The People-First Approach to Building Effective Privacy Programs

Intro 0:01

Welcome to the She Said Privacy/He Said Security podcast. Like any good marriage, we will debate, evaluate, and sometimes quarrel about how privacy and security impact business in the 20-first century.

Jodi Daniels 0:21

Hi, Jodi Daniels here. I’m the founder and CEO of Red Clover Advisors, a certified women’s privacy consultancy. I’m a privacy consultant and certified informational privacy professional, providing practical privacy advice to overwhelmed companies.

Justin Daniels 0:36

Hello, I am Justin Daniels. I am a shareholder and corporate M and A and tech transaction lawyer at the law firm Baker Donaldson, advising companies in the deployment and scaling of technology. Since data is critical to every transaction, I help clients make informed business decisions while managing data privacy and cybersecurity risk. And when needed, I lead the legal cyber data breach response brigade.

Jodi Daniels 1:00

And this episode is brought to you by Red Clover Advisors. We help companies comply with data privacy laws and establish customer trust, so that they can grow and nurture integrity. We work with companies in a variety of fields, including technology, e-commerce, professional services, and digital media. In short, we use data privacy to transform the way companies do business. Together, we’re creating a future where there’s greater trust between companies and consumers. To learn more and to check out our best-selling book, Data Reimagined: Building Trust One Byte at a Time, visit redcloveradvisors.com Our book was picked for a book club. I think that’s kind of fun that people want to read about privacy and trust in a book club.

Justin Daniels 1:44

Maybe they can get you to come and give comments on what it was like to write it and go through that process.

Jodi Daniels 1:52

Oh, I think they want to hear you because picking the title and the cover was so much fun.

Justin Daniels 1:56

Yes, that’s why I am going to have AI help me write my new screenplay. I survived writing a book with my spells.

Jodi Daniels 2:04

Good luck with that. Well, today we have Chris Tarbell, who is a leading privacy, cyber, and data strategy executive, who currently serves as the chief privacy officer for VERSANT Media. Chris has an extensive background, and prior to his current role, he was associate general counsel for Fanatics and the Walt Disney Company, where he advised global businesses on compliance with domestic and international privacy, data security, and related consumer protection laws. And most recently, Chris served as senior counsel at the leading law firm of Kelly Dry and Warren, where he also supported clients in numerous regulatory investigations related to marketing and advertising, and we are so delighted, Chris, that you are here with us today.

Chris Tarbell 2:47

Thanks so much, Justin. Very excited to be here. It’s been a long time coming, and very feel very fortunate that you guys asked me to be here.

Jodi Daniels 2:56

Now, I, I, I know, Justin, you are going to get this podcast started for this part. You said, “Oh, that’s so fun! I had to play on a music song. But Chris, I think what’s so exciting is what is behind you. I love the story of the special drawing that is behind you. So, if you are listening, you’re going to have to go and check out the video so you can actually see what I am talking about because you can see it in the picture. So, Chris, before we dive in, you got to talk to us about the drawing.

Chris Tarbell 3:23

Yes, it is by far and away the most asked about thing since I joined Versant. Has nothing to do with my background, my life, anything. Here’s what is this, and I will give the listeners and viewers a description. It is a hand drawn picture jointly by my son and spouse, which will be the sequel to Justin’s screenplay, How to Draw a Picture with Your Spouse, of sadness from the movie Inside Out, and you know, having worked at Disney for a long time, one of the common questions you get asked, like as an icebreaker at events and things like that, is like, What is your favorite Disney character? And this is mine. And I don’t know. I think this Inside Out movie, despite my prior, you know, work history, is I think just such an amazing testament to like complex human emotions and how to deal with them, and how they interact together, and just like super topic that’s accessible to people of all ages. And so, my for my first date, first my partner Melinda and my son Sam drew this for me, and I keep it here as a good reminder about sort of how hard things and happy things often go together, and you need to have both to really appreciate things.

Jodi Daniels 4:45

I love it. Thank you. Thank you for sharing.

Chris Tarbell 4:48

Yeah, of course.

Jodi Daniels 4:49

All right, Justin, you get to kick us off now.

Justin Daniels 4:51

Okay.

Jodi Daniels 4:52

Out of sadness and into Happyville.

