In this Volunteer Spotlight, The Privacy Advisor caught up with Allen Brandt, CIPP/E, CIPP/US, CIPM, FIP, and asked him to reflect on the past and current state of affairs in the privacy space. It's a space Brandt knows well, having worked in a number of sectors over his career. Now executive director, associate general counsel, chief privacy officer and lead cybersecurity counsel at Depository Trust & Clearing Corporation, Brandt says juggling his roles comes down to time management, setting expectations and having a good team of people to work with. For him, the biggest challenge is: How do I stay on top of what’s new in privacy at the level that I want to see it? In a step towards addressing that challenge, Brandt is scheduled to complete a master of law in cybersecurity and privacy law through Albany Law School this spring. 

The Privacy Advisor: Working for a financial services company that has operating facilities, data centers and offices spread across 16 countries must present a challenge when looking at the various privacy jurisdictions. How do you address that?

Brandt: From a privacy standpoint, we take the strictest approach. Our definition of personal information will work globally, as will the way we gather consent. We use the same language worldwide — meaning we say the same thing in the U.S. as we would in Europe or Asia. From a marketing standpoint, most of the world today requires some type of opt-in requirement. The U.S. is really one of the very few outliers on that.

The Privacy Advisor: You’re someone who’s worked on privacy in various sectors. Which sector has been the most challenging for you, and which do you think has the farthest to go on privacy?

Brandt: I’ve been in online marketing, education and financial services. I think financial services and the health care sector are probably the most mature, while the education sector, particularly in the K-12 world, faces the biggest challenges. In the education space, there are a lot of regulations and oversight, but they don’t have a lot of resources. If a million dollars fell out of the sky, a school wouldn’t use that to harden their network; they would support education efforts by hiring another teacher, an aid, teaching materials, etc. Whatever issues exist on the network are still there after the extra million. In my opinion, online marketing has the farthest to go. A lot of what I saw when I joined marketing in the mid-2000s still exists today, and I think you’re seeing frustration with this play out in the form of the California Consumer Privacy Act, the EU General Data Protection Regulation, and you will see it again in the ePrivacy Directive. Simply put, people are just not comfortable with the way data is bought and sold.

The Privacy Advisor: As momentum grows for the development of a privacy law in the U.S., what would you take from your experience with EU General Data Protection Regulation in terms of guiding the U.S. approach?  

Brandt: I think we need some type of standard, but I’m not sure if we want to go all the way to the GDPR. I’m very interested to see how it's working in Asia, which has a bit of a hybrid model. There you are seeing something that takes part of the European approach and combines it with a part of something else in a way that allows for growth and innovation. In some ways, the Asian privacy model is more flexible. One of the problems you have with no regulation is that you have a company that wants to do the right thing and they will spend the time and money to develop a program that will meet every standard, and then you will have someone who will refuse to do anything and adopt the mentality that if they do get caught, they will pay the fine. Having seen the growth of some businesses, I'm not sure I agree that companies see the economic value in developing strong privacy programs.

The Privacy Advisor: Are you still interested in privacy at this point? Or could you do your job with your eyes closed?

Brandt: I’m still interested in privacy but in a different way than I would have answered this question five years ago. I’m fairly new in the financial industry so, no, I can't do this with my eyes closed. While the day to day managing of programs has really become second nature, changing industries means you are also changing languages. I am still learning the language and the regulations. 

I don’t know how a person can go 20 years doing the same thing in the privacy space, it would get too easy. Even with all the changes that have happened over the last three or four years ... privacy moves along at a fairly slow pace. GDPR has been the one big thing that has happened in 14 years. If Congress does pass sweeping privacy regulations, that would be monumental for a lot of people and would probably provide another five years of activity. But, absent that, once you build up to a certain point, privacy hasn’t really changed much.