Speaker 1: Welcome to this deep dive. We're tackling global privacy today,
Speaker 1: and our guide is doctor Allen Tang's book, Privacy in Practice.
Speaker 2: It's a fantastic resource, really dives into data protection, laws, policies,
Speaker 2: real world examples, you name it.
Speaker 1: Yeah, it's like a crash course on how all this
Speaker 1: stuff actually impacts you and me, not just theoretical stuff.
Speaker 2: Exactly, we're going to go way beyond just being left alone.
Speaker 2: You know, what does privacy really mean when we're practically
Speaker 2: swimming in data these days?
Speaker 1: Right? Because it's not about hiding in a bunker, right,
Speaker 1: it's about how companies are handling our data, what rights
Speaker 1: we actually have?
Speaker 3: You got it?
Speaker 2: So first things first? What is privacy? Doctor Tang makes
Speaker 2: a good point. It's not just about being left alone.
Speaker 1: Oh okay, so there's more to it.
Speaker 2: Yeah, it's also about autonomy control access to your data.
Speaker 1: Okay, I could see that, but like what does that
Speaker 1: look like day to day? Like if I'm using a
Speaker 1: smart speaker or what are those fitness trackers? Is that
Speaker 1: messing with my privacy?
Speaker 2: Perfect example? Think about a smart speaker always listening for
Speaker 2: your voice, right, super convenient, but it's constantly picking up audio. Yeah, true,
Speaker 2: so that could be bumping into your territorial privacy, like
Speaker 2: your expectation of privacy at home, but also communications privacy,
Speaker 2: like what you're saying in your own space.
Speaker 1: Wow, I hadn't thought about it like that. The lines
Speaker 1: get kind of fuzzy, they really do.
Speaker 2: That's why doctor Tang breaks it down into four key areas,
Speaker 2: information privacy, bodily privacy, territorial and communications.
Speaker 1: Okay, so not just one big umbrella term.
Speaker 2: Nope, they often overlap, but it helps to think about
Speaker 2: them separately.
Speaker 1: Makes sense. Could you give us like a quick rundown
Speaker 1: to each Sure?
Speaker 2: Information privacy that's about your personal data, name, address, what
Speaker 2: you do online, the basics, gotcha. Bodily privacy that gets deeper.
Speaker 2: It's stuff that's uniquely you, genetic data, medical records, biometrics
Speaker 2: like part of your physical being.
Speaker 1: Okay, so info privacy is like digital you, bodily is
Speaker 1: physical you. What about the other two? Right?
Speaker 2: So, territory we touched on that with the smart speaker,
Speaker 2: right reason, expectation of privacy and spaces your home, car,
Speaker 2: even public restrooms they have an implied right to privacy.
Speaker 2: And then communications privacy that's keeping your conversation's confidential, phone online,
Speaker 2: even snail mail.
Speaker 1: Okay, starting to see how complex this whole web of
Speaker 1: privacy is. And it's not just companies we got to
Speaker 1: watch out for it.
Speaker 2: They're right, it's governments too, all that surveillance stuff, even individuals, stalkers,
Speaker 2: identity theft, that's a whole mess wild.
Speaker 1: Luckily we have laws, right, doctor tang mentions this global
Speaker 1: patchwork of privacy laws. What does that mean for US?
Speaker 2: Well, good news is over one hundred and thirty seven
Speaker 2: countries have some.
Speaker 3: Data protection law.
Speaker 1: That's a lot, it is.
Speaker 2: But not all laws are created equal, you know, scope,
Speaker 2: how they define personal data, your rights, it all varies.
Speaker 1: So it's not as easy as saying global law, we're
Speaker 1: all protected.
Speaker 3: Nope, not that simple.
Speaker 2: Like take GDPR, that's the EUS big one. Yeah versus
Speaker 2: CCPAC Pere, California's deal.
Speaker 1: Okay, yeah, I've heard of those. But what are the
Speaker 1: big different as we should know about?
Speaker 2: Well, GDPR is a broader geographically, any company dealing with
Speaker 2: EU resident data, no matter where the company is has
Speaker 2: to comply.
Speaker 1: So a US company with EU customers, they still got
Speaker 1: to follow a GDPR.
