She Said Privacy/He Said Security

Jodi and Justin Daniels
  • 0.0 (0)
  • MANAGEMENT
  • UPDATED WEEKLY

This is the She Said Privacy / He Said Security podcast with Jodi and Justin Daniels. Like any good marriage, Jodi and Justin will debate, evaluate, and sometimes quarrel about how privacy and security impact business in the 21st century.

  1. 3 DAYS AGO

    From Gatekeeper To Architect: How General Counsel Are Shaping Innovation in the AI Era

    Smrithi Mohan is General Counsel at Awesome, the parent company of SmugMug and Flickr, where she oversees all legal, IP, privacy, and compliance matters for two of the world's most recognized photo-sharing platforms. She previously spent a decade at Dun & Bradstreet, where she built the company's first global IP and innovation practice. An elected Board of Education member and recognized Top Woman Leader, she speaks and writes on legal operations, IP strategy, leadership, and building legal functions from the ground up. In this episode… When a new AI feature ships or a new product is designed, general counsel may not be looped in until after key decisions are made. This creates risk because most product decisions have legal implications, especially around data use, user rights, and consent. That changes when legal teams are brought into the product development cycle at the outset, helping design outcomes that align with legal obligations and business goals. How can general counsel and legal teams move from being seen as gatekeepers to business drivers? Shifting how general counsel and legal teams are viewed starts with building strong relationships across business teams. When legal leaders understand how product, engineering, and other teams operate, they are more likely to be included as ideas take shape. Early involvement enables general counsel to explain regulatory requirements and legal frameworks across different jurisdictions, thereby improving products and making them more defensible. It also creates space to ask fundamental questions in AI development upfront, including what data is being used, whether the company has the right to use it, who owns the outputs, and whether user information is collected with proper consent flows. Vendor relationships require the same level of attention, as older contracts may not address AI and often need audits, addendums, and updated terms.  In this episode of She Said Privacy/He Said Security, Jodi and Justin Daniels talk with Smrithi Mohan, General Counsel at Awesome, about how legal teams can integrate into AI and product development. Smrithi explains why general counsel needs to act as business architects and not just legal advisors, and what it takes to make that shift. She outlines the core legal questions teams should address when developing AI tools and other products, how to manage third-party vendor contract risks, and the evolving legal gray areas surrounding AI-generated content and platform liability. Smrithi also offers practical advice on building genuine, collaborative relationships across teams.

    40 min

  2. 23 APR

    The Accountability Problem Behind AI Adoption

    Kristin Calve is the Editor & Publisher of Corporate Counsel Business Journal and the Co-founder of Law Business Media. She leads editorial strategy focused on AI governance, legal operations, and board-level risk, and convenes forward-leaning legal leaders through interviews, events, and industry analysis. In this episode… Controlled AI deployment is one of the most pressing challenges legal and business leaders face right now. New AI tools are often adopted quickly without the full understanding of how they're being used, where data goes, and who's accountable for the outcomes. Some teams explore AI without direction or intention. Others prescribe it with guardrails, defining who can use it and how. The gap between those two approaches is where risk lives. So, how can organizations deploy and use AI without losing control? Legal operations teams are often accountable for how AI is used in practice. They understand the regulatory landscape and manage contracts and deadlines. They're often involved in operations across finance, HR, sales, and other business functions, so they know how those processes work and why they were built that way. That institutional knowledge matters as AI is introduced into those systems. At the same time, prompt documentation, AI notetakers, and recordings are introducing new risks. Teams may not know what is being captured, where it is going, or how it could become discoverable. Supply chain exposure adds another layer of risk. Vendors might embed AI into the tools organizations already rely on, potentially affecting an organization's overall privacy and security posture.  In this episode of She Said Privacy/He Said Security, Jodi and Justin Daniels talk with Kristin Calve, Editor & Publisher of Corporate Counsel Business Journal and Co-founder of Law Business Media, about how organizations are navigating AI deployment and risk. Kristin explains how companies are deploying AI inconsistently and the challenge of controlling its use. She shares how regulatory requirements shape accountability and why legal operations teams often bear responsibility for what's permissible. Kristin also explains the risks of prompts and recordings becoming discoverable and discusses how AI increases speed and capacity, but does not replace the need for judgment.

