Masters of Privacy

Sergio Maldonado

Interviews and updates at the intersection of marketing, data, privacy, and technology. With an eye on a human-centric, demand-led future in which transparency, control, and personal agency play a crucial role. Sergio Maldonado (host) is a triple-qualified lawyer (California, England & Wales, Spain), entrepreneur, investor, guest lecturer at various universities. LL.M in IT & Internet Law, FIP, CIPP/E/US, CIPT. www.mastersofprivacy.com

  1. 2d ago

    Theodore Christakis: chatbot privacy and the health AI agent rush (remastered and revisited)

    This is a (remastered) repost of our last interview with Theodore Christakis earlier this year. Our guest rightly anticipated an avalanche of personal AI assistants, with a particular emphasis on healthcare, and we believe many more people (including our new subscribers) should benefit from his insights and associated research. Theodore Christakis is Professor of International, European and Digital Law at University Grenoble Alpes (France). He holds, since 2019, the Chair on the Legal and Regulatory Implications of Artificial Intelligence at the Multidisciplinary Institute on AI (AI-Regulation.com). He is Director of Research for Europe at the Cross-Border Data Forum, a member of the Board of Directors of the Future of Privacy Forum, and a former Distinguished Visiting Fellow at the New York University Cybersecurity Centre. His work focuses on the questions at the centre of today’s debates on digital sovereignty: government access to data held by private companies, international data transfers, the security and operational resilience of digital infrastructure, and the regulation of artificial intelligence. He served as an expert for the OECD in the process that led to the adoption, in December 2022, of the OECD Declaration on Government Access to Personal Data Held by Private Sector Entities. He was a member of the International Data Transfers Experts Council of the United Kingdom Government, and an expert for the High-Level Expert Group on Access to Data for Effective Law Enforcement established by the European Commission and the Council of the European Union. He has also served as a member of the French National Digital Council and of the French National Committee on Digital Ethics. He has published or co-edited twelve books and is the author or co-author of more than 120 academic articles and book chapters. He has been invited to lecture and present his work at conferences, workshops and seminars on more than two hundred occasions, in over 38 countries. As an independent expert, he advises governments, international organisations and private companies on questions of international and European law, cybersecurity, artificial intelligence, digital sovereignty and data protection. References: * Theodore Christakis’ SSRN Author Page * Theodore Christakis on LinkedIn * You Trust Your Chatbot With Everything. Should You? Part I: How The Controller Uses Your Chat Data (March 3, 2026) * You Trust Your Chatbot With Everything. Should You? Part II: Governments, Courts and the Battle Over Your Chatbot Conversations (June 8th, 2026) * The Health AI Agent Rush: Five Companies, Your Health Data, and the Governance Questions Nobody Is Asking (March 25th, 2026) * Mikel Recuero: a deep dive into the European Health Data Space (ES, Masters of Privacy, June 2026) * Multidisciplinary Institute on AI * Université Grenoble Alpes: Centre d’études sur la sécurité internationale et les coopérations européennes. DPO Central: build a privacy program in minutes (TODO.LAW) This is a public episode. If you'd like to discuss this with other subscribers or get access to bonus episodes, visit www.mastersofprivacy.com/subscribe

    Theodore Christakis: chatbot privacy and the health AI agent rush (remastered and revisited)
  2. Oct 25

    Dera Nevin: navigating new data categories, Retail Media, Agentic Commerce, and automated DSRs

    Dera Nevin is Managing Director of Digital Insights & Risk Management at FTI Consulting. She is a data lawyer and expert with more than 20 years of experience addressing digital risk issues, including privacy, data protection, information risk management, e-discovery, advertising technology and the application of emerging technologies to the delivery of legal services and compliance programs. Prior to joining FTI Technology, our guest was the Data Policy and Strategy Officer at Blackstone, Inc., where she developed and oversaw global privacy, data protection, information risk management and data science compliance programs. She is a frequent speaker, writer, and teacher on how law responds to technological change. References: * Dera Nevin on LinkedIn * FTI Consulting * Under New Jersey’s data privacy law (Assembly Bill A.5328, enacted June 30, 2026), a “Data Collector” is a business collecting personal data directly from a consumer and selling or licensing it downstream to a data broker. * What is the Model Context Protocol? (official docs) * Introducing System One Models & Jev (TypeSafe): on “Classifier models” * Jeffrey Bustos: Retail Media, privacy, and the future of addressability (Masters of Privacy, November 2023) * DPO Central on TODO.LAW (hosted). This is a public episode. If you'd like to discuss this with other subscribers or get access to bonus episodes, visit www.mastersofprivacy.com/subscribe