Speaker 2: You bet ccpack PA it's influential, but more focused on California, So.
Speaker 1: Location matters big time for which laws apply.
Speaker 3: Absolutely.
Speaker 2: Then there's how they define personal data. GDPR is wide
Speaker 2: anything that identifies you directly or indirectly.
Speaker 1: Hmmm, makes sense.
Speaker 2: CCPAC pery started a narrower but CPRA broadened it a lot.
Speaker 1: Okay, so getting closer. What about the rights these laws
Speaker 1: give us? Do those differ to Yeah?
Speaker 2: GDPR starts with a whole bunch of rights. Access your data,
Speaker 2: correct it, delete it, restrict processing, even move it to
Speaker 2: another company.
Speaker 1: Wow, that's a lot it is.
Speaker 2: CCPA originally focused on data sales disclosure, but CPR expanded
Speaker 2: those rights, getting more similar to GDPR.
Speaker 1: So they're kind of moving towards similar levels of protection,
Speaker 1: even if from different starting points.
Speaker 3: You got it.
Speaker 2: And that's a trend throughout doctor Tang's book, this global
Speaker 2: push for stronger standards.
Speaker 1: Okay, that's good to hear, But how did we even
Speaker 1: get tea here? Was there always this concern about data protection?
Speaker 1: Like did people one hundred years ago even care?
Speaker 3: It's been a journey.
Speaker 2: Doctor Tang talks about privacy one point oh two point
Speaker 2: oh three point zero shows how tech changed our understanding
Speaker 2: of privacy and the laws.
Speaker 1: Who I like that? Okay, walk us through these privacy eras.
Speaker 2: What was one point oh like privacy one point oh?
Speaker 2: That was late eighteen hundreds, early nineteen hundreds. It was
Speaker 2: mostly about protecting yourself from nosey pres government snoopings.
Speaker 1: Like keeping the Feds out of your business pretty much.
Speaker 2: Think about the Fourth Amendment in the US no Unreasonable searches, right,
Speaker 2: that's classic privacy.
Speaker 3: One point oh.
Speaker 1: Gotcha. So back then privacy was like keeping big brother
Speaker 1: out of your stuff exactly.
Speaker 3: But then came computers databases.
Speaker 2: Suddenly we could store tons of data and bam, privacy
Speaker 2: two point zho.
Speaker 1: Okay, so things got more complicated they did.
Speaker 3: This is mid twentieth century.
Speaker 2: We start seeing early data laws, fair credit reporting in
Speaker 2: the US, Data Protection Directive in the EU.
Speaker 1: So people realize, hey, this data thing is getting out
Speaker 1: of control. We need some rules exactly.
Speaker 2: And that leads us to privacy three point zero. Where
Speaker 2: we are NW internet, smartphones, social media, the Internet of.
Speaker 1: Things, data data everywhere.
Speaker 2: Right, We're making more data than VR, and it's used
Speaker 2: in crazy ways, targeted ads, facial recognition, even predicting crime.
Speaker 1: Wow, So privacy three point zero is like trying to
Speaker 1: tame this databast, make sure it's used responsibly.
Speaker 3: You got it.
Speaker 2: That's why we see stricter laws like GDPR, CCPACQRAA. China's
Speaker 2: got their own PIPL.
Speaker 1: So trying to keep up with all the tech changes.
Speaker 2: Exactly give individuals more control in this digital age.
Speaker 1: This reminds me doctor Tang talks about the business case
Speaker 1: for privacy, right, it's not just about avoiding fines, legal trouble.
Speaker 2: He's spot on good privacy practices can actually HLP organizations
Speaker 2: build trust, loyalty, even give them an edge over competitors.
Speaker 1: Okay, so how does that work in real life? Give
Speaker 1: us some examples.
Speaker 2: Think about data breaches. Companies can face huge fines, their
Speaker 2: reputation goes down the drain. Sometimes execs even go to
Speaker 2: jail hikes.
Speaker 1: That's serious, it is.
Speaker 2: But companies that focus on privacy data protection, they often
Speaker 2: see more trust from customers. People stick with them.
Speaker 1: So it's not just legal or ethical, it's good business.
Speaker 2: Absolutely. Consumers are getting smarter. They want companies they can
Speaker 2: trust with their data.
