Brandi M. Bennett, CIPP-US’ Post

Does the modern Chief Privacy Officer (CPO) need to be technical? In my opinion, yes. I’m not suggesting they need to write code. But it would help immensely if they could (pro)actively work with people who write code. Historically, CPOs have assessed risk through the lens of the law. Today, with decentralized engineering teams, CPOs need to also assess risk through the lens of the code. Rather than waiting for the privacy review stage, modern CPOs should consider shifting left by using tools that identify risk: 1) As code is being written, 2) Before code is deployed,  3) Before code creates large volumes of data. 4) Before code is reused across multiple teams This mental model repositions the modern CPO as an end-to-end technologist who can help right-size risk, compliance, trust and efficiency proactively rather than an after-the-fact adversarial blocker who slows the company down. It will help CPOs become more influential within the company and preempt pushback from data governance/platform teams. This approach will position CPOs as technologists and innovators rather than reviewers and blockers. Most importantly, rather than “one size fits all” solutions that are unwieldy to implement and impossible to scale, this approach will enable CPOs to align their solutions to the company’s innovation culture rather than the other way around.

A vending machine that sells bullets using facial recognition and AI. What could go wrong? #law #artificialintelligence https://lnkd.in/giPB8meR

The Brazilian DPA just ordered Meta to stop training large language models using public content shared by adults on Facebook and Instagram in Brazil. See https://lnkd.in/ewQp_jKN. Credits: Arthur Pereira Sabbat and Lucas Anjos

The Oregon Consumer #Privacy Act goes into effect today (along with Texas's privacy law - see my post from last week for more on that)! As the number of state #privacylaws grows, so does exposure to privacy-related risks for regulated companies. Now more than ever, it's worth periodically taking stock of your compliance measures, like keeping your privacy policy up to date, ensuring your sale/share opt out mechanism works correctly, conducting any required #DPIAs, and ensuring you're set up to process consumer requests in a timely manner. The trail toward privacy compliance can be bumpy. Having an up-to-date map of your compliance measures can help you plan ahead for any rivers you need to ford or mountains you need to climb. #privacycompliance #dataprotection #dataprotectionlaws #privacypros #usprivacylaws #OCPA #riskmanagement #datamapping #privacymanagement #dataprivacy

It seems these #terrible #privacy #jobs never end. Here's another one in the greater DC metro area where they seem to think they can get 9+ (but don't worry, 12+ is highly preferred!) years of experience for a grand total of $131-237k with the usual bucket of global privacy laws and management experience. For the record, the highly preferred 12+ range means you've been doing privacy in this country since before it was cool because you predate GDPR. There's a pretty slim number of us who can credibly claim that since the profession exploded in the last 6 years.