What Companies Get Wrong About Data Protection – and How to Fix It Without Slowing the Business Down

In this episode of AI Savvy Lawyer, Lisa Mosby talks with Charlyn Ho about how companies can protect data and meet privacy obligations without slowing down business. They discuss why written policies often fail in practice, how to prepare for cyber incidents, and how data classification, privacy by design, and AI governance can help build compliance into everyday operations. They also explore how businesses of all sizes can tailor their protections to their risks.

Transcpript:

AI is moving faster than your legal foundation can keep up. Rica Law Group helps growing tech companies deploy AI, protect data, and close deals without creating legal risk they didn't see coming.

Welcome to the AI Savvy Lawyer with Charlyn Ho, founder of Rika Group. Charlyn is a technology transactions and data privacy attorney who advises companies on artificial intelligence governance, complex technology agreements, and legal frameworks needed to deploy emerging technologies responsibly.

I'm Lisa Mosby, and today we're talking about what companies often get wrong about data protection and how to fix those problems without slowing down the business. Welcome back, Charlyn. Thank you so much for being with me again.

Thank you so much, Lisa, for having me. I'm excited to be here. Yeah, you know, Charlyn, why do many data protection programs look strong on paper, but they fail to work effectively in practice?The reason that data protection programs fail to work, even though they look good on paper, is the same way that all things on paper don't work unless you actually implement them correctly and you have the knowledge and capabilities to execute on the plan.

So, just to give you an example, as an entrepreneur and founder, I have so many great ideas, and I'm full of ideas. But when it comes to executing and making things happen in in real life, that's where the rubber meets the road. So similarly, for a data protection program, you can have all the policies in the world, but if you're not actually a knowing what your policies say, b doing what you say in your policies, and C, making sure everybody in the organization consistently is doing that, and then finally D, mandating or enforcing with some sort of you know carrot or stick model, depending on your culture, compliance. Then your program will break down. I'll just bring this into an example.

So, a lot of companies have what's called a privacy policy on their website. This is actually something that is mandated by law. And if your privacy policy says I will never use your data to train AI systems, but in the backend you're using the data to train AI systems, maybe not even intentionally. Let's just say your company employees are using ChatGPT, the basic free model. You're effectively allowing ChatGPT to train on your client's data, and so it doesn't have to be intentional. The law doesn't always care about intentionality.

I mean, some laws have that as a component, but many, if you do something that is against the law, it's just against the law. And one thing that is looked unfavorably upon is if you say you're going to do X in your privacy policy, but you do Y. That is really not a good thing, and you can have a lot of liability from that.

So, Charlyn, when your firm is brought in after an incident versus before one occurs, what differences do you typically see in how companies have approached data protection?When we get a client that says, "I've had a data breach, the first question is, "Do you have a data incident response plan, and are you executing on it?

So, if we had been brought in before the incident had occurred and helped the client set up their governance program. Then that really helps us know that the client is on solid footing before something bad happens. It's almost like when you take out insurance for you know your car. Hopefully, nothing will ever happen on the road, but if something does happen, you know exactly who to call, what the process is, what your coverage limits are, and everything is kind of already known in advance.

Imagine if you got into a fender bender and you're on the side of the road arguing with the other driver, and you're trying to figure out then and there what you know what you're going to do, who you're going to call-that would be a total mess. I mean, I try to give analogies just to explain things a little bit more concretely, but it's similarly applicable for cyber incidents. So there is cybersecurity insurance. It's something that I definitely recommend for clients that deal with a lot of data or even a little data. It's it's something that you want to have in place beforehand. You also want to have a a lawyer that is well versed in these matters on call beforehand, and you want to have a cybersecurity company that operates on the technical side because the lawyer can only do the legal matters.

But whenever there's a breach, there's also incident response from a technical perspective of someone that can come in and say, "Well, where is the virus? Or is there a ransomware attack going on? What are we going to do? How are we going to get your data back? You know, these are all technical matters, and all of these different players have to work together. And hopefully, you've set this team up beforehand.

