Episode 2: Information Privacy – professions of trust

September 10, 2019

Privacy isn’t dead. It’s hiring. Part two of our conversation with Trevor Hughes explores the new-era professions that are emerging as a result of the digital revolution. Hughes explores the parallels between the American Industrial Revolution and the digital revolution as well as the cross-disciplinary, entrepreneurial skill sets needed to help guide privacy professionals through this unprecedented era of change.

Episode Notes

Privacy isn’t dead. It’s hiring. Part two of our conversation with Trevor Hughes explores the new-era professions that are emerging as a result of the digital revolution. Hughes explores the parallels between the American Industrial Revolution and the digital revolution as well as the cross-disciplinary, entrepreneurial skill sets needed to help guide privacy professionals through this unprecedented era of change.

J. Trevor Hughes is the CEO of the International Association of Privacy Professionals (IAPP), the world’s largest association of privacy professionals. The IAPP promotes, defines and supports the privacy profession globally. Trevor is widely recognized as a leading privacy expert, appearing at SXSW, RSA and other privacy and technology events. He has contributed to media outlets such as the New York Times, TechCrunch and WIRED and has provided testimony on issues of privacy, surveillance and privacy-sensitive technologies before the U.S. Congress, the U.S. Federal Trade Commission, British Parliament and more. Hughes received his undergraduate degree from the University of Massachusetts, Amherst and his Juris Doctor from the University of Maine School of Law, where he is also an adjunct professor and member of the Law Foundation Board.

***
Connect with Us
Website: umainecenter.org/greatergood
Twitter: @greatergoodpod

Produced by the University of Maine Graduate and Professional Center, with help from WMPG

Episode Guests

J. Trevor Hughes is the President and CEO of the International Association of Privacy Professionals (IAPP), the world’s largest association of privacy professionals. The IAPP promotes, defines and supports the privacy profession globally. Trevor is widely recognized as a leading privacy expert, appearing at SXSW, RSA and other privacy and technology events. He has contributed to media outlets such as the New York Times, TechCrunch and WIRED and has provided testimony on issues of privacy, surveillance and privacy-sensitive technologies before the U.S. Congress, the U.S. Federal Trade Commission, British Parliament and more. Hughes received his undergraduate degree from the University of Massachusetts, Amherst and his Juris Doctor from the University of Maine School Of Law, where he is also an adjunct professor and member of the Law Foundation Board.

Disclaimer

The information provided in this podcast by the University of Maine System, acting through the University of Maine Graduate and Professional Center, (the University) is for general educational and informational purposes only. The views and opinions expressed in this podcast are those of the author(s) and speaker(s) and do not represent the official policy or position of the University. Assumptions made in the analysis are not reflective of the position of any entity other than the author(s) and speaker(s) – and, since the author(s), speaker(s) and listeners are critically-thinking human beings, these views are always subject to change, revision, and rethinking at any time. All information in the podcast is provided in good faith, however the University makes no representations or warranties of any kind, express or implied, regarding the accuracy, adequacy, validity, reliability, availability or completeness of any information in the podcast and will not be liable for any errors, omissions, or delays in the information in this podcast or any losses, injuries, or damages arising from its broadcast or use. It is the listener’s responsibility to verify their own facts. Your use of the podcast and your reliance on any information in the podcast is solely at your own risk. The podcast does not contain nor is it intended to contain any legal advice. Any legal information provided is only for general informational and educational purposes, and is not a substitute for legal advice. Accordingly, before taking any actions based upon such information, the University encourages you to consult with an appropriate legal professional or licensed attorney.

Transcript

​This transcript has been lightly edited for clarity.

***

The Greater Good: Episode 2

Host:
Welcome to The Greater Good, a podcast devoted to exploring complex and emerging issues in law, business, and policy. I’m your host Carrie Wilshusen, Associate Dean for Admissions at the University of Maine School of Law. 

Today’s episode is part two of our conversation with Trevor Hughes, President and CEO of the International Association of Privacy Professionals and an adjunct professor at Maine Law. In this episode, we will explore the digital revolution and how job markets are changing as a result of emerging concerns over data privacy.

