Hawk: Startups do not need expensive consultants for GDPR compliance
Lisa Hawk · a16z Podcast | What to Know about GDPR · Jan 2, 2019 · at 29:48
Lisa Hawk, VP of Security and Compliance at Everlaw, advises startups on practical, cost-effective approaches to GDPR compliance.
0:00 / 0:15exact quote · 15.7s
▶ Watch the full episode on YouTube → 720p mp4 · rendered on demand · StarZero watermark
“Startups can do it themselves. I think they have a lot of smart people. There are tools out there that you can use. Eventually you will need a lawyer to draft some contracts, but I do think there are practical things you can do without engaging a really expensive consultant.”
quote is from the automated transcript, cleaned for reading: filler sounds and stutters are removed, nothing is rephrased. names can be misheard (the analysis reads context, assessments check outside sources). how →
More from Lisa Hawk
Hawk: GDPR applies to any global company processing EU personal data
“Well, in legal terms, there's a thing called long-arm jurisdiction, and this is probably one of the longest of the long-arm jurisdictions, and what I mean by that is a situation where a local court can actually assert jurisdiction over someone in another state…”
Hawk: Over 80% of US population re-identifiable with three data points
“I think there's a stat out there that says that over 80 or 85% of the U.S. Population can be identified with three pieces of data.”
Hawk: A culture of silence led to a deferred prosecution agreement
“I've been on the receiving end of a deferred prosecution agreement, largely relating to a cultural issue around not reporting things and sort of being scared to report things, and I can absolutely say You know, without reservation, that that is not where you w…”
Hawk: EU regulators are prioritizing transparency above all GDPR principles
“And with the data protection principles under GDPR, the one that I've heard the regulators focusing on the most is transparency. So they are putting a huge amount of work in the making sure individual citizens in Europe understand that they have the right to k…”
Hawk: Fully anonymized data is exempt from GDPR regulations
“There is one escape route from GDPR, which is the provision in the regulation, which is also the same as the 95 directive, which says that data that are fully anonymized, meaning that no individuals can be identified are outside, outside the scope of GDPR. So …”
Hawk: GDPR fines are a last resort after investigations and corrective actions
“Well, I have to say, I do recommend that folks take a look at it, because working backwards from there, they actually tell you what they care about when they're going to potentially assess a fine, which is, you know, is there negligence? Was it intentional? So…”