    Dera Nevin: navigating new data categories, Retail Media, Agentic Commerce, and automated DSRs
  3. Oct 12

    Heidi Saas: data as a valuable asset, US consumers vs. data brokers

    Attorney Heidi Saas (CIPP/US) has over twenty years of experience in consumer rights, eight years in data privacy, and five years of ethical AI and governance experience. Her projects currently involve working with CEOs, CTOs, CISOs, DPOs, and CMOs of companies in various industries on regulatory strategy, privacy program designs, risk management, implementation, and monetization of data assets within their privacy ecosystems. She also works with businesses to provide ethical AI advisory, and pre-audit consulting services, as well as regulatory compliance, legal consulting, and public speaking events. References: *What is a “data broker” under California law (CCPA as amended by CPRA)? A business that knowingly collects and sells the personal information of consumers with whom it does not have a direct relationship (thresholds: $25m revenue, 100k+ consumers/households, 50% of revenue originating from such selling or sharing of personal info). * Heidi Saas on LinkedIn * Tom Kemp (CalPrivacy): on the SECURE Data Act, CCPA whistleblowers, DROP, and AB 566 (Masters of Privacy, May 2026) * Build a privacy program on TODO.LAW (DPO Central) * Upcoming CIPT at DPO School (October 19th-20th, 2026) * Heidi Saas: AI compliance for MarTech vendors and data controllers (Masters of Privacy, September 2024). This is a public episode. If you'd like to discuss this with other subscribers or get access to bonus episodes, visit www.mastersofprivacy.com/subscribe

    Heidi Saas: data as a valuable asset, US consumers vs. data brokers
  4. Oct 4

    Aleksandr Tiulkanov: dissecting transparency requirements in the EU AI Act

    Aleksandr Tiulkanov has advised businesses on legal and compliance matters since 2003 and has focused on IT law and digital policy since 2015. He has previously been a Special Adviser on Digital Development at the Council of Europe; as well as Senior Manager for Technology, Media and Telecoms at Deloitte Legal. Aleksandr is also a Member of the AFNOR CN IA (French Commission on AI Standardisation), as well as a Member of the CEN-CENELEC JTC 21 (Artificial Intelligence), and a PECB Certified ISO/IEC 42001 Lead Implementer. He also holds an LL.M. in Innovation, Technology and the Law, University of Edinburgh (2018) and has been listed in “Best Lawyers in Information Technology Law (2020)” References: Aleksandr Tiulkanov on LinkedIn Engagements and training by Aleksandr Tiulkanov Preparing for the EU AI Act, a 4-week course by Aleksandr Tiulkanov (code for a 10% discount: MOPPTL2) For how the Article 50 disclosure duties apply to chatbots, see this guide on “AI Act duties for chatbots”. Paragraphs 1-4 of Article 50 of the EU AI Act: Transparency obligations for providers and deployers of certain AI systems * Providers shall ensure that AI systems intended to interact directly with natural persons are designed and developed in such a way that the natural persons concerned are informed that they are interacting with an AI systems, unless this is obvious from the point of view of a natural person who is reasonably well-informed, observant and circumspect, taking into account the circumstances and the context of use. This obligation shall not apply to AI systems authorised by law to detect, prevent, investigate or prosecute criminal offences, subject to appropriate safeguards for the rights and freedoms of third parties, unless those systems are available for the public to report a criminal offence. * Providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text content, shall ensure that the outputs of the AI systems are marked in a machine-readable format and detectable as artificially generated or manipulated. Providers shall ensure their technical solutions are effective, interoperable, robust and reliable as far as this is technically feasible, taking into account the specificities and limitations of various types of content, the costs of implementation and the generally acknowledged state of the art, as may be reflected in relevant technical standards. This obligation shall not apply to the extent the AI systems perform an assistive function for standard editing or do not substantially alter the input data provided by the deployer or the semantics thereof, or where authorised by law to detect, prevent, investigate or prosecute criminal offences. * Deployers of an emotion recognition system or a biometric categorisation system shall inform the natural persons exposed thereto of the operation of the system, and shall process the personal data in accordance with Regulations (EU) 2016/679 and (EU) 2018/1725 and Directive (EU) 2016/680, as applicable. This obligation shall not apply to AI systems used for biometric categorisation and emotion recognition, which are permitted by law to detect, prevent or investigate criminal offences, subject to appropriate safeguards for the rights and freedoms of third parties, and in accordance with Union law. * Deployers of an AI system that generates or manipulates image, audio or video content constituting a deep fake, shall disclose that the content has been artificially generated or manipulated. This obligation shall not apply where the use is authorised by law to detect, prevent, investigate or prosecute criminal offence. Where the content forms part of an evidently artistic, creative, satirical, fictional or analogous work or programme, the transparency obligations set out in this paragraph are limited to disclosure of the existence of such generated or manipulated content in an appropriate manner that does not hamper the display or enjoyment of the work. Deployers of an AI system that generates or manipulates text which is published with the purpose of informing the public on matters of public interest shall disclose that the text has been artificially generated or manipulated. This obligation shall not apply where the use is authorised by law to detect, prevent, investigate or prosecute criminal offences or where the AI-generated content has undergone a process of human review or editorial control and where a natural or legal person holds editorial responsibility for the publication of the content. This is a public episode. If you'd like to discuss this with other subscribers or get access to bonus episodes, visit www.mastersofprivacy.com/subscribe

