Navigating Data Privacy

Privacy by Design and Default are more than just buzzwords They're fundamental principles that can make or break trust with your users. Yet, many professionals still struggle to grasp their importance. Let me break it down using a timely example from Telegram Messenger: The Good: Privacy by Design Telegram gets it right when it comes to Privacy by Design. Their settings are a masterclass in giving users control, offering three privacy levels for most options: -Everybody - Contacts - Nobody This shows they’ve integrated privacy into the very fabric of their app, giving users the power to decide who sees what (in the design). The Miss: Privacy by Default But here’s where Telegram drops the ball—Privacy by Default. Despite offering granular privacy controls, all options are set to ‘Everybody’ by default. This is a major oversight. Why does this matter? Privacy by Default means that the most secure, private setting should be the default. Telegram should have set all options to ‘Nobody’ by default, allowing users to opt into less privacy if they choose. This approach not only protects users but also demonstrates a commitment to their privacy from the get-go. A Timely Reminder: The recent arrest of Telegram’s CEO highlights the importance of getting privacy right—it’s not just about ticking boxes; it’s about safeguarding your users and the integrity of your platform. In an era where trust is easily lost, these principles are not optional; They are essential. Your Actionable Takeaways: Embed Privacy by Design: Start with privacy as a core principle, not an afterthought. Make it easy for users to control their data. Default to Safety: Always set the most private option as the default. This small step goes a long way in protecting users. Educate and Empower: Make sure your team understands these principles and can apply them. Privacy isn’t just the responsibility of the legal team—it’s everyone’s job. The Bottom Line: In today’s digital landscape, privacy is power. Build it into your product from the start. Always put your users first by defaulting to the most privacy friendly settings. This ensures compliance and also builds a foundation of trust that will set you apart. -----------  👋 I'm Jamal! I want to help you become a world-class privacy expert so you can have the thriving career you deserve. 🔔 Hit that bell for more inspiration, insights and tips. ♻ You've made it this far - so why don't you, repost to your network now so they can benefit too

How To Handle Sensitive Information in your next AI Project It's crucial to handle sensitive user information with care. Whether it's personal data, financial details, or health information, understanding how to protect and manage it is essential to maintain trust and comply with privacy regulations. Here are 5 best practices to follow: 1. Identify and Classify Sensitive Data Start by identifying the types of sensitive data your application handles, such as personally identifiable information (PII), sensitive personal information (SPI), and confidential data. Understand the specific legal requirements and privacy regulations that apply, such as GDPR or the California Consumer Privacy Act. 2. Minimize Data Exposure Only share the necessary information with AI endpoints. For PII, such as names, addresses, or social security numbers, consider redacting this information before making API calls, especially if the data could be linked to sensitive applications, like healthcare or financial services. 3. Avoid Sharing Highly Sensitive Information Never pass sensitive personal information, such as credit card numbers, passwords, or bank account details, through AI endpoints. Instead, use secure, dedicated channels for handling and processing such data to avoid unintended exposure or misuse. 4. Implement Data Anonymization When dealing with confidential information, like health conditions or legal matters, ensure that the data cannot be traced back to an individual. Anonymize the data before using it with AI services to maintain user privacy and comply with legal standards. 5. Regularly Review and Update Privacy Practices Data privacy is a dynamic field with evolving laws and best practices. To ensure continued compliance and protection of user data, regularly review your data handling processes, stay updated on relevant regulations, and adjust your practices as needed. Remember, safeguarding sensitive information is not just about compliance — it's about earning and keeping the trust of your users.