Speaker 1: So it's about being transparent showing your response with that. Okay,
Speaker 1: so what does this mean for companies practically, how do
Speaker 1: they build a good privacy program? Where do they even start?
Speaker 2: Doctor Tang lays out some core principles. Any program should
Speaker 2: have these transparency, purpose limitation, data minimization, accuracy, and security.
Speaker 1: Okay, lot to unpack there. Let's start with transparency. What
Speaker 1: does that mean? Like on the ground, it.
Speaker 2: Means being honest with people about what data you collect, why,
Speaker 2: how you use it, who you share it with.
Speaker 1: No more hiding behind legal jargon and fine print.
Speaker 2: Nope, clear, easy to understand privacy notices people have a.
Speaker 3: Right to know.
Speaker 1: Makes sense. What about purpose limitation?
Speaker 3: This is key.
Speaker 2: You've got to be specific about why you're collecting data
Speaker 2: and only use it for that reason.
Speaker 1: So no more just grabbing data just in case, right.
Speaker 2: No data hoarding. Got to be selective, responsible about what
Speaker 2: you store. That's where data minimization comes in.
Speaker 1: Okay, So how do companies figure out the minimum data
Speaker 1: they need? Yeah, especially if they don't know how they'll
Speaker 1: use it in the future.
Speaker 2: That's the tough part. Requires careful thought. Got to justify
Speaker 2: keeping ecch piece of data. Move away from that collect
Speaker 2: everything mindset.
Speaker 1: So big shift in thinking. What about accuracy? Why is
Speaker 1: that so important?
Speaker 2: Well, so many decisions are made based on data now
Speaker 2: right inaccurate data that leads to unfair outcomes, discrimination, all
Speaker 2: sorts of problems.
Speaker 1: Makes sense, especially with algorithms and AI making more decisions
Speaker 1: these days, exactly.
Speaker 2: And lastly, security, what does that mean for privacy? Security
Speaker 2: is putting up those safeguards technical and d organizational to
Speaker 2: protect data from well everything, unauthorized access, use, disclosure, changes, deletion.
Speaker 3: You know it.
Speaker 2: So digital walls to keep out the bad guys, kind
Speaker 2: of encryption, strong passwords, access controls, and a plan for
Speaker 2: when things go wrong, a breach response plan.
Speaker 1: So it's not just tech, it's policies, training, a whole
Speaker 1: culture of security.
Speaker 3: You got it.
Speaker 2: Everyone from the top down needs to understand how important
Speaker 2: protecting data is.
Speaker 1: It sounds like a lot of work to build a
Speaker 1: strong privacy program. It's not just checking boxes, it's making
Speaker 1: privacy part of the company's DNA right, and doctor Tang
Speaker 1: actually takes it a step further with this idea of
Speaker 1: privacy by design. Yeah, we're talking tell me more. Is
Speaker 1: privacy by design even possible? With how fast tech moves,
Speaker 1: can companies innovate quickly and deprotect privacy.
Speaker 2: It's a challenge, but it's the challenge. Privacy by design
Speaker 2: means making privacy part of every system, every process from
Speaker 2: the very beginning.
Speaker 1: So not adding it on later as an afterthought.
Speaker 2: Exactly, think about potential privacy risks throughout the entire life
Speaker 2: of product or service. Build in those safeguards from day.
Speaker 1: One, so baking it in, not bolting it.
Speaker 2: On, exactly, being proactive that can lead to better privacy solutions. Overall,
Speaker 2: turns a compliance headache into real positive change.
Speaker 1: That makes a lot of sense. So how do companies
Speaker 1: actually do this? What are some concrete examples?
Speaker 2: Doctor Tang has a bunch of practical steps, but two
Speaker 2: big ones are data inventory and privacy notices.
Speaker 1: Okay, data inventory, Why that's so important?
Speaker 2: You can't protect what you don't know you have. Data
Speaker 2: inventory means mapping out all the personal data your company handles,
Speaker 2: where it is, what it is everything.
Speaker 1: So like a map of all the data flowing through
Speaker 1: the company. But I bet most companies have no idea
Speaker 1: where all their data is.
