She Said Privacy/He Said Security

Arsen Kourinian is a Partner in Mayer Brown's AI Governance and Cybersecurity & Data Privacy practices. He advises clients on data privacy and AI laws and frameworks. Arsen has published numerous articles regarding nuanced issues in these fields, including a forthcoming book entitled Implementing a Global Artificial Intelligence Governance Program. In this episode… The growing number of global and state privacy laws and AI regulations is prompting companies to integrate fundamental frameworks into their AI governance programs. While the US lacks a comprehensive federal AI law, states like Colorado have begun implementing AI regulations that could serve as a model for future state-level standards. With seemingly fragmented regulations, how can companies effectively develop an AI governance program? A multi-regulatory approach to AI governance can be challenging for companies to navigate with regulations like the EU AI Act, Colorado's Artificial Intelligence Act, and international standards like ISO and NIST. While the regulatory landscape is patchy, harmonizing across various regulations and frameworks can help companies meet compliance obligations and reduce risk. This includes forming an AI governance committee, implementing a data governance plan, conducting risk assessments, documenting accountability with policies and procedures, and continuous monitoring and oversight of AI vendors. In this episode of She Said Privacy/He Said Security, Jodi and Justin Daniels speak with Arsen Kourinian, Partner at Mayer Brown, about developing an AI governance program amid emerging global and state regulations. Arsen emphasizes incorporating key components and frameworks from various laws to develop AI governance programs. He also delves into the departments that assume responsibility for these programs and offers guidance on completing AI impact assessments, highlighting the importance of risk mitigation and understanding practical harms.

Darren Abernethy is a Shareholder in Greenberg Traurig's data, privacy, and cybersecurity practice. As an AdTech and data privacy attorney, he is licensed to practice law in California, New York, and Washington, DC. Darren holds seven IAPP Certified Information Privacy Professional, Manager, and Technologist certifications. In this episode… Talks about shifting away from third-party cookies is pushing companies to rethink their advertising strategies and adopt cookieless alternatives. As many companies explore other AdTech solutions like first-party data collection strategies, they need to evaluate their advertising practices to ensure alignment with evolving state and global privacy laws. How can businesses effectively implement alternative AdTech solutions while adhering to evolving compliance requirements? First-party data collection, contextual advertising, and CRM-based approaches present opportunities for businesses to refine their ad targeting strategies. However, these alternatives also require companies to ask probing questions when evaluating new technologies, such as how these solutions fit within evolving privacy laws and what vendor safeguards are needed. In this episode of She Said Privacy/He Said Security, Jodi and Justin Daniels chat with Darren Abernethy, Shareholder at Greenberg Traurig, about the future of AdTech and data privacy in a world transitioning away from third-party cookies. Darren explains how businesses can take a privacy-first approach to implementing new AdTech solutions by proactively managing vendors and keeping privacy programs up to date. He underscores the importance of modernizing vendor assessments, updating contracts regularly, and maintaining proper documentation in case of regulatory scrutiny to build trust and mitigate risks.

Shanti Ariker is the Chief Legal Officer of JFrog (NASDAQ: FROG), where she leads the company's global legal policy development and compliance. She is a solution-creator with global legal expertise, leveraging more than 20 years of experience working with high-growth technology companies to act as a trusted business advisor to CEO and executive teams and public company Boards of Directors. In this episode… The rise in cyber risks is placing increased pressure on companies to closely examine their software and codes and integrate security measures into every stage of the software development process. And, with the SEC cyber rule requiring publicly traded companies to report material breaches, there's an increased need for companies to perform thorough due diligence on their vendors, especially those incorporating AI into their products. So, how can businesses protect their supply chains in such a volatile environment? Supply chain security is not a one-time task but an ongoing process that demands continuous integration of security throughout the software lifecycle. Companies like JFrog, a software supply chain platform, recognize this and utilize a security by design approach to help companies reduce cyber risk by embedding security protocols into every stage of its software design process, securing each piece of code at the binary level before it reaches the end user. In this episode of She Said Privacy/He Said Security, Jodi and Justin Daniels chat with Shanti Ariker, the Chief Legal Officer at JFrog, about the complexities of securing the software supply chain in today's tech and regulatory landscapes. Shanti explains how JFrog embeds security by design principles into every stage of software development to help companies mitigate cyber risks, while enabling companies to conduct thorough due diligence on their suppliers' cybersecurity, legal, IT, and privacy practices. She also emphasizes the need for companies to implement a robust AI review process, particularly for third-party vendors incorporating AI into their products to gain a holistic review of the cybersecurity, data privacy, and regulatory compliance implications.