Chris Tarbell 4:54

That’s right.

Justin Daniels 4:56

So, Chris, why don’t you tell us about your career journey a little bit?

Chris Tarbell 5:00

Yeah, sure. I had a very, very nonlinear legal career, and I actually almost feel bad sometimes when I try very hard to like help mentor law students that are like, “Well, tell me how to get into privacy. And I’m like, “Really, I am the worst example on like a practical level in Height I’ll Debtness. I did. I won’t bore you with all the stuff I did before law school, but I ended up going when I graduated. I ended up working at a big law firm doing like class action defense, and then by the time I was like seventh year, I had clerked on the Ninth Circuit, and the judge I worked for was very very adamant about like getting people exposed to like the legal work that is like the machinery that makes communities work every day. And he had been a public defender and had worked in a criminal system. And so at that point, I was like, hey, you know, I’d really love some like experience, and so I ended up quitting my job, and I went to work as a DA for free for almost two years, and it was amazing. I thought I would never leave. I loved just the whole entire process of working in the criminal justice system, and I loved both sides. I loved defense work. I loved prosecutorial work. But my partner Melinda, who I have been together with, this is our 30th year together. She was traveling a lot, and I we decided to relocate to Los Angeles. And I had two former colleagues from my days working in civil litigation who were starting a privacy program at a media company, and they said, “Hey, we think you would love this. I was very interested, like in a very nerdy way, because I had done a lot of Fourth Amendment work, and so I went and started a privacy lawyer, and I’ve been doing privacy work ever since. And I’ve been at different places. I’ve been an in-house lawyer for a long time. I had a wonderful time as an outside lawyer, most recently working at Kelly Drive. But I have done done all sorts of things.

Jodi Daniels 7:18

Chris, I think what makes your background so interesting is what you just shared. You have done, you know, outside counsel work and as an in-house privacy leader. How do you think those experiences shape and influence how to build a privacy program?

Chris Tarbell 7:39

Yeah, I absolutely think they’re more complementary than people might expect, and I am feel so grateful having done both. I mean, some of the obvious things I think is being an in-house lawyer is a very unique job experience, and I would say gives you sort of two practical things that I think make you an even better outside lawyer. One is you’re often thinking practically, and you’re focused on what the business objectives are. Now it’s easy to say that I think because you hear that a lot. I think one part of that is that you could go one step third or further about that because our business teams that we support as in-house lawyers are not thinking for themselves; they are often thinking about for consumers. And so, thinking like a business person is really thinking about like what is the best consumer experience. And I tend to think in privacy, especially good consumer experience is good compliance. And so, I think bringing a set of practical sort of everyday approach and how best to do these things in the real world is something that gives makes a good outside lawyer. I believe you there are plenty of them out there, but you bring a sense of that having done in house work. The also the other thing I think about in-house work that makes you better outside lawyer. Is you realize how much, despite how efficient we’ve become, how technology has revolutionized the way we do work, it is still a people business. It is about what relationships you have, who you can call, who trusts you and who you trust, and that’s not altogether that different. I think, and that’s like a personality thing in part too. Like that’s just how I approach life, but that is something that I think you don’t see as much until you get to be an in-house lawyer. But what I think people miss often, so that that sort of trajectory, being an in-house and then becoming an outside lawyer, is very often like, oh, that’s a good path and makes you better. But like, what’s interesting is I do think really good outside counsel make you even an even better in-house lawyer. I think you know one thing that in young in-house lawyers have a hard time doing is just. Being an advocate, think advocacy sometimes gets lost in favor of just getting stuff done. But I think the best way to get stuff done is oftentimes you have to advocate to different people about the best way to do things, whether that’s senior executives or regular everyday engineers or all this stuff. Just advocacy in general, and writing clearly, and all the things that come with advocacy. The other thing I was actually laughing with a former colleague me the other day that I said I did not anticipate is how much business generation as an outside lawyer helps you be a good in-house lawyer. Being an in-house lawyer is a lot about being a part of the business, I have to advocate for things that are not legal related at all. Like, what is the best tooling out there for me to help with my compliance program? What about like people management and head count and all those kinds of things where you’re advocating not just for a legal position foot, but for budget and human resources and for like approach to things and I think so that a lot of that is just being a good way of helping understand the importance of what we do and that’s the same thing about doing outside counsel business generation so I don’t know. The one has really helped me be better at the other. I hope I still have a long ways to go. And anybody that says that doesn’t is probably missing the point. But both have been really helpful in the other.
[Continue to Page 2]

Jodi Daniels 11:32

That’s so interesting. I I really appreciate your perspective of the outside business generation and how that might help on the inside. I haven’t heard that perspective.

