Ep 41: Proactive Strategies for Data Protection in the AI Age

So you read the GDPR framework so that we don't have to.

231 pages and which is the best page?

So let's look at an example where a company's got it wrong. What's the impact to them?

Ben, there's a list of worst offenders here, people you would not expect.

They'd got hold of somebody within Finance Senior messaged a more junior person, called them up and it sounded like them, and they were told, just make the payment to this supplier now or they're going to shut us off. And 50 grand was transferred. You can get your privacy notice analyzed and get recommendations on what to do to improve it.

Hi, I'm Freya. Welcome to the Skynet Chronicles Business in the AI Age, the podcast that dives deep into the world where artificial intelligence meets business. Join us as we explore. Explore the latest trends, challenges and opportunities in this ever evolving landscape. From innovative startups to established enterprises, we'll uncover the secrets behind the successful integration of AI technologies. So grab a cup of coffee, sit back, and get ready to unlock the mysteries of business in the AI age.

Welcome. Simon Hinks, Privacy Practitioner Master of gdpr. How are you?

I'm fine, Tim, and thank you for that lovely introduction. I like to really see myself as a practitioner helper rather than a policeman, but fire away, treat me as you want.

I think policeman's a nice, strong word, isn't it? But we did. We'll stick with practitioner. Okay, so tell me how you became a privacy practitioner.

Right, okay. You don't become. You get a calling. And my calling was eight years ago, I'd been doing marketing and data, and I realized that there was something on the horizon, 2016, called GDPR. And people started to ask me about them. So I thought, this is interesting. So we got to 2018, and people were going mad because they had to be compliant. So they thought. So they were panicking. People were ringing me and I'm thinking, wow, this is an opportunity. So I read the. All the framework material, the regulation, and I built some tools. Not AI tools. These were. These were Excel spreadsheets to allow me to audit companies. And I said, yep, I could do it. And I did it. And it worked. And I did some more. And so that was eight years ago, and I must have done about 80 businesses. And when I say done 80 businesses, what I mean is that I've helped them become compliant with the regulation. So, yeah, so that was my. That was my calling. And I do nothing else now. So I just focus on the one.

Thing so you read the GDPR framework so that we don't have to.

213, 231 pages.

And which is the best page?

Right. The end.

I was gonna say it's got to be the last one.

Great. Yeah. But you don't really need to read it because.

Because you've read it for us.

Well, yeah, I have read it for you. But also that there's a lot of help out there for companies. The regulator called the ico, they're quite helpful at the end of the day.

So let's start with worst case. Company says, I don't need to worry about any of this crap, what happens.

Right. Okay. So I'm going to put some context on that, because my view is, and I've had this for a couple of years, is that a third, and I'm talking about SMEs here, predominantly a third are compliant, a third are thinking about it, and a third are thinking, I can't be bothered. And that scenario, I think, has remained for some time now. Any business which has got personal data, so basically any business which employs staff has personal data. So you have to, you have to be compliant with the regulation. It's, you know, it's. It's not either or you have to, and. But a lot of businesses out there haven't. And to be fair, they'll probably go through life and nothing will happen to them and it'll be great and they won't have to be compliant. But, you know, but then there are a lot of businesses out there who actually don't realize what is the situation they put themselves in.

So let's look at an example where a company's got it wrong. What's the impact to them? Ben?

Right, okay. So if we were to take a company with say, 10 employees turnover of say, 5 million a year, a. It could mean they're not registered with the ico, which means they're not their details on the database. That's a fine of a thousand pounds from the regulator. They don't like that, even though it costs £40 to register. And then you've got the whole scenario of all the personal data that you hold on your staff and all your customer data, and if you lose it, it's quite common for organizations to have a server and that server might get stolen. I had one client, the server was sat next to the back door where everyone would go and have a fag. It wasn't even in a lock box. It was accessible by anyone. And, you know, it has a value. So it's Quite common for if there's a burglary for burgles to steal the racks with all the data in, so they lose all the data, which means that a. Well now this is where it gets interesting because it's like, who do I tell my data's been stolen? Do I tell the regulator? Well, actually I'm not registered with the regulator, so I might not tell them. I believe that there is a lot more loss of data that goes unreported and the reason for that is that all those reported to the regulator because the regulator face transparent, will go on their website. So if you've got shareholders and a little notice comes up saying, oh, we've lost all our customer details, the shares are gonna fall in value. So I think a lot of organizations just, they'll either a pay the money for the ransom for the data, I believe that's more common than we hear about, or they just don't tell the regulator that they've lost the data. But if they were to tell the regulator and the regulator was to go, actually you weren't really looking after this data, you know very well you weren't, you weren't very transparent, etc. Etc. There was financial data on there, you know, people's credit card data, they could find you telephone numbers. People like Meta and Google have been fined millions and billions of pounds. Vast amounts of money, vast amounts to.

