The Legal Zone (S2:E8): U.S. Data Privacy Laws and Considerations

Transcript

Host: Regina M. Campbell, Esq., The Campbell Law Group (TCLG)

Guest: Elise Houlik, Chief Privacy Officer, Intuit

Introduction

Regina Campbell: Hi, everyone. I'm Regina Campbell, your host at The Legal Zone. Welcome back for season two, episode eight, where we're going to talk about U.S. data privacy laws and considerations. I have a very special guest today, but first I just want to go back for a moment and talk to you a little bit about our prior podcast, in case you missed it. It was #MiamiTech Through the Business Lens, where we welcomed Leigh-Ann Buchanan and Joycelyn Brown, two attorneys here in Miami who do quite a bit of work for tech companies and are among the founders, or the forerunners, bringing Miami tech here.

In the podcast, we talked about the definition of a tech mecca and whether Miami has become one or not. My panelists' opinions varied: one said, "Yes, we're here already," and the other said, "No, not quite." You can listen in to that conversation to hear how they define it and where they believe Miami is. I think they're very informative and helpful for small and medium-sized businesses looking for venture capital to start, or growth funds, and a lot of the foundations that are available here in Miami. So if you want to catch that, I recommend it. You can see it on our YouTube channel or our Apple Podcasts channel.

But today I have an incredibly special guest, Elise Houlik. She's the Chief Privacy Officer for Intuit, and she's here with us. Hi, Elise.

I just want to give you a little background on Ms. Houlik's experience and knowledge, which is quite extensive. We're really happy to have her. I think she's a terrific guest for today's topic. Ms. Houlik is the Chief Privacy Officer of Intuit, as we discussed. In this role, she drives Intuit's data stewardship vision and advises on complex privacy and interrelated regulatory issues. Her team is deeply engaged in all matters related to product development, data governance and information security. Elise joined Intuit in August of 2022, and she's based in New York.

Prior to joining Intuit, Elise worked at Mastercard as VP, Assistant General Counsel for Privacy and Data Protection, where she led the privacy work for the North America and Latin America and Caribbean markets. She helped serve several global divisions, including open banking, small and medium-sized business, B2B platforms, digital payments and partnerships, startups, cryptocurrency and blockchain, marketing and communications, human resources, operations and technology, and corporate security. She also held a former role as associate general counsel at Fannie Mae in Washington, and she is admitted to the Maryland, D.C. and New York bars. She's a Certified Information Privacy Professional. She holds a Bachelor of Arts in English with a minor in women's studies from Johns Hopkins University and a Juris Doctor from George Washington Law School.

And I just realized I probably should have made sure I had no spelling mistakes in my speaker's notes to you, you being an English major. Well, Elise, it's such a pleasure to have you.

Elise Houlik: Thank you. No, it's great to be here. You've got a topic that's near and dear to my heart, so I'm ready.

Regina Campbell: I can tell. I can tell. And I think there's no one better who can help us dive into the chaos that is sometimes privacy law. And not just data: some people don't understand that it's data, privacy and potentially cybersecurity. We talked briefly before this podcast about taking apart the intersection between all of those areas, because they do intertwine. So I think it's really hard for business owners, whether small, medium or large, to navigate these waters, with all the changes in the law and so forth. So I just want to talk to you a little bit about it, and have you help us take it apart, so to speak, and make it a little more digestible for small and medium businesses to understand.

Data security, privacy and data protection

Elise Houlik: Sure. You know, I think overlap is a great way to think about it. And what I love about the overlap is that one tends to make the next one more accessible, right? If you have to start somewhere, I think the thing we're most used to in the United States, and the thing we can grab on to with a little more certainty, is conceptually the idea of data security. There's data that's been entrusted to your organization. You've got to use it to process business requests and make things work, basically, and you've got to make sure nothing bad happens to that information. A lot of our laws in the U.S. are rooted in that concept of security: the expectation that people need to take care of information, what happens when things go sideways, and how you inform people as quickly as possible, with enough information, so they can do what they need to do to continue to secure their information and know where it is and what's going on with it.

