Frost Brown Todd Podcast

Latest Episodes:

Episode 87 - Japan’s Data Privacy Approach May 16, 2022

Show notes

Japan is a major U.S. ally commercially and otherwise. What is the Japanese approach to personal data privacy, and how does it differ from the U.S.’s privacy culture? Erik Jacobs addresses the differences in how privacy is conceived and addressed in Japan in contrast to the complex U.S. system that has no overarching federal law about how our personal information is collected, stored, sold, and otherwise handled. Erik advised the White House Office of Science and Technology and coordinated policy at the U.S. Energy Department during the prior administration. Fluent in Japanese and English, Erik is now Policy Manager for the U.S. and Asia at Access Partnership, a leading global public policy firm dedicated to opening markets for technology. He discusses the Japanese attitude toward privacy policy and Japan’s 2022 Act on Protection of Personal Information (APPI), a comprehensive personal data privacy code that augments sectoral and other laws governing the flow of personal data. Tune in to learn Japan’s approach and what the U.S. can learn from how a leading Asian ally developed a national approach to data privacy protection. If you have ideas for more interviews or stories, please email info@thedataprivacydetective.com.

Episode 86 - Blockchain and Privacy - The First Imposition of U.S. Sanctions Apr 25, 2022

Show notes

Blockchain. Does it protect personal privacy? Is it a tool that can evade the law? How should we think about the relationship between blockchain technology and individual privacy? In this first of a series of podcast episodes about blockchain and privacy, we turn our spotlight on the first use of U.S. Government sanctions against a cryptocurrency mining company. On April 20, 2022, the U.S. sanctioned the Russian-Swiss Bitriver conglomerate, as part of its response to Russia’s 2022 invasion of Ukraine. Consider how blockchain and privacy interact and what it means for the future of this technology, the use of cryptocurrency, and the ongoing contest between government and personal privacy. If you have ideas for more interviews or stories, please email info@thedataprivacydetective.com.

Episode 85 - Japan’s New Data Privacy Act, 4 Key Developments Mar 31, 2022

Show notes

Japan’s Act on the Protection of Personal Information (APPI) becomes effective on April 1, 2022. The APPI strengthens the country’s comprehensive personal data privacy code and affects all businesses that collect or process personal information of Japanese residents. Yugo Nagashima of Frost Brown Todd LLC explores four key developments that affect global business: 1. “Person Related Information” – a new category of data – with consent required to transfer such data to a person related information handler. 2. Extra-Territorial Reach – Instead of an adequacy approach (like the EU), Japan requires a business that will handle Japanese personal information outside Japan to have the consent of those persons after a clear description of the data privacy laws of the foreign jurisdiction. 3. Data Breach Notification – A two-step notification process is mandatory for data breaches, with a low threshold of 1,000 persons triggering a mandatory notification. 4. Pseudonymous Information – Specific definition of pseudonymized data and exemption from data breach notification when pseudonymous data has been hacked. If you have ideas for more interviews or stories, please email info@thedataprivacydetective.com.

Episode 84 - The Role of EU Data Protection Officers Mar 21, 2022

Show notes

The data protection laws of the European Union require many European and other companies holding or processing personal information of EU residents to appoint a Data Protection Officer – a DPO. This role creates a triangle of DPO duties – with responsibilities to the individuals whose personal information is at stake, to the company the DPO serves, and to the Data Protection Authorities who enforce GDPR. Marie Penot provides outsourced DPO services to companies in German, French, and English from her own German consultancy. We explore with her the working life of an outsourced DPO. Learn how companies benefit from the independent role of a DPO regarding EU residents’ personal data. Explore advantages and disadvantages of an outsourced DPO instead of one appointed internally. If you have ideas for more interviews or stories, please email info@thedataprivacydetective.com.

Episode 83 - Ethical Hacking and Data System Assessments Feb 17, 2022

Show notes

Hacking – it gets a bad rap. For good reason. It’s associated with bad actors who infiltrate an IT system and steal organizational and personal information for criminal purposes. But hacking is simply an activity. Ethical hacking is a means for companies and people to test their data systems and avoid bad actors from getting into them. Ethical hacking is a tool to protect data by upgrading defenses. André Sollner is Global CFO of wizlynx group, a global ethical hacking and penetration testing provider. André holds numerous certifications over a 20+-year career in cybersecurity, including that of Certified Data Privacy Solutions Engineer. He is our tour guide for how a system assessment is conducted in five phases, from understanding and mapping an IT system and all points of entry, to a final assessment and report after the system is ethically attacked. This podcast episode will inform you about preventive system assessments that can fortify defenses against data theft, ransomware attacks, and other data disasters. We discuss the range of personal information commonly found in company databases and key weaknesses in IT systems. You will get top tips for both organizational and personal data privacy protection. If you have ideas for more interviews or stories, please email info@thedataprivacydetective.com.

Episode 82 - India’s Imminent Data Privacy Law Feb 11, 2022

Show notes

India is about to enact a far-reaching Data Privacy Law. Expected to be passed by April 2022 and in force as early as 1st quarter 2023, it represents a far-reaching comprehensive approach based on but extending beyond the model of European Union’s GDPR. It would govern not only personal information but how non-personal data is collected and processed across borders. The bill would force global companies that gather and use data of Indian residents – or that have personal data of non-Indian persons processed by India’s stellar offshoring/outsourcing industry – to reconsider existing privacy policies and procedures. By including non-personal data and introducing measures of data localization, India’s novel approach would represent perhaps the most onerous and strict national policy about data collection, storage, and use. Join this excursion to India, guided by Stephen Mathias, head of the Technology Law Practice at Kochhar & Co. (https://kochhar.com), one of India’s premier multi-city law firms. If you have ideas for more interviews or stories, please email info@thedataprivacydetective.com.

