Making Privacy Tech Work: Why Process is the Game-Changer

Intro 0:01

Welcome to the She Said Privacy/He Said Security Podcast, like any good marriage, we will debate, evaluate, and sometimes quarrel about how privacy and security impact business in the 21st century.

Jodi Daniels 0:21

Hi. Jodi Daniels, here, I’m the Founder and CEO of Red Clover Advisors, a certified women’s privacy consultancy. I’m a privacy consultant and certified informational privacy professional providing practical privacy advice to overwhelmed companies. Hello.

Justin Daniels 0:35

Justin Daniels, here, I am a shareholder and corporate M&A and tech transaction lawyer at the law firm, Baker Donelson, advising companies in the deployment and scaling of technology. Since data is critical to every transaction, I help clients make informed business decisions while managing data privacy and cybersecurity risk. And when needed, I lead the legal cyber data breach response brigade.

Jodi Daniels 0:59

And this episode is brought to you by Red Clover Advisors. We help companies to comply with data privacy laws and establish customer trust so that they can grow and nurture integrity. We work with companies in a variety of fields, including technology e commerce, professional services and digital media. In short, we use data privacy to transform the way companies do business together. We’re creating a future where there’s greater trust between companies and consumers to learn more and to check out our best-selling book, Data Reimagined: Building Trust One Byte at a Time, visit redcloveradvisors.com. Well, hello. What’s up? It’s lunchtime. I think someone over here needs some lunch.

Justin Daniels 1:38

Indeed, soon as we’re done broadcasting. I’m going to get lunch.

Jodi Daniels 1:43

Alright, so go in the energy reserve, do some yoga stretches and make it through. Today, we have Amanda Moore, who is a seasoned leader with extensive experience in privacy strategy, technology and operations. She currently serves as the Senior Director of Privacy at DIRECTV, where she oversees the company’s privacy program with respect to technology and operations. Prior to her role, she held pivotal positions at CVS Health and at&t, leading technical and business teams. Well, Amanda, we are so excited that you are here with us today.

Amanda Moore 2:19

Thanks for having me.

Justin Daniels 2:21

So Amanda, can you share with us a little bit about your career journey and how you got to where you are today?

Amanda Moore 2:28

Yeah, it started off on a really strong foot. I graduated with a degree in economics during the great recession. So no one was hiring. No one wanted to hire me, but I ended up taking a contracting job, like working with through a contracting agency, and took a job in an administrative assistant. I was really bad at that. I didn’t know that I was supposed to say that my boss was Ave not available, as opposed to just not there. It was a whole — it was a mess. So I was bad at that, but I weaseled my way into technical documentation, documenting disaster recovery processes, processes which got me in the door with it, and then I was able to, you know, pivot that into support analyst role, and eventually a product manager, which I loved. I love technology, and I was really good at writing requirements and understanding what technically needed to be done, but putting that in plain English so developers could develop on it and business teams could understand it. So that was my first introduction to privacy. As a privacy product manager, I took a hiatus, joined another company, and then came back to DIRECTV, running their Operations and Technology here at DIRECTV, and it has been great. I love privacy because it’s always changing. It’s always something new. Every day there’s like, it seems like a patchwork — thousands of laws on the books. And so it’s a fun space to be in, because there’s a new headline and there’s a new problem to solve.

Jodi Daniels 4:17

We have definitely have a lot of problems to solve and a lot of headlines. So I am glad that you like privacy, because I think for people who want black and white and consistent, privacy is probably not going to be the best spot. And I love how you enjoy technology and privacy operations, which is one of my favorite topics. So I’m so excited for us to kind of dig into that conversation today. What would you say might be some effective ways that privacy technology can enhance efficiency without disrupting business operations?