Privacy and data protection, I think, have always been around. The idea that there's certain information that is very, very personal, that belongs to a particular individual and helps inform who they are in the world, has long existed as a concept. But now we're in a place where there's so much data and so much technology. We're generating data faster and faster every day, and it's enabling an amazing explosion of innovation. There's lots of great work out there, new products and technologies. We were talking earlier about how we've spent the last two years speaking to each other in these little boxes, right? That's because data and technology have made it happen. What a world we live in. But that just means all of the mindset you have about security, as a foundational starting point, is what you've got to continue to apply to that information. More information means more things to keep track of.

What I like about privacy and data protection in general is that it brings in not only the idea of securing that data, holding tight to it where you need to and preventing its exposure to parties who shouldn't be seeing it, but it also forces the question of why, right? And that, to me, is where it gets really interesting. You've got information that you're entrusted with. The expectation is, of course, that you're going to keep it secure. You're going to do everything you can to stop a bad actor or some other party from accessing that information. But when it comes to using that information, are you thinking about the impact on the individual to whom it belongs, the reason why you want to use it, and whether it's the best information for that reason? And then you get into some really, really interesting conversations about how to build something and how to make something happen.

And the chaos you're talking about is the laws acknowledging that we're at a moment in time where this is happening day to day, as new fintechs and startups and all these different entities are getting into the market and playing with the same data. How do you come up with some sort of legal construct to put boundaries around that work? Frankly, it's really hard to do.

Regina Campbell: It's hard.

Elise Houlik: Yeah.

Regina Campbell: Yeah. And that's my thought too. Even just from an internal point of view as a business lawyer, I think of my clients: everything from the data being collected on the business side, to employees' internal access to that data, even just from the point of view of not reusing it but making sure they're securing it. You think of doctors' offices, you think of banking, you think of companies that have such sensitive information about people. You can tell so much. When I do discovery in litigation, financials are protected, and there's a limited scope to the financials you can obtain in litigation. It has to be relevant to the pleadings. Why? Because financials can tell you so much about someone's habits: where you eat, where you shop, what you buy, your hobbies, whether you pay child support or you don't. It can say so much about you.

So in general, as a business lawyer, I'm always advising business owners to have security protocols in place, even when they're small, for protecting the data internally, even with employees. But it's a whole other world when you go external. Of course, we know business owners have to protect it: if they have a website and they collect clients' information, of course they have to keep it private and have a certain level of security, the minimum that's considered reasonable for the industry, depending on which industry you're in. In general, it's just so important. And I think this is where we get to the chaos. The laws are trying to figure it out, because data can be so potent, so absolutely dynamic, that companies can read what people anticipate and what people are going to buy. They see shifts in patterns, in shopping, in everything, right?

The EU approach and the GDPR

Regina Campbell: So I see the EU is much more protective. EU laws are generally more protective. They have more transparency rights. You're required to let people know where their data is being held. You're required as a platform, depending on whether you qualify under their laws, to give users copies of the data you're storing. The data user has the right to ask you to remove it. There's also limited consent on how you can use the data, and if you intend to use it another way, you ask that permission. Which is what you're saying: how do we put contracts and laws on this? And to give an example, U.S. laws haven't totally caught up there. California is a little bit ahead of the game, Virginia is making some laws, and each state is trying to find its way, so to speak. But then how do you balance that? Many U.S. companies may not know that if they do business in Europe, in the European Union specifically, they could be subject to those laws there as well.

Elise Houlik: Correct. Yeah, absolutely. I think the sharpest contrast between the EU approach and how things are evolving in the U.S., to my mind, in addition to foundationally coming from a different starting point, which we can chat about in a second, is that they build layer upon layer upon layer of regulation. For those of my friends who've suffered through law school: laws are sort of the boundaries, and the regulations are the implementation piece. That can get very, very complicated, because effectively what you're trying to do is push out boundaries that people then have to interpret and operationalize. You have to make that happen to comply with these different layers of regulation.