Speaker 2: It's more common than you think. Creating that inventory. It
Speaker 2: can be a huge ge task, especially.
Speaker 1: For big companies, I can imagine.
Speaker 2: But it's necessary if you're serious about privacy. Helps you
Speaker 2: identify risks, see if you're collecting too much data, find
Speaker 2: weak spots in security, make sure your privacy note are accurate,
Speaker 2: the whole nine yards.
Speaker 1: So it's the foundation of a good program basically. And
Speaker 1: speaking of privacy notice, doctor Tang talks a lot about
Speaker 1: those two he does.
Speaker 2: He's all about making them clear, concise, actually user friendly.
Speaker 2: No one wants to read pages of legal mumbo jumbo.
Speaker 1: I've definitely been guilty of just scrolling through those without
Speaker 1: reading a word. So how do you make them engaging?
Speaker 2: Plain language, Ditch the technical terms, break down complex stuff
Speaker 2: into bite sized pieces.
Speaker 1: Okay, so read people like humans exactly.
Speaker 2: Explain what data you collect, why, how you use it,
Speaker 2: who you share it with, what rights people have.
Speaker 3: Make it simple.
Speaker 1: It's about respect, acknowledging people's right to know what's happening
Speaker 1: with their data.
Speaker 2: Absolutely, a good privacy notice builds trust, shows you're committed
Speaker 2: to transparency.
Speaker 1: That makes sense. But let's be real. Things aren't always
Speaker 1: so simple, are they. Doctor Tang mentions these tricky situations
Speaker 1: like consent and legitimate interest areas where the lines get blurry.
Speaker 2: You're right, those are tough ones with consent. The question
Speaker 2: is when is it really valid? We click agree to
Speaker 2: so much online without thinking.
Speaker 1: Oh all the time? So what are some red flags?
Speaker 1: When should we question if consent is actually real?
Speaker 2: GDPR is clear consent has to be freely given, specific, informed,
Speaker 2: and unambiguous.
Speaker 1: Okay, so no pressure tactics, right, Like if.
Speaker 2: You have to consent to use a service, or if
Speaker 2: it's buried in a huge wall of text, that's not
Speaker 2: real consent.
Speaker 1: So if you're pressured or tricked, it might not hold
Speaker 1: up legally. What about legitimate interests? That sounds tricky too.
Speaker 3: It is legitimate interests.
Speaker 2: It's another way to justify processing data, but it's a balancing.
Speaker 1: Act, well kind of balancing act.
Speaker 2: Balancing the organization's interests against the individual's privacy rights. Like
Speaker 2: a company might have a legitimate interest in processing data
Speaker 2: for security, preventing fraud.
Speaker 1: Oh yeah, it seems reasonable.
Speaker 2: It can be, but it can't outweigh basic rights and freedoms.
Speaker 2: Companies have to justify it, show they've thought about the
Speaker 2: impact on people's privacy.
Speaker 1: So it's not just a free pass to do whatever
Speaker 1: they want with data.
Speaker 3: Nope, not at all.
Speaker 2: It's all about careful consideration, really understanding the laws.
Speaker 1: It's definitely more complicated than it seems at first glance.
Speaker 1: There's so much more to it than meets the eye, for.
Speaker 3: Sure, And we've only just scratched the surface.
Speaker 1: Well, we've covered a ton of ground already in this
Speaker 1: deep dive, but there's more to come.
Speaker 2: Welcome back to our deep dive into privacy and practice.
Speaker 2: We were just getting into some of the trickier parts
Speaker 2: of privacy, like when is consent really valid?
Speaker 1: Yeah, and now I'm thinking about all the companies we
Speaker 1: hand our data over to, not just one, right, this
Speaker 1: third party risk.
Speaker 3: Thing, it's a big one.
Speaker 2: Companies share data all the time, vendors, suppliers, partners, the
Speaker 2: whole shebang.
Speaker 1: So it's a tangled web basically totally.
Speaker 3: And here's the thing.
Speaker 2: They're still responsible for protecting that data even if it's
Speaker 2: not in their hands directly.
Speaker 1: Oh so it's not like they can just wash their
Speaker 1: hands of it. Nope.
