Anyone who has been paying attention to the privacy and data protection landscape knows this, if they know anything at all: The General Data Protection Regulation is looming, and firms are scrambling to prepare, staffing up the privacy office and appointing a data protection officer (depending on their stage of preparedness). Given that, one could reasonably assume that privacy professionals are getting scooped up in record numbers. But a recent thread on the IAPP's Privacy List noted a number of privacy professionals are frustrated with their own ability to get hired, particularly if they aren't considered a "veteran" in the field.
One person said, "I see a paradox in that there is a great need for experienced privacy lawyers but few opportunities to get that experience."
But will the GDPR start to shift that? And will that extend beyond just privacy attorneys?
Zachary Plotkin says the need for privacy hires has been intensifying for some time now. He works for ICS, a recruitment firm that got its start in New York circa 2002, but has since built out its offices in a handful of U.S. states. Plotkin recruits for privacy, compliance and legal jobs, and he says around two years ago, he started to see a "significant uptick" in companies interested in hiring for privacy. He decided it was a space he wanted to get into.
When he began, he was — and still is — doing a lot of advising companies on what they even needed to ask for. "More often than not, the companies we go to are not well versed because they're not used to using an agency for hiring in privacy," Plotkin said.
But what companies knew, even then, they wanted in a privacy role: The candidate should be a lawyer, and a lawyer with experience, according to Plotkin.
That's a concept that resonates very much with Amy Oliver, CIPP/US. On paper, Oliver is a pretty strong candidate. She was a lawyer for the U.S. Department of Justice Criminal Division for 15 years. She left in 2013 for a career break, deciding she wanted to move out of criminal law as a focus. During her time at DoJ, Oliver gained some experience in privacy but more through the lens of the Fourth Amendment than data protection or privacy compliance.
But she's got a strong interest in technology, so she decided to do some networking around the D.C. area at industry events or happy hours, and, at the urging of some of those acquaintances, eventually found herself poking around in privacy. She found the privacy community to be vibrant, interactive and receptive to talking to newbies. Not as receptive to newbies? Employers.
"It was problematic," Oliver said. "I can send stuff in, but most of the ads in terms of where I wanted to get in wanted people either with very specific privacy experience, or even a year [of it], which I didn't have. What I had just didn't quite translate to a year in terms of what they were looking for. And I didn't come from a law firm background, which they often also wanted. I can add a whole lot in terms of dealing with the government, but I never worked for a firm."
Plotkin sees that kind of "experience-necessary" a lot in his recruiting work.
"Every company wants someone who's gonna be able to hit the ground running right away," he said. "No one wants to train somebody. It's an extra chore. Everyone tries to put that in a job description."
But he said the lesson for candidates today is to not be deterred if they don't see themselves in the advertisement: "What most people don't understand is the job description is for the ideal candidate, and 99 percent of the time, the ideal candidate doesn't exist for what you're willing to pay."
Simon McDougall, CIPP/E, CIPM, CIPT, leads the global privacy and data protection practice at Promontory, a regulatory consulting firm. He said hiring the "perfect" candidate is always a struggle, and most of his clients, which are large, private-sector firms, haven't traditionally found exactly the right person the first time around.
"They've normally had to modify their job description, consider their relative scale, especially at the experience level, considering the number of people out there in the market who can handle a senior management role. You will be very lucky to find this the first time around," McDougall said.
But the GDPR is looming. The regulation comes into effect less than a year from now, and the potential fines for noncompliance are daunting, as we've heard ad nauseam. Firms that don't have a team of people in place to adequately address the legal requirements of GDPR are scrambling to put those teams in place. Plus, there's the added requirement for private-sector companies processing or controlling the data of EU citizens to hire a data protection officer. (You've likely seen the IAPP survey finding that 75,000 DPOs will be needed worldwide.) So is this the game changer privacy professionals like Oliver need to be considered by firms that previously had a very narrow idea of who they'd hire for their privacy team?
"Given how little time we have between now and the middle of next year, there are going to be lots of firms who are putting out job advertisements and then struggling with the responses they get back," McDougall said.
For some companies, though, they'll train up.
"In some cases, they include additional reallocation of responsibilities to internal positions," McDougall said. "Many of our clients are looking to use their internal staff in the data protection officer role because, given the independence and importance of the role, they are keen to make sure there's someone in there who understands how the organization actually works. Giving that kind of role to an outsider is seen as high-risk, even if they are increasing head count into the privacy function."
But Plotkin says the employers he works with are beginning to be more flexible than one might assume. He admits, "The hard thing for people to accept is finding individuals who are not attorneys — attorneys are still the main target for what people look for — and usually lawyers coming out of the tech and the intellectual property spaces."
But he does see a shift there, if subtle. Companies are starting to loosen on that in part because of the GDPR, he said. It may be that those with less experience and without a JD will have a seat at the bargaining table soon.
"They used to push back, but they are not pushing back as much since the start of this year," Plotkin said of the companies he works with. "The idea of someone in privacy who's not an attorney is becoming more ubiquitous. ... There's more demand than supply at this point."
Jodi Daniels, CIPP/US, knows a little bit about overcoming those C-suite "you-gotta-be-a-lawyer" expectations. Daniels is not a privacy attorney. But five years ago, she was working at Cox Automotive doing targeted advertising. It touched privacy a bit, but she realized that no one at her company was really doing privacy and probably should. So, she wrote a job description, handed it to her CFO, and got him to sign off on it.
Years later, via some networking, she was introduced to the CPO at Bank of America, which was looking for a digital privacy expert. Given her experience with privacy at Cox, she fit the bill and was hired. She stayed there for two years. Now, she's opening her own privacy consulting firm in Atlanta, Georgia.
"I wanted a change, and the only way I was going to get there was to take ownership of my career and identify opportunities myself," she said. "They could have said no, but they said yes, and that's how I got here."
Her advice to people looking for privacy work is to get out there.
"I wasn't waiting. I think if people were waiting in their careers for someone to find them and remember them, it's not gonna happen," she said.
And that's basically the approach Oliver is taking. She's now volunteering full-time at the Future of Privacy Forum in Washington, D.C. That opportunity came about after some soul-searching about how to approach what she wanted. She started thinking about how to make her elevator speech at the networking events she was attending.
"How do you sell yourself?" she thought, and came up with, "'Hey, I'm happy to volunteer. What can you give me?' Those are really important questions when you're in a spot participating in all of these wonderful events. How do you pique someone's interest? If you go in there saying, 'All I want to do is make what I made when I left X job,' it's not gonna work.
"You need to sell yourself, but you also need to sell them a plan," she said.
Based on Plotkin's experience, companies facing GDPR compliance may be more receptive than ever to that kind of sale.
photo credit: torbakhopper hello! is it me you’re looking for? : castro, san francisco (2015) via photopin (license)