𝟔𝟔% 𝐨𝐟 𝐀𝐈 𝐮𝐬𝐞𝐫𝐬 𝐬𝐚𝐲 𝐝𝐚𝐭𝐚 𝐩𝐫𝐢𝐯𝐚𝐜𝐲 𝐢𝐬 𝐭𝐡𝐞𝐢𝐫 𝐭𝐨𝐩 𝐜𝐨𝐧𝐜𝐞𝐫𝐧. What does that tell us? Trust isn’t just a feature - it’s the foundation of AI’s future. When breaches happen, the cost isn’t measured in fines or headlines alone - it’s measured in lost trust. I recently spoke with a healthcare executive who shared a haunting story: after a data breach, patients stopped using their app - not because they didn’t need the service, but because they no longer felt safe. 𝐓𝐡𝐢𝐬 𝐢𝐬𝐧’𝐭 𝐣𝐮𝐬𝐭 𝐚𝐛𝐨𝐮𝐭 𝐝𝐚𝐭𝐚. 𝐈𝐭’𝐬 𝐚𝐛𝐨𝐮𝐭 𝐩𝐞𝐨𝐩𝐥𝐞’𝐬 𝐥𝐢𝐯𝐞𝐬 - 𝐭𝐫𝐮𝐬𝐭 𝐛𝐫𝐨𝐤𝐞𝐧, 𝐜𝐨𝐧𝐟𝐢𝐝𝐞𝐧𝐜𝐞 𝐬𝐡𝐚𝐭𝐭𝐞𝐫𝐞𝐝. Consider the October 2023 incident at 23andMe: unauthorized access exposed the genetic and personal information of 6.9 million users. Imagine seeing your most private data compromised. At Deloitte, we’ve helped organizations turn privacy challenges into opportunities by embedding trust into their AI strategies. For example, we recently partnered with a global financial institution to design a privacy-by-design framework that not only met regulatory requirements but also restored customer confidence. The result? A 15% increase in customer engagement within six months. 𝐇𝐨𝐰 𝐜𝐚𝐧 𝐥𝐞𝐚𝐝𝐞𝐫𝐬 𝐫𝐞𝐛𝐮𝐢𝐥𝐝 𝐭𝐫𝐮𝐬𝐭 𝐰𝐡𝐞𝐧 𝐢𝐭’𝐬 𝐥𝐨𝐬𝐭? ✔️ 𝐓𝐮𝐫𝐧 𝐏𝐫𝐢𝐯𝐚𝐜𝐲 𝐢𝐧𝐭𝐨 𝐄𝐦𝐩𝐨𝐰𝐞𝐫𝐦𝐞𝐧𝐭: Privacy isn’t just about compliance. It’s about empowering customers to own their data. When people feel in control, they trust more. ✔️ 𝐏𝐫𝐨𝐚𝐜𝐭𝐢𝐯𝐞𝐥𝐲 𝐏𝐫𝐨𝐭𝐞𝐜𝐭 𝐏𝐫𝐢𝐯𝐚𝐜𝐲: AI can do more than process data, it can safeguard it. Predictive privacy models can spot risks before they become problems, demonstrating your commitment to trust and innovation. ✔️ 𝐋𝐞𝐚𝐝 𝐰𝐢𝐭𝐡 𝐄𝐭𝐡𝐢𝐜𝐬, 𝐍𝐨𝐭 𝐉𝐮𝐬𝐭 𝐂𝐨𝐦𝐩𝐥𝐢𝐚𝐧𝐜𝐞: Collaborate with peers, regulators, and even competitors to set new privacy standards. Customers notice when you lead the charge for their protection. ✔️ 𝐃𝐞𝐬𝐢𝐠𝐧 𝐟𝐨𝐫 𝐀𝐧𝐨𝐧𝐲𝐦𝐢𝐭𝐲: Techniques like differential privacy ensure sensitive data remains safe while enabling innovation. Your customers shouldn’t have to trade their privacy for progress. Trust is fragile, but it’s also resilient when leaders take responsibility. AI without trust isn’t just limited - it’s destined to fail. 𝐇𝐨𝐰 𝐰𝐨𝐮𝐥𝐝 𝐲𝐨𝐮 𝐫𝐞𝐠𝐚𝐢𝐧 𝐭𝐫𝐮𝐬𝐭 𝐢𝐧 𝐭𝐡𝐢𝐬 𝐬𝐢𝐭𝐮𝐚𝐭𝐢𝐨𝐧? 𝐋𝐞𝐭’𝐬 𝐬𝐡𝐚𝐫𝐞 𝐚𝐧𝐝 𝐢𝐧𝐬𝐩𝐢𝐫𝐞 𝐞𝐚𝐜𝐡 𝐨𝐭𝐡𝐞𝐫 👇 #AI #DataPrivacy #Leadership #CustomerTrust #Ethics

Women’s rights don’t look good through Meta's AI Glasses In her new book, Laura Bates paints a grim, yet painfully accurate, picture of how AI technologies are deliberately harming women. Meta’s AI glasses are a striking example.  Tech billionaires have decided to put their money on instruments to sell women and girls to men. It's like a giant Epstein network - where men hold power and women are objects given to them as bait or reward. Reports of women being filmed through these glasses without their consent are piling up. One woman found herself on TikTok after a man approached her at the beach to compliment her on her bikini. Unaware she was being recorded, she revealed private information about her employer and family. In another case reported by the BBC, a women’s phone number was visible, leading to a bombardment of calls and messages from strangers. Such videos are part of a social media “pick-up trend”, where men film women in gyms, airports or beaches with AI glasses and upload the footage online. The comment sections quickly fill with derogatory and hateful comments about the women. The result? Humiliation, fear, and feelings of insecurity in public spaces. Meta points to the small LED light that signals recording. In reality, this is only a fig leaf. Online tutorials show how easily the light can be disabled or covered. And frankly, it's not my job to check whether a man's glasses have a light! Instead of tackling those risks, Meta plans to intensify them. According to TechCrunch, the company is developing a facial recognition