TOTAL: {[ getCartTotalCost() | currencyFilter ]} Update cart for total shopping_basket Checkout


Anyone who has been paying attention to the privacy and data protection landscape knows this, if they know anything at all: The General Data Protection Regulation is looming, and firms are scrambling to prepare, staffing up the privacy office and appointing a data protection officer (depending on their stage of preparedness). Given that, one could reasonably assume that privacy professionals are getting scooped up in record numbers. But a recent thread on the IAPP's Privacy List noted a number of privacy professionals are frustrated with their own ability to get hired, particularly if they aren't considered a "veteran" in the field. 

One person said, "I see a paradox in that there is a great need for experienced privacy lawyers but few opportunities to get that experience." 

But will the GDPR start to shift that? And will that extend beyond just privacy attorneys?

Zachary Plotkin says the need for privacy hires has been intensifying for some time now. He works for ICS, a recruitment firm that got its start in New York circa 2002, but has since built out its offices in a handful of U.S. states. Plotkin recruits for privacy, compliance and legal jobs, and he says around two years ago, he started to see a "significant uptick" in companies interested in hiring for privacy. He decided it was a space he wanted to get into.

When he began, he was — and still is — doing a lot of advising companies on what they even needed to ask for. "More often than not, the companies we go to are not well versed because they're not used to using an agency for hiring in privacy," Plotkin said. 

But what companies knew, even then, they wanted in a privacy role: The candidate should be a lawyer, and a lawyer with experience, according to Plotkin.

That's a concept that resonates very much with Amy Oliver, CIPP/US. On paper, Oliver is a pretty strong candidate. She was a lawyer for the U.S. Department of Justice Criminal Division for 15 years. She left in 2013 for a career break, deciding she wanted to move out of criminal law as a focus. During her time at DoJ, Oliver gained some experience in privacy but more through the lens of the Fourth Amendment than data protection or privacy compliance.

But she's got a strong interest in technology, so she decided to do some networking around the D.C. area at industry events or happy hours, and, at the urging of some of those acquaintances, eventually found herself poking around in privacy. She found the privacy community to be vibrant, interactive and receptive to talking to newbies. Not as receptive to newbies? Employers. 

"It was problematic," Oliver said. "I can send stuff in, but most of the ads in terms of where I wanted to get in wanted people either with very specific privacy experience, or even a year [of it], which I didn't have. What I had just didn't quite translate to a year in terms of what they were looking for. And I didn't come from a law firm background, which they often also wanted. I can add a whole lot in terms of dealing with the government, but I never worked for a firm." 

Plotkin sees that kind of "experience-necessary" a lot in his recruiting work. 

"Every company wants someone who's gonna be able to hit the ground running right away," he said. "No one wants to train somebody. It's an extra chore. Everyone tries to put that in a job description." 

But he said the lesson for candidates today is to not be deterred if they don't see themselves in the advertisement: "What most people don't understand is the job description is for the ideal candidate, and 99 percent of the time, the ideal candidate doesn't exist for what you're willing to pay." 

Simon McDougall, CIPP/E, CIPM, CIPT, leads the global privacy and data protection practice at Promontory, a regulatory consulting firm. He said hiring the "perfect" candidate is always a struggle, and most of his clients, which are large, private-sector firms, haven't traditionally found exactly the right person the first time around.

"They've normally had to modify their job description, consider their relative scale, especially at the experience level, considering the number of people out there in the market who can handle a senior management role. You will be very lucky to find this the first time around," McDougall said. 

But the GDPR is looming. The regulation comes into effect less than a year from now, and the potential fines for noncompliance are daunting, as we've heard ad nauseam. Firms that don't have a team of people in place to adequately address the legal requirements of GDPR are scrambling to put those teams in place. Plus, there's the added requirement for private-sector companies processing or controlling the data of EU citizens to hire a data protection officer. (You've likely seen the IAPP survey finding that 75,000 DPOs will be needed worldwide.) So is this the game changer privacy professionals like Oliver need to be considered by firms that previously had a very narrow idea of who they'd hire for their privacy team? 

"Given how little time we have between now and the middle of next year, there are going to be lots of firms who are putting out job advertisements and then struggling with the responses they get back," McDougall said. 

For some companies, though, they'll train up. 

"In some cases, they include additional reallocation of responsibilities to internal positions," McDougall said. "Many of our clients are looking to use their internal staff in the data protection officer role because, given the independence and importance of the role, they are keen to make sure there's someone in there who understands how the organization actually works. Giving that kind of role to an outsider is seen as high-risk, even if they are increasing head count into the privacy function." 

But Plotkin says the employers he works with are beginning to be more flexible than one might assume. He admits, "The hard thing for people to accept is finding individuals who are not attorneys — attorneys are still the main target for what people look for — and usually lawyers coming out of the tech and the intellectual property spaces."

But he does see a shift there, if subtle. Companies are starting to loosen on that in part because of the GDPR, he said. It may be that those with less experience and without a JD will have a seat at the bargaining table soon. 

"They used to push back, but they are not pushing back as much since the start of this year," Plotkin said of the companies he works with. "The idea of someone in privacy who's not an attorney is becoming more ubiquitous. ... There's more demand than supply at this point."