And I'm curious, what does it look like to build compliance programs that integrate with business operations rather than just working against them?

At Rikka, that's what we pride ourselves in helping clients do. It doesn't really matter, as we just said, how good the policy looks on paper if it doesn't work in practice. So the business has to be vested in compliance and has to understand that compliance is actually good for them. You know, many times legal is seen as the bottleneck. Legal is seen as a cost or somebody that just says no all the time. And at Rikka, we definitely understand that because as an entrepreneur and as a founder, I can definitely appreciate that speed is of the essence, and you want to get deals done quickly, and you don't want to be told no.

However, as a lawyer, I also understand the flip side, and having the business understand that kind of risk and benefit trade-off, and really work together with the legal department-that's critical, and that will just ensure the success of any compliance program that you put in place much more so than if it's driven just by either the compliance office or the legal office without the buy-in from the other stakeholders in the business.

And I'm also wondering what kinds of regulatory, reputational, and contractual costs can companies face when data protection programs fail. What types of regulatory, contractual, and reputational costs can clients face if they have a data breach?

Reputational is pretty obvious. If you're on the front page of the Wall Street Journal saying client X had a huge data breach, expose the 100,000 people's names and social security numbers and addresses. That's that's never a good look. Of course, there could be things that are not true about that statement on the Wall Street Journal. But once it's out there, we call it you know the Wall Street Journal test or the New York Times test, whatever you want to call it. Once something is public like that, the truth sometimes doesn't always matter because your reputation as a company is already harmed, particularly if you are in a field that prides itself on protection of data. As an example, a law firm, an accounting firm, a medical provider; these are all considered trusted institutions that handle people's most sensitive information. And if you're out in the public as being known to have lost data or breached data, that can create a lot of downstream reputational risks that you'll have to manage. Furthermore, on the contractual side of things, if, for example, you have committed to protect data in a certain way and you have a breach, there are two ways that you could be liable at least minimum two ways.

One is it doesn't matter whether it was your fault; you're still liable. The company whose data you lost, or if it's your customer's data that you lost, they could come after you and sue you because you lost their data, or allowed a hacker to get into it, or you know you revealed it to the public without authorization. Or better for for the person or the company that is in this situation.

If you had a lawyer negotiate the agreements that said, "Hey, unless we didn't comply with our cybersecurity obligations, and that's what caused this breach, then we won't be liable because breaches are a fact of life, and breaches are a risk of doing business.

So, hey, you client, by trusting us with your data, we will certainly implement all of these different measures like encryption, and we'll keep the data in you know a separate place from other people's data. You know, we'll have virus scans. We'll have all of these different protections. But if we do what we said we're going to do, and there still is a breach, like North Korea try to hack into the system, we can't be a guarantor of cybersecurity, you know, without limitation, and that's better for the client.

And that's often something that clients rely on us at Rikka Group in order to negotiate that, so that they're not per se liable for every potential breach that might happen.

And then, why is data classification such a foundational step in building an effective data protection program?

Data. We're using data in this kind of broad way right now. Data, data, data. But what does data actually mean? There's different kinds of data. There could be employee data. There could be healthcare data. There could be financial data. There could be marketing data. There could be IT data. There could also be data that is directly identifiable, meaning you can know exactly who that that data is about just by looking at it.

Someone's name, someone's address, someone's email address, someone's phone number. These are all directly connected to an individual. Then there's something that is less directly identifiable to an individual, but the law still considers personal data that you have to protect.

For example, when you're browsing on the internet, there are little little cookie crumbs, there are trails that you leave all across the internet. These are things that are captured by a technology called cookies or trackers. So if you've ever wondered why, when you're browsing for, let's just say, athletic shoes on one website, and then all of a sudden everywhere you go, on the sides or on the top, you have ads that say, "Are you looking for shoes? Come, you know, shop at Nike. Come shop at Adidas. Come, you know, come to Macy's. Whatever it is, that's because there are trackers that are following you across the internet, and and those trackers are not necessarily capturing your name, but they're capturing potentially something called an IP address.