Us mere mortals, but not significant really to them as companies.

Well, to be fair, Tim, I actually don't know whether they pay them because there's nothing that said, I mean, just.

Because they've been fined.

Well, Yeah, I mean, BA got fined 20 million after being told that their website was, was not sufficient. They got fined 20 million. They put 20 million in the exceptional section of the report and accounts. But I think what happened was they had a lunch with the, the regulator and that became a smaller figure and I can't even tell you whether that's been paid. I have no idea who pays their fines.

And so that kind of leads some companies to think, well, we don't have to worry about it then. It's, it's a paper policy. It's not actually something that is enforced.

Yeah, it does, it does. So the regulator has a list of all the companies it finds and most of those because it's a regulator in every country in the uk, most of the fines for people cold selling through email campaigns where they don't have consent or telephone campaigns and the fines will be, you know, 50,000, 80,000 pounds and, and some of the Times what happens is they just liquidate the company. So, fine. Yeah, so that. It's a long list. It's quite interesting, actually, to see the list of. So let me just tell you, the worst offenders. There's a list of worst offenders here, people you would not expect. NHS trusts, worst offenders, Police force, worst offenders, UK Government Cabinet Office worst offenders. What else we got? Schools, worst offenders, councils, worst offenders. And the common thread through all this is that they are organizations which have high staff turnover, so the training gets missed. People don't understand really what they're doing when it comes to data. And the other one is they just don't think they got the finances to be compliant and they get fined. So. And charities is another big one. But the regulator, now, in the old days, the regulator used to find a charity and you used to think, ah, what, that's not nice. You know, they've done all these, you know, marathons and they've got all this money. Now the regulator's taken it away because their website wasn't secure. Whatever. What the regulator does now, it provides advice and guidance. So, like, puts them on a watch list and helps them become compliant. So it doesn't find them anymore because it realize what's the point of finding a charity? Yeah, you know, it's just not morally fair, is it?

Especially when the CEOs are already taking all the money.

Well, there is that, yeah. But we don't. We don't talk about that. And, yeah, so. So I. And the other thing about the fines, they go into the treasury pot, so it doesn't go into the ICO Christmas party. It would have been a lot easier if you could see that number. So. So, like I said, I actually don't know who pays the fines or not if anyone pays any fines. But.

So, yeah, for those who are more ethically and corporately minded, good citizens, what should companies be doing in terms of privacy of data?

Right. Well, okay, the easy answer to that is with me, because I'll help them become compliant. But what I should really be doing is thinking about what data have I got and where is it? And also how secure is it? You know, what systems have I got in place? And also make someone responsible for data protection. Now, this comes on to another interesting scenario, because the person responsible for data protection, it can't be the IT manager, they have to be separated from the data. Most companies will make the CEO or the head of IT responsible for data protection, but legally, as a. As a, like a data protection person, they can't be doing that. Because you have to work on the side of the employees whose data you've got and the customers. So you're. You're a bit biased. So in theory, you're meant to highlight to the regulator. If a company is. Is messing around with data, doing stuff with it, it's not meant to do, losing it. So you're meant to be a whistleblower. So that's why it can't really be a CEO. And the other thing is that there is part of the regulation, they can end up going to court and going to prison now, which they don't seem to realize when they take on the role. So making someone responsible, they really do need help. Whatever they do, they're going to need help. And that's where what they should be doing is contacting someone like me or an organization that can help them become compliant and start the conversation. Because it's a tough old thing, it's knowing what's what. So, for example, I've made businesses compliant. I've made, you know, there was a fudge factory in Cornwall, a lobster factory in Plymouth. I've done Love Island, Fly tv. They're all different businesses, but they all have the same issues. It's the same thing all the way through. So there's nothing there that I haven't seen yet, which, you know, which means I can help businesses quite easily and simply. But it's about taking responsibility and accepted. And also from a brand perspective, customers, well, if they see that you are a compliant business. Now, I know you're going to ask me about stamp. You can't have a stamp that says, well, I'm compliant. We don't have that.

