Where Privacy Meets Security

AI-Savvy Lawyer explores the intersection of technology and law, with practical insights on AI contracts, data governance, privacy, cybersecurity, and the legal challenges of artificial intelligence.

Privacy and Security Are the Same Problem

In this episode of AI-Savvy Lawyer, Rikka founder Charlyn Ho joins host Sean O'Connor to explain why privacy and cybersecurity cannot be managed as separate issues.

They discuss what “reasonable security” means under GDPR and why U.S. privacy law remains a patchwork of sector-specific statutes rather than one federal law.

They also cover why data mapping should come before building a privacy program, what to review in an AI vendor contract, and what a real incident response plan needs before a breach occurs.

Welcome & Introduction

Narrator:

Hello, everyone. Welcome to AI-Savvy Lawyer.

Today, we're joined by Charlyn Ho, founder of Rikka Law Group. Charlyn is a technology transactions and data privacy attorney who advises companies on artificial intelligence governance, complex technology agreements, and the legal frameworks needed to deploy emerging technologies responsibly.

I'm Sean O'Connor. Today, we're talking about why privacy and cybersecurity cannot be treated as separate issues and how companies should approach them together.

Charlyn, it's good to see you.

Charlyn:

Good to see you too, Sean.

Privacy and Security Are Two Sides of the Same Coin

Narrator:

Let's start with the basics.

Why can separating privacy and cybersecurity into different organizational functions create legal and operational exposure? Why should companies approach them together?

Charlyn:

Absolutely.

The way I look at privacy and cybersecurity is that they're really two sides of the same coin.

Think about privacy in the physical world. If you want to be left alone in your home, you also need to live in a secure area where people cannot simply break in.

The same concept applies in the digital world.

If you want privacy for your data, part of that privacy means ensuring the data is protected through administrative, technical, and organizational measures. That's also a cybersecurity concept.

The law treats these issues as related.

For example, the European Union's General Data Protection Regulation, or GDPR, includes requirements for reasonable security measures. GDPR is one of the broad privacy laws that treats privacy as a fundamental right.

Under GDPR, companies can face fewer problems after an incident if they have applied reasonable security measures, such as encryption.

GDPR was drafted well before 2018 and went into effect that year. Since then, a lot has changed in digital privacy, technology, and security.

The law is intentionally broad. It does not simply say that every company must use one specific security or privacy measure.

Instead, it gives the data controller responsibility for deciding what is reasonable and appropriate based on the sensitivity of the data.

Why the Law Lags Behind the Technology

Narrator:

You've mentioned before that written and statutory law often lags behind technology.

That means there may be steps a company can take to protect data even when those steps are not specifically required by law.

What patterns are you seeing with clients? Is there often a gap between privacy compliance programs and the way companies actually handle data?

Charlyn:

Yes, that's a great question.

Privacy law is often somewhat separated from the technology it regulates. One reason is that lawyers and legislators do not always have a deep understanding of how new technologies work.

Blockchain is a clear example.

Blockchain technology is decentralized by nature. Data can be stored across many nodes around the world.

Now consider GDPR, which has requirements for protecting cross-border data transfers. Those requirements can become difficult to apply when data is distributed across a network of nodes.

The nodes are not necessarily people or companies. They may not have a practical way to enter into contractual mechanisms with one another.

So there are times when, as a lawyer, you're looking for a solution that is good enough and legally defensible.

A perfect 100% compliant solution may simply not be technically possible.

Why U.S. Privacy Law Is So Fragmented

Narrator:

That makes sense.

We've talked before about how statutory law often looks backward. Legislators may not even have the vocabulary to describe or regulate new technologies.

We've seen this with blockchain and other emerging technologies.

In the United States, privacy laws such as CCPA and HIPAA, along with broader cybersecurity requirements, are starting to converge in how regulators approach data protection.

Why is that happening?

Charlyn:

In the United States, we have what I call a sectoral approach to privacy.

That's different from jurisdictions such as Europe, which have traditionally taken a more comprehensive approach.

By sectoral, I mean that the United States does not currently have one overarching federal privacy law focused on consumer privacy.

Instead, different laws protect different types of information.

For example:

• HIPAA protects certain healthcare information.
• COPPA protects children's data.
• GLBA protects certain financial information.

There are also comprehensive state privacy laws.

California's CCPA is one example. Unlike sector-specific laws, it applies more broadly across industries.

Other states, including Virginia, Utah, Colorado, Texas, and New Jersey, have also adopted comprehensive consumer privacy laws.

This creates tension between federal laws, sector-specific requirements, and state privacy laws.

Many state privacy laws also include exemptions for data already regulated under laws such as HIPAA or GLBA.

For example, if information qualifies as protected health information under HIPAA, CCPA may not apply to that information.

The challenge is determining which law applies to a particular piece of data.

Take someone's name as an example.

A person's name could be protected health information when it appears in the context of a patient's medical records. The same name could be treated differently in another context.

This creates an operational challenge for companies.

Many businesses store information across Google Drive, OneDrive, databases, and other systems. They are not necessarily keeping each piece of information in a separate repository based on which privacy law might apply.