Chris Tarbell 11:43

Yeah, like I, I wish I could talk to young associates because, like, I think business generation. I wish we could come up with a different name for it, right? Because that is a descriptive term in terms of like the outcome, but I don’t think is accurate as to the process. I think business generation is a lot is just forming relationships, helping build trust, helping people see the value of like what you’re doing. And I always thought, especially going from being an in-house lawyer to an outside, I was very scared. I can say that like we can all be vulnerable, sadness, right about that. I have so many friends who were in-house lawyers still, and I never wanted it to seem transactional when I talk to them, right? Like I never wanted my friends to all of a sudden see me as like, oh, well, Chris is calling because he wants to build business. First of all, I didn’t. I’m invariably just wanted to say hello, but like one of the amazing parts that like worked for me to view this is like what an opportunity to get to work and help my friends, and like I always wanted to talk to them about hey, like I can really help here, and like what an amazing thing I could support you with. That was my version of business generation, and that is, or I guess what we call business generation, and that’s no different than what in-house lawyers have to do on all sorts of things.

Jodi Daniels 13:11

Well said.

Justin Daniels 13:14

So why don’t we talk a little bit about more specifics and about what’s been different about building a privacy program in the media industry.

Chris Tarbell 13:24

Sure, and you guys tell me if this is not what you were looking for, but I happen to think like working in media has been amazing. One of the primary things that again I don’t think you would appreciate until you do it is how much collaboration as a privacy lawyer, you get to do with other legal disciplines in a media environment that you might not get otherwise. So, for example, if I have there, oftentimes situations where you have to deal with well, somebody has exercised their privacy rights in order to address a news article that contains personal information about them, so you’re dealing with the sort of cross, like cross pollination of the First Amendment and the right to be forgotten, and how do those things work together? Both of them are valuable and very, very meaningful to people’ rights, and how do you balance the two of them? And I get to work with my news colleagues who are just tremendous, and I’ve got you know like that kind of collaboration is so amazing. Same thing with like content protection. How do you work together with like our IP team, who is focused on helping our content creators protect their creative works, while at the same time protecting people’s personal data when connection with investigations into piracy or other kinds. Things. I mean, I just. I’m sure everybody can say this, but like the collaboration that you get to get with other disciplines in media that you might not otherwise has just been so rewarding. Like maybe on a more bigger picture, you know, media has changed more in the window that I have worked as a privacy lawyer in this space than the entire 100 years before that. For example, linear television kind of bopped along for a long time in a traditional format, and then it has exploded in its distribution models, the way people consume content, how people creators create it, and like aside from my privacy specific experience, it is just a powerful career sort of luck lucky straw I drew to get to work in an area that has seen light years in evolution, and that breeds new legal issues that are so amazing. Like my mom, you know, got her first TV when she was 16 years old. Never, if you had asked 16 year old Jane Tarbell, she would streaming media companies would have not even been on the same planet as her, and that has been cool. And then, like, pardon me if I digress into a little bit of a like hokey answer to this one. I think that the companies that I have been able to work for, and I’m going to say this gently, really matter to people. We’re not carrying cancer, and we’re not doing like certain things. I I get it, but like going to the Disney parks or buying a ticket to a movie with Fandango or going with your parents to golf is something that really really matters to people. Like the sole focus is to bring joy and to bring news and current events and opportunities to people who I think at a time in the world are really yearning for it, and that as a lawyer is very very rewarding.

Jodi Daniels 17:17

Very well said. I love the media industry, and as you talk about how much it’s changed, it’s interesting because I remember 25 plus years ago the big graphs about how digital was coming and it was coming and it was mobile and it was coming and it was going to take it all over and for years it was one of those it keeps saying it’s coming it keeps saying keeps saying and then and then poof here here here we are

Chris Tarbell 17:38

here we are very much so.

