I could do a blog exclusively on data breaches because they happen so frequently that I’d never run out of material. Eight hours ago, the Supreme Court of India’s website was hacked, apparently by “HighTech Brazil Hackteam.” I imagine that they’re either a group of highly motivated lawyers or, given their logo, a group of very high teenagers. Read More
GDPR Countdown – Six Weeks to Go
It’s easy to think about data as a depersonalized set of information that we can use for whatever purpose we want. But complying with GDPR will require a change of mind and a change of approach to data, and especially data subjects. Businesses that cannot navigate between unrestrained use of information and the lofty — and potentially unachievable — goals of the GDPR will struggle after May 25. How will you chart your course? Read More
Recognizing the Risks of a Malicious Insider
Data security is a complicated thing, and it’s made much more complicated by the human element. The vast majority of breaches are a result of error, negligence, or intentional misconduct. And that misconduct isn’t always a hacker (invariably, he’s wearing a hoodie) – many times, it’s a malicious insider in your own company who steals or facilitates the theft of your crucial data. Understanding the risks of malicious insiders is a vital part of avoiding a breach, and being #datasmart. Read More
GDPR Countdown – 8 Weeks to Go
There were quite a few data breaches in the news this week, and the media makes it seem there’s a breach a day. That’s fake news, folks: there are way more than one a day.
It’s no secret that the GDPR imposes strict new requirements for preventing, detecting, resolving, and reporting data breaches, and similarly strict penalties when companies fall short. Sometimes it may appear like you’re facing risks from hackers and regulators alike. But it doesn’t have to be so. Taking a datasmart approach to security and compliance can help keep you out of the crosshairs and out of the courtroom. Read More
E10 🎧Podcast: Don’t Come At Under Armour, Bro – The New Privacy Breach Normal

Under Armour, Saks, and Panera, all announce privacy hacks and major data breaches within the last few days. We are learning more each day how each company responded, the good and the bad.
In this episode of “Are You DataSmart?”, the Ward brothers dissect health data, like the kind popular in fitness apps as well as the “don’t throw stones in glass houses” aspect of data breaches. About 60% of larger corporations have been hacked according to a Duke University and CFO Magazine analysis in 2015. Read More
E9: IAPP Global Privacy Summit Recap, Big Questions, and Indiana Jones Analogies

“We have top men working on it right now.” – Government Bureaucrat.
“Who?” – Indiana Jones
“… Top… Men…” – Government Bureaucrat
If you know this iconic scene from Indiana Jones and the Raiders of the Lost Ark, then you know it comes following the epic search and recovery of the Lost Ark by Indiana Jones. And that exact feeling of confusion seemed to permeate some of the raw details of how the GDPR and other regulations will actually be governed and executed by regulatory authorities. Read More
GDPR Countdown – 9 Weeks to Go
So I’m buying some Under Armour shorts at Saks when I suddenly get a craving for Panera.
What a difference a week makes. With new breaches and investigations beginning seemingly every day (Under Armour, Saks, Panera, all in the last five days), it raises a critical, and practical, issue: how are regulators going to approach data security enforcement after May 25?
We’re entering the home stretch of the GDPR countdown now, with just about two months to go. At this point, you may or may not have realized that you need good advice about what to do and how to do it. Ideally, you’ve started the process of implementing a thoughtful data security plan (or have at least thought about thinking about it). Read More
Top Takeaways from the IAPP Global Privacy Summit 2018
Top 5 Takeaways from this year’s IAPP Data Privacy Summit (#GPS18). We’ve heard from regulators, industry leaders, and specialists in every topic from facial recognition to ethical use of data. It’s an incredible event, and one that every privacy professional should consider attending – the swag ain’t bad either. Read More
🎧 E8 Podcast: Interview with Cookiebot CEO on Technical Solutions to GDPR Readiness
Do you have cookies on your website?
Of course, you do! [In fact, almost every website in existence utilizes cookies now]
With GDPR on the way, the time to come into compliance is now, and the Ward brothers are interviewing a great SaaS solution Founder and CEO, Daniel Johannsen.
Mr. Johannsen explains how Cookiebot can analyze any site and identify the necessary changes to be compliant while ensuring a great user experience. Read More
E7: The DataSmart Method of Valuing Data Assets
Is your data valuable? Might be. Is all data valuable? Nope. How do you construct a data strategy that identifies what is valuable quickly so you can keep the good and dump the rest?