Episode 81 - Quantum Computing and Data Privacy Does a Privacy Apocalypse Draw Near? Jan 28, 2022

Show notes

Quantum computing – some view its emergence as heralding the end of data privacy. It threatens to penetrate encryption used in conventional computing to give hackers ready access to digital data. What will quantum computing mean for our privacy and the digital world? And what can we do to defend against its perils? Our guest is Ken Morris, CEO of KnectIQ, a company that provides beyond military grade identity, authentication, access, and data protection solutions for highly sensitive environments. KnectIQ: ZeroTrust based identity, access & data protection. Explore the meaning of quantum computing - its promise, timing, and limitations, as well as the defenses against attackers who will harness it to steal and misuse our data. Learn the two schools of thought about defenses to data theft when quantum computing empowers bad actors as never before. This podcast will force you to rethink cryptography as the sole defense against data loss. Learn how we can better protect data by dealing directly with the infrastructure of data storage and transfer and eliminating the fundamental problem. Tune in for an introduction to the coming age of quantum computing and how individuals, businesses and governments can protect personal and other data from misappropriation. If you have ideas for more interviews or stories, please email info@thedataprivacydetective.com.

Episode 80 - Backup and Privacy Jan 24, 2022

Show notes

Backup – what does it have to do with protecting data privacy? And how does a backup service work? What should businesses and individuals know about backing up their digital data? On one hand, a backup of data provides a second target for data thieves. Not properly handled, backups can increase privacy risks. But without a backup of data, it can be lost and subject to exfiltration by thieves who steal or freeze the data held by businesses and government, the prime targets of ransomware criminals. This podcast explores the world of backup with W. Curtis Preston, sometimes referred to as Mr. Backup. Host of the podcast series “Restore It All,” author of books, veteran of the data backup business, and Chief Technical Evangelist for Druva (www.druva.com), our guest will take you on a tour of a business and service little understood but vital for protecting and recovering data in case of loss. Learn the meaning and importance in tech field lingo of “regular expressions” and “immutability.” Consider how backup services can inform businesses about protecting sensitive data better, beyond their role in resiliency and providing prompt access to data streams that are lost or stolen. And get tips about how individuals can consider the role of backup for their own personal data. If you have ideas for more interviews or stories, please email info@thedataprivacydetective.com.

Episode 79 - Data Localization - The Case of Taiwan Jan 14, 2022

Show notes

Taiwan occupies a unique geopolitical position – with a substantial population and robust economy, it lacks formal diplomatic recognition by most countries and is considered by the People’s Republic to be rightfully part of it. Taiwan has its own system and laws. How does it approach personal data flows beyond its borders? Taiwan has a comprehensive personal data privacy law with a GDPR-similar approach. It provides more flexibility than the EU in how Taiwanese personal information is collected and processed. There is no express extraterritorial reach to its law. But Taiwan businesses must comply with rules on handling data they collect and can be held criminally and civilly liable for exporting data that infringes Taiwan principles. There are statutory exceptions to the relatively free ability for cross-border sharing and processing of personal data. Taiwan’s financial regulator requires financial institutions to obtain consent for the export of personal financial data. Taiwan prohibits its telecommunications and broadcast companies from storing subscriber data in the People’s Republic of China. Taiwan uses sectoral exceptions to address particularly sensitive security concerns. This podcast episode explores the unique position of Taiwan on our continuing global tour with Yugo Nagashima about how data localization is practiced. If you have ideas for more interviews or stories, please email info@thedataprivacydetective.com.

Episode 78 - Data Localization - The Case of Turkey Jan 05, 2022

Show notes

Turkey is the first 2022 stop on our global tour about data localization. What is Turkey’s approach to cross-border transfers of personal data about its citizens and residents? Turkey’s Law on Protection of Personal Data is comprehensive and like the European Union’s former Data Protection Directive, though it differs in some respects. Data localization is not part of this existing Turkish law. Instead, Turkey takes a sectoral approach to cross-border collection and processing of personal data of its residents. Turkish banks must collect and store Turkish customer data within Turkey. Data localizations requirements apply to payment and electronic money institutions, forcing companies like Paypal or Venmo to locate a payment system within Turkey and to comply with Turkish data privacy regulations. Social media providers must register with and report every six months to Turkish authorities about Turkish social media users. In August 2021, the Turkish Data Protection Authority (KVKK) proposed to amend Turkish law to permit cross-border data transfers if it issues an adequacy decision about another country. But unlike GDPR, the amendment would require the foreign country to be reciprocal in its data privacy laws, a unique approach that extends beyond adequacy. If adopted, the KVKK approach would encourage multinational companies to use Turkish-based servers and a Turkish subsidiary to have broad access to the Turkish market but would allow flexibility through binding corporate rules and notifying the Turkish authorities of a standard undertaking. Tune in to Episode 78 to learn how and why Turkey may be aligning with evolving European standards instead of more authoritarian and protectionist rules evident in China, Russia, and India. If you have ideas for more interviews or stories, please email info@thedataprivacydetective.com.

Our TOPPODCAST Picks

Follow Us

Stay Connected

Related Podcasts

Links

Stay Connected