Send us Fan Mail

Patrick Zeller, General Counsel, Jetstream Security

In this episode of The Data Diva Talks Privacy, Debbie Reynolds, The Data Diva, speaks with Patrick Zeller, General Counsel of Jetstream Security, about artificial intelligence, cybersecurity, privacy, and the evolving risks organizations face as AI becomes embedded throughout their operations. Patrick shares his unique career journey from the Illinois Attorney General's Office into technology law, cybersecurity, and emerging technologies, explaining how his early interest in computers shaped a career that bridges both legal and technical disciplines.

The conversation explores how organizations are adopting AI at an unprecedented pace and why many leaders are struggling to understand the risks associated with these technologies. Patrick explains that AI entered many organizations through productivity tools and enterprise platforms before legal, privacy, and security teams had an opportunity to evaluate its implications. As a result, many companies are now working to gain visibility into how AI is being used, what information is being shared, and where risks may exist.

Debbie and Patrick discuss AI risk through three primary categories: input risks, output risks, and related organizational risks. They examine how employees may inadvertently expose sensitive information by entering confidential, financial, employee, legal, or proprietary information into AI systems. The discussion highlights real-world examples involving compensation information, trade secrets, attorney-client privileged communications, and sensitive corporate data that may be exposed through unauthorized use of AI tools.

The episode explores