Could we make one?

Well, yes, but that would be against the regulation.

Simon says it would be.

It would be an illegal statement, trademark. But you can say, I'm compliant with GDPR. You're never 100%. And that, in my eyes, endorses your brand a bit more. So, you know, you become a more trusted business because people dealing with you are going to think, well, they're going to look after my data.

But can companies say that they are registered with the ICO and put that registration details, does that carry any weight?

Yeah, they. I've seen that they do that as well. No, it carries absolutely no weight at all. So just the fact that they're registered doesn't mean diddly anything to anyone, to be fair. And, you know, anyone really can be registered for £40 with the ICO.

But.

But it's. Actually, that's a really interesting question, because when you look at it, you could be registered and be non compliant and it's like, well, that's really not what it's there for. So, yeah, you can be registered, you can stay registered with the ICO and you could be a non compliant business.

But is it still a step that companies should take? They should want to register with the ico, shouldn't they?

Yeah, every company, it's the easiest thing to do and it's the least painful. So if you've got data, if you've got staff, you should register with the ICO. Costs you between 40 and 60 pounds. That's all it takes. So what it does, it puts you on a register. And what that means is that the ICO knows you've got data now. Then people go, okay, well, I don't want the ICO coming after me, you know, the secret police or whatever you want to call them. There are not enough staff in the ICO to go after everyone on the register. The ICO go after people who they receive complaints about. So if I'm working with a company and they've received, and the ICO's received several complaints, this is why the email marketing and the telephone people complain about them. And the ISO will then look at those organizations who complaints they've had.

So registering the ICO is something that businesses should do. It's not the secret police that will come hunting because they don't have the manpower. But if there is a breach and somebody makes a complaint, but that business is registered with the ico, it shows that they've had some, and I attempted to air quote that some intention to work within the legislation. And so is that then seen favorably if they have registered versus haven't and there is a complaint against them?

No, just the fact they're registered doesn't really mean anything. The regulator will look at the company and go, right, okay, tell us about your security systems. And they would expect there to be. Now, the regulator doesn't tell you what security systems you need in place. It says security systems in place relevant to the data that you have on the premises or whatever. So what it means is that it wants to see that you're spending a certain amount of money on a good level of security. So if you're doing that, that's great. It sees that, it will then say to you and your staff, how many staff trained gdpr? And you'll go, none.

And they go, we wouldn't say none, surely.

Well, some aren't. But, but to be fair, in a lot of organizations now, when you join and you go through the training. I would say a lot of them have a little A module for gdpr. Now my argument with them is that the modules I don't think are very good and you, you go through a module and then you go and have a cup of tea and you've forgotten it all. Yeah, in my experience. So I prefer more hands on type of training but you know that they recognize it needs to be done. So you join a business, you'll have a GDPR training, training module. So that's fine. So you've got a certain level of training at the end of the day. Now I'm going to talk about the biggest issue around security and that is human error. People, people, they are the weakest link in all this. So you're going to have a million pound security system with men with guns and robots and whatever you want.

But so do you say memory guns?

Men with guns.

Men with guns. I don't know what memory guns are they so cool.

Men with guns standing, standing around looking. However they look. It won't mean anything because there's. And I'll give you an example, there's a, a band of hackers called the Spider Wickers or something. I can't remember now but they're.

They did this guys that did mns.

Yeah, yeah, they did M S. Yeah, these are the guys did M and S. And what they do is they look for a weakness in the human elements. So what they do.

Social engineering, isn't it?

Exactly right. Funny that that's the word that was in social engineering was written in the description that I read about them. So they, they try and get people to provide information about passwords and things like that. So they ring up pretending to be a supplier or a customer or a member of staff or whatever and, and they get details on how to get into the system and they get into the system and you know, and off they go do whatever they do.