feature that would identify people and provide information about them without their knowledge. This makes it easier than ever to access personal data, increasing the risk of stalking and harassment. Meta argues the feature would only recognise public profiles or existing connections. But having a public account or being in a large WhatsApp group does not equal consent to share personal information. Already today Meta AI glasses can be paired with facial recognition tools like PimEyes. Forbes reports that two students tested this and were able to find the name, home address and phone number of strangers instantly. In the EU, secretly recording and widely sharing such videos can violate the GDPR. Real-time facial recognition would likely qualify as a high-risk system under the EU AI Act, requiring strict human oversight and testing before a product is placed on the market. The AI Act also prohibits building face databases by scraping images from the web. This makes Meta’s plans to integrate a facial recognition feature in the glasses highly dubious. Unfortunately, the current motto in Brussels is "deregulation". While getting rid of unnecessary red tape is important, many rules protect people from violence and attacks on their dignity - women in particular. Let's put people first - and resist the calls of tech companies and the US government to strip citizens of their rights.

This new white paper by Stanford Institute for Human-Centered Artificial Intelligence (HAI) titled "Rethinking Privacy in the AI Era" addresses the intersection of data privacy and AI development, highlighting the challenges and proposing solutions for mitigating privacy risks. It outlines the current data protection landscape, including the Fair Information Practice Principles, GDPR, and U.S. state privacy laws, and discusses the distinction and regulatory implications between predictive and generative AI. The paper argues that AI's reliance on extensive data collection presents unique privacy risks at both individual and societal levels, noting that existing laws are inadequate for the emerging challenges posed by AI systems, because they don't fully tackle the shortcomings of the Fair Information Practice Principles (FIPs) framework or concentrate adequately on the comprehensive data governance measures necessary for regulating data used in AI development. According to the paper, FIPs are outdated and not well-suited for modern data and AI complexities, because: - They do not address the power imbalance between data collectors and individuals. - FIPs fail to enforce data minimization and purpose limitation effectively. - The framework places too much responsibility on individuals for privacy management. - Allows for data collection by default, putting the onus on individuals to opt out. - Focuses on procedural rather than substantive protections. - Struggles with the concepts of consent and legitimate interest, complicating privacy management. It emphasizes the need for new regulatory approaches that go beyond current privacy legislation to effectively manage the risks associated with AI-driven data acquisition and processing. The paper suggests three key strategies to mitigate the privacy harms of AI: 1.) Denormalize Data Collection by Default: Shift from opt-out to opt-in data collection models to facilitate true data minimization. This approach emphasizes "privacy by default" and the need for technical standards and infrastructure that enable meaningful consent mechanisms. 2.) Focus on the AI Data Supply Chain: Enhance privacy and data protection by ensuring dataset transparency and accountability throughout the entire lifecycle of data. This includes a call for regulatory frameworks that address data privacy comprehensively across the data supply chain. 3.) Flip the Script on Personal Data Management: Encourage the development of new governance mechanisms and technical infrastructures, such as data intermediaries and data permissioning systems, to automate and support the exercise of individual data rights and preferences. This strategy aims to empower individuals by facilitating easier management and control of their personal data in the context of AI. by Dr. Jennifer King Caroline Meinhardt Link: https://lnkd.in/dniktn3V