That's your internet protocol, that that identifies your computer, and that can be considered protectable as personal information under the law as well. So if you don't understand data taxonomy or classification, basically what the data is, how it's classified, what kind of data it is, you really won't be able to protect it.

And then, what does privacy by design actually look like in real products or operational environment. So before I was at Rikka Group, my job was helping you know tech companies at my Am Law 100 firm launch products, and that meant I got to be in the room maybe five years before, however many years before something hit the shelves.

Let's just give an example: a mobile phone. So some of my clients may have developed a mobile phone, and they want to make it unique in such and such way to have these sensors, so it knows when you're going to your coffee shop. It it will detect. I'm just making this up. It will detect. Oh, this person loves Starbucks. They go to Starbucks every day at 8 a.m. They or order a venti cappuccino, and then essentially it could start predicting your patterns and maybe pre-order your Starbucks for you, so that your Starbucks is already waiting for you when whenever you show up, rather than you having to wait on the line.

These are things that are very potentially invasive of someone's privacy. It knows your habits. It knows what you like to order. It knows where you are. It knows where you like to go. Knows what time you get to work. But it's also helpful. A lot of people, frankly, trade convenience for privacy. Like they're willing to give their personal data for convenience.

So privacy by design, to answer your question, is thinking about privacy as the product is being designed because if you bring the lawyer in too late, and let's just say the product's already finished, it's going to be really, really hard to go back to the engineers and say, actually, no, we need to now completely redo this design.

It's not going to work because it violates X Y Z law or it creates X Y Z risk. So privacy by design, as I said earlier, is is essentially understanding privacy and cybersecurity, for that matter, at the outset, and implementing it into how the product is ultimately designed.

Charlyn, why is AI generated data becoming new a new compliance frontier that many programs are not yet addressing.

When we think about AI-generated data, we can think about it in at least two different ways. So there's AI-generated data, meaning I put in a prompt and I get an output. So, for example, let's just hypothetically say I am representing a travel company, and I'm trying to predict when people want to buy flights and what they're willing to pay. So I could put in historical information from my travel company about the past six months of data of people buying flights, when they buy it, how much they're going to pay, and then ask the AI to analyze that data and predict for the next six months what they're going to the customers are going to be willing to pay.

If the company uses that AI-generated data and starts setting pricing without really understanding how the AI came up with that answer, that could create a lot of problems. I'll just give you an example. And again, these are all hypotheticals, but let's just say based on the person's you know, profile. If you're you're able to identify this person is African American or a female or some other, you know, protected class, and the price is higher for them versus somebody else, that could be a problem.

So AI generated data can mean many many things, but in this particular case, when you use AI generated data to make predictions and make make decisions based on those predictions. You have a lot of potential issues to think about from a legal compliance standpoint. The other scenario that I mention is that there's this new frontier called synthetic data. So instead of using actual real data, you can use AI to create fake data, and that fake data can then be used to predict outcomes.

Why would anyone use fake data? Well, there's a few different reasons that are kind of too technical to get into right now. But one reason is because historical data collected in the past is. Inherently biased because imagine in 1910 or 1890, let's just hypothetically say the the cultural norms were very different then than they were now. There may not even be data about I'm just making this up women patients with a certain disease versus male patients. So if you're only using historical data, you'll be inheriting some of those historical biases.

Whereas, if you're using synthetic data or artificially generated data, you can use technical means to model things to mitigate or potentially even eliminate that bias.

And then, what kinds of practical frameworks help companies move from check the box compliant to something that actually works operationally for their busines?