Well, encrypt all of the data and ask for money. And now what they're doing is they're going down the supply chain. So they've got details of all of the suppliers who are putting product into Marks and Spencer's. They're attacking them. They do to then get the information to go after Marks and Spencer's equivalents and it's, it's rampant. That particular organization are apparently very aggressive.

Yeah, the whole supply chain has been a really big issue because what has not been happening is that when a large organization that has a number of suppliers on its books for that's the way it works. As part of the due diligence with these suppliers, they're not asking about their compliance with gdpr, nor are they asking about their level of security. And so you get a mismatch of businesses with different levels of security and different levels of compliance with the regulation. And so this is what happens. They, you know, the suppliers get hacked or whatever and they can work it up the line into the. Right up to the top. And in this example, M and S. So there's a whole raft of work around ensuring that the supply chain is compliant with the regulation and also has.

A good level of security and that people know. Don't click on links, don't open that, don't give away information over the phone call, even if it sounds like your boss.

Well, yeah, but the trouble is, Tim, when I. When I first saw these, they were always from Nigeria. They were bad English.

It was a prince. I've raised some money.

That's the one. You remember that one? Uh, the English was rubbish. The images were low, low graphs. And you'd look at it go, yeah, I can see that. I can see what it is. Delete it. Nowadays, it's. This looks like it's come from my CEO.

Well, and it is from the right email address.

Yep.

They can phone you.

Yeah.

Or message you and it still sound like them from their numbers. So they spoof the email address. Spoof the phone number.

Yeah.

They've cloned the voice.

Yeah.

How do you tell the difference?

Well, you don't. And what they're really looking for is they're looking for an office environment where people are forced to make a really quick decision of what they do with this. And it's those quick decisions that get people in trouble. Yeah.

I mean, I heard an example and it was. It was about 18 months ago, but they'd got hold of somebody within Finance Senior messaged a more junior person, called them up and it sounded like them and they were told, just make the payment to this supplier now or they're going to shut us off. And we can't have that. And 50 grand was transferred. It was completely fraudulent.

Yeah.

They'd inserted the bank account and they'd taken 50 grand out from. Bit of social engineering. And a phone call that was fake.

Yeah. I mean, that's interesting. I mean, things have. When you look at it, I remember a few years ago that companies receive just invoices from anyone and what they're relying on is it just going into the system and getting paid and. And that's what used to happen in a lot of cases. I remember working in the banks and we'd receive invoices for things they were like telephone directories with, and they get faxed through and they'd come from the Cayman Islands or something like that. And you'd look at these things and think, now this is not quite right. But it's like, well, if I don't pay it, you know, we might get the bailiffs coming in or. Yeah. So, you know, someone has to make a decision. So yeah, I could see why that would happen. And, and that could be a password, you know, as well as an invoice. It could be, you know, getting someone to give up a password to a system by forcing them to do that using the human social engineering. So it's, it's really difficult now for, for the average person in an office to know what's coming through on email. And I know there are systems out there that help you. But part of my, what I do is I, I train people to try and recognize and what I say to them is, don't make the decision on whether it's right or wrong. Send it to me and I'll, and I'll sort and I'll tell you whether it's right or wrong. So I say that to all my clients. Don't make the decision if you're not sure. Come to me with a question and I'll make this. I'll make the decision for you.

So it's human expert in the loop.

It is, but even I can get it wrong, I should admit to that.

I mean, everybody's fallible on there.

Yeah. And the other one, the other, the other great one is when people send an email to a mass group and they want it to go blind and it goes out cc'd so everyone can see everyone else's email, which is not so bad. The courts have recognized that there's a, only a small element of reward for having your email shared, but it's all to do with what's the message. So I've had a couple of examples. One was an email from an HIV clinic. So it contained the details in the, in the, in the email of all those who were HIV positive. So that was a bad one. And the other one was a pharmacy. This, I laugh at this one. I know I shouldn't, but it was a pharmacy who had a new stock of a certain blue tablet in and they sent the note out to all the men who always purchasing, waiting for the supply and it went out so everyone could See everyone else's name and. And so it's in the. It's in the message. Yeah, it's the context of the message which causes the greatest pain, or not so. But we can laugh at these things. But, you know, to be honest, again, it's just human error. It's someone doing it too quickly, not thinking about it. But it happens every day. That's the most common one I get from companies I work with.