 

You talk about the responsibility of legislatures and the responsibility of the technology companies. The responsibility of individuals I’m hearing you say is to have an outcry when you feel impacted, right? To have a voice in this, it’s overwhelming, right? I mean, all of these technologies to stay on top of even what you’re losing or what you’re compromising is pretty overwhelming right now. 

Trevor:
Yeah, and I want to be certainly sympathetic to and agree with many of the advocates who talk about that sense of disempowerment of really a futility in trying to manage some of this stuff. I think that’s very real as well. And I think that’s actually part of the analysis and process if people do not feel, um, that they have agency that they have, uh, an ability to be self-determined and um, and make choices of their own accord in the digital economy. That’s not good for us generally, but there are circumstances in our life, for example, the light switches in this room where I’m okay with just flipping the switch up and down. I don’t need to know the number of watts or the code that went into the electrical wiring, where the energy is coming from. I don’t need to know all of that stuff. I just want to be able to flip the switch and know that it works and trust that it’s not going to fry out the building or start a fire or anything else awful for me. I think that’s what we’re moving towards in the digital economy, that we need to demand that the stewards of our data are held accountable for the uses of our data. And so when I engage digitally or otherwise with my data that I know that it’s going to be used for purposes that benefit me, that I have a broad sort of sense that that data is going to be handled in a way that is respectful and protects it. And that I am not going to be exposed to unnecessary harms or violations as a result of sharing my data. That’s the, that’s direction that we are headed. We’re certainly not at a perfect end state and I don’t think that exists actually, but that is the direction that we’re headed. 

Host:
So you are the International Association of Privacy Professionals who are these professionals? What sorts of people do the work of privacy information privacy? 

Trevor:
Sure. We have 51,000 members around the world riding at about a thousand members a month right now. Our growth is actually accelerating and so there’s lots of privacy professionals emerging all around the world. We exist in 120 countries. Our members are in 120 countries. There are heavy concentrations in the United States, in Europe. Interestingly, we are a hybrid profession. And what I mean by that is that we’re not a single thing. The legacy professions, the legacy academic or professional silos don’t quite fit in privacy. 40% of our members are lawyers and that is to say 60% aren’t. So law and policy being able to understand privacy law, being able to understand compliance demands, being able to respond to legal environments, whether they are legislative or the courts or otherwise. That’s an important domain within the privacy domain but so to is business process management, risk management inside organizations. 

The work of privacy professionals sometimes is about interpreting laws and providing counsel and guidance on compliance and legal things. But often it’s about implementing business management tools in order to manage privacy inside organizations. So many of our members do things like privacy impact assessments where they go into product development cycles and different areas and regions of a company. And they assess what are the privacy impacts associated with some new thing, new idea, new product, new feature that we might be implementing. Some of them do data flow audits or data inventory audits. Some of them are managing technologies that manage all of those things. So there is a business management aspect to our world as well. And many of our members come to us from more traditional business backgrounds. And then the third broad category is IT. So we have members who are engineering professionals who are IT professionals and they actually are responsible for ensuring that products or services in the IT realm are built with privacy sensibility in the, in the mix so that privacy concerns are baked in at the beginning, not bolted on at the end. So privacy engineering and IT, that’s another broad category. Three big domains: law and policy, business risk management and, and IT engineering. And to be a privacy pro, it’s probably not possible to be a top professional in each one of those domains. Most of our members come from one of those domains, but privacy demands cross-domain conversational capabilities. So if you’re a lawyer, you need to be able to talk to an IT professional. 

Host:
So you don’t need to be a computer expert. 

Trevor:
Correct. But you do need to be able to understand what a cookie is or what a web call looks like an http call to a server. You need to understand some of the fundamental building blocks in order to share your expertise in law and policy with an IT professional. Conversely, if you’re a business management professional, you need to be able to pull in law and compliance obligations and bake them into better process management inside your organization so that you actually do the thing that compliance or law requires. So if the law says you have to, you know, maintain this form of consent for this type of data in this context, you’ve got to be able to go into your systems and create business processes that give life to that legal obligation. So regardless of which domain you come from, law, business or IT, you have to have conversational fluency with the other domains in order to do your job. And in that way, privacy is a hybridized profession. It is sort of an aggregate of those three domains, but most people come from one specialization or another. 