As you mentioned, the GDPR is the law of the European Union. To the extent there were countries that were not looking in the direction of data protection, that sort of woke things up. It's been around for four years now, since 2018, I guess, and it follows a long history of prior directives and whatnot. In Europe, privacy is a human right. It is a fundamental human right. It would be as though, in the United States, it was baked into the Constitution that everyone has the right to privacy, owns their data and has the ability to control it. They take it very seriously, and there are all sorts of historic reasons why that's the foundation for the approach.

So when they're evolving their regulations, they're coming from that place. They're looking at it in terms of what choices are offered to the individual, how much information needs to be provided so that the individual can make an informed choice, and where the technology has proliferated to the extent that the choice is meaningless, to your point. There's a lot that goes on just through interaction with a website that they're very, very sensitive to. They've got regulations coming about marketing communications, cookies, as you mentioned, ad tech and AI, and they are really leaning in hard. And the interesting thing that has come about in the European Union, as you mentioned when you talked about how you interact with your employee base, protect the information that's entrusted to you and make sure you don't inadvertently cause any security concerns, is that they fold in the concept of employees and their individual information having value, and how employers treat that information.

The U.S. patchwork of privacy laws

Elise Houlik: All of that has been swirling in the background for some time. And then you look across the ocean to the United States, which has a very, very different landscape when it comes to governing data. At the moment, we've got no comprehensive privacy law at the federal level that would cover the entire country. We have sectoral laws. To your point, we've got GLBA that covers the financial sector. We've got HIPAA that covers the healthcare sector. There are laws for education. There are laws for children interacting online. So it's very siloed and fragmented.

And then at the state level, historically, you just had breach laws. There are different breach laws; I think there are 54 of them, right? Every state, plus the territories. They're very similar, but they're not identical, which is a lot of fun. Now, though, we see that in the absence of a comprehensive federal law, the states are filling the void. California was the first out of the gate. Again, I would say it was inspired by the GDPR, but it's not identical, and it takes a very different approach. I think California's law was in effect for 11 months, and then it changed through the ballot initiative. So come January, we're going to have the CPRA instead of the CCPA.

Along with that, Virginia passed a law, and we've got Colorado, Utah and Connecticut. They're all going into effect next year. And my suspicion is that as we hit state assembly season, and they gather and get going in earnest at the beginning of the year, we're going to see more. So there's going to be this parallel conversation: Are we going to have 54 different omnibus privacy laws in the U.S.? Are we going to have one national standard that's going to come in and preempt everything? TBD, right? That's, again, more of the chaos.

Regina Campbell: And I think part of the problem, as you pointed out, is that in Europe there's a more naturally rooted privacy expectation, like a human right, whereas here the concept of privacy is still quite evolving. What does privacy mean? How far can you stretch it? Some people are trying to contract it, so to speak, and what it might mean. And there's a lot of protection in this country. I know that when I have to issue subpoenas to Google or try to get information from some of these platforms, there are additional rules that go into it because of the privacy laws that do exist. For the individuals, that can be very protective, but then the laws step on each other's feet, so to speak, all of the different state rules and privacy concerns.

Some people don't realize that if you do business across the United States, if you're a Florida business doing business in California, or you're on the internet and doing business in various states, you still might be subject to some of these state laws. That really creates a mess, a problem for businesses to figure out which laws apply, especially as some of these states start changing them. And then, are some of these state privacy laws going to be subject to constitutionality issues, because they step on something in the U.S. Constitution, the way privacy has been defined, for instance? This idea of privacy is shifting, and rather than becoming more expansive, it seems like we have a slight trend toward a little more contraction right now in the definitions of privacy, and in what protections we can actually say we have.

I have to tell you, even just as a litigator, when I have to explain the slight distinctions between the different acts: "Well, this one is unauthorized use of a computer, but this is the theft of the information, and you qualify for both of them." It's kind of silly. The law hasn't really caught up with the technology, so to speak, and with how people are abusing it. And going back to our original idea of how to help businesses: how do businesses navigate that?