In the second step of the DataSmart Method, the Ward brothers walk through a valuation approach to data assets designed to be done quickly. This ensures you focus on the data assets and partnerships strategies early on in your evaluation. Read More
Are you DataSmart? An Introduction to the DataSmart Method
“Are you DataSmart?” is the question we keep asking our clients and friends. Frankly, “are you datasmart” is the question that drives our entire practice, because we think it represents the intersection of data security, law, and technology. We want every one of our clients to be datasmart, because if you aren’t examining all of those issues and how they interact, you’re going to fall behind.
So what exactly does it mean to be datasmart? Read More
E6: The Long Arm of the Law. Data Regulators
FTC, FCC, SEC, NYDFS, AGs… you name it, the acronym exists! There are countless regulators that are weighing in on Data Privacy. As #GDPR approaches and stories about data misuse or breach mount up, you need to know the regulatory players.
In this episode of “Are You DataSmart?” the Ward brothers discuss how each government, department, and even State regulator will likely be involved in data privacy and data security. Read More
Loose or Tight Fit? Data Partnership Strategies in Voice Solutions
If you don’t read The Information, you probably should start.
Their recent report on Apple’s Siri and the struggle to help Siri’s experience improve is a fascinating dive into the pros and cons of an open ecosystem approach. For many companies like Apple, Amazon, Samsung, and Google, the desire to improve user experiences has to be measured against the impending chaos that can consume a project when “too open”. Read More
GDPR Countdown – 11 Weeks to Go
A client recently asked me what I think are the biggest risks for companies regarding the GDPR. I had to think, because the question requires a straight answer, and lawyer answers are rarely direct. The first answer is probably “it’s pretty risky not to know that the GDPR exists.” Brussels is not going to accept the “oh wait what is this?” defense. But even for a company that understands GDPR basics (data security by design, robust consent, transparency), the biggest concern I have is about data transfers – transfers from one company to another, and transfers from one country to another. Read More
E4: The Case for Data Security & IAPP Certification
In episode 4 of the “Are You DataSmart?” podcast, the Ward brothers discuss the balance between technology, policy, and execution of data security. The first two should assist with the third, execution, but that doesn’t always work out…
GDPR, ePrivacy Regulation, and the general topics of data protection require that you and your company take a proactive approach to data security and working with certified IAPP members may be a great way to get started. Read More
E5: An Introduction to Data Partnership Strategy
In the upcoming book, Data Partnership Strategy, the Ward brothers tackle the best way to create a comprehensive data strategy that positions companies for success with their data assets.
In episode 5 of “Are You DataSmart?” the Wards break down the initial starting points for every business when building their data partnership strategy. The ability to identify available data to any business across internal and external data sources is the first critical step in the DataSmart Method. Read More
Blockchain, Bitcoin and Some Serious Struggles Ahead with GDPR
It’s 2018, so we can’t go ten minutes without hearing the words “blockchain,” “Bitcoin,” or “Tide pods.” I only want to talk about the first two because, honestly, enough with the Tide pods, people. (Please end this meme, Internet).
If you’ve asked what Bitcoin is, someone has likely explained it to you by saying something along the lines of: “Bitcoin is a cryptocurrency based on blockchain transactions recorded in a distributed ledger and is, therefore, virtually unhackable.” That explanation brings on two follow up questions: Read More
E3: Are You DataSmart? Cookies, ePrivacy Regulation, and What’s Next
Cookies are amazing. Whether chocolate chip or the 1×1 pixel type dropped on your browser session. But GDPR and more specifically, the ePrivacy Regulation, have a lot to say about how cookies will be managed and used going forward.
And what about the business benefits? The ROI on re-targeting (that creepy advertisement following you all over the internet) has been shown to be really compelling. So how do businesses not run afoul of cookie usage! Read More
E2: Are You DataSmart? tackles the DPO, FTC, and several other TLAs
In our second part of an introduction to the legality surrounding data privacy, the “Are You DataSmart” podcast discusses the need for DPOs (or not) and how the FTC is likely to respond to some of the significant changes brought on globally by the GDPR.
Data Minimization is a concept alien to many organizations. The business theory around “keep all data!” has been very popular in the last few years and the Ward brothers introduce the natural tension between keeping data and staying compliant. Read More
GDPR Countdown – 12 Weeks to Go
With only twelve weeks to go until May 25, we’re getting down to the wire. Some companies are looking forward to that date with dread, and others are merely hoping it passes without causing too much mayhem. We’re spent a good amount of time talking about what to consider and what to do to prepare, but we shouldn’t ignore a more basic question: who needs to prepare? Read More