Host:
Great. So let’s focus in on, on the law piece. So you are an alumnus of Maine law but you also teach there. Can you talk a little bit about some of the students you’ve taught and some of the opportunities they’ve had while they were at main law and then some of the careers they’ve gone to from the law school.

Trevor:
Sure. Maine Law has been a phenomenal home for information privacy and it’s been a tremendous asset to the global information privacy community. I’m certainly very proud to be an alum. When I was at law school, there wasn’t a single privacy lock clot class offered. I think we touched it in con law for a little bit and certainly there’s a threat of privacy that touches a number of different courses in a traditional law school education. But about 12 years ago I was asked to teach a privacy law class as an adjunct and I was really excited at the opportunity. I have to admit the 8 or 10 students in that first seminar course that I taught, they were more, anxiety producing than most audiences that I speak in front of around the world. It’s gotten less so over the past 12 years. 

But for 12 years now, we have been building a privacy law program at Maine law because of the association with the IAPP and also because of the exploding opportunities around the world. Those students who have gone through those classes who have pursued the new certificate program, who have participated in the summer institute that we run. They’ve had some really phenomenal opportunities, including in that very first seminar class that I taught 12 years ago. In fact, one of the students from that class, Justin Weiss has gone from a career in at the network advertising initiative to Yahoo now to a global role for a global multinational called Naspers, which is one of the biggest companies you’ve never heard of. And he’s based out of Hong Kong and really flies around the world as their chief privacy officer managing their subsidiary companies in many of the emerging markets around the world. We have professionals who have been at Starbucks, we have professionals who have been in Google, we have professionals who are in tech startups, we have professionals in consulting firms and law firms all coming from privacy law classes at Maine law. It has been a tremendous launchpad for many, many, many privacy careers. 

Host:
You know, it’s interesting, I got to go down to the global privacy summit a couple of years ago and it blew me away the energy and the opportunity that there seemed to be in this field, 

Trevor:
Without question, our growth speaks for itself. Two years ago we had 25,000 members. We have 50,000 now. That means there’s 25,000 jobs that were created in the last two years in the field of information privacy. And we think that there’s even more to come. We just did some research that, um, suggested that in Europe alone, there currently are 500,000 data protection officers that have been registered with the various authorities under a major European law called the GDPR. This field is growing, this field is exploding around the world. There is a huge demand in the marketplace right now for professionals who have education, a little bit of experience and really a willingness and drive to dive into the complex issues that are here. So it’s a fun space to be in. 

Host:
So is there an opportunity for folks that are currently working in the business world to be able to get some, some training around it and, and do this work as a smaller scale program rather than a full JD or a full MBA or something like that? 

Trevor
Sure. Well, at the IAPP, that’s one of the major things we do. We offer certification programs for professionals in the marketplace and they certainly can do that. There are other opportunities to at Maine law. The summer institute actually is usually populated quite heavily by professionals coming back to law school for a couple of weeks in the summer to really dive deep into some of this content. There are lots and lots of opportunities for lateral moving professionals; people who want to build some privacy knowledge into their current experience. Lots and lots of those opportunities around the world. 


Host:
So we’re calling this podcast the greater good because we believe that there are people that are working on behalf of their communities and that means local, state, global, national, that we don’t necessarily think of as working for the greater good. Do you see your work in that light? 

Trevor:
I do. So you know, in leading the IAPP I lead a mission driven not for profit organization and our mission is to define, promote and improve the profession of privacy globally. And when I stepped back from that mission a little bit, I realized that the professionalization of this field, the education that we do, the research that we do actually helps with that evolutionary process of making privacy better in the marketplace, in society more broadly. And so I think there is a greater good that we perform at the IAPP, which is we help to make privacy better around the world. The more privacy professionals there are, the more smart people there are struggling with, grappling with, and working through privacy issues inside organizations. The better privacy is going to be in the long run. And so we are mission-driven in that sense. And our mission is specific to the profession of privacy, but more broadly I think it serves societies around the world to help us grapple with and manage some of these really challenging issues. 