    Aleksandr Tiulkanov: dissecting transparency requirements in the EU AI Act
  5. Sep 27

    Dazza Greenwood: from agentic contracts to AI-assisted law firms. Delegation, attribution and judgment

    Daniel “Dazza” Greenwood is the founder of CIVICS.com, a boutique provider of professional consultancy services for legal technologies, automated transactions, privacy and data management, and technology strategy. Dazza is also a researcher at MIT Media Lab and Lecturer at MIT Connection Science where he has been advancing the field of computational law and generative AI for law as Executive Director of law.MIT.edu. Our guest serves as lead on the Data Rights Protocol initiative through Consumer Reports Digital Lab. This protocol provides a common open specification for enabling consumers and companies to process the exercise of individual data rights as a consumer-connected digital service. Dazza Greenwood consults to Fortune 100 companies, architecting and building integrated business, legal and technology cross-boundary networks at industry scale. As an attorney, he served as both in-house and special counsel for technology law, representing corporations and governments. He has also testified before the US House, US Senate and other legislatures on electronic transactions law and consults extensively to the public sector. References: * Dazza Greenwood on LinkedIn * Dazza Greenwood’s Substack * CIVICS.com * Data Rights Protocol: Standardizing consumers’ data rights requests (Consumer Reports) * Uniform Electronic Transactions Act (1999) * Authority Boundaries for AI (Dazza Greenwood, May 2026) * LQAI from LegalQuants on Github (open source platform for law firms) * Thirteen Words Shape Legal AI (Dazza Greenwood, September 2026) * MIT Computational Law Report - Now part of Stanford Law School * HOPE Lab, Hands-On Projects and Experimentation: Learn to work with agents across multiple stages, with clear goals, boundaries, and evidence of what worked. * Interlateral (“Bring your own agent”), run by Dazza Greenwood: A space where people and their AI agents meet, coordinate, and build together over the web. * Jamie Smith: AI Agents, digital identity, wallets and personal data (Masters of Privacy, December 2024). This is a public episode. If you'd like to discuss this with other subscribers or get access to bonus episodes, visit www.mastersofprivacy.com/subscribe

    Dazza Greenwood: from agentic contracts to AI-assisted law firms. Delegation, attribution and judgment

Ratings & Reviews

5
out of 5
8 Ratings

About

Interviews and updates at the intersection of marketing, data, privacy, and technology. With an eye on a human-centric, demand-led future in which transparency, control, and personal agency play a crucial role. Sergio Maldonado (host) is a triple-qualified lawyer (California, England & Wales, Spain), entrepreneur, investor, guest lecturer at various universities. LL.M in IT & Internet Law, FIP, CIPP/E/US, CIPT. www.mastersofprivacy.com

You Might Also Like