Omer Tene is a Partner in Goodwin's Technology group and Data, Privacy, and Cybersecurity practice. For the past two decades, he has consulted governments, regulatory agencies, and businesses on privacy, cybersecurity, and data management. Omer is also an Affiliate Scholar at the Stanford Center for Internet and Society and a Senior Fellow at the Future of Privacy Forum. Before Goodwin, he was the Chief Knowledge Officer at the IAPP. In this episode… The US privacy landscape is rapidly evolving, as more states enforce privacy regulations similar to California's comprehensive privacy law. In 2025, eight new privacy laws will come into force — even states without comprehensive privacy laws are imposing regulations to protect consumer data. Notably, New York, where the New York Attorney General recently established guidelines around cookies and tracking technologies emphasizing the need for companies to properly categorize cookies and configure consent mechanisms. The NY AG has also proposed regulations surrounding kids' privacy, like the Child Data Protection Act, that will impact how companies process children's data. As the US privacy landscape becomes an increasingly complex web of regulations, how can companies prepare for what lies ahead? Beyond New York, privacy regulations around kids' data are gaining momentum across the US, with laws like the California's Age-Appropriate Design Code aiming to protect minors from harmful content. Regulations on kids' privacy include everything from age verifications that restrict the sale of minors' data to design codes that protect children from exposure to harmful internet content. These guidelines have garnered pushback in states like California, where businesses claim violation of the First Amendment, consequently delaying enforcement. Regardless, companies should prepare to respond to these regulations that govern the collection, processing, and sale of children's data. In this episode of She Said Privacy/He Said Security, Jodi and Justin Daniels welcome Omer Tene, a Partner at Goodwin, to explore the complexities of evolving privacy regulations, specifically on children's data. Omer shares his insights on the nuances of various privacy regulations, ethical challenges surrounding children's data protection, and the potential future of privacy legislation. Omer maintains that although some regulations have not yet been enforced, companies should take a proactive approach adapting to these new regulations as the privacy landscape shifts.

Shoshana Rosenberg is the Senior Vice President, Chief AI Governance and Privacy Officer at WSP, one of the world's leading engineering and professional services firms. She is also the Founder of SafePorter, Co-founder of Women in AI Governance, and a Strategic Program Advisor at Logical AI Governance. Shoshana is a seasoned attorney with over 16 years of experience in international data protection law, a US Navy veteran, and a passionate advocate for social entrepreneurship and inclusion. In this episode… In the ever-evolving and largely unsettled AI landscape, one certainty remains — the need for companies to develop governance programs to navigate and address the organizational impacts of AI. Such governance accounts for client, stakeholder, and employee expectations for AI use, as well as risk management and overarching visions for innovation. But the process involves more than simply understanding AI tools and vendors. So where do companies begin when developing AI governance programs? AI governance isn't another compliance program where decisions are made in a vacuum. Instead, it's about building a centralized intelligence function across various teams to identify and understand AI tools, use cases, and vendors. A sustainable AI governance program evolves with the changing regulatory and technology landscape and is monitored and evaluated by the governance committee and other organizational stakeholders. In this episode of She Said Privacy/He Said Security, Jodi and Justin Daniels sit down with Shoshana Rosenberg, the SVP, Chief AI Governance and Privacy Officer at WSP, to talk about how companies can build an AI governance program in an evolving landscape. Shoshana emphasizes the need for a proactive approach to AI governance and recommends regularly evaluating AI tools and use cases while creating and adapting associated risk profiles. This establishes a foundation that allows companies to keep moving forward, regardless of how business needs change and the AI landscape shifts.