So, generally, companies should register with the ico, they should have training for all employees on initial induction and on a regular basis to educate them on how to look after company data and personal data, customer data, and have measures in place to protect themselves from social engineering hacks. There's probably an IT security layer that they need on top of that in terms of automatic disabling of devices when they are compromised. But that's a level beyond this conversation. But all of these things sound great, but it's complicated, it takes time and so companies will look for shortcuts when they.

Yeah. So, yes. And there's one other element in this, which is bring your own device to work, which. Which is another level of, how do I say, craziness. Because the mobile phone camera emails, you can accept your work emails on your mobile phone. There's a whole issue. Companies basically need to make decisions on how devices are used within their environment. When you bring it to work, are you allowed to bring it to work? You know, do you have to have a work one? Blah, blah. So, but your. Your summary there is great, what you just said. I couldn't have said it better. And the issue is that, is it complicated? It's not that complicated. Done over time. It can't be done quickly. I mean, training, the regulator likes at least twice a year and to train people, depending on how many staff, can take time. So the trick in all this is to build yourself a GDPR compliance plan. And that plan could be over three months, six months. Doesn't have to be. The regulator likes to see that you're doing it, even if you've not reached the end of your, you know, compliance. I'm not going to say it doesn't matter, but it has less issue with the regulator.

There's merit that you're working towards being great, even if currently you're only good.

I use the phrase, you're on a journey.

Yeah.

And if the regulator can see that you're on this journey and that you've got all the right things that you're going to do along the journey, then they will be. They Will feel more comfortable with you as a business.

Awesome. Okay. Changing tacts. I love cake. I don't love cookies on the Internet. What are your thoughts about cookies on the Internet?

Right. I don't like cookie banners, the things that pop up and ask you to tick a box. I understand the value of cookies in that they help you understand where people are going on a website, what they're doing.

I.

I don't, I don't really like them to be fair because then again, they give people choice when they're on a website, whether they want to receive marketing or stuff like that. I just feel that it would be a lot easier if the, the cookie questions could be done once, once only, but they're done every website you go.

To and most people, honestly, they haven't got a clue what they're talking about, what they're ticking.

No, they don't. No, they don't. They don't have a clue. They haven't got time to look at. They're not going on that website to read their cookie policy. They're going on that website because they want to buy something on and see.

The products just click accept blindly.

Yeah, of course they do. So I, Yeah, but you know, but businesses like them because it tells them a lot about what goes on on the website where people go. It allows them to move data to the, to the US or to other countries. So, you know, it's, I mean, I think one of the big cookie issues was around Facebook. Facebook have been fined oodles amounts. They have a certain level. Oh yeah, this is another word I'm going to use. Arrogance. Arrogance sits quite high in all this. And what I mean by arrogance is that large brands are very arrogant on that. A, that they're compliant and B, that their security is sufficient. They are the worst offenders. So we can go with the talk about Facebook, BA Marriotts, you know, all large organizations who think they're, they're top of the game and they end up losing data for, for whatever reason. So high level of arrogance. So cookies I don't like, I'd like them to go away, but I understand the value in them. I just think that if there was a, if there was a way that when I got up in the morning and went on my browser, I would be asked questions, cookie questions, and I'd put the answers in and that would be the last time I saw us. That's the last time I was asked that question for the day. Then I'd be happy with that.

I think there are probably some browsers that do that, but general users won't know about them.

No.

So companies are obliged to keep a record of their data processes, what they're doing with data, how they're parsing that, how they're storing it. And that kind of brings us onto privacy notices on websites. So what are your thoughts on those privacy notices?

Right. Okay. So this for me is the, the greatest bits of gdpr, which a bit like the unsung hero now, the regulator and GDPR is all about transparency. What that means is that the regulator is saying it wants companies who you are a customer of to be very transparent while they're doing your data. Very simple privacy notice, which is the one thing least read by people which you find at the bottom of your website where no one goes to if there at all, if they're at all next to the whistleblower and the slavery notices and the. What else was the other one I saw the other day, Terms and conditions and the staff bicycle scheme. You're fine.