Speaker 2: Doctor Tang is very clear on that. Organizations they have
Speaker 2: to do their homework when they work with vendors, you know,
Speaker 2: vet them carefully.
Speaker 1: So make sure those vendors have good privacy.
Speaker 2: Practices too, exactly, and have really solid contracts spell out
Speaker 2: who's responsible for what. When it comes to data protection, it's.
Speaker 1: Like picking your friends carefully, right. You want to align
Speaker 1: with companies that share your values.
Speaker 2: Great analogy, building a network of trust. It's crucial. And
Speaker 2: it's not just the big name companies we got to
Speaker 2: think about. They're also data brokers.
Speaker 1: They get brokers. That sounds kind of, I don't know, shady.
Speaker 2: They can be data brokers. They're kind of behind the
Speaker 2: scenes in this whole data world. They collect and sell
Speaker 2: personal data from.
Speaker 1: All over really from where.
Speaker 2: Tons of places, and often people have no idea it's
Speaker 2: even happening.
Speaker 3: This data.
Speaker 2: It gets used for targeted advertising, credit scores, background checks.
Speaker 3: All sorts of stuff.
Speaker 1: So what's the risk with these data brokers? If they're legal,
Speaker 1: why should we care?
Speaker 2: Well, the big worry is what if that data gets misused, abused,
Speaker 2: If they don't have good security, it's vulnerable, right, breaches, leaks,
Speaker 2: that kind of thing.
Speaker 1: Okay, that makes sense, And even if it's used for
Speaker 1: something legitimate. I don't love the idea of my info
Speaker 1: being bought and sold without my knowledge.
Speaker 3: That's the thing.
Speaker 2: A lot of people feel that way. Are there any
Speaker 2: laws about this? You know, keeping these data brokers in check.
Speaker 1: That's what I was wondering.
Speaker 2: Some places are starting to regulate them. California, Vermont they've
Speaker 2: got laws now data brokers have to register, give people
Speaker 2: more control over their data. Okay, so baby steps, yeah,
Speaker 2: but globally regulation is behind. You know, a lot of
Speaker 2: work to do, both laws A and D making people
Speaker 2: aware this is even happening.
Speaker 1: So it's kind of the wild West out there when
Speaker 1: it comes to data brokers. Anything we can do to protect.
Speaker 2: Ourselves absolutely, check those data brokers periodically, see if they
Speaker 2: have your info. Then exercise your rights, you know, access correct,
Speaker 2: even delete that data.
Speaker 1: So be proactive, take charge of your digital footprint exactly.
Speaker 2: And this leads us to another messy topic, cross border
Speaker 2: data transfers. Data zips around the globe. But that must
Speaker 2: create all sorts of legal issues.
Speaker 1: Oh yeah, for sure. Every country has different laws, right,
Speaker 1: you got it.
Speaker 2: In some countries like China, Russia, they've got these data
Speaker 2: localization laws.
Speaker 1: Data localization, what's that all about?
Speaker 2: Basically, they force certain types of data to be stored
Speaker 2: and processed within their borders. They say it's for national security,
Speaker 2: protecting their citizens' privacy. I could see that side, Yeah,
Speaker 2: but it can also mess with international trades, slow down innovation.
Speaker 2: It's complicated, lots of economic and political angles to consider.
Speaker 1: Can you give us a real world example? How does
Speaker 1: this impact the stuff we use every day?
Speaker 2: Doctor Tang uses Microsoft three sixty five as a case study.
Speaker 2: It's perfect for this, Microsoft through a US company. But
Speaker 2: where your data is stored it depends on your location.
Speaker 1: Oh interesting, So it's not just one big data center somewhere.
Speaker 2: Nope, EU organization. Your data likely stays in the EU,
Speaker 2: but other regions your data might end up somewhere with
Speaker 2: weaker privacy laws.
Speaker 1: So even with global services, local laws still matter. It's
Speaker 1: a legal maze. How do companies even figure this out?
Speaker 1: Make sure they're transferring data ethically, A and D legally.
Speaker 2: It's tough, but crucial if you're doing business globally. Doctor
Speaker 2: Tang goes through a few legal mechanisms that companies can use.
Speaker 1: Legal mechanisms sounds complicated, They can be, but they're important.