Where businesses should start

Elise Houlik: It's difficult on a number of levels, most of which you've walked through. Historically, when you've had conflicts of laws that seem to govern the same subject matter, one approach could be to take the most restrictive, the harshest law, the one that's most difficult to comply with, and just say, "Look, that's it. That's the standard across the board." Here, that might get you 70% of the way, right? But then you really have to balance it against what your business objectives are, how you genuinely are using the data, what kind of data you're talking about, and what your practices are for outreach, to your point. I can be a business in the United States with no offices or outlets or any presence in Europe at all. But if I'm sending advertisements to people who happen to reside somewhere in Europe, I may be tripping the GDPR without even knowing it, because I'm trying to engage with them in some way and attract them.

So for me, in the many places I've been lucky enough to work in this space and grow as a professional in privacy, it's important to know the laws that are going to impact you. Understand which ones apply to you and which ones don't. Unless you are a very, very small business that is completely localized and only engaging in one state or area, chances are you're going to end up tripping one of these other state privacy laws. And if you take a step back and think about what the objective is here, foundationally, there's a lot that can be done to show how you're trying to comply with the laws.

What I mean is, really, it's the basics of understanding what your data is. What information are you taking in? Where are you keeping it? Why are you taking it in? What's the reason for its use? Are you sharing it with third parties? And what are their expectations? How do you communicate that to them? Really getting an understanding of your data footprint is the first step, I think.

And then there are the definitions, to your point, of what personal information is. I have a measure of sympathy for the drafters of this legislation, because the biggest challenge in this space, and it will be going forward, is that the minute you get through the juggernaut that is the legislative process and you have an actual law that is published and ready to go, if it is granular and very specific about certain types of technology or certain types of data, it's almost out of date the day it gets printed. So you end up seeing these super broad definitions, where anything that might arguably, possibly be linked to an individual is personal information and part of the scope.

So for me, if you're just looking for a place to start, worrying a little less about the nuances and focusing very, very intentionally on what kind of data you're interacting with will serve you well. Knowing and understanding that about your organization, what the parameters are and where maybe you have to shore things up, will always help you navigate any of these different state laws. There's not going to be a law anytime soon that says, "Ah, you don't have to worry about it."

When to hire a privacy officer

Regina Campbell: Yeah, no. Definitely not. And think about the credit bureaus, or the companies that hold credit cards: they have a certain duty to notify their customers if there's been a data breach. But to your point, it's about taking a more practical approach: look at your specific business, how it's using the data and what it's doing with it, and start there. And I guess you would always recommend being proactive, right? Because sometimes businesses change. They might evolve, they might add another product line that starts to acquire additional data, or they might use additional third-party vendors. So I always tell my clients, and I think that's great advice, to just keep an eye on it, because I do see businesses grow in different ways. They add products, and then they have to think about how that might affect their original analysis. And like you said, technology changes too.

So I wanted to ask you: is there a size of company at which you would recommend having a separate privacy officer? Because at some point this can become a mammoth thing to keep track of. If you're a medium-sized company with a couple hundred employees, or a couple thousand employees, it becomes harder: everything from employee information and data, the employment files, so to speak, to client information, cutting across different servers, countries, technology and software. Is there a point at which you recommend a company have a privacy officer?

Elise Houlik: Yeah. To me, that's been the most interesting thing about this field: it is not uncommon to have, as they say, the one-man band. The attorney who is the general counsel and the chief privacy officer and the chief human resources officer, and so on. And look, there's a practical reality to that. Companies have different resources available to them, and different sizes and scopes. To me, if you're really interested in growing as a company that uses data to fuel your mission, whatever your product or service is, at the very least you want somebody thinking about these issues, almost no matter the size. When it comes time to have a full-time job for it, the beauty of this space is that it can grow organically.