Jodi Daniels, CIPP/US, knows a little bit about overcoming those C-suite "you-gotta-be-a-lawyer" expectations. Daniels is not a privacy attorney. But five years ago, she was working at Cox Automotive doing targeted advertising. It touched privacy a bit, but she realized that no one at her company was really doing privacy and probably should. So, she wrote a job description, handed it to her CFO, and got him to sign off on it. 

Years later, via some networking, she was introduced to the CPO at Bank of America, which was looking for a digital privacy expert. Given her experience with privacy at Cox, she fit the bill and was hired. She stayed there for two years. Now, she's opening her own privacy consulting firm in Atlanta, Georgia. 

"I wanted a change, and the only way I was going to get there was to take ownership of my career and identify opportunities myself," she said. "They could have said no, but they said yes, and that's how I got here." 

Her advice to people looking for privacy work is to get out there. 

"I wasn't waiting. I think if people were waiting in their careers for someone to find them and remember them, it's not gonna happen," she said. 

And that's basically the approach Oliver is taking. She's now volunteering full-time at the Future of Privacy Forum in Washington, D.C. That opportunity came about after some soul-searching about how to approach what she wanted. She started thinking about how to make her elevator speech at the networking events she was attending. 

"How do you sell yourself?" she thought, and came up with, "'Hey, I'm happy to volunteer. What can you give me?' Those are really important questions when you're in a spot participating in all of these wonderful events. How do you pique someone's interest? If you go in there saying, 'All I want to do is make what I made when I left X job,' it's not gonna work.

"You need to sell yourself, but you also need to sell them a plan," she said. 

Based on Plotkin's experience, companies facing GDPR compliance may be more receptive than ever to that kind of sale.

photo credit: torbakhopper hello! is it me you’re looking for? : castro, san francisco (2015) via photopin (license)


If you want to comment on this post, you need to login.

  • comment Joanna Antoniewska • Sep 27, 2017
    Great article! Thank you very much!
  • comment Michael Sneberger • Sep 28, 2017
    Nice follow-up Article.
    I think Zachary Plotkin the recruiter is talking to an elite group of targets if he is seeing that companies only want lawyers for privacy positions. If you do a search for “privacy attorney” on LinkedIn with no geographic limitation you get 18 hits. “Privacy counsel” gets you 48 hits so that really grows the numbers of postings, but overall that is a minuscule number of postings for the entire country given the growing worries about privacy regulation. If you search “privacy compliance” you get 777 hits which tells me lawyers are a tiny part of this - less than one out of ten if you look at these numbers.
    But the big problem remains – as Counselor Oliver's comments show in the article – how  do any of us (lawyer or not) gain any experience? CIPP/CIPM/CIPT can get you through the first layer of HR filters, but then you hit a wall without experience.
  • comment Sholem Prasow • Sep 29, 2017
    I have seen a few of examples of this disturbing trend:
    The job offered is for a junior person to do a laundry list of activities. One of those jobs I saw was for a contact person for a year.
    One of those half dozen or so privacy and related activities for this junior person is the GDPR.
  • comment Sheila Dean • Sep 29, 2017
    I don't know if business leaders are aware of how they are being seen by applicants, of any kind: under qualified, qualified, overqualified, experienced or inexperienced. 
    When a professional sees or hears company leadership issue the public facing phrase, "We don't train for compliance or legal program management."   Applicants see and hear, "We're too cool for school and legal compliance is for people who get caught."  
    You don't want to work there. LIABILITY is blazing in flashing neon, like the word ICHABOD, over their businesses. It's screamingly apparent to people who want to work for good companies, who are going to be around awhile. 
    For your enrichment.
  • comment Jolanta Solecka • Oct 12, 2017
    It does apply not only to the US. I look forward to reading more advices. Volunteering is good when you're 20 years old. But when you're older and have a family you don't want to do stuff for free. Especially, when you invest your own money in your privacy training ! greetings from Poland
  • comment Robert Gilbert • Oct 17, 2017
    Good article - thanks Angelique. I see a lot of companies asking for legal, but these are mostly US, where litigation has a long history. European countries on the other hand want DPOs with practical expertise, augmented with strong IT chops.
  • comment David Schulz • Oct 19, 2017
    Great article, and good comments by colleagues.  Most admire the Jodi Daniels example of entrepreneurship; it's a parallel course to mine and nice to know of another ship in this fairly obscure ocean.  One thought struck me when reading the piece: the "uptraining" will need people skilled in both understanding and explaining.  I've found that in HIPAA privacy, the training mandate is the easiest port into both practices and business associates.
  • comment Bruno Genovese • Oct 20, 2017
    This article perfectly reflects the mood of US companies regarding data privacy jobs: short of nighttime janitor, office to the left, under the stairs. Cybersecurity sounds so much better. The hitch is that the GDPR is calling for not just expertise in privacy "law" but also "practices". Which leads the EU bar to start looking at DPOs as providing legal advice for compensation, which is a “reserved activity" that can only be done legally by licensed attorneys, just as you need to be a licensed attorney in most States to be a GC in any company. I am preparing an article on the subject, because if Bob from IT or Sylvia from HR become overnight DPOs in 2018 for lack of licensed attorneys, the 28 EU watchdogs are going to have a lot of fun going after these companies who thought a token-DPO would cut it for a while...