Speaker 1: There are things like standard contractual clauses, binding corporate rules,
Speaker 1: and adequacy decisions.
Speaker 2: Okay, break those down for me. What are the differences.
Speaker 1: Standard contractual clauses secs? Those are like preapproved contracts for
Speaker 1: transferring data outside the EU. They offer set of safeguards
Speaker 1: make sure the data is protected to a similar standard
Speaker 1: as GDPR, so.
Speaker 3: It's a shortcut.
Speaker 2: Basically, don't have to reinvent the wheel every time you
Speaker 2: move data across border exactly.
Speaker 1: It makes things easier. Then you've got binding corporate rules BCRs.
Speaker 1: Those are internal data protection policies good for multinational companies,
Speaker 1: governed transfers within their own organization.
Speaker 3: Some more customized.
Speaker 1: You got it more complex to set up than secs,
Speaker 1: but more flexibility tailored to how the company works. BCRs
Speaker 1: are like a custom suit. Secs are off the rack.
Speaker 3: I like that. And then there are adequacy decisions. Those
Speaker 3: come from the European Commission.
Speaker 1: Oh, so the EU decides.
Speaker 2: They decide if a country has good enough data protection laws.
Speaker 2: If they get that adequacy decision, companies can transfer data there,
Speaker 2: no problem, no extra safeguards needed.
Speaker 1: So it's like a seal of approval from the EU
Speaker 1: pretty much.
Speaker 2: But those decisions can change, you know, if country's laws
Speaker 2: get weaker or there are worries about government snooping, the
Speaker 2: EU can take it away.
Speaker 1: So it's not a permanent thing.
Speaker 2: Keeping up with data privacy regulations is a full time job, seriously, and.
Speaker 1: It sounds like it. But understanding these mechanisms it's key
Speaker 1: for anyone handling data in this global world.
Speaker 2: Couldn't agree more. Okay, let's shift gears a bit talk
Speaker 2: about data retention and deletion. Do companies really need to
Speaker 2: keep our data forever?
Speaker 1: Right? That's something I've always wondered.
Speaker 2: Doctor Tang tackles that head on. There's this principle storage limitation.
Speaker 2: Companies should only keep data for as long as they
Speaker 2: need it for the original reason they collected it.
Speaker 1: So no more data hoarding, right, be responsible, respect people's
Speaker 1: rights to have their data deleted when it's not needed
Speaker 1: anymore exactly.
Speaker 3: But here's the thing.
Speaker 2: Different privacy laws, different rules about data.
Speaker 1: Retention really, so it's not so simple.
Speaker 2: Nope, GDPR, for example, they don't say exactly how long
Speaker 2: you can keep data. You got to have a policy
Speaker 2: justify why you're keeping it.
Speaker 1: Okay, So companies have to figure out what makes sense
Speaker 1: for them and follow the law exactly.
Speaker 2: And it's not just how long you keep it, it's
Speaker 2: also making sure when you delete it it's actually gone.
Speaker 1: Wait, really, I thought hitting delete was enough? What else
Speaker 1: is there.
Speaker 3: It's trickier than you think.
Speaker 2: Deleted data sometimes it can be recovered, you know, special tools,
Speaker 2: that kind of thing.
Speaker 3: Compani's got to prevent that.
Speaker 1: How do they do that?
Speaker 3: Overwriting the data.
Speaker 2: A bunch of times, special methods for hard drives, even
Speaker 2: physically destroying the storage sometimes.
Speaker 1: So it's more than just emptying.
Speaker 2: The trash can way more data deletion.
Speaker 3: It's got to be taken seriously.
Speaker 2: If companies want to follow the rules A and DY
Speaker 2: protect people's rights.
Speaker 1: It's a lot to think about. Speaking of protecting data,
Speaker 1: doctor Tang gets into data security too.
Speaker 2: This is where everything we've been talking about comes together.
Speaker 2: You know, transparency, purpose, limitation, minimization. It all relies on
Speaker 2: good security to actually work.
Speaker 1: So security is like the foundation.
Speaker 2: You could say that no security, even the best policies,
Speaker 2: won't matter. Doctor Tang talks about two types of measures
Speaker 2: technical A and D organizational both are important.
Speaker 1: Two types. Okay, what are those.