Amanda Moore 4:56

So the first thing I like to do is. Map out the business process, really understand, like, what the business is doing today, because maybe it’s a small change that we can make in the back end and not disrupt it at all, right? So maybe they are, you know, reading a disclosure when they make a sale, and all we have to do is add it, opt in on the back end. So I think it’s important to meet the business where they are, understand the process, so you can make light touch recommendations. You know, having been on the other side in the business, there’s nothing worse than like someone coming in saying, you know, this isn’t okay. You can’t do this. So I think mapping out the business process is really the key to not disrupt business operations.

Jodi Daniels 5:53

That makes a lot of sense, and by doing that, you might also be helping in your data, inventory requirements. It’s like a two for one.

Amanda Moore 6:02

Exactly, exactly, all about being efficient, right there. I love efficiency because, you know, having my education and economics I really like was energized by labor economics, efficiency, and so I think that’s what kind of spurred my interest in technology. Because I’m like, why are we doing it this way? This is so inefficient, and so you know that it has helped me in my career by adding value and doing good work. But you know, sometimes didn’t go over, like, I would like —

Jodi Daniels 6:41

I’ll just add that I think in privacy, you kind of have to be that kid that always says, why? Yeah, it’s worked out very helpful. Why?

Justin Daniels 6:56

So with a wide range of privacy tools available, what factors help determine the best fit for an organization’s needs?

Amanda Moore 7:04

There are a lot of great tools out there, and I think about it like going to the mall and buying cheese, right? So the tools just solve a problem, the jeans just cover your bum. And so, you know? So if all else is equal, you know, it’s how much money do you have? Do you already have a relationship with a certain platform? And do they have a solution that will meet your needs? But it really starts with the problem that you’re trying to solve. I mean, even by all the tools in the world. But if you’re not really clear on the problem you’re trying to solve, it’s going to be a mess. So I always start with a problem in mind, and I tend to look at our existing relationships to see if they have a solution that will fit my needs. Will probably get a better price. We already have a relationship with these people, so there’s a lot of benefits to doing that. However, I am not afraid to branch out if there is a specialty need and a specialty problem that I’m trying to solve, but I always recommend you know is sometimes, if all else is equal, it comes down to price, it comes down to the customer service. So there’s a variety of factors with so many tools that I weigh, I tend to stick with the platforms we already have a relationship with, just because it’ll be easier implementation this far along in the journey.

Jodi Daniels 8:36

So as companies are trying to figure out, should I have technology or should I not? I think when I talk to companies, a lot of times they think the technology is just going to poof, magically get implemented, and it’s going to just do whatever privacy compliance that they think they need to have. And I’m smiling. If you were watching this video, you would know that, and that doesn’t quite work that way. Privacy technology is here to help in some places, it can automate in some places it is a requirement to have, but there’s a lot of parts and steps to making privacy technology actually work. And Amanda, you hit on, well, what are the business goals? So can you share a little bit about how you think people can help have this conversation internally about I have this privacy technology, I’m trying to figure out this business process and how they can make the two pieces actually work well together.

Amanda Moore 9:39

I think really understanding and partnering, like building strong partnerships, have proven invaluable. It helps, you know, just from a relationship, you know, working relationship, but then it also builds your reputation so other they talk to, they have their own little network, and we’ll talk. Talk to other leaders that may need our help, or I get all kinds of requests like, hey, we can do, you know, privacy helped us do this. You know, maybe they can help you do what you’re trying to solve. So I think that having strong partnerships and really building relationship of Yes, but so maybe it’s yes, you can do that, but you also need to do this, or rather than No, that’s not okay from a privacy and compliance perspective. You know, that’s a violation. I think there are ways to frame it where it’s more positive and you get a better response. So I have found just building those strong partnerships with the business it is pays back in dividends.

Jodi Daniels 10:50

And those partnerships, from a business standpoint, aren’t just it who might help or legal, but also it might be a marketing function, or a product function or a customer support function, like the actual business teams performing whatever it is that the company is actually doing.

Amanda Moore 11:09

Yeah, I had strong partnerships with marketing. And you know now we help marketing turn things around faster by making sure all of the consents are right, and then they can launch a campaign. And so, you know, then privacy is a that, you know, it tends to be kind of more like a cost in there. It doesn’t make any money. But then you get to spin the story of privacy is helping. The bottom line, privacy is helping the business grow, and that’s a good story to tell the leadership.