Jodi Daniels 17:41

Oh, it’s very, very interesting. Now, if you reflect you to this first year of building a program here, what do you think have been some of the challenges and lessons that you would impart to someone else working on a privacy program? Yeah,

Chris Tarbell 17:59

good question. I’ll I’ll give a couple responses there. One is some of them are unique to the experience of having, and again, I tell people on our team or people as part of our legal department, you may never have an opportunity again where you started out as one giant company and spun off to be an entirely different giant company that came with some amazing opportunities, very class half full about the Excel experience and our colleagues across both companies that did it gave everything they had, and I’m I feel very lucky. But I will say that I tried to focus on a couple things as we spun off into our own group that I think were helpful in in sort of expanding and building on the amazing sort of foundation that NBCU brought to our privacy program. One is just being a people first team, and there we could probably spend the rest of the podcast time talking about what that means. But just to give you an example, like it was very important to me that our team be a very flat one. I just really feel like good ideas should rise to the top wherever they come from, no matter what, and so you know, in the way that we organize ourselves, in the way that we every day deal with ourselves and our colleagues across the legal department or across the business, we try to be as flat as possible. Which I think I’m so lucky for the team I have have really had new and innovative ideas bubble to the top, which I think has been very successful for a company like Versen that is very focused on innovation and moving forward. That has been really amazing. The other thing that I think has been successful as you get to build a new company. Is to be a business participant, not just a legal advisor. So, for example, when we are thinking about workplace innovation tools for VERSANT as a enterprise, we have a legal function to perform. We provide legal advice, and we give compliance, and we help teams achieve their objectives. But we’re also employees, and so we’re also like consumers of those same services. So as we think about building a program, I think what has been uniquely and hopefully hopeful and successful is thinking of our team, not just as a compliance function and as a privacy legal program, but also as a stakeholder and participant in a broad range of services, just like marketing or engineering or employment or anybody else across the organization who’s just triggering it, figuring, trying to figure out how do we solve problems and in innovative ways using tools and what is the best way to do that, you know. I think also one of the challenges, and again, I will say this is a very Chris Tarbell problem, as much as anything else. But hopefully, other listeners can identify is how to let perfection not be the enemy of progress. You know, it’s like when you you’re like you move into a new apartment or something, and you’re like, I want to decorate all of this exactly the way I want it right away, right now. And then you quickly realize that you know you’re eating top ramen, and you don’t have the funds to do that, and you know you have a partner you got to negotiate with, building a program and building on a program that was amazing when we got it is also a little bit like that, where I had to. We have to think about what can we achieve. Where is the best way to spend our time and resources without letting sort of paralysis occur because we can’t do it all at once everywhere. That has been a little bit of a challenge. And then again, maybe not privacy specific, although maybe a little bit. But one of the things that was really unexpectedly hard for me was the pressure I felt in hiring people. It was like naming my firstborn son. I felt so much responsibility to get it right, and I am so thankful for the team. But I think you know it. Not having like never having to have built a team from scratch.

Chris Tarbell 22:37

I have tried to call like my you know one of a close mentor to me to be like, I don’t know how you hired so many people so right, like so. It seemed it seemed very easy for you. If you liked, it wasn’t. We laughed, but you just want to have the right people to have the right opportunity. Like putting aside the idea of, you know getting the right mix of experience and all those things that I think you would intuitive, I felt like especially in this day and age, I worried so much that I didn’t. If I didn’t, for example, personally review every application, that that one person who was like just looking for the right chance, wouldn’t get it, and that would be my fault. And I think as our privacy universe and the people who are in this vertical legal area grows, I don’t know. I it’s just I don’t know. That was my own experience. That was some of the hard things and easy things and happy things that occurred as a result of going through this.

Jodi Daniels 23:44

Well, now I’m so curious, either from your point of view or your mentors, is was there some type of did she say here’s how I picked great people, or is there something that you found here was a theme that I found in interviewing people that I was looking for.