You'll find somewhere between bicycle scheme and slavery. It's a privacy notice.

It's a privacy notice. Now this privacy notice, I dare you to go and look at one because they're I, I love them, sadly enough, because the privacy notice outlines everything that's going to happen to your data. That's what it should be doing. So it'll tell you what it's collecting through the website or whatever, how it's going to process it, what legal term it's going to process it, on where it's going to go, so what countries are going to go to. And, uh, it'll talk about security. It'll also offer you rights where you can request a copy of your data. Um, it will also name the individual who's looking responsible for your data. There's a lot of really useful information in there that people just don't read. But the thing about a privacy notice is that it sets the scene on how your data's gonna be used. So if you don't read it, you don't really know what's going to happen to your data. And this is where at the early days Facebook were getting away with their advertising model, where your data would be shared with thousands of advertisers. And they said they could do that because it was in the privacy notice, but that one could got knocked on the head. It's also meant to highlight in the privacy notice where your data gets shared, who it gets shared with. So there's a whole load of useful stuff in there. The problem is there's Two problems here.

Most of them are rubbish.

Well, yeah. Well, that's three then. So one is if it's written by a firm of lawyers, you'll never understand a bloody word.

Yeah.

Because it'll all be legal jargon. Two, some people make them really long and boring and you just don't want to read them. They don't have to be long.

Do you think that's deliberate?

Sorry?

Do you think that's deliberate?

No, I think they just don't know what to put in there. So they put everything in. And those privacy notices have. And the regulator specifies this have to be understood by a 16 year old or it could be a 13 year old. Whoever's responsible for. There's an age, there's actually an age where you become responsible for your own data on the Internet and it varies by country. I think in the UK it's 13, some countries it's 16, some 15. So it has to be understood by a 13 year old. So that's why images are good. Break it up into sections. I've the best one I ever saw. The best one I ever saw. EasyJet. They made a video. They made a video, it was a cartoon of what happens to your data and it was just, it was just outstanding. Really, really good.

And they make you pay for that every time you get on a flight.

With one of the extras. Yeah, yeah.

So.

And the worst one I've seen have been, oh well, there's just too many worse ones to. To note. But there are or there are none at all. They're very vague and I think there is a whole. And the other one is it's meant to be updated annually and some are quite old, some go back to 2018 so, you know, they're out of date and so privacy noticed. For me, it's the most important notice document around gdpr. It's. It's sat in the least accessible place and it's probably read as the least amount of times as well, but which is a real shame, I think.

So a good privacy notice is a good indicator that a company actually cares about the data and that they're looking after or at least has thought about it appropriately. Yeah. So we had a chat about is it possible to review privacy notices and come up with what's good, what's bad, what could be improved and do so in a way that it was simple enough for anybody to use and could then offer them a simple 3 choice. I want to fix it myself. I'd like some help fixing it or I need to talk to A specialist. Because my entire process and all of my documentation is rubbish. And so that as an idea, we then we built a little prototype, didn't we? And we had a play with that.

Yeah, we did. I'm just going to say the reason we were able to do that is that the regulator specifies the structure of a privacy notice. So it's already there and that's what you should be doing. So that's how we're able to provide this little tool, Magic. The magic that we've built, which will take your privacy notice and tell you where you're good and bad.

Yeah, technically, it will take anybody's privacy notice from any country. So you can look at Google's privacy notice and it will highlight the gaps in this.

It will, it will, it will even create a. An answer to some of the gaps. So it'll identify the gap and then it will say, and this is what really should be going on in here. Why didn't we have this six years ago? I mean, it's a great idea, it's a great tool. The trick with all this is getting people to look at their privacy notices. And I think that by having a tool like this, it makes it easy for them to review their privacy notice.

And what we actually do is we do two levels of analysis. We do the level of analysis that we give back to the user in terms of effectively a rag status. And here's the couple of recommendations you could do to improve it.

Yeah.

And you get the full detailed analysis of all of the gaps that have been found.

Yeah.

