I want to note that this month marks my 35th year anniversary of my Call to the Bar of the Province of Ontario. This also marks one year since I joined nNovation LLP, and I went to thank Kris Klein, Tim Banks, Shawn Brown, Dustin Moores, Abigail Dubiniecki and Kim Alexander-Cook, for welcoming me to a great and supportive group. Their expertise in privacy is huge, and the anxiety of launching into practice in the midst of a pandemic and a recession, has certainly been made less stressful with their support. This started off as just a note to acknowledge these two milestones, but as I wrote, I realized that I want to offer up my history as a bit of guidance to those who are starting their journey in privacy. Perhaps it will also be encouraging to those further down the road, too, given how many times I have had to reinvent myself over the course of my career.
I want to thank my clients, whom I appreciate for how engaging they are to work for and with. I have had a chance to learn their businesses, their challenges, and to support them in various steps on their privacy journey. Whether it in negotiating data transfer agreements, helping to establish or enrich a privacy program, or (shudder) dealing with the incidents that befall all organizations, it has all been fascinating work – and what I love to do.
I want to thank the many people that have helped me along the way – the friends and business colleagues, the clients, who have been a part of my journey.
I was called to the Bar in 1986. My first real job was for a software company called Legalware, which had developed tools to help lawyers automate documents and files. I began developing expert system templates for them, which involved analyzing legal processes and figuring out how to automate them through questions and answers. I was so lucky to get got involved with and learn technology far earlier than many others then in law. Sadly they folded – too far ahead of their time- and I went through a couple of law firms before starting practice on my own. I heavily used technology in practice – I had a bulletin board for my clients to connect to me, for those of you who remember the whine of modems… while also still consulting and lecturing about the use of technology in law (some of you may remember “CSALT”?)
In 1998 I was approached by CGI and initially I thought they wanted me for their legal department. They actually wanted me to join as a consultant because I was well known, not for law, but for legal technology. At that point, I had had my fill of trying to compete as a sole practitioner in a crowded market where I was relatively unknown, and despite what I knew about technology, the tech firms of the world were not beating on the door of a sole practitioner. I welcomed being able to combine what I knew about law and technology, joined CGI and worked with some really great people in their legal technology practice, and then their document & knowledge management group.
One of my most proud accomplishments at CGI was when I was project manager for the Video Remand and Bail Project. I was the only consultant on the team; I led for three years an outstanding group of people in a project to build and run a video conferencing network between the courts and the jails in Ontario. Our project won a Diamond Award for Organizational Transformation at Showcase for the Justice Cluster, and it is still in operation as a key component in the delivery of justice (remember that anytime you hear “the accused appeared by video”). What I definitely found influenced my later career in privacy was about change management: technology was easy, but getting people to change the way they do things – much harder – but with the right approach, you can get “organizational transformation.”
My part in the project come to an end as it became a program, but I was soon on another. A project manager at CGI found me and said “You! You can read a law! You are now the privacy manager on a government project we’ve won.” At first I was not so keen; but as I got into it, I found to my surprise, that privacy also combined whet I loved most about law, with what I loved to do in technology.
That project was a mixed blessing. I got a chance to develop a PIA that had four ministries (!) sign off on a very complex project, another chance to practice what I had learned about building consensus; but the project was ultimately cancelled, with the PIA I had led being the sole document accepted by our client out of the whole project. However, it was what started me on the privacy road.