I think the most important thing you can do is get the attention of leadership and help them really appreciate and understand not only the risks when there's non-compliance, because, look, those are really significant, and I definitely don't want to downplay them. That is something that drives this space, especially for lawyers. We're always looking at the risks. But there's a huge amount of opportunity in being thoughtful and trying to get this right from the start, foundationally, and in propelling your commercial objectives: moving faster because you know where your information is and you understand who you're sharing it with, so you can make decisions quicker.

So if you're on the smaller side and perhaps wearing many hats, start that conversation with leadership, so that when the time comes and you see that your day is filled with 90 hours of work and only one person to do it, that paves the way for "I need some extra hands." And to be credible in this space, if we're going to say we're focusing our attention on using data to provide this amazing product or service, I think more and more you see that to be taken seriously, you need to have somebody devoted to the function.

Regina Campbell: Gotcha. So what you're saying is, basically, when you can't keep switching hats enough in a day, that's an indication you're ready for someone to...

Elise Houlik: Yeah, unless it's driven by law, right? For our friends in Europe, and other laws have similar requirements, it's embedded in the law that somebody must be assigned responsibility over privacy. So if you know you're falling into that bucket, you're going to have to appoint someone, and that can come in different flavors. It can be a role like mine, where the privacy officer is ostensibly responsible for the entirety of the program, the way a company might use data and the methods behind it. There are also requirements for individuals like a data protection officer, which is a very specific compliance role that needs to have some independence from the people who are building things and making the decisions, so that they can advise. So you'll see those, and if you trip those requirements, then yes, you're going to have to navigate that.

There are a lot of different ways you can do that in terms of staffing. But more realistically, if you're thinking practically day to day, I think to be taken seriously in this space you've got to be able to point to somebody who has this as their key area of focus. And candidly, the work is endless, right? So again, to capture the attention of the leadership team, who is going to give you the thumbs up or thumbs down on funding for additional resources, extra hands, outside counsel, contract work or something else to help, you've got to show them the business value of this too. And then I think things start to happen.

Regina Campbell: And that's where I try to be proactive with my clients. If they don't have something in place and I'm foreseeing that this could be an issue, or they come to me with an employment issue, defending their company on a non-compete or something of that nature, with an employee who left and took their confidential information or the client list, I hear this and I go, "Well, did you have this in place? Did you have that in place?" And invariably the answer is no, no, no. Unfortunately, that can also lead to a lack of protection. It can potentially hurt someone's case, and it also exposes them to additional risks on different sides, from the customer side to a data breach.

I try to explain to them the importance of it, and it seems so daunting to most business owners. They just look at me like, "Something else I have to do, Regina." But I think you said it best: it's to mitigate risk, even when you get to the point where it's endless. It's so important to do, from a business responsibility point of view, from a legal point of view, and because it's the right thing to do, because I'm sure that as customers they would not want their information tossed around and used for anyone to see what's going on in their lives. When you go to a hospital, you don't expect the nurses or the doctors to be telling someone, "Oh, so-and-so is having this done." You have a right to privacy.

So I think it's important. It still seems daunting, but I think you've definitely been able to bring it down to a level that makes it simple to understand and take apart. It's layered, but there's a reason for it. There's also the business sense in doing this, the importance of doing it, why legally we have to keep an eye on everything, and a practical way of doing so. And that's important, because it's really hard to understand how to accomplish that. Do you have any other tips for businesses? And I'm not saying plug anyone's software. I mean, just for the record, I do use QuickBooks, and I like it quite a bit.

Building relationships inside the company

Elise Houlik: I think, look, the first thing to do is ground yourself in the fact that, no matter where you are in your organization, if this is in your wheelhouse and you're trying to get your arms around it, the very, very first thing to remember is that you cannot do this alone. You can't. I happen to be fortunate enough to have a team of really bright, engaged attorneys helping me along and helping me propel our program forward. Not everybody is that lucky. So you think about who is doing things in your organization that are likely to intersect with what you care about.