So that if they go down a path that they want to talk to a specialist, you can give them so much more insight without needing to spend hours and hours going through every line item. It effectively gives you a shortcut to understand. Here are the key areas of the privacy notice. But you're then able to give your wisdom on all of the other layers that they need to be compliant. So it's kind of a. It's a giveaway, really, in that you can get your privacy notice analyzed and get recommendations on what to do to improve it. If you want to go the full hog and look at what you could really be doing, or even just have an initial consultation, it gives you the information that you can then go, okay, well, we've seen these issues currently. We suspect you've got these challenges. Here's what a package would look like to make you a compliant business.

It will. And in addition to that, I'm just going to say that it's one of the documents the Regulator looks at. So when it starts to look at a business, that's the first thing it looks at is the privacy notice. It's looking at how old is it and has it got all the right bits in. And from there the regulator then now will now know what it needs to look at going forward. But I think the tool is great in that it, it does a lot of the work for you in identifying the gaps. And the thing is, you can, you can, like you mentioned Google, but you can look at some big brand privacy notices and identify several gaps. There are, there are two common gaps I found. One is people don't put in how long they retain data for. That's a really big gap for a lot of privacy notices. And the other one is they don't tell the legal basis of processing the data. So what legal basis are they using to process data? Those are the two common things I found.

So you can't just put indefinitely. No, and uk, England, Wales.

No, that's what people do. They do, they go on the retention. They go for as long as we need it. Yeah, no, that doesn't work like that.

Till the ends of time.

Yeah, until we blow up. So, yeah, it's, it's a great tool. And, and I think that people should be A, be aware that this tool's available to them and hopefully we'll be able to share some details about how they can. Yeah, we'll give them, we'll give a.

Link on the, the comments on the podcast on all of the clips.

Great. So they can try the tool out. And the thing about the tool is that they don't have to use someone like me if they don't want to write it. They can take the gaps and they can try and do it themselves. But I tend to find a lot of organizations, A, they don't have the time to do it and B, they don't have an individual who actually knows how to write privacy notices. So.

And I mentioned those three options, didn't I do it myself, Use a tool to help or use a consultant. So we know you're going to get swamped. You're going to have too many companies wanting to work with you because of this tool. And so the next offering that we'll bake into, there will be effectively an engine to help write a good quality privacy notice which will give you a subscription revenue.

Yeah.

But won't require so much of your time because there's only so many meetings that you can have in a week and still get to enjoy the time of life. In the nice countryside you live in.

Yeah, actually, but let's not forget that other countries also have privacy notices outside of gdpr. Slightly different to ours in some respects, but we also write those as well. I also write those as well. So I can write you one for an American bank or an American website or an Australian website or a Singaporean website, depending on really what you're looking for. So, you know, if we can make this global and that'll be. I'll make it more interesting for me at the end of the day.

Are you saying you'd just like to have a flight out to Singapore just to help somebody enhance the policies?

No, but I have.

No, but yes.

Yeah, yeah. No, but yes. Yes. Yeah, yeah. So, yeah, just to mention the rest of the world, because, I mean, we're talking about GDPR here, but the rest of the world sees GDPR as the golden framework for data protection. And what they do is they steal the nice bits to build their own. And that's quite common around the world. Which means that, as I understand, GDPR makes it easy for me to understand other countries as well, but a lot of them have privacy notices.

And what's been the impact on GDPR because of Brexit?

When it, when it first, when it first happened, we just took the regulation from the eu, wrote it into our own law, so there was no difference there. Yeah. But the UK being the uk, likes to have a more personalized law. And so we have the duaa, which has just gone through Parliament, which is a regulation which amends the data protection framework. So if you think you're compliant as a business, then come April next year, you won't be. Because the regulations changing. Correct, the regulations out there now so you can prepare for it. But it's, it's there, it's been done to help businesses. So it's getting rid of some of the cookie stuff.

Okay.

And technically you don't need a data protection officer anymore, but.

Well, it's good practice to have one.

Yeah, it is, it is. And it also helps processing as well. There's this. It allows you to process data without consent. So there are some elements in there which are quite positive for businesses. But.

But if a business is trading within the EU or has customers within the eu, then both legislations apply.