Few things you've heard me say before, but have a trusted counsel at your fingertips. Make sure that this person or persons understands your business very, very well. Businesses are not all created equal. Even businesses in the same industry are not all created equal. Large businesses versus small businesses have different risks, have different operational concerns. So, in order to properly implement any privacy or AI governance program, the first thing is have a good lawyer.

Second thing is map your data, understand where your data lives. The third thing is have a good data classification system. Understand what data is more risky versus less risky to put into an AI system or put into another type of platform, and then finally have a way to monitor compliance. Because similar to when a lot of us start to exercise on January one, we start out really great.

We exercise Monday through Friday, and then by February one, it gets less and less. And then by March one, maybe we're not exercising at all. It's it's similar to privacy and cybersecurity and AI governance. On day one, you might say, "Yes, I've got this plan. I've got this program. I'm going to do all these things. And then by day 180, you may not be doing any of those things, or you might not even know how many people are actually still complying, and that's really important.

Here's where I want to wrap this up today. I am an entrepreneur, small business owner, and I do have websites. I have landing pages. Am I somebody who needs to have an attorney look at those things if I'm gathering data, or am I too small, insignificant.

Is there a size of a company that you recommend they absolutely must have this? How does this apply to all of those different sizes of companies that are doing business online right now?

Fantastic question. We we get clients of all sizes from a single person, I haven't even started my company yet, to you know multi-billion-dollar companies, and I would say everybody needs to be concerned with privacy because you, even as a small company, let's just say you're selling cookies, you're still collecting payment information, you're still collecting people's address if you're shipping cookies to. I'm just making this up, but even small businesses have a risk.

However, it doesn't mean that compliance needs to be a break the bank type of thing. There's different levels of compliance because, frankly, as a small business, your risk of somebody suing you is also less than if you're a giant company. But just kind of going in blindly and collecting data and not having any idea how to protect it is also not a good thing.


So the the compliance, I would say, like to answer your question a little bit more directly, everybody should be thinking about it if you have a digital presence. But having a compliance that's fit for your size and your risk profile is also really important. And just finding the right person who can help you and not break the bank. That's that's going to be critical.

Talking about insurance, you had mentioned it earlier. Are there insurance options available for small, medium, large, or mega companies so that they can protect themselves should they have missed something in their planning?100% There are a myriad of options in cyber liability, and I'm not an insurance attorney or broker. But for example, we carry a fair amount of cyber insurance just because, as an attorney, we have a lot of data that is sensitive to clients.

I mean, all attorneys do, but if you are in a business where you have sensitive information and there's a risk of liability if that information were to get out. Again, I I kind of use the the Wall Street Journal test. If you are worried that a client might find out that you've lost their data or mishandled their data, even if it wasn't your fault, even if it was, for example, you use a Stripe or a Square, or for example, you use Wix to host your website or Squarespace, and it was them that lost the data or resulted in the breach.

It doesn't really matter because it's your website, and your clients may still say, "Hey, website owner, I bought the product from you, and I'm now unhappy. That is legal risk. People can sue for anything, even. They don't have merit, so having some sort of cyber liability insurance is definitely pretty important. And there are different options depending on the size, and even within cyber liability, there's a lot of different options, which is probably beyond the scope of this question.

But just suffice it to say, I personally think it's important to have it as just a peace of mind type of thing if you run a small business, a medium business, or large business.

Charlyn, this has been eye-opening beyond imagination for me, and I hope that our audience feels the same way. Your insights have been valuable and appreciated. Thank you so much for your time today.

Thank you so much, Lisa. Appreciate you as well.

That's it for today's episode of AI savvy lawyer. If you'd like to learn more about Charlyn Ho and the work her team does at Rica Group, visit RikkaGroup.com. And if you enjoyed this conversation, don't forget to subscribe, share the episode, and leave a review.

We'll see you next time.That's it for this episode of AI Savvy Lawyer. If your company is deploying AI and you want to make sure your legal foundation is keeping up, book a call with us at RikkaGroup.com. See you next time.