    22 min

  3. 9 APR

    Advancing AI Fluency With Grit and Growth Mindset

    Gabrielle Kohlmeier is a lawyer, tech whisperer, and transformation executive in a lifelong love affair with growth mindset and sustainable innovation. From building a Fortune 30 legal and policy approach to antitrust, to navigating retail risk, to leading global legal AI adoption and outperforming teams. She helps organizations rightsize risk and turn disruption into strategic value. In this episode… Many companies are rushing to adopt AI tools and publish AI policies, yet far fewer are investing in AI fluency across their workforce. Knowing how to use an AI tool is not the same as understanding what it is doing, what data it collects and uses, and the privacy, security, and compliance obligations that come with using it. Without that level of understanding, organizations risk using AI without fully grasping its impact. So, what does true AI fluency look like in practice?  Organizations spend time creating AI governance policies, and sometimes those policies are not operationalized. Governance then becomes "precious" when it is documented and published but not embedded into how teams actually work. That gap becomes more pronounced when teams lack the AI fluency needed to apply governance to their day-to-day use of AI tools. To be effective, governance needs to be lived, with clear accountability, ongoing feedback loops, and policies and processes regularly revisited as AI use cases evolve. It also requires establishing privacy and security guardrails that allow teams to experiment with AI responsibly, while right-sizing risks.  In this episode of She Said Privacy/He Said Security, Jodi and Justin Daniels talk with Gabrielle Kohlmeier, Legal and Innovation Executive, about building AI fluency and operationalizing responsible AI use. Gabrielle explains why AI fluency goes beyond simply using AI tools and requires a deeper understanding of the ethical and legal obligations that come with them. She shares how AI governance often breaks down in practice and what it takes to truly operationalize it, while enabling responsible AI experimentation with clear guardrails. Gabrielle also highlights numerous curated resources to help companies stay grounded as AI evolves and offers a practical privacy tip that applies to everyday internet and AI use.

    31 min

  4. 26 MAR

    Why Every Company Needs a Trust Center

    Kelly Peterson is the Chief Privacy and Compliance Officer for Yobi AI, a company dedicated to building models based on consented data to democratize access to data in an ethical and privacy-respecting manner. As CPO, Kelly establishes the strategy for the company's compliance programs and advises on product development utilizing PbDD. She collaborates cross-functionally with key internal stakeholders and external partners to explain Yobi's unique approach to AI development. In this episode… Building trust around how companies collect and use consumer personal information has become a defining challenge. Companies need to be upfront with the types of personal information they collect from consumers, why they collect it, and how it is used. Making that information easy to access can help people better understand a company's privacy and security practices. And one way to do that is through a trust center.  Trust centers do more than build credibility. They can also serve as an efficient sales and marketing tool that quickly answers questions about an organization's privacy and security practices. Building one often starts with an internal advocate. That advocate can work with sales and marketing teams to demonstrate how having privacy and security information in one place enables more effective responses to requests from organizations evaluating potential business partnerships. When building AI tools or other new products and features, companies should treat trust as a design choice and be transparent about how behavioral data is used and the benefits consumers receive from it.  In this episode of She Said Privacy/He Said Security, Jodi and Justin Daniels talk with Kelly Peterson, Chief Privacy and Compliance Officer at Yobi AI, about building trust-centered approaches to privacy and security practices. Kelly explains the role trust centers play in demonstrating transparency to consumers and business partners. She shares how businesses benefit from building new products, features, and AI tools with trust in mind, and why demonstrating the benefits of using consumer behavioral data helps build trust. Kelly also discusses the challenges companies face when navigating overlapping privacy laws, AI regulations, and other privacy-adjacent regulations.