The one other thing that I’ll add is that here at the IAPP we also like to think of our organizational mission and I think there’s a greater good that we’re serving there too. We’re a different kind of workplace and we have really tried to strip away some of the extraneous baggage of the corporate world, certainly of the legal world and really focus on what makes for a successful organization and what makes for successful employees and successful human beings and citizens. And that work has been really rewarding and enriching for us as well. It’s not necessarily related to privacy, it’s more about how we do work here. But as a company, our 200 employees, we think a lot about how are we maximizing the results that we can drive as an organization? Well at the same time ensuring that our employees are whole people and that they are living whole and valuable and productive lives in their communities. 

I think the thing to understand is that we are a new era profession, that this is a new profession. And one of the things that I have found really valuable is I have a built the IAPP worked at the IAPP, worked in the field of privacy is by looking back at other historical disruptions, huge market changing developments and seeing the societal effects that those created, it kind of gives me a sense, it’s a bit of a roadmap even. So understanding history really helps to understand what might be coming in the future. And so I look back at the industrial revolution a lot. I spend a lot of time thinking about the industrial revolution, researching it, reading about it. And the, the professions that emerged out of the industrial revolution are really fascinating. Many, many new professions emerged engineering for one, um, as a massive profession. 

And it took some time for it to be really recognized professionally. Um, all sorts of other professions, accounting and even some educational professions because the idea of public education really emerged as a result of the industrial revolution. And so by looking at those disruptions in the industrial revolution, you can see that we are in the awkward turbulent stage of the early years of the digital revolution. The data revolution is around us right now. It’s only 25, 30 years old. And so if there was something that I would want people to know about the work that I do or what we are trying to build is that we are forward looking a bit, that we are recognizing that this is the early stage of the digital revolution of a technological revolution. And that the analog era of the past, the industrial era of the past is fading. And we are in the process of figuring out what are the new professions, laws, societal tools, education that we will need in order to better manage this new reality that we find ourselves in. That makes my work fascinating every day. It makes it really hard to explain to people outside of this world. My poor mom I think still doesn’t have any sense as to what I do day to day or what my company does. Whenever I’m at a family party, and I’m introduced by someone, they always say, “Can you tell them what you do?” because they don’t quite know how to explain it. So if there was something that I’d like people to know about the work that we do, it’s that we are helping to build the professions that will be necessary now and into the future to manage the disruption of this new era that we find ourselves in. 

Host:
And do you have a vision for that future?

 

Trevor:

Yeah, I think privacy is part of a broader umbrella of professions of trust that will emerge in the digital economy. We are going to need proxies. We are going to need people who protect us in the digital economy. If we think about the industrial revolution and the rise of broad global markets, accountants and auditors and engineers and there were just so many hundreds of professions that help to create a sense of safety and stability and predictability in that industrial market driven, financially driven, economy that we know so well. Privacy is one of many professions and it’s probably the first and probably will be one of the biggest, um, that has and will emerge as a result of the digital revolution. And those professionals are going to be responsible for making sure that all of these new technologies give us the best benefits we can possibly get while minimizing the costs and harms to societies. I think that makes the privacy profession a many multiples bigger of what it is today. We have 50,000 members maybe there are 75,000 people working in the field of privacy around the world. I think our field is 10x or a hundred x of what that is. By the time I retire 20 years from now. It is a, a massive, massive undertaking. And these are the professions of trust that will help to usher in and stabilize, this new digital revolution.

Host:
Trevor, thank you so much for being with us today and for being our inaugural podcast person. Thank you so much. 

Thank you for tuning in to the greater good. Please join us next time as we consider rural health challenges in Maine and beyond with Doctors Erica Ziller and Yvonne Jonk of the University of Southern Maine Muskie School of Public Service.

Love this episode of the Greater Good? Please rate, review, and subscribe to the podcast. As a new podcast, ratings and reviews are critical to our success. We’d also appreciate your feedback to ensure we are bringing you quality content and conversation. If you’d like to learn more about our guests, access show notes and find additional resources, visit https://umainecenter.org/greatergood. Thank you. 

The information provided in this podcast by the University of Maine System acting through the University of Maine Graduate and Professional center is for general educational and informational purposes only. The views and opinions expressed in this podcast are those of the authors and speakers and do not represent the official policy or position of the university.