Chris Tarbell 24:04

Yeah, no, not really. I I too was hopeful that she would be like, oh, you know, yes, my young Padawan learner. Let me tell you the secret formula to how to hire. And not surprisingly, she didn’t. But I think I think we approached it very much the same, in that having the right team is the most important vector, and I think I tried to approach it the same. Everybody on this team can that I work with now could be their own chief privacy officer, and I joke with them all the time that when they’re off running their own department, and I’m you know old, old, very old, and looking for part time work, that I would hope that they would you know look upon me fondly. But aside from that, just having the right mix of people. And the right soft skills, I just could not undersell every single person on this team, regardless of what year they are. I can confidently tell you, I could say, I can’t attend this meeting tomorrow. It’s with someone I don’t know on a topic I know nothing about, and they need something tomorrow. I would feel confident they could go in and figure it out, and that is an in-house skill. Quite frankly, that’s a life skill that is not that is undervalued. And so, getting the right people who love their job but also are just so supremely talented. I don’t know what you know door I held open or parking spot I gave up for them to choose this team, but I am so thankful for all the goodwill I put out into the universe because I am just feel very fortunate.

Jodi Daniels 25:51

Appreciate you sharing. Everyone’s always asking that same question.

Chris Tarbell 25:57

Yep. Yes. If if anybody, if you two or any future guest gets the manual and figures it out. I would I will happily subscribe to that service.

Justin Daniels 26:09

So, what’s one thing privacy leaders can do to make their programs more effective?

Chris Tarbell 26:14

Oh, I can tell you with let me quick reaction hot take. Just make it fun. I I think we undervalue like we can make it more efficient and we can make it clearer and we can make it more self cert and all of those things are great, but I I think ultimately just being a fun person that people want to spend their time with is the thing that you can do the most to make a successful program. I don’t always succeed, believe me. I am sure that I am the face upon many a dartboard around the globe, but I try very hard to remember. You know, I will say, I very much remember leaving the DA’s office, and then starting my first privacy job, like within a weekend of each other, and I had just been doing stuff like, you know, helping to support homicide prosecutions and helping people work to do, you know community release? I mean, who were on probation with suspended sentences, and that I remember like thinking that I remember distinctly having a call my first week where there’s somebody was like, “This sweepstakes is the most important thing that is happening right now, I remember having a moment, and I just sort of laughed, and then I told them this odd sort of juxtaposition, like you know, sort of juxtaposition between what I was just doing and now, and we kind of laughed, and we kind of made a joke of it, and we solved it. And I think just being a good person who brings some fun to the job is something that everybody would benefit from and make your privacy program as good as it can be.

Jodi Daniels 28:08

That really ties to what you were talking about before with relationships and how your. This is still a people job, and I, I think technology can help tremendously. It is a people job. You have to actually talk to the humans who are using information or thinking about how to use information new and interesting ways.

Chris Tarbell 28:28

Yes, 100% Every person, hopefully, everybody who on the team at Verson here would would agree with me. But the very first thing I have on there, like onboarding documents that I and that I have asked them to do, is I said, just go out and make friends. That’s the very first thing. That is the most important way and the most valuable thing that you can do for your own career because it makes your everyday job more meaningful. But also for the program in general, like the more people we know, the more like and the world is just filled with. And the company is no different. Like with just so many interesting, amazing people who are doing stuff. I just can’t think of a better use of your time. Like we have two, just to give you an example. Like we have two amazing women who run one of the divisions in our one of our news groups, and I discovered them because they had this like very small need on something relating to a partnership we were doing for an event, and I just found that I was so inspired by them, by the work that they had done, and by the program and business they had built, and I just was like, “Hey, would you just like spend an hour just talking about your just what you’re doing? And now, if they need stuff, they know to come to me. But also, like, it’s so rewarding. I almost felt selfish in a way. But you know, if they have privacy needs, I’m confident they know who to go to. But like, my job is just more rich and. Filling because of them.

Jodi Daniels 30:03

Now we ask everyone who comes on the show, what is their best personal privacy or security tip? Since everyone here is doing so many interesting privacy and security related things, so based on everything you know, what tip would you offer people listening?