    27 min

  5. 12 MAR

    Behind the Curtain With Tom Kemp: New CCPA Rules, Enforcements, and What's Next

    Tom Kemp is the Executive Director of CalPrivacy. Previously, he was a Silicon Valley tech entrepreneur and CEO. He volunteered on the California Privacy Rights Act campaign and has advised on major tech policy legislation nationwide, including the Delete Act (SB 362) and AI Transparency Act (SB 942). He is the author of Containing Big Tech. In this episode… California's privacy law evolves once again as its new regulations push companies to move from policy to proof. Privacy risk assessments, cybersecurity audits, and automated decision-making technology requirements introduce new obligations for businesses that process personal information at certain thresholds. Alongside recent CCPA enforcement actions, these new rules reinforce the importance of establishing governance, ensuring technical compliance, and demonstrating accountability. So, what do businesses need to do to stay ahead?  CCPA enforcement actions do not happen in a vacuum. Consumer complaints, website and data flow reviews, and media reports influence investigations that can trigger enforcement actions. Tom Kemp, Executive Director of CalPrivacy, knows this firsthand as he oversees these efforts, along with the rollout of the new CCPA rules. Companies are being evaluated based on real-world user experience. That's why they need to establish governance and strong operational processes that ensure compliance as regulations and consumer expectations evolve. Companies also need to walk a mile in a consumer's shoes and test their websites and mobile applications to ensure they are free of dark patterns and that access, deletion, and opt-out rights function without friction. And when it comes to AI use, companies need to keep in mind that existing CCPA obligations still apply whenever personal information is involved. In this episode of She Said Privacy/He Said Security, Jodi and Justin Daniels talk with Tom Kemp, Executive Director of CalPrivacy, about the new CCPA regulations, enforcement, and what's next for businesses. Tom explains why the California Privacy Protection Agency transitioned to the CalPrivacy name and how the agency focuses on raising privacy awareness and making it easier for consumers to operationalize their privacy rights. He outlines key timelines and thresholds tied to risk assessments, cybersecurity audits, and automated decision-making obligations and discusses how businesses can leverage existing processes to meet the new requirements. Tom also shares how California's collaboration with other state attorneys general and international regulators is shaping enforcement coordination and privacy oversight.

    39 min

  6. 26 FEB

    Governing AI and Privacy Without Becoming the Bottleneck

    Brittney Justice is the Global Head of Privacy at Valvoline Inc., leading the company's privacy strategy. She works at the intersection of data privacy, technology, and AI, advising on governance and risk at scale. Brittney also serves on the IAPP Privacy Law Advisory Board, shaping the future of privacy law. In this episode… Privacy and security leaders operate in an environment where innovation moves quickly, and risk evolves just as fast. That's why global companies need to maintain one consistent privacy program and layer in jurisdiction-specific requirements as privacy laws evolve. At the same time, organizations are adopting new AI tools while deepfakes and executive impersonation threats introduce new reputational challenges. How can companies enable innovation while staying ahead of emerging privacy and security risks?  When privacy and security teams are pulled into projects early, relationships strengthen, and teams no longer hesitate to involve them in new initiatives. Instead of being seen as gatekeepers, they become part of the conversation, strengthening trust and collaboration across business teams and prompting proactive issue spotting. That same discipline applies when evaluating and managing AI tools, where privacy leaders need to coordinate with business teams to understand what the tool will accomplish and how it could affect the company. This requires asking: what problem is being solved, what data is involved, and what the real impact would be if something goes wrong, especially when third-party vendors and model training are involved. That same mindset is critical to educating employees about AI deepfakes and executive impersonation risks, as coordinated response planning can reduce impact.  In this episode of She Said Privacy/He Said Security, Jodi and Justin Daniels talk with Brittney Justice, Global Head of Privacy at Valvoline Inc., about building a globally consistent privacy program while supporting business growth and managing emerging AI risks. Brittney explains her approach to building and maintaining one strong global privacy program without creating separate versions for every applicable jurisdiction, and the importance of embedding privacy and security teams into projects early to identify risks. She also shares tips on evaluating new AI tools, managing third-party and AI model training risks, and using executive deepfake simulations to strengthen employee awareness and establish clear escalation paths.