Speaker 2: Techno stuff like encryption, firewalls, intrusion detection, multi factor authentication,
Speaker 2: all those techy things to prevent unauthorized access.
Speaker 1: So those digital walls we talked about keeping the hackers out.
Speaker 2: Right, But tech alone isn't enough. You need the organizational
Speaker 2: stuff too, strong policies, training employees, controlling who can access what,
Speaker 2: and that breach response plan just in case, so.
Speaker 1: Everyone in the company knows how to protect data from
Speaker 1: the top down.
Speaker 2: That's the goal, and that breach response plan that's crucial.
Speaker 2: No matter how good your security is, something can always happen.
Speaker 2: Got to be ready to respawn, minimize damage, tell the
Speaker 2: people affected, follow the law.
Speaker 1: The whole deal sounds intense.
Speaker 2: It is. Data security is never over always got to
Speaker 2: be evolving, keeping up with new threats.
Speaker 1: It makes sense. Doctor Tang really lays it all out there.
Speaker 2: Huh. He does all the key principles best practices. It's
Speaker 2: a great guide for companies that want to do this right,
Speaker 2: protect that data effectively.
Speaker 1: We've learned so much. I can't wait to hear what
Speaker 1: else he has to say. And we're back, last part
Speaker 1: of our deep dive into privacy in practice. Time to
Speaker 1: put everything together, see how it works in the real world.
Speaker 2: Right, we've got the principles, the laws, tricky stuff like consent.
Speaker 2: Now let's see how these play out in specific situations
Speaker 2: where the stakes are high.
Speaker 1: Okay, yeah, Doctor Tang calls these high risk business scenarios
Speaker 1: where privacy really matters.
Speaker 2: Exactly, Companies dealing with tons of sensitive data where a
Speaker 2: mistake could have a big impact on people's lives.
Speaker 1: Okay, let's jump into one. Marketing, it feels like it's
Speaker 1: getting harder to tell the difference between personalized experiences and
Speaker 1: just being creepy.
Speaker 2: You know, it's a tightrope for sure, companies that they're
Speaker 2: always using data to target us with personalized messages, But
Speaker 2: how do you do that ethically? Doctor Tang says, Privacy
Speaker 2: by design is key.
Speaker 1: Right, Privacy by design again, but how does that actually
Speaker 1: work in marketing? Isn't there a conflict between collecting data
Speaker 1: to personalized stuff, yeah, and de respecting people's privacy.
Speaker 3: There is.
Speaker 2: It's about finding that balance, doctor Tang says. Bake privacy
Speaker 2: into your marketing from the start. Be upfront about what
Speaker 2: data you're collecting, give people real choices about how it's used,
Speaker 2: and actually respect those choices.
Speaker 1: So no more sneaking cookies onto people's computers or spamming
Speaker 1: them with emails they never asked for.
Speaker 3: Exactly.
Speaker 2: It's not just following the rules, it's about building trust.
Speaker 2: People want to support companies that handle their data responsibly. Right,
Speaker 2: if you're bombarding them with irrelevant ads making it hard
Speaker 2: to opt out, you're going to lose that trust.
Speaker 1: Makes sense. So this applies to l kinds of marketing right,
Speaker 1: social media, email, even those annoying telemarketing calls, and cookies,
Speaker 1: all of it.
Speaker 2: Let's take cookies. They're everywhere tracking what we do online,
Speaker 2: but a lot of people have no idea how they work,
Speaker 2: what they're collecting.
Speaker 1: Honestly, I usually just click except all cookies without thinking twice.
Speaker 3: We've all been there.
Speaker 2: But doctor Tang, he's big on giving people clear choices
Speaker 2: about cookies. Explain what they are, how they work, what
Speaker 2: data they collect, make it easy to understand, and give
Speaker 2: people a way to opt out of the non essential
Speaker 2: ones without jumping through hoops.
Speaker 1: So empowering people to decide about their data, even something
Speaker 1: as small as a cookie, it's about giving them that control.
Speaker 2: Exactly, and that applies to everything else too, email, telemarketing,
Speaker 2: social media, ads. Companies got to be transparent, give people
Speaker 2: real control.