Chris Tarbell 30:22

I would say the biggest thing that I try to do that I think we should all try to do that is not a tip but a like a plea is talk to kids about privacy, and I’m not talking about talk to kids about COPPA compliance. I’m talking about like talking to kids about how they engage with our digital ecosystem and what it means to put information out there, what happens to it, and why, and we are as privacy lawyers, we’re in such a unique position to help under give people the behind the curtain thing about what happens, not just like a technology sort of transparency, but how data gets used and who has access to it. And there are people working with like government requests and all sorts of things. And I try to do my best in a fun and age-appropriate way, like talk to my son, who’s 10, about privacy and what it means and what he can do and what happens. He asks he asks questions, and I I worry a lot about the next generation for lots of reasons. And I do feel like we are as privacy lawyers in such a unique posture to talk about those things, and you don’t have to have kids to do this. You can volunteer at schools. You can. There are plenty of community groups. There are all sorts of teams that do like like law firms that do street law. My tip is like get out there and talk to young kids as much as possible about privacy and what it means.

Jodi Daniels 32:05

And I would add, and just I’m going to ask you to remind people because I think kids, for sure, we care significant. We’ve had lots of episodes on that. We also, I think, our seniors, you know, that’s also a group who came in a different generation, and so they might have been able to pick up on some of the just how to use technology, but actually, what happens behind the scenes and how to protect yourself is a little scary. So, Justin, why don’t you remind people where they can participate as a privacy professional, and also how to get information to share with those in their communities,

Justin Daniels 32:43

we’re talking about Op Inspire.

Jodi Daniels 32:45

Bingo!

Justin Daniels 32:46

Why don’t you tell us?

Jodi Daniels 32:47

No, you’re on the board. Off you go.

Justin Daniels 32:49

Yes. Well, that’s what another one of our friends of the show, Lexi Lutz, does. So it’s an entire organization dedicated to helping educate seniors and kids to be safe online and privacy professionals can actually get what IAPP credits for showing up and

Jodi Daniels 33:09

and participating

Justin Daniels 33:10

and participating.

Jodi Daniels 33:11

Yep, can you remind people where they go? Can you remind people where they go? The

Justin Daniels 33:15

Opt-Inspire website.

Jodi Daniels 33:16

Yes,

Justin Daniels 33:17

yes.

Jodi Daniels 33:18

Do you know the Opt-Inspire website?

Justin Daniels 33:19

It’s optinspire.org

Jodi Daniels 33:21

Oh, there you go. Everyone listening. All right, that was a plug, and so, but it’s your turn.

Justin Daniels 33:30

Yes. So, Chris, we’ll finish up by asking you, what do you like to do for fun?

Chris Tarbell 33:36

No. How much time do you have? I am a very lucky person. Huge reader. My mom and I have been like that was our happy place together is reading. So I read it all nonfiction, fiction, big books, small books. You can probably find me with a book wherever I go. Huge sports fan. In fact, you know, as a privacy lawyer, you often are like giving people hypotheticals, and so you will always find every one of my hypotheticals as much as possible involves collection of data about people’s UCLA sports fandom, which is my alma mater and my mom’s alma mater, and like I’m a diehard Bruin fan, so sporting events of all kind. I just moved to Colorado like a few years ago, and so being outside is a big thing for me. And then my amazing partner in life and spouse Melinda is a fashion stylist and vintage clothing company owner, and she also travels a lot. So spending time together is something I like to do. It’s fun when we’re in the same place and have nothing to do. I feel like it’s a gift.

Jodi Daniels 34:52

Well, Chris, we are so glad that you were able to come and share what it’s been like as outside counsel inside building. Building a privacy program, tips on how to hire privacy pros, and we we again we’re so grateful. If people would like to connect and learn more, where could they go?

Chris Tarbell 35:11

Reach out to me on LinkedIn. You can send me an email. Like I, I really one of the things I try to do is I’m an open door for anything. You are interested in joining Privacy Cruise. You want to move. You also love sadness. You just want to hang out anywhere and everywhere you can reach me. I will. I will never turn down a chance to sit down and talk.

Jodi Daniels 35:36

Well, Chris, thank you again so much. We appreciate it.

Chris Tarbell 35:40

Thank you.

Outro 35:45

Thanks for listening to the She Said Privacy/He Said Security podcast. If you haven’t already, be sure to click subscribe to get future episodes and check us out on LinkedIn. See you next time.