Hawk: Startups should appoint detail-oriented risk sentinels to lead GDPR compliance
Lisa Hawk · a16z Podcast | What to Know about GDPR · Jan 2, 2019 · at 33:08
Lisa Hawk, VP of Security and Compliance at Everlaw, discusses how early-stage technology companies should assign ownership for GDPR initiatives when they lack dedicated compliance personnel.
0:00 / 1:18
▶ Watch the full episode on YouTube → 720p mp4 · rendered on demand · StarZero watermark
“If you're at a smaller company and you need somebody to lead your GDPR compliance project, then, and you don't have a, you know, person in charge of compliance, then my advice is to look for what I think of as your risk sentinel. ... You want the people who can triage issues, who can spot issues, who can think ahead to what the challenges might be and how you will solve them. I don't think it necessarily matters what function, but look for the people who have that detail-oriented nature and the ones that are just always thinking ahead.”
quote is from the automated transcript, cleaned for reading: filler sounds and stutters are removed, nothing is rephrased. names can be misheard (the analysis reads context, assessments check outside sources). how →
More from Lisa Hawk
Hawk: GDPR applies to any global company processing EU personal data
“Well, in legal terms, there's a thing called long-arm jurisdiction, and this is probably one of the longest of the long-arm jurisdictions, and what I mean by that is a situation where a local court can actually assert jurisdiction over someone in another state…”
Hawk: Over 80% of US population re-identifiable with three data points
“I think there's a stat out there that says that over 80 or 85% of the U.S. Population can be identified with three pieces of data.”
Hawk: A culture of silence led to a deferred prosecution agreement
“I've been on the receiving end of a deferred prosecution agreement, largely relating to a cultural issue around not reporting things and sort of being scared to report things, and I can absolutely say You know, without reservation, that that is not where you w…”
Hawk: Startups do not need expensive consultants for GDPR compliance
“Startups can do it themselves. I think they have a lot of smart people. There are tools out there that you can use. Eventually you will need a lawyer to draft some contracts, but I do think there are practical things you can do without engaging a really expens…”
Hawk: EU regulators are prioritizing transparency above all GDPR principles
“And with the data protection principles under GDPR, the one that I've heard the regulators focusing on the most is transparency. So they are putting a huge amount of work in the making sure individual citizens in Europe understand that they have the right to k…”
Hawk: Fully anonymized data is exempt from GDPR regulations
“There is one escape route from GDPR, which is the provision in the regulation, which is also the same as the 95 directive, which says that data that are fully anonymized, meaning that no individuals can be identified are outside, outside the scope of GDPR. So …”