This is where the gap between law, technology, and operational reality becomes important.

Part of my job is helping clients navigate that gray area and stay as protected as possible.

Why Data Mapping Has to Come First

Narrator:

That makes sense.

We see similar challenges across industries as federal and state laws evolve at different speeds.

Within privacy, companies may also have to deal with different rules for healthcare data, children's data, financial information, and other categories.

Why is it so difficult to build a meaningful privacy program if a company does not know where its data lives or how it moves?

Charlyn:

The key to doing anything in life is having an organized plan and a methodical way of approaching it.

A data privacy program is no different.

Many of my smaller clients are focused on survival. They may not have time to think about data organization, data retention, or which laws apply to their information.

The approach also changes when working with larger enterprise clients. These companies may have more regulatory scrutiny, so mistakes can create significant problems.

One thing is important for companies of every size: data mapping.

Data mapping is simply a way to understand where your data lives and how it moves.

For example, does your company use OneDrive or Google Drive? Do you use tools such as Otter AI or Loom?

Every technology platform your company uses may collect or process data in some way.

Privacy is therefore not limited to the company itself. It also involves the third-party service providers and subprocessors that handle company data.

Companies need to understand:

• What data each provider has
• Where that data is stored
• How the data is processed
• How long the data is retained
• What happens when data must be deleted
• What happens when a person requests access or modification

Imagine receiving a data deletion request.

Can your company identify every location where that person's information is stored?

Can you actually delete or modify the information across those systems?

If you cannot, you may have a problem.

What to Check in an AI Vendor Contract

Narrator:

That answers my next question.

AI tools make this even more complicated because data can move across multiple systems.

You may need to delete someone's data, but it could exist in several places that the company does not know about or cannot easily access.

Charlyn:

Exactly.

I want to return to one of the themes we discussed in an earlier episode: the contract.

If you're procuring AI technology for your company, you need to understand several key areas.

These include:

• Data export
• Data retention
• Data deletion
• Confidentiality
• How the vendor can use your data
• Whether the data is personal or non-personal

Start with data export.

If you use an AI tool, how will you get your data out of that tool?

Even if you export the data to your own hard drive, the AI provider may still have a copy.

Data can exist in multiple locations.

Retention and deletion are separate issues. You need to understand how those provisions work together with confidentiality obligations.

Ideally, your company's data should be treated as confidential information and used only to provide the contracted services.

You also need to understand whether some of your data qualifies as personal data.

If it does, additional privacy and cybersecurity requirements may apply.

This is where legal experience can help companies navigate the gap between contract terms and the practical reality of implementing a compliant program.

Building an Incident Response Plan That Actually Works

Narrator:

Let's move into the practical side.

Suppose a company has reviewed its vendor agreements and confirmed that data export, retention, and deletion provisions are covered.

Then something goes wrong.

What does a technically sound incident response plan look like compared with one that only works on paper?

Charlyn:

First, have an incident response plan.

It sounds simple, but some companies do not have one.

When an incident happens, they suddenly have to ask:

“Who do I call?”

“What am I supposed to do?”

That is not a good position to be in when you're making significant decisions during a crisis.

In privacy and cybersecurity, people often say that it is not a question of whether an incident will happen, but when.

That's a particularly concerning reality for law firms. Many law firms have been targeted by ransomware because they hold large amounts of sensitive client information.

Lawyers also have professional obligations to stay current with technology.

Having an incident response plan is therefore essential.

The second step is to build relationships before an incident happens.

For example, a company may need a cybersecurity firm or forensic specialist to investigate an incident and handle technical issues.

That team may need to:

• Identify what happened
• Determine whether data was exfiltrated
• Patch vulnerable software
• Strengthen security controls
• Help contain the incident

You want those relationships in place before a crisis.

Ideally, the engagement terms should already be agreed upon.

You do not want to negotiate rates and scope while your company is in the middle of a serious incident.

Your response plan should also include important contact information and resources.

For example, if your company is being extorted, the plan should identify the appropriate government agencies and reporting channels.

The goal is to know what to do before an incident occurs rather than trying to figure it out during the crisis.

Narrator:

I love that.

First, have a plan.

Then, test it.

It's almost like a war game. Walk through the plan and ask what would happen if you had to put it into action.

Who is the forensic firm?

Do we have one under contract?

Do they understand our systems?

Do they know where our data is?

If they already understand the environment, they can respond much faster when something happens.

Fascinating stuff. I'm loving it, Charlyn.

We're out of time. It's been great talking with you.

Charlyn:

You as well. Thank you so much, Sean. I really appreciate your time.

Narrator:

Thanks, everyone, for tuning in to today's episode of AI-Savvy Lawyer.

If you'd like to learn more about Charlyn Ho and the work her team does at Rikka Law Group, visit rikkagroup.com.

If you enjoyed this conversation, don't forget to like, leave a review, and subscribe to the show so you don't miss the next episode.

I'm Sean O'Connor. Have a great day.

Narrator:

Thanks for watching.

Be sure to like and subscribe, and leave us a review in the comments.