Google's cookies announcement isn't the week's big news; Oracle's $115 million privacy settlement is. 👇🏼 This week's most important news headline is: "Oracle's $115 million privacy settlement could change industry data collection methods." Every marketer and media leader should understand the allegations in the complaint and execute a review of their data strategy, policies, processes, and protocols, especially as they pertain to third-party data. While we've been talking and fretting about cookie deprecation for four years, we've missed the plot on data permission and usage. It's time to get our priorities straight. Article in the comments section and Industry reaction from legal and data experts below. Jason Barnes, partner at the Simmons Hanly Conroy law firm: "This case is groundbreaking. The allegations in the complaint were that Oracle was building detailed dossiers about consumers with whom it had no first-party relationship. Rather than face a jury, Oracle agreed to a significant monetary settlement and also announced it was getting out of the business," Barnes said. "The big takeaway is that surveillance tech companies that lack a first-party relationship with consumers have a significant problem: no American has actually consented to having their personal information surveilled everywhere they go by a company they've never heard of, packaged into a commoditized dossier, and then monetized and sold without their knowledge." Debbie Reynolds, Founder, Chief Executive Officer, and Chief Data Privacy Officer at Debbie Reynolds Consulting, LLC: "Oracle's privacy case settlement is a significant precedent and highlights that privacy risks are now recognized as business risks, with reduced profits, increased regulatory pressure, and higher consumer expectations impacting organizations' bottom lines," Reynolds said. "One of the most important features of this settlement is Oracle's agreement to stop collecting user-generated information from external URLs and online forms, which is a significant concession in how they do business. Other businesses should take note." #marketing #data #media Ketch super{set}

This Stanford study examined how six major AI companies (Anthropic, OpenAI, Google, Meta, Microsoft, and Amazon) handle user data from chatbot conversations.  Here are the main privacy concerns. 👀 All six companies use chat data for training by default, though some allow opt-out 👀 Data retention is often indefinite, with personal information stored long-term 👀 Cross-platform data merging occurs at multi-product companies (Google, Meta, Microsoft, Amazon) 👀 Children's data is handled inconsistently, with most companies not adequately protecting minors 👀 Limited transparency in privacy policies, which are complex and hard to understand and often lack crucial details about actual practices Practical Takeaways for Acceptable Use Policy and Training for nonprofits in using generative AI: ✅ Assume anything you share will be used for training - sensitive information, uploaded files, health details, biometric data, etc. ✅ Opt out when possible - proactively disable data collection for training (Meta is the one where you cannot) ✅ Information cascades through ecosystems - your inputs can lead to inferences that affect ads, recommendations, and potentially insurance or other third parties ✅ Special concern for children's data - age verification and consent protections are inconsistent Some questions to consider in acceptable use policies and to incorporate in any training. ❓ What types of sensitive information might your nonprofit staff  share with generative AI?  ❓ Does your nonprofit currently specifically identify what is considered “sensitive information” (beyond PID) and should not be shared with GenerativeAI ? Is this incorporated into training? ❓ Are you working with children, people with health conditions, or others whose data could be particularly harmful if leaked or misused? ❓ What would be the consequences if sensitive information or strategic organizational data ended up being used to train AI models? How might this affect trust, compliance, or your mission? How is this communicated in training and policy? Across the board, the Stanford research points that developers’ privacy policies lack essential information about their practices. They recommend policymakers and developers address data privacy challenges posed by LLM-powered chatbots through comprehensive federal privacy regulation, affirmative opt-in for model training, and filtering personal information from chat inputs by default. “We need to promote innovation in privacy-preserving AI, so that user privacy isn’t an afterthought." How are you advocating for privacy-preserving AI? How are you educating your staff to navigate this challenge? https://lnkd.in/g3RmbEwD

What does privacy mean in the age of AI? In this month’s Dean’s Call, I speak with IESE Business School Prof. Tawfiq Alashoor about data privacy risks and why it is becoming increasingly critical as organizations rely more on data and AI. As Tawfiq explains, data privacy should concern all of us. We are all constant generators of data, and today’s technologies allow organizations to capture, process and create value from it at an unprecedented scale. This raises important questions about ownership, responsibility and protection. My takeaways: - Being compliant is not the same as being secure. - Most privacy and security risks do not come from technology, but from human behavior. Not everything needs to be shared, and we all must learn to assess the risks and benefits before disclosing information. - Privacy decisions are often the starting point of broader security risks. Recent developments show how easily vulnerabilities can emerge when data is exposed. As AI continues to evolve, managing privacy is not just about systems and controls, but about how each of us understands and handles the data we create.

𝑾𝒉𝒆𝒏 𝑨𝑰 𝑲𝒏𝒐𝒘𝒔 𝒀𝒐𝒖 𝑩𝒆𝒕𝒕𝒆𝒓 𝑻𝒉𝒂𝒏 𝒀𝒐𝒖 𝑲𝒏𝒐𝒘 𝒀𝒐𝒖𝒓𝒔𝒆𝒍𝒇 – 𝒕𝒉𝒊𝒔 𝒊𝒔 𝒏𝒐𝒕 𝒔𝒐𝒎𝒆 𝒓𝒉𝒆𝒕𝒐𝒓𝒊𝒄𝒂𝒍 𝒒𝒖𝒆𝒔𝒕𝒊𝒐𝒏 𝒃𝒖𝒕 𝒊𝒕’𝒔 𝒂 𝒓𝒆𝒂𝒍 𝒄𝒉𝒂𝒍𝒍𝒆𝒏𝒈𝒆 𝒐𝒇 𝒕𝒐𝒅𝒂𝒚 Yesterday, my good friend Narasimhan Elangovan raised an important point about privacy with trending, GPU melting, and Ghibli images, I thought to discuss some real concerns with examples that I could think of The problem lies not just in data leaks or breaches – but more so in how AI quietly infers, profiles, and nudges us in ways we barely notice. Some under-discussed scenarios-   1.  𝗜𝗻𝗳𝗲𝗿𝗲𝗻𝘁𝗶𝗮𝗹 𝗣𝗿𝗶𝘃𝗮𝗰𝘆 𝗕𝗿𝗲𝗮𝗰𝗵 You never disclosed your religion, health status, or financial worries. But the AI inferred it—based on the questions you asked, the times you searched, and the tone of your inputs. 𝗥𝗶𝘀𝗸: This silent profiling is invisible to you but available to platforms. In the wrong hands, it enables discrimination, targeted influence, or surveillance—with no transparency. 𝟮.  𝗦𝗵𝗮𝗱𝗼𝘄 𝗣𝗿𝗼𝗳𝗶𝗹𝗶𝗻𝗴 Even if you have never used a particular AI tool, it can still build a profile on you. Maybe a colleague uploaded a file with your comments. Or your name appears in several related chats. 