You think about the information security team, to your point. There's going to be a person or people responsible for maintaining the network, looking for threats, and thinking about how to protect the information that is being processed day in and day out. That's your new best friend, because together you're going to be much more impactful than if each of you goes off into your own silo and gives redundant information when you're engaging with the business, or worse, conflicting information.

Privacy has evolved as a career. I happen to sit in the legal organization, and I have for the entirety of my career in privacy, but it could just as easily sit in your enterprise compliance group. It can sit in information security. It can sit in risk. Companies have different places to put it. If you're not in one of those groups and your company has somebody who's taking care of that, make friends with them too. There is a compliance aspect to it. There's ultimately going to be a conversation about the risk of choosing one path versus another, and you want to do that collectively, so that you're speaking with one voice, or at least have an understanding of their perspective in that conversation.

And then your extra, extra best friends are the people making the products and services, the ones innovating and wanting to use the data. If you can't get inside their minds and understand what they're trying to do, it's really hard to give advice. And that's all free, right? You can talk to people all day for free and look for opportunities to engage lightly. You don't have to come in with the sledgehammer. Just say, "Oh, I hear you're doing this interesting thing, and it seems to me there's information involved. Can you tell me more about it? I would love to hear what you're trying to accomplish, where you want to go and what market." That conversation can go anywhere. You're getting valuable information to help guide how to create guidelines and parameters around how to use the data. And you're also creating a moment in time that they may remember the next time they have to use data or want to change something about the product or service, and they will come back. There's a lot of give and take in this, and it's almost entirely relationship-based.

Regina Campbell: It really is. You have to understand the laws and everything; that's what any attorney would be required to do. Of course you know the law. But do you know the business? That's really the key. That's where I think it's so important: I can understand the law behind the issue, but if you don't understand how a business works, its ins and outs, how it does things specifically... Some clients make their own path in how they go out and sell products and who they really have relationships with. If you don't understand those pathways, you can't possibly help them or counsel them on how to protect their data, their relationships, their personal information, and their business in general.

You don't want to make something so difficult from the legal point of view that, great, I protected you as much as I possibly could, but you can't move. Some clients tell me, "I want a really good contract, Regina, one that's amazing and that no one can break." And I'm like, "Okay, so you want no one to sign it?" Because if I give you everything you want, the strongest for you, it's not a balance. It's not a compromise. Your customers and your vendors also don't want to be stepped on, so to speak. So sometimes there's a practicality to business that comes into counseling, and into finding those experts.

A lot of times, if my businesses are still small, I counsel them to look for leading industry experts in that area. If you are in the medical field, look for someone who knows how to set up these protections, these computer systems, the software and the checks and balances in the medical field, so to speak. They can tell you what kind of encryption you need. They can tell you what kind of software everyone's using. They have the experience. Otherwise, they just look at me and they're like...

Managing third-party risk

Elise Houlik: And I think the third-party angle is really, really important too, because more and more you see concern in these emerging laws about what you are doing. What kinds of questions are you asking your third parties before you hand over any information? Your house may be in order, but then you share information with a party that may be less sophisticated, less mature in the development of its data protection, privacy and security program. What kinds of things are you going to put in the contract, or come around and expect by way of audits or services? That can be a really challenging conversation, because you certainly don't want to do everything you can to keep your place locked down, with all the processes and procedures, and then introduce a vulnerability unintentionally by bringing in a third party that hasn't been fully vetted.

That too can be challenging when you are sharing a certain amount of information. Let's say I have a conference coming up, and several employees are going to attend, and the hotel needs their business emails to register them for the event. That's the only thing they get, and they commit to deleting it immediately after the event is over, all of the bells and whistles. Do you require a full-scale security review for that point in time and that data sharing, because arguably the emails are personal information? Or do you have a layered approach?