Speaker 1: Okay, moving on another big one the workplace. Employers have
Speaker 1: so much info about us salaries, performance reviews, even medical records.
Speaker 2: Sometimes and nowadays internet history. What you're doing on the
Speaker 2: company computer, it can get really ethically messy.
Speaker 1: Where's the line? How do you balance the company's needs
Speaker 1: with employees privacy?
Speaker 2: Doctor Tang says, clear policies and procedures are essential. What
Speaker 2: data are you collecting, how are you using it? Disclosing it?
Speaker 1: Tell your employees so no more secretly reading employees emails
Speaker 1: or tracking their every key stroke. Right.
Speaker 2: There has to be a legitimate business reason for collecting
Speaker 2: that data, and you've got to be upfront about it.
Speaker 2: Building trust is important even inside a company.
Speaker 1: What about background checks, drug tests, that kind of thing.
Speaker 1: Are their privacy issues there too?
Speaker 3: Absolutely?
Speaker 2: Doctor Tang points out those can be problematic if they're
Speaker 2: not done ethically. Be transparent with applicants. What info you're collecting,
Speaker 2: how you'll use it?
Speaker 1: So, no we're digging up dirt on people just because
Speaker 1: you can.
Speaker 2: Nope, be upfront, respectful, Only collect what's relevant to the job.
Speaker 2: Employees have rights even at work.
Speaker 1: Good point. Okay. Another group that needs extra protection children,
Speaker 1: especially online, they're so vulnerable.
Speaker 2: Absolutely, Doctor Tang talks about COPA, that's the Children's Online
Speaker 2: Privacy Protection Act in the US.
Speaker 3: Other countries have similar.
Speaker 1: Life I've heard of that, what does it do.
Speaker 2: Basically, companies have to get permission from parents before collecting
Speaker 2: data from kids under a certain age.
Speaker 3: Can't just do it without asking, So.
Speaker 1: No tricking kids into giving up their info, oh or
Speaker 1: showing them ads for stuff that's not appropriate exactly.
Speaker 2: And the whole online experience for kids has to be
Speaker 2: designed with safety in mind, age appropriate.
Speaker 1: All of that makes sense, protecting kids online. That's a
Speaker 1: huge responsibility, it is.
Speaker 2: And finally we come to maybe the most complicated one
Speaker 2: of all, artificial intelligence AI.
Speaker 1: It's everywhere these days, and it's only going to get bigger, right,
Speaker 1: but how do we make sure it doesn't completely destroy
Speaker 1: our privacy?
Speaker 2: That's the big question. Doctor Tang has some thoughts on that.
Speaker 2: He says, build AI systems with privacy in mind from
Speaker 2: the very beginning, not as an afterthought.
Speaker 1: So same principles as before, transparency, purpose, limitation, all that those, plus.
Speaker 3: Some extra stuff.
Speaker 2: AI systems got to be transparent, accountable, fair. People need
Speaker 2: control over their data, protection from harm.
Speaker 1: Because AI it's not just collecting data, it's making decisions right,
Speaker 1: decisions that affect.
Speaker 2: Our lives exactly, and those decisions they got to be fair, ethical.
Speaker 2: We need to protect people from bias, discrimination, all those
Speaker 2: things that can go wrong when you let a machine
Speaker 2: make decisions.
Speaker 1: It's kind of scary. All the power AI has, how
Speaker 1: it can be used for good or bad.
Speaker 2: It is and that's why talking about this stuff privacy,
Speaker 2: A and d AI ethics, it's so important. We got
Speaker 2: to shape the future of AI and not just sit
Speaker 2: back and watch it happen.
Speaker 1: Well, that brings us to the end of our deep
Speaker 1: dive into privacy and practice. It's been a wild ride.
Speaker 1: I feel like I have a much better grasp on
Speaker 1: how important privacy is these days with all the data
Speaker 1: flying around.
Speaker 2: It's definitely complex, always changing, but doctor Tangk's book it's
Speaker 2: a great guide for anyone who wants to navigate this
Speaker 2: world build a future where privacy is respected.
Speaker 1: It's definitely given me a lot to think about, and
Speaker 1: I hope it's done the same for you, our listener.
Speaker 1: Thanks for joining us on this journey into the world
Speaker 1: of privacy.