    32 min

  7. 12 FEB

    Optimizing Privacy, Cybersecurity, and AI Governance for Growth

    Amy Worley is a seasoned executive and thought leader in cybersecurity, privacy, and AI governance. She is the Managing Director at BRG and leads its Privacy Compliance Advisory Practice. With a unique blend of legal, technical, and strategic expertise, Amy brings a multidimensional perspective to digital risk management and value creation. In this episode… Digital trust has become a commercial imperative. As companies move quickly to adopt new AI tools and systems, privacy, security, and governance efforts often remain fragmented. Teams continue to operate in silos, without a shared framework for managing data and AI across the business. Without governance and core privacy and security controls in place, AI initiatives are more likely to fail or create risk. So how can organizations move forward with AI while building digital trust?  The best path forward often starts with structure, not speed. Rather than jumping straight into new tools, organizations need to have clear processes in place before implementation. Developing a competitive advantage through the confidence by design framework means building evidence-based programs grounded in transparency, data minimization, and core privacy and security controls. Taking time upfront to anticipate where projects might fail can help teams scope governance work more effectively before moving forward.  In this episode of She Said Privacy/He Said Security, Jodi and Justin Daniels talk with Amy Worley, Managing Director and head of the Privacy Compliance Advisory Practice at BRG, about building digital trust by aligning privacy, security, and AI governance frameworks. She explores how organizations can integrate these disciplines into one unified approach rather than operating in silos. She shares insights from her book, The Confidence Advantage, and explains how evidence-based programs, metrics, and governance fit into the confidence by design approach. Amy also discusses why governance must precede companies' implementation of AI tools and offers practical ways to strengthen everyday privacy and security habits.

    21 min

  8. 22 JAN

    How Safe Are Kids' GPS Trackers and Smartwatches?

    Steve Blair is the Senior Privacy and Security Test Program Leader at Consumer Reports, where he evaluates connected devices and digital products to uncover privacy and security risks. With a background spanning early internet technology, mobile hardware, and product security, he helps consumers better understand how their data is collected, used, and protected, especially in emerging technologies designed for families and children. In this episode… Connected devices designed for kids play a growing role in how families stay connected and informed. GPS trackers, smartwatches, and other apps and tools often promise safety and convenience, yet they also raise questions about how children's data is collected, used, stored, and protected. The challenge is not whether these tools function as intended, but how they handle personal information once they are in use. How can parents gain confidence in the technology their children use every day while avoiding privacy and security risks?  A practical starting point is to read privacy notices and product descriptions, then examine how devices and apps behave in practice. Reviewing default settings, questioning app permissions, and noting how easy privacy controls are to find can help parents manage risk and better understand how a company collects and handles kids' data. These considerations become especially important when children are required to use certain apps or connected devices to participate in school activities or other events. In this episode of She Said Privacy/He Said Security, Jodi and Justin Daniels talk with Steve Blair, Senior Privacy and Security Test Program Leader at Consumer Reports, about privacy and security risks in kids' GPS trackers, wearables, and apps. Steve explains what Consumer Reports found when testing GPS trackers and wearables designed for children, and how hands-on testing helps parents better understand device privacy controls. He shares practical ways parents can assess app privacy and security protections, even without deep technical expertise. And Steve also shares practical privacy and security tips parents can use every day, like keeping devices updated, removing apps when they are no longer needed, and requesting data deletion when app use ends.

    30 min
See All (258)

About

This is the She Said Privacy / He Said Security podcast with Jodi and Justin Daniels. Like any good marriage, Jodi and Justin will debate, evaluate, and sometimes quarrel about how privacy and security impact business in the 21st century.

Information

You Might Also Like