I find more and more people are really looking at this. In parallel to their data programs, there's somebody looking at the risks associated with working with third parties, and really getting an understanding of the ones that potentially expose the company to the most risk. You put those in a certain category that receives restrictive contract terms, certain audit rights and certain extra things, because you know they're handling very sensitive information, or a high volume of it, or they're connecting to your network systems directly. Maybe there's a second tier where there's information sharing, but with different types of parameters. And then there are the more day-to-day suppliers and the like, who maybe aren't getting any data at all. Do you treat them all the same, or do you have a different approach? Because, again, coming back to resources, there are only so many hours in the day, and teams are only so big. You can't treat every single third party identically if you've got a significant number of them. So where are you being the most thoughtful and the most risk-balanced you can be, while still protecting information that's very, very sensitive in some cases?

Regina Campbell: I agree. And are you limiting what access they need? You shouldn't be giving them access to data they don't need. They don't need access to all the data. They need access only to what they need to carry out the relationship. I also get concerned when there are live feeds, or a third party can log into my client's system, because maybe they're the vulnerable side at their security level. They log in, and they can be a back door to my client's information. So you're right, it's looking at all those different layers and making sure you're covering them.

Elise Houlik: Yeah. And even with the, we'll call it, middle tier, you can put a lot of controls in place. I think it's always beneficial to ask them: What is your information security policy? Do you have one in place? How do you tell your employees about the reality that data is very important and sensitive? Are you training them? Are you letting them know this is something you care about? If you're not seeing some of these really basic things, you may want to consider another vendor. It depends on the situation, of course, but there are a lot of basics that are not super burdensome, and you would want to at least see some evidence that that kind of activity is taking place before you, to your point, connect systems, share information or engage with that third party.

Closing

Regina Campbell: Definitely. Definitely. So this has been extremely instructive. I don't want to take too much of your time. I know I could go long.

Elise Houlik: I could go on for days. I geek out on this stuff.

Regina Campbell: Yes. I have my girls behind the camera going, "Okay, Reggie." I forget what time it is. But I wanted to ask: is there anything else you'd like to add, something we haven't talked about that might be helpful for some businesses?

Elise Houlik: I'll tell you, in the spirit of, especially if you're a smaller business, or maybe you're listening and this is not your area, but you're working with data and doing things: if you're not on the privacy team or responsible for privacy, find the person who is. We're pretty nice. Come say hey, talk to them, get engaged with them, and really start thinking about what you can do in your role to make sure this information is secure. Because I really do believe that at the end of the day, no matter what role you play, whether it's the chief privacy officer or something else on the team, taking care of this information is everybody's responsibility. And the dividends that get paid off when people are very thoughtful about what they're doing with the information are tenfold at the end of the day.

So I would say, just find your friendly neighborhood privacy attorney and/or counsel and really start the conversation. A lot of the good work in terms of organization and structure and everything comes down to that first chat. So I'll throw that out there. We're nice people. We try.

Regina Campbell: Who are very knowledgeable as well, and very excited to talk about this area, I find. I have my computer guy too, and it's so funny, because I'm like, "Well, why doesn't that go faster? Why doesn't that do that?" I ask really basic questions, and he smiles at me: "Okay, Reg, for this reason: it's got to go across the network, and it's got to do this." "Okay, okay, thank you." And I've learned quite a bit that way, by asking those questions about the actual technical stuff, as opposed to the legal stuff. I think it's important to understand things, especially when they're within your office or your home, because even your home is subject to being hacked into, so to speak, and to having security issues as well.

Elise Houlik: Yes.

Regina Campbell: So, well, this has been so informative, and thank you so much for making time to speak with us today. I think it's been really, really helpful to everyone watching and everyone who will watch. We always post our podcasts later, so that people can look and get some tips on the area and understand what our speakers are saying and suggesting. Hopefully it's really helpful to our listeners and other businesses. Thank you, Elise. Thank you for coming.

Elise Houlik: Thank you.

Regina Campbell: And everyone out there, stay tuned for our next podcast. We'll be announcing it soon. We want to thank everyone for tuning in, and don't forget to follow us on all our social media accounts. Thank you, and everyone have a wonderful day. Bye.

Elise Houlik: Bye.