LabMD case, they said, you know, you have to be more specific.

You can’t just say you have to have a security program. Many of them had. Detailed activities that were on on point for an enterprise program. So that was good. I mean, I credit them and NIST with with helping push out security programs more than any other agency. Now, however, we have the SEC that’s jumped in and the SEC first started out with giving some disclosure guidance on how to report cyber security incidents to investors.

that might have a material impact that investors should know about, because it could be an investment risk. [00:23:00] And then they had to put out more interpretive guidance of what’s material mean. And then finally now they’ve just come out with the rule. That is the cyber security risk management disclosure rules on for applies to all public companies.

And if you have a cyber security incident that’s material, then you need to disclose that within 72 hours and you need to disclose information about your governance practices and how you’re managing cyber risk. So that’s going to have a big push. We also have to remember the North American Reliability Corporation, NERC.

As we call it, and it’s critical infrastructure protection regulations, which we call SIP, NERC SIP. It almost sounds like a bad word. But NERC SIP are the mandated regulations for our utility infrastructure electricity grids. But TSA also came out with regulations on [00:24:00] pipelines. And so gas pipelines.

And so that is very important. And then there’s some federal acquisition regulations on safeguarding contractor information systems. And so it all sums up to again, you know, a plethora of federal rules on cyber security. The states Have these breach laws that were mentioned and these comprehensive privacy laws, but at least 23 of the states and their breach laws call for reasonable cyber security practices and procedures, but these have also that same wording, which is kind of their magic words have has gotten put into these comprehensive privacy laws too.

So it’s saying you have an obligation. to secure this private data even before you have a breach. So you have to have reasonable security practices and procedures. The New York Department of Financial [00:25:00] Services came out with their reg 500. I don’t know how many years ago, five or six. And that required all the institutions subject to their authority in the financial industry is quite broad.

It includes insurance companies and and a number of other lending and advisory firms that they have to file a statement with the regulator signed by the regulator. And an officer stating that they reviewed their cyber security program and it’s up to date. There’s also the National Association of Insurance Commissioners, NIAC that came up with a data security model law after New York came up with theirs.

And that’s been adopted in 18 states and it’s actually better than New York’s law. New York is now amending theirs to, I think, more closely pick up some of the things that was in the NIAC model law. But all of those things are good because it’s, it’s pushing out a framework that’s consistent with best practices and standards and saying, here are the things you have to be doing.

And [00:26:00] so that’s You know, that that’s happening at the state level, but the White House also has put out a lot of executive orders pertaining to critical infrastructure protection and these, they do in part because again, Congress is paralyzed, but in part because it’s a way to, Jumpstart activities that spill into the private sector.

So if they put requirements on federal agencies and departments, they can spill those over to federal contractors, and they can become best practices. It’s always been a favorite way to try to get practices going in the public and private sector. So these executive orders are out there. And then, most importantly, there is U.

S. case law and This is what Delaware Courts, Delaware Courts guide corporate law across America, and [00:27:00] they had a 1996 case called Caremark that basically said a board director isn’t violating its fiduciary duty and not monitoring acts of the business, unless it’s just sitting there doing nothing.

And then there was a case, Marshawn, which it was maybe four years ago, five, and Cranmery got listeria and people died. And the board is paying no attention. It’s just all left up to the operational level. So there’s been that case, plus a few more, a few several more that have come on out, come down.

But the bottom line is

experts agree and I’m with them on this, that regulated industries and companies with a high level of compliance requirements, and that includes companies with privacy and cyber security requirements that they need to implement board level oversight systems with appropriate information flows and reporting.

Thank you. To enable the board to monitor those [00:28:00] risks and keep their eyes on them and respond in a timely manner. They’ve also said directors and officers can be held personally, personally liable if they are not doing this. This is all part of the fiduciary of loyalty and good faith oversight. And so that is, I think, combined with what the SEC is doing is going to be a sea change at the board and C suite level.

I really think so too, because Usually when fines are issued, let’s say we have a groundbreaking fine of 50 million or something like that. I mean, to us, that seems like a lot of money, but to some of these companies, that’s like half a day of operations, right? So having that personal responsibility, I think will really, really change things because, you know, CEOs don’t want to go to jail.

And, and they don’t want to get in trouble. They want to continue living their lives. So I think it will make a big difference. Yeah. [00:29:00] And we shouldn’t leave cyber security without mentioning the EU. We, you can’t talk about privacy without talking about the EU because they control privacy and have ever since the data protection directive came out in 95.

But you have to pay attention to them because the, the European Union is divided into its directorates and they are well funded and they have a lot of binge. In the in expert on topic areas and privacy cyber security are 2 of them and they have they do what they say they’re going to do and it’s well funded.

So they had the 2020 EU cyber security strategy. And they’ve been implementing that. There’s a new NIS2 directive, Network and Information Security Directive, and it has measures for a common level of cybersecurity across the EU. Plus they put out guidelines. There’s [00:30:00] the Digital Operational Resilience Act that requires the financial sector to be more resilient.

The EU Cybersecurity Act. They had a NISA over there, the European Network and Information Security Agency. It’s now the European Agency for Cybersecurity. It was, it was It’s it was boosted and funded better for under this act, and that establishes a voluntary certification framework for products and services, and they’re now looking at amending that and pending a certification for managed security service providers.

They also have an EU cyber resilience act. This is proposed. It’s not adopted yet. For rules to ensure safer hardware and software and smart devices will have to comply with the EU rules to be in the EU market. They have the European Cybersecurity Competence Network and Center, ECCC, to help the EU retain and develop [00:31:00] cybersecurity technological industrial capabilities.