Yeah. So now see what we. We have this scenario where the UK is now moving away from the EU GDPR framework. There is a point coming up very soon where the EU have to decide whether the UK is a adequate country. And what that means is, does the UK's GDPR, is it good enough or is it the same as GDPR in the eu? So we're going to assume that we're going to get that tick that allows us to move data in and out the uk, in and out of the UK to the EU without any kind of restriction. But, but the point with all this is that Brexit didn't really change, but things are changing now. And part of my job is to make people aware of these changes in businesses because it, it will affect you. So everything that you've done so far to make self compliant, you're gonna have to relook at.

It's as simple as that, which is good practice anyways. I mean, you should be regularly reviewing the policies and checking that they're still aligned with the frameworks. Yeah, but governments changing the frameworks make things more complicated.

So, so yeah, you're absolutely right. And so, and, and what's to say what's going to happen, you know, in, in another year's time? You know, it's just like it's. But it's all being done on the basis that they're trying to reduce the cost for businesses to become compliant and they're trying to make it easier. Whether you agree with that or not, we'll wait till you see the changes. But that's the theory that sits behind it.

Plenty more opportunity for you then. Well, companies need help.

I like to think so. So I like to think that I could keep going for a few more years yet. But you know, we've also got the rest of the world, they're forever changing. So very briefly, if you're a business that sells or buys from the US, the US has not got one data protection framework. It has about 40 different versions. It's per one for every state. Yeah. So I call it the Wild west, which is what it is. And so that means that technically a privacy notice could have quite a lot of different elements to it if it refers to different states. So for example, if you're selling into California, you've got the California regulation to deal with and it just goes on and on and on. And I was hoping that they were going to get a federal data protection framework, which would be for the whole country, but they haven't. So it just remains lawless or so.

Many different laws, it's impossible to keep up with all of them.

Yeah, it is. Well, that's half my job is trying to keep up with what's going on around the world and the uk, What I would say is that most countries are now signing up for two day protection framework. There's only, I don't think there are many countries at all. It's African states. But otherwise China has one. I mean we talk about a data protection framework.

So China has one, is their data protection framework. Give us all of your data.

But not to the benefit of the, of the, of the consumer. Even Russia has one. But it's not really very good. You know, people have it because people understand there's a value to data. That's the other thing some people talk about. It's the oil, but it's a bit more than that. It's probably gold in the sense that data is a very valuable asset to organizations to help.

And if any of those organizations are looking to develop AI to enhance their processes, the quality of that data and the accessibility of it is what's going to make those processes work.

Well, you're absolutely right.

It's become more important.

Yeah, yeah. It's you know, rubbish in, rubbish out scenario. You're absolutely right. And I think AI has a big place when it comes to data protection and the whole data protection framework within organizations. I think there's a lot it could do to help businesses remain compliant.

I do. But I think it's also created more risk because now how many individuals within companies are using large language model based chatbots with company data and doing so outside of their company's AI policy? I know of a company where they had a policy, they blanket said thou shalt not use chatgpt.

Yeah.

So what did their people do? Well, they use it on their phones and they email the output to their work email address and then they're using the output. So they're still using the AI process. They're still leaking data that they shouldn't be.

Yep.

And so that sort of recognition of how data is used within a business and putting in the right structures and framework is absolutely critical. Otherwise actually what they're doing is opening up a whole new avenue of problems.

You're right. And the regulator recognizes that. And there are lots of papers out there at the moment to try and create a framework that companies should work to or at least recognize the risks that they have by using certain AI tools. Yeah, I agree. The trouble is. Well, the reason why GDPR came out is it was the current regulation was behind the technology. So it was brought out to catch up with the technology AI, the technology is just ahead of the regulation at the moment. So the regulation is trying to catch up with it.

And that's always been the way. So it is an interesting time to be alive.

I think it's brilliant time to be alive. I really do. I can't wait for the robots.

They're coming.

Well, I hope so. I've got loads of jobs for them.

I'm writing a list already. I just hope they stay friendly.

Oh, yeah.

Well, Simon, it's been an absolute pleasure. Thank you for joining us today.

Thanks for inviting me to. I've really enjoyed it and I'm. I'm sure. Well, I hope our listeners will get something out of this conversation.

Well, and that's certainly out of our new toy.

Thank you very much.

Thank you.