𝗥𝗶𝘀𝗸: You are being digitally reconstructed—without consent. And this profile might be incomplete, outdated, or wrong, yet used in risk scoring, decisions, or content filtering. 𝟯. 𝗕𝗲𝗵𝗮𝘃𝗶𝗼𝘂𝗿𝗮𝗹 𝗠𝗮𝗻𝗶𝗽𝘂𝗹𝗮𝘁𝗶𝗼𝗻 𝘃𝗶𝗮 𝗙𝗲𝗲𝗱𝗯𝗮𝗰𝗸 𝗟𝗼𝗼𝗽𝘀 Imagine an AI financial assistant slowly nudging CFOs toward certain frameworks or partners—not based on merit, but algorithmic incentives. 𝗥𝗶𝘀𝗸: This is not advice. It’s behavioural steering. Over time, professional decisions are shaped not by judgment, but by what the system wants you to believe or do. These aren’t edge cases of tomorrow—they are quietly unfolding in the background of our workflows, and conversations. 𝗜𝘁𝘀 𝗵𝗶𝗴𝗵 𝘁𝗶𝗺𝗲 𝘄𝗲 𝘀𝘁𝗼𝗽 𝘀𝗲𝗲𝗶𝗻𝗴 "𝗽𝗿𝗶𝘃𝗮𝗰𝘆" 𝗮𝘀 𝗮 𝗰𝗵𝗲𝗰𝗸𝗯𝗼𝘅 𝗮𝗻𝗱 𝘀𝘁𝗮𝗿𝘁 𝘀𝗲𝗲𝗶𝗻𝗴 𝗶𝘁 𝗳𝗼𝗿 𝘄𝗵𝗮𝘁 𝗶𝘁 𝗶𝘀. Would love to hear how others are approaching and how do we future-proof this? #AIPrivacy #DigitalEthics #AlgorithmicTransparency #FutureOfAI

Most new privacy professionals with fresh CIPP certifications are unprepared for this conversation "We want to track what customers look at on our website and send them targeted emails about those products. That’s fine since they’re already our customers, right?" You know the legal framework. You understand GDPR. You passed your certification. But now you're facing a room of marketing stakeholders who need answers that help them do their jobs. Knowledge tells you: This involves processing personal data for marketing - need to check lawful basis, likely legitimate interests with balance test, plus consider ePrivacy rules for tracking. Judgment asks: Does this specific use case make sense? → What exactly are they tracking? Page views or detailed behavior? → What does “personalization” mean here, recommendations or aggressive targeting? → What did customers expect when signing up? → Can they easily opt out? → Is this helpful to the customer or just to marketing? The legal answer is the same. The practical approach varies completely. This gap isn’t discussed enough in privacy education. We learn the "what" and "why" in certification programs, but day-to-day privacy work is all about the "when" and "how." → When to push back vs. find creative workarounds → How to get buy-in without a budget or authority → When "perfect" compliance isn’t realistic—and what to do instead → How to speak business language while holding privacy lines Many privacy professionals struggle here because we're: → Waiting for perfect info before acting → Speaking only in compliance terms → Afraid to make the wrong call and get blamed But here’s the reality: Judgment comes from experience and imperfect action beats perfect paralysis. The most effective privacy professionals aren’t those who memorize every regulation. They’re the ones who navigate gray areas and keep the business moving. Real examples of knowledge vs. judgment: → The Marketing Automation Dilemma Knowledge: Needs lawful basis, tracking consent, LI balancing test Judgment: Start with product category suggestions, include opt-out, test customer response before expanding → The Vendor Assessment Crisis Knowledge: DPA + security questionnaire needed Judgment: Vendor handles minimal data, go live now with essentials, full review in parallel → The Data Retention Debate Knowledge: Delete data when no longer needed Judgment: Tier retention by sensitivity/business value with review points, not a one-size policy Certifications teach you to spot problems. Experience teaches you to solve them. What’s the biggest gap you’ve faced between privacy theory and real-world practice? P.S. If you’re feeling this tension, you’re right on track. This isn’t a flaw in your education. It’s the start of real expertise. The most effective privacy professionals I know all went through this same shift.