Amy Bogac is the Chief Information Security Officer at Elevate Textiles. As a seasoned security leader, she has over 20 years of experience in information security, IT governance, and compliance. She holds an MBA from Lake Forest Graduate School of Management and a CISSP certification from ISC2. Previously, Amy was the CISO for The Clorox Company during a significant cyber incident. In this episode… The concept of disaster recovery has evolved significantly in recent years, urging companies to evaluate their security capabilities and infrastructure to plan for cyber events and specific scenarios. While publicly traded companies have some measures in place to restore data and minimize disruptions, privately held companies may not be as prepared. And, as new SEC cyber disclosure rules target third-party risk management, this places pressure on privately held companies to disclose breaches. How can companies maintain strong data resilience and incident response planning? With cyber events becoming increasingly disastrous, having a business disaster recovery plan that can recover data and resume operations is more critical than ever. Yet, sometimes the affected data isn't always trustworthy, especially if the breach occurred among third-party vendors. In this episode of She Said Privacy/He Said Security, Jodi and Justin Daniels chat with Amy Bogac, the CISO at Elevate Textiles, about the critical need for businesses to revisit their disaster recovery plans and integrate data resilience strategies. Amy stresses going back to the basics by regularly reviewing and updating DR plans and ensuring that all business processes are documented and tested. She also explains the magnitude of risks companies face today, highlighting the need for stakeholder and company-wide involvement in training and incident response planning.

Ralph Pasquariello is a Senior Partner at The Tech Collective, a technology solutions company. He works with the FBI, GBI, and US Secret Service on the Atlanta Cyber Fraud Task Force. Ralph is also the former Executive Committee Chairman for the Tech400 Cyber Symposium and an advisor to the Georgia Tech Research Institute. He has served and chaired on numerous boards and organizations. Ralph's cyber liability expertise has qualified him to present at over 100 events. For the past 14 years, he has moderated and spoke at dozens of conferences and panels on cyber liability and data breach risk management. He's hosted educational seminars on cyber exposure for professional associations of all industries, including operational technology and intellectual technology. In this episode… When a company undergoes a cyber attack, the repercussions are costly. From remediation and replacement costs to third-party damages and operational interruptions, cyber insurance aims to cover expenses businesses incur and help them stay afloat after a cyber event. Cyber insurance is a crucial part of security, yet many businesses remain underinsured, believing that compliance with third-party vendors and/or client contracts is sufficient. What coverage might your company be missing, and how can you ensure it's optimal? Cyber insurance coverage may include more than basic security provisions, encompassing additional elements such as commercial crime, social engineering, ransomware, and fraudulent transfers. As cyber insurance requirements have become increasingly strict over the years — The Tech Collective helps companies navigate complex insurance applications, analyze optimal insurance coverage based on business-specific needs and risks, and perform a comparative industry analysis. In this week's episode of She Said Privacy/He Said Security, Jodi and Justin Daniels welcome Ralph Pasquariello, Senior Partner at The Tech Collective, to talk about how companies can ensure optimal cyber insurance coverage. Ralph emphasizes that business security measures and contractual compliance are not equivalent to proper cyber insurance coverage. He also shares instances where insurance companies may deny claims and provides insight into carriers changing requirements.

Alexandria (Lexi) Lutz is the Senior Corporate Counsel at Nordstrom, where she advises the company on legal matters related to privacy, cybersecurity, and AI. Prior to Nordstrom, Lexi worked for a large national hotel brand and an international food service company. She is a Certified Information Privacy Professional in the US and Europe and holds the Charlotte Business Journal award for Outstanding Corporate Counsel in a large company. In this episode… 19 states have passed privacy laws, fundamentally altering how companies collect, share, and sell consumer data. And, as consumers become more aware of their privacy rights and how companies and their third-party vendors handle their data, retailers are at the forefront adapting their privacy programs, due diligence processes, and third-party contractual agreements to meet compliance requirements and maintain customer trust. What's more, the new SEC cyber rules place even more security requirements on retailers' relationships with third-party vendors, further complicating expectations. How can retailers navigate this complex regulatory landscape while providing the best experiences for their customers? Adapting privacy programs to evolving regulations is an intricate process requiring a company to evaluate its operations, size, and resources. No matter the circumstances, it's crucial to maintain control over consumer information and ensure all third-party vendor contracts are up to date and transparent. And as retailers incorporate generative AI into their online and in-store shopping experiences, they should take extra steps to ensure personalization, efficiency, and protection are not lost. In this week's episode of She Said Privacy/He Said Security, Jodi and Justin Daniels chat with Alexandria (Lexi) Lutz, the Senior Corporate Counsel at Nordstrom, how retailers can navigate privacy challenges, leverage AI, and maintain consumer trust in an increasingly complex regulatory environment. Lexi highlights how these regulations — including the SEC cyber rules — impact everything from third-party vendor due diligence and contractual requirements to in-house privacy programs and consumer data sharing and selling. She also discusses the implications of generative AI in retail, maintaining that it should enhance the shopping experience rather than replace human input.