Jodi Daniels 11:47

That’s a great story to tell. I really want everyone to hear that again, which is that privacy doesn’t have to be a cost center when done right and with the right conversations and education and partnership and tools and process privacy, can app 100,000% be an enabler of the company? And it absolutely is. I mean, if done right, if done right, yes, which takes time. Also, it’s not just a, you know, super easy 1-2-3 kind of thing.

Amanda Moore 12:19

It’s not magic. Doesn’t happen overnight. It’s not magic.

Justin Daniels 12:24

So what common challenges arise when encouraging internal teams to adopt privacy technology and what strategies help them overcome them?

Amanda Moore 12:35

So if there’s low adoption, I have found that the cause is usually an awareness issue, awareness of process, awareness of tools. So I’ve done road shows in the past. I’ve worked with the comms team to send out company wide communications. But like, what’s most effective is like building your reputation within the organization so people aren’t afraid. Sometimes people privacy gets a bad rap because they’re the no people, and especially if you’re in the legal department, like, there you guys, you’re the no people, the people that are going to, like, really crush my dreams, and I’m out of dream pressure. So I think reputation, but road shows, getting out there, making people aware of the tools, the process, and making it easy. So there’s, you know, there’s a couple approaches to simple things like PIs, right? We all do PIAs. But what you need to know to like, what’s the bare minimum you need to know to assess the privacy risk. You know on the surface, is there personal information involved? Is there sensitive personal information involved? Are you sharing this? If the answer is no to all of those, and they’re just doing a project, they don’t, they shouldn’t have to fill out a super long assessment, because they’re really, you know, they’re clear from a privacy perspective. So we make it easy on the teams to comply you, so you capture the bare minimum and make it easy to comply, and then they’re probably more likely to start adopting it.

Jodi Daniels 14:24

I think, Amanda, what one of the pieces I hear you saying is we’re thinking of the business first, and have them, they’re our customer in this conversation. So what is going to make it easiest and simplest for the business? To help you, the privacy team, the organization, comply and do what we need to. But we flipped from privacy first, no first. Let me understand, then approve to help me, help me hear what it is that you’re doing. Let me make it as simple as possible. Then my little risk flags will go up, and then we’ll have the conversation. But I’ve built a really good partnership. Have helped educate you along the way so that we can get to not being the no people, but being with the Well, here’s how we have to do whatever it is that your dream is.

Amanda Moore 15:11

Right, exactly.

Jodi Daniels 15:14

Now, when people are implementing technology, you know, it’s probably good to measure how effective it is and how useful it is in the organization. And there’s different kinds of technology. So how you might measure cookies and consent might be different than how you measure for PIAs or data subject requests. Right? Different technology is serving different purposes. What are your thoughts on effective ways, or maybe you have a few favorite metrics that you think people could be using in their programs.

Amanda Moore 15:47

There’s always the DSR like volumes, handle time, consent rates. I don’t know how much value that provides and what that exactly says to my personal opinion, not the opinion of my company. So what I think really moves the needle is how you can measure program — privacy program maturity with tech, the use of technology. So for like, I love the CICA privacy maturity model, because it’s simple, and then we can measure each domain on, okay, so we deployed this thing, this piece of technology. How is that moving the needle and making us more mature as a program? So I am a big fan of measuring the program’s success in its use with technology and measuring each domain independently, versus like the typical DSR handle time consent rates, because that doesn’t say anything except like customer behavior, right? That doesn’t tell you anything about how well your program is doing. So I use that framework, the CICA framework, because it’s easy, it’s easy to understand, easy to measure against.

Jodi Daniels 17:17

Big fan. Is that a measurement that you’re doing, like, how often are you doing that? Is that a once a month, a quarter, an annual and then my second part is, who sees that? I mean, obviously you are, and that’s going to be important for measuring a program. But who else in an organization do you think should be part of that review?