Okay, so what does this say? It says watch out. American companies need to get their heads up and pay attention and Congress does too. Because the EU came out in privacy with its directive data protection directive in 1995 and they said it’s going to apply extraterritorially and you can’t take any data out of the EU and send it to your country without our law applying or you have to offer adequate protections and we had a lot of diplomatic pushback on that during that time.

But since then, the diplomatic pushback has gone away. And the EU, when they come out with voluntary certification frameworks, will watch out because that could become, you know, mandated and a mandated framework. And so while they’re busy doing all this, they could very easily grab the stage for cyber security.

And we, we are increasingly seeing them take action that’s [00:32:00] regulating our companies. So this Digital Services Act, Digital Markets Act that they just passed that applies to very large online platforms and very large search engines. They named those very large online platforms and the search engines.

And guess what? They’re all American companies except ByteDance, which is Chinese. And so, and there’s the Services Act, which applies to intermediary services, but that includes online marketplaces and all of that. It’s, it’s, it’s not based on size. They also have special requirements for the very large ones, but they’re over there enacting these laws that are applying to our tech companies.

And we’re doing nothing about it. So I think we have to really keep our eyes on cybersecurity before we wake up one day and see that the [00:33:00] EU’s. Controlling cyber security globally, not the U. S. Yeah, I think it’s interesting. We’ve seen this in the last couple of weeks where Google has been sending out these notices to small companies that use their advertising services saying that now Google is requiring you to have a cookie consent banner.

So it seems like it’s even trickling down. So, you know, maybe it’s initially applying to Google and Facebook and all of those large companies. But then they’re implementing these requirements on their customers, which are much smaller as well. So it seems like it’s all trickling down to, and that’s a great point.

So we have this mishmash of, of laws with privacy and security. Are these laws enough?

Interesting question. No, we, we do need a federal privacy law. We need to stop this ridiculous. Situation we have going on in our country with privacy because it’s costing us on the, at the global stage [00:34:00] there, I think it will be one of the biggest federalism issues that we will have seen in this country for a long time, if not ever, because the state attorneys general, I fully expect them to push back and say, wait, just a minute, you guys couldn’t do anything when we were out here passing laws to protect our citizens, which we are entitled to do.

In fact, that’s what we’re elected to do. Thank you. And yes, we know the Commerce Clause gives federal law the right to preempt in commerce, and you could say, well, everything about the Internet is commerce, but, I think it may well end up and practically end up with some enforcement authority given to the state attorney generals just to appease them.

And if they’re enforcing federal law, well, that might not be such a bad thing. But that could be a nightmare too when the data protection directive in the EU was adopted in 1995. It was a mess because every state, they said, well, here’s a lot now [00:35:00] you can implement it as you want in your own country, you each have to have a data protection authority.

Well, they all implemented it. Well, not all of them, but many implemented it differently enough that it was a real patchwork of, of how compliance in the European Union, that’s where they’ve gone to regulations because regulations in the European Union differ from directives and that regulations say, here’s how it’s going to be across the EU.

Now go make this happen in your country, much more sensible approach. And they learned that lesson from the data protection directive. So I, I, I think that We need to see that that we don’t end up in the same situation, learn the words, learn from their history. We don’t need to have 50 states with 50 different ways of doing things.

But we need to get some sort of uniformity where. If at least it’s, here’s U. S. law, here’s E. U. law, here’s, here are the major trading blocks and then companies can figure out how to deal with [00:36:00] that. But having this as fragmented as it is, is very expensive for companies and it really can put them in compliance binds.

Absolutely. I really think it’s just a mess. And, you know, we get these laws that are passed on a state level. There’s differences between them. You have to resolve the conflicts and then you get regulations, which create even more conflicts for compliance. And it’s very, very difficult. But hopefully we can get something someday.

But thank you so much for sharing your insights into the differences and similarities between privacy and cybersecurity. So one more item that I wanted to quickly touch on is the California Delete Act, which has been recently in the news, hasn’t been signed yet. But can you tell us a bit more about this act and why it’s important?

Well, as California leads. Of all the states, California leads, whatever they do, then others follow. They were the [00:37:00] first to have a breach notification law. They were the first to have a comprehensive privacy law. And so this would amend certain aspects of their existing data broker registration law.

It’s called the 2019 Act. And it empowers this new California Privacy Protection Agency. California is the first state to have its own regulatory agency on privacy. But it’s the, it would empower the CPPA, as it’s called, to develop a system so consumers could make a single data deletion request that’s binding on all data brokers registered in California.

So it’s a way to try to save the consumer. A lot of steps that, frankly, are futile steps because you just can’t ever quite take enough of them. Maybe if you do it every day before you retire. So, so, so they’re trying to this is the first approach. I mean, it [00:38:00] only applies to the data brokers, but it’s an approach where they’re trying to help people reign in this massive exploitation of data.

Yeah, I really wish we had that here. So I live in Illinois and we, we don’t have this and I mean, I get calls at least five, six times a day and text messages five, six times a day asking if I need business loans, which is not something that I’ve ever inquired with anybody about. And it’s just. You know, somebody is selling my data to, to all these companies who are offering the service, which I don’t want and there’s no way to stop it.

I mean, even if you tell them, you know, stop or stop messaging me, there’s like 30, 000 other ones that will message you five minutes later. So I think it’s, it could be huge for, for people to stop the sale of their data and hopefully stop some of this spam. Exactly. Well, Jody, thank you so much for being here.

Thank you so much for sharing your insights [00:39:00] with us. And for anyone listening definitely make sure to subscribe so you don’t miss our next episode. Thank you, Donata.