Julie Rubash is the General Counsel and Chief Privacy Officer at Sourcepoint, a data privacy software company. She coordinates legal efforts for Sourcepoint and ensures that the product suite innovates and expands to meet the demands created by the ever-changing regulatory landscape. Julie brings over 15 years of legal experience and has worked at both law firms and as internal counsel in the media, technology, and advertising sectors. Prior to Sourcepoint, Julie served as the VP of Legal at the advertising platform Nativo. In this episode… As companies head towards a cookieless future, advertisers are devising clever ways to target consumers, some of which may risk infringing on privacy laws and privacy rights obligations. While companies are creating universal solutions to comply with evolving privacy laws, they may overlook nuanced targeting methods that use consumer data differently than cookies. The stakes are high for any company engaging in these emerging targeting methods, as businesses must recognize the privacy risks and carefully blend legal requirements with their marketing efforts to protect consumer data. Some of the most innovative companies have embraced privacy considerations as a marketing touchpoint, working with consumers to build trust and provide clear options to manage their preferences. Companies like Sourcepoint recognize this need and that privacy obligations and consent solutions are not one-size-fits-all, so they offer flexible privacy software solutions that allow companies to tailor privacy programs based on their unique business goals, circumstances, and legal requirements. In this week's episode of She Said Privacy/He Said Security, Jodi and Justin Daniels speak with Julie Rubash, the General Counsel and Chief Privacy Officer at Sourcepoint, about the ins and outs of managing consent as new targeting methods emerge. Julie stresses the need for customized consent solutions that align with company principles and privacy regulations while allowing consumers to manage their preferences. She also discusses how privacy professionals can recognize and mitigate the risks of new targeting methods, the importance of understanding the data you're collecting, and why combining marketing and privacy goals is paramount in this evolving ad tech landscape.

Craig Schwartz is the Head of Legal at Covariant, an AI and robotics company out of Berkeley. He is a veteran tech lawyer with 20 years of experience at the intersection of emerging technology and regulated markets. Craig previously worked for Palantir Technologies, where he led the USG Partnerships team and served as Lead Counsel for the Intelligence Community business. Now at Covariant, Craig is part of a team building foundational models for the physical world, focusing on automation and AI integration in industrial settings. In this episode… Europe's aging workforce is fueling a growing demand for automated labor solutions, with US-based AI robotics companies stepping in to fill the gap. But this trend isn't just about technological innovation. For US-based companies entering the European market, success in this landscape requires a deep understanding of product capabilities and the global regulatory environment. To stay ahead, companies must make informed decisions on ethical AI use and on how to handle data — from collection to storage to use — without stepping on any global regulatory toes. With emerging regulations like the EU AI Act and Internet of Things (IoT) legislation, it's now more important than ever for companies to integrate privacy considerations into product design from the start. By adopting privacy-by-design principles early on, companies like Covariant can meet anticipated global compliance requirements and create operational efficiencies, demonstrating their proactive approach to these regulatory challenges. In this week's episode of She Said Privacy/He Said Security, Jodi and Justin Daniels chat with Craig Schwartz, the Head of Legal at Covariant, who shares invaluable insights on navigating the complex intersection of AI, robotics, and international privacy regulations. Craig explains the steps Covariant takes to stay ahead of global privacy regulations. He also discusses the critical need for legal professionals in tech to immerse themselves in technical product knowledge, the challenges of applying existing global privacy laws, such as GDPR, to cutting-edge technologies, and the potential impact of antitrust policies on innovation in the AI space.