ZoomInfo Chief Compliance Officer Simon McDougall, CIPP/E, CIPM, CIPT, has seen privacy evolve while wearing a number of different hats. He started in the private sector with multiple accounting firms before entering public service. McDougall served as the Deputy Commissioner in the U.K. Information Commissioner's Office and Executive Director of the office's Technology, Policy and Innovation program.
McDougall is a past member of the IAPP Board of Directors. However, his relationship with the IAPP dates back more than a decade when he sought the organization's assistance while working at Promontory Financial Group and was tasked with ramping up its U.S. privacy program.
In this Member Spotlight, McDougall, based in London, spoke with IAPP Staff Writer Alex LaCasse during the IAPP's annual Board of Directors retreat in Portsmouth, New Hampshire. McDougall looked back at his career in privacy, both in the public and private sectors. He also looked into the future and projected how the global privacy landscape might evolve if the United States passes a comprehensive privacy law, such as the proposed American Data Privacy and Protection Act.
Editor's note: This conversation has been edited for clarity and length.
The Privacy Advisor: How did you get your start in privacy, and what attracted you most to the field?
McDougall: Like most people of my generation, I came to privacy sideways by chance. It wasn't a profession when I left university. In my case, I worked for Arthur Andersen (in 2000) and moved into their technology risk team. Once I qualified as a chartered accountant, they had a big list of different things and asked, 'Do you know what you'd like to do? And I said I'd like to do privacy. And they said great. Nobody was doing privacy, so we made it up, and I became the head of privacy. I had to quickly become a subject matter expert in privacy.
The Privacy Advisor: Can you talk about the experience of scaling Arthur Andersen's privacy program out of nothing and how you acquired subject knowledge?
McDougall: In the U.K., privacy was a very small world. And only a small number of people were going to those kinds of events at the time. The conferences would only have 50 people. At the time, everyone knew one another, so it was quite intimidating to start. But, you come to learn with privacy people that it was a nice community. I gradually learned the area in the first half of the 2000s. After Arthur Andersen was bought by Deloitte & Touche U.K. after the Enron scandal, I set up Deloitte U.K.'s privacy consulting practice in the mid-2000s.
That's why I moved from being a technology risk person, the sole subject matter expert in privacy, to recruiting people, building a team and building a practice around privacy.
The Privacy Advisor: How did serving on the IAPP Board and then member impact your career? How has being a member of the IAPP helped as your career has progressed?
McDougall: I served two years on the board, then had to leave because I went to the U.K. Information Commissioner's Office and had to activate the walk away from all my other board activities. Being on the IAPP Board was just enormous fun; it was a wonderful experience. I've always been passionate about privacy as a profession: the importance of the chief privacy officer and data protection officer in different organizations because I consulted for firms 20 years ago and saw how often those folks made a real difference. They're on the ground building that community and supporting those people. That makes a real, much larger difference in substance to how people's privacy is protected than a million-and-one theoretical papers.
I was at Deloitte until 2010. Then, I worked for another consultancy called Promontory, an American-headquartered, compliance-focused consulting firm. It has more of a global reach rather than just a U.K. practice. That's actually the first time I came to the IAPP — in 2011-2012. I set up my U.K. team or project tree, and flew here to speak to Trevor Hughes because I knew him. McDougall asked Hughes if could talk with him about how privacy worked in the U.S. Hughes invited him to headquarters to talk to him for as long as he wanted. "I remember talking to Trevor and he was so generous with his time. I'm one of many people he's helped over these last 20 years.
The Privacy Advisor: In the post-Brexit U.K., do you think leaving the European Union provides the U.K. with more flexibility to shape its privacy regime, or does going at it alone present its own set of risks?
McDougall: Last week, the U.K. government produced its response to its consultation … I'll be honest, I think lots of people have concerns that the ICO remains sufficiently independent from the government because this is important and it has to have credibility. But outside that, the reforms being proposed are relatively minor compared to what could have happened. (They're) a bit of a nothing burger.
The Privacy Advisor: What was it like serving in the U.K. Information Commissioner’s Office during the confluence of Brexit, the implementation of the EU General Data Protection Regulation and the COVID-19 pandemic?
McDougall: It was such an interesting time to be there. My job was to set up technology and innovation functions. This included policy issues like our outward facing work on AI, cybersecurity, sandbox, those kinds of things. Over time, I picked up more responsibilities, including leading all of the work we did to respond to COVID-19, which was fantastic. When I came in … the GDPR had been live for six months. The regulator had gotten past the initial rush of providing advice during GDRP's implementation and asked what (other issues) we should look at next? We looked at AdTech, AI, competition and privacy. We were just starting to get past (the point of) being reactive to GDPR.
The Privacy Advisor: Was it difficult to strike a balance between upholding U.K. citizens’ privacy rights and formulating a public health response to the COVID-19 pandemic?
McDougall: It was not hard at all. The GDPR is not always well-written, but whoever wrote the stuff about preparing for future crises, got it just right. ... The European regulator asked ... us if there was anything in the GDPR that needed to be waived for a few months because of this massive crisis, which (was) an entirely reasonable question. And (there weren’t), because in the GDPR, there are balancing tests. Privacy is a fundamental right, but it's not an absolute right. There are questions of public task and public interest and proportionality, and so every scenario that's brought to us when there's all these things around data sharing: thermal imaging in airports or thermal imaging in a café. Every time when we applied the GDPR to it, we got to a sensible conclusion. There was never a time where we said, “We can't do this thing because of these rules.”
The Privacy Advisor: After leaving the U.K. Information Commissioner’s Office, you went to become the Chief Compliance Officer at ZoomInfo, can you talk about your day-to-day work?
McDougall: We’re a business-to-business data company based in the U.S., that’s growing very fast around the world. It’s a really great place to be. The basic business model is not massively intrusive or risky, because it's a business-to-business data company. But within a business-to-business, it does want to be able to enable people to contact other business people who wants their details and wants to be able enable business conversations to flow. It’s an interesting data company, but the online business model is nowhere near as risky in an organization doing lots of profiling or being intrusive, in some way.
The Privacy Advisor: So, from all your experience leading privacy programs for private sector companies on both sides of the Atlantic Ocean, and seeing the privacy landscape as a regulator from the ICO, how do you see the global privacy landscape changing if the U.S. passes a federal comprehensive privacy law, now that there is some momentum behind the American Data Privacy and Protection Act?
McDougall: So there are two macro things that are interesting right now. The first one is, yes; there's a fighting chance of the federal privacy bill — nobody really knows if it's going to happen or not. But the fact it has a fighting chance is amazing. People keep focusing on the differences between (the proposed American Data Privacy and Protection Act) and the EU GDPR, but it's remarkably similar in many ways. Also, within the U.K., we've got online harms, which talks about duties of care. So I think it's incredibly exciting. For somebody who is now dealing with the increasing patchwork of U.S. state legislation, it would be one less headache (with a federal law). So that's exciting.
Privacy regulation is not in a silo anymore. You have to be open to considering all of the risks that happen when any data is processed, the ways that can affect different communities and people, the environmental impact it has, and the possible impact on competition if one organization has all the data. You have to open up to all of that, and (the privacy pros who do) will be the ones that will be massively successful. It's a very exciting world.
Photo by Keagan Henman on Unsplash