Amanda Moore 17:37

I think that is something you can tell if you have leader quarterly leadership readouts, it’s something you can share and share the journey and share how effective you’re being in each of the domains that you measure. I think it’s a good story to tell when you can show growth and say, Yeah, we have some repeal processes here. We are mature in certain respects, but these are the areas that we need to focus on next. Because we are we’re less mature. And it’s a good way to measure your overall program health, in my opinion. But, yeah, it’s a, I think, leadership, you know, all the way up the chain. However you can, if you have quarterly ones-on-ones with your boss’s boss, I think it would be a great time to share that information.

Jodi Daniels 18:31

Excellent tips. And the last thing I think I’ll add, which I’m sure you already do, but for those listening, is depending on who your audience is, to really tailor what those metrics are, because different executives want to receive information different ways. Some are going to be really linear. They want lots of words. Some want charts. Some want visuals, but imagine your short time to be able to explain your program. How are you going to be able to communicate that effectively? And we started this conversation around Operations and Technology and how, how is the technology working for the company? So think about how you can help tell the story there, especially if you’re trying to ask for more resources. You want to be able to say how the first set of resources have been really helpful, and how this will continue to be beneficial for the program.

Justin Daniels 19:26

So we always like to inquire your opinion on, do you have a favorite personal privacy or security tip that our audience should be thinking about?

Amanda Moore 19:37

Okay, so I’m going to speak from Amanda from like, two weeks ago, and then Amanda today, because those people are two, we have two different perspectives here. So first, I always use a private browser VPN. I don’t want people to track me on the internet. But I recently applied for a mortgage, and in doing so, I. Received all kinds of text messages, like, your house is now your offer is now ready. I didn’t I’m not interested in selling my house. So now I’m thinking maybe a do not sell or share my personal information would be, would be warranted. So I like both. I think browser, private browsers and VPN are an easy way and not really have to think about it, but with a do not sell because of what I’m experiencing right now. I think is my new favorite today.

Jodi Daniels 20:35

Well, yeah, that is, that is insanely frustrating. I get all kinds of text messages. Whoever decided to start text messaging offers direct it was a horrible I’m just so curious to know what the success rate is on them, because I haven’t met a single person who is happy, right? I yeah, I don’t understand. I have a lot of blocking. Delete — report as junk is a joke. Yes, I don’t know if it works, but I love the block on a phone. Oh, so much fun. Okay, maybe I was a little too much. All right, so, Amanda, I know you have some really cool favorite activities when you are not doing this privacy thing.

Amanda Moore 21:17

Well, right now it’s skiing. So I live in Utah, and we have probably six months of ski season, so winter, early spring, is definitely skiing. Do it a couple times a week. I also love to travel. My husband and I usually plan a trip in the summer and fall to kind of break up the non ski season. And, you know, dabble in photography, volunteer. So I have interests that consume my summer months, but seeing is definitely a thing in the winter, like all the time.

Jodi Daniels 21:50

Do you have a favorite destination that you’ve been to, or is on your wish list?

Amanda Moore 21:58

Bhutan? Bhutan is the most magical place I’ve ever been.

Jodi Daniels 22:04

I love Bhutan. I see that’s my favorite. Thank you. Thank you for sharing. And if people would like to connect with you, where should they go? 

Amanda Moore 22:15

You can find me on LinkedIn. It’s just Amanda Wayne. Is my profile. It’s probably Amanda Wayne Moore so find me on LinkedIn, connect with me. Say hi.

Jodi Daniels 22:26

Amazing. Share your favorite destination. Well, Amanda, worse, let’s go Trad that you joined us today to talk all things privacy, Operations and Technology and really cool travel destinations. But thank you.

Amanda Moore 22:40

Thank you Jodi, thank you Justin.

Outro 22:46

Thanks for listening to the She Said Privacy/He Said Security Podcast. If you haven’t already, be sure to click Subscribe to get future episodes and Check us out on LinkedIn. See you next time.