It was about this time I was introduced to the International Association of Privacy Professionals. I wrote at the first CIPP exam in New Orleans in 2004, when the IAPP was I believe about 400 members. At first I thought I joined a cult – there was Richard Purcell proctoring the exam in a nun’s outfit, I think because of a popular musical at the time… Anyone who knows me knows I drank the Kool-Aid, because I went on to get more certifications and as well to teach them, and to speak and participate as often as they’ll let me. Later on when they got really big, when the IAPP first introduced the “Little Big Stage” they had an empty slot and offered it to me. Note: I am currently the only person I am aware of that has done a stand-up routine at the Global Summit; perhaps the IAPP learned from the experience…
I was put in charge of the Security and Privacy team at CGI, which gave me an exposure and grounding in the cybersecurity world; and then ultimately moved from there to Symantec. I initially support compliance sales, but then moved to an internal position to build and manage Symantec’s global privacy program. In 2010 I became a privacy officer to Mercer, a human resources and benefits company, again getting to work with great and dedicated people. In both organizations, supported by great people, I developed an international experience and mandate, working on issues both internal, client-facing, and customer-facing, around the world. I realized while helping to negotiate yet another data transfer agreement with a EU company, that I had realized my goal in going to law school was to practice international law – in the realm of privacy, and that I was getting an experience few lawyers in Canada were able to get.
From Mercer I went to Nymity. I had been a customer for over ten years and routinely had dragged people to their booth to talk to them at conferences, so it was in many ways natural that I would go there. I had very different role leading a sales team, but it gave me a chance to learn more, and apply what I had leaned as a privacy officer in a whole new way, to build and run a successful team of privacy advisors who could understand and speak to clients’ issues. And in a strange way, it was what I had started in technology doing – I was just helping to automate a different kind of practice.
And from Nymity I went to PwC, where I re-entered the consulting world to address the question I kept hearing from customers while at Nymity: “This is great software, but could you just do it for us?” At PwC l had some really great clients, and found, with some surprise, that my long road and experiences were truly valued – I could actually help clients not only by building a program and helping them with it, but by help them learn to do it.
Which brings us up to date: I joined nNovation in April last year. It has not been an easy year for any of us, and it’s been particularly trying and worrisome to build a practice in the midst of a pandemic. What is different now is that I have spent nearly two decades in privacy, and have now established a reputation. It is the result of the accumulated effort over many years of experience but also speaking and writing. I have to thank the marketing people who put me into positions where I could speak at many events, both in the real world and online, and for teaching me to promote. Anyone who knows me knows that I am frequently writing, speaking and otherwise participating through the IAPP (as was with other organizations and technology partner events).
And while promotion is important, I feel strongly you can only be successful at it if you share knowledge and experience with our community, in a productive way, to help advance our understandings of privacy as a discipline and as a transformative exercise.
It also helps me, I think to reach out and try to be a help to others – whether one-on-one for young professionals now trying to develop their careers in privacy, in offering my time to charities to talk about good privacy hygiene in an epidemic (pun intended), or through teaching (I am getting my teaching fix right now through Continuing Studies at the University of Toronto).
Since I have mentioned puns… One of the things, my friends and colleagues have always known about me – or soon learned – was my sense of humour. I tell jokes; I relate privacy principles to stories, to help clients and students, using humour to make the privacy learnings I have to share, well, interesting – memorable, and approachable. The best compliment I have received was when a client’s employees said in after a full day workshop was “I never thought privacy would be so interesting.”
In addition to making a successful practice – one where I can be the ‘guru on the hill,’ counselling organizations and their general counsel, my goals now include continuing my teaching, and also getting onto a board of directors, as there are few at that level with the experiences needed in today’s world of cybersecurity and privacy challenges.
We will constantly re-invent ourselves, and that is okay; I have had at last count six career changes. I was once in the middle of an interview for a privacy officer role, which I was ultimately unsuccessful in getting. The interviewer asked me why they would hire me, since I had been in a software company, entered practice, left practice, gone to consulting and now wanted to become their privacy officer.
I was unprepared for that question, so my response came to me (and the interviewer) as an epiphany:
I analyze and solve problems; I build programs; I advocate and persuade; I find ways to understand and utilize the connections between technology and the way we work; I write; I amuse and engage; and I motivate and teach. The job title is irrelevant; what I do, stays the same.
The interviewer wanted to hire me on the spot, but as I said, I was not selected. That is okay; we all will face situations where we know we are the right person but at the wrong place, or the wrong time. My learning from this moment in my past was that I understood what made me tick. I hope you will take the time to reflect on what makes you tick; this will ultimately be what gives you contentment in your career path, whatever twists and turns it takes.
The Privacy Inquisition 