My oldest daughter is learning how to drive, and she learned an important lesson last Sunday night.

Always check your car before driving it.

As a family, we had just come back from a weekend trip. We got a really awesome prime parking spot on the top level of the parking deck – the level that’s nice and exposed to all the elements, including the blazing summer sun.

It appears that a few days before our trip, the sidewall of a tire got scraped, but I didn’t notice it.

After a few days of baking in the sun, I’m convinced that the tear expanded. Walking up to the car in the bright daylight, with no cars next to me, made it easy to spot the fairly large portion of the tire that had peeled away.

My husband, Justin, and I both looked up what the risk is of driving on a highway with a tire like this. As we expected, our multiple searches and cross-checking the internet told us it has a very high risk of a blowout. We checked multiple sources just in case there was a glimmer of good news. In case you’re curious, here’s what it says:

It was around 7:30 pm, and the airport is quite a distance from our house. After calculating various scenarios, including a blowout on a 7-lane highway NOT being a good one, we moved the car to a nearby hotel, called roadside assistance to get it flatbed towed, and I ordered an Uber for my girls and me to get home. Justin stayed with the car and enjoyed a lovely ride home in the tow truck, and I hear he had a wide-ranging conversation.

The next day, we learned our road hazard on our tires covers the new tire. By Tuesday, my car was happy again, AND it got some other work that needed to get done anyway.

While talking about the cost of a flatbed and a new tire + taking an Uber home, my younger daughter said: “That’s why we have a rainy day fund.”

In case you think your kids aren’t listening, this is proof they are because Justin uses this phrase ALL the time to teach why it’s important to save for unexpected events.

Lucky for us it turns out that the cost of the insurance + the road hazard covered all of it. I was just out for the Uber.  

Why am I sharing this story?

Because I can’t help but think about content and lessons and how it ties to privacy – I know, it just keeps happening to me!

Last Monday, I started typing out my notes from this experience to put into this newsletter. In case you were wondering, a Sunday newsletter means I have to be done writing it Thursday night so it can get into this pretty newsletter format (and sometimes, yes, I’ve been known to still be tweaking it bright and early Friday morning).

Just what are these lessons?

It comes down to how to identify risks, evaluate them, and prepare a response.

Identify Risk

Part of really preparing for risk is knowing how to find it. In this situation, it was doing a physical inspection of the car. Being super observant (remember in prior issues I shared that I really notice details?) That proved to be super helpful here. Though, my kids aren’t quite fans of this superpower when I notice something isn’t done that I asked them to do.

In privacy, the question is: how can teams identify risk? Is it through a conversation held monthly? A privacy impact assessment (PIA) that’s reviewed? A security risk assessment? A vendor assessment? Looking at a product or marketing release and finding an issue?

Consider how you can learn about new initiatives, new data use cases, or new tools that could present risk.

What are the steps your organization is taking to find them?

Evaluate Risk

For us, we had to evaluate the actual harm to the tire, the likelihood of an issue, situational awareness being really only highways to get home, time of day, and my entire family being with me.

We went through what’s too risky for us – a blowout on a major highway could be a significant safety risk. Our lives were not worth this risk.

In a company context, evaluating the risk means needing a list of criteria and having a way to then measure each activity against it. Based on the calculation, it will be determined not so risky, middle-of-the-road risky (yes, pun intended), or too risky. Each company has its own risk tolerance. Having a risk framework, a methodical way to measure it, and then a process to execute on the risk is important. Just knowing the risks with no way to evaluate them is only a part of the process.

At work, if you had a privacy risk with a project or initiative, who would you call? What is your company’s process for managing those?

I participated in a webinar last week with Syrenis, and we talked about this very topic.

One of the issues I see time and again is there’s either new projects getting flagged, but not documented, or they are documented but no one follows up on the risk. Then there are companies that are doing none of these things or not doing anything consistently.

What needs tweaking at your company for finding and evaluating risk? What one action step could you take today to close that gap?

Responding to the Risk

Knowing a risk of a car problem can occur, we had a roadside assistance plan (for us it was through our insurance, but there are a variety of options out there). Because where we live has so much construction, potholes, and a variety of obstacles that tires are enduring, we had road hazard insurance.

Just having these “insurance” options wasn’t quite enough. Not all risk mitigation can be planned. Sometimes it needs to be just-in-time management. For us, we also needed a plan on how to get home. After considering various options, we decided to divide and conquer and thought Uber was our best bet.

Companies might need insurance (for example, some insurance now covers privacy incidents or lawsuits if noncompliant with privacy laws). I also encourage companies to review their crisis communication plans often. They should be ready if they choose to move forward with something risky that customers might disagree with.

In prior newsletters, I’ve talked about having an owner for various privacy requirements. Privacy risk also needs an owner to answer: who can override a high privacy risk activity?

My overall lesson

What’s the most important asset in your work? In your life? What risk are you willing to take that could jeopardize that?

For us, our lives and safety come first, and anything that could significantly jeopardize that wasn’t worth the risk, even if it was super inconvenient.

For a company, it’s often its trust with its customers. Putting customers first can help center companies to what’s most important and manage risk accordingly.

And remember – the next time you get in your car, don’t forget to check all four tires and know who you would call if there’s an issue.

Jodi

💡 When you’re ready, here’s how we can help:

⚙ Privacy Advisory & Implementation: We help companies navigate privacy requirements with confidence. Our advisory support covers strategy, operations, and real-world implementation.

⚙ Fractional Privacy Services: We provide fractional privacy leadership tailored to your needs and pace. From program development to day-to-day support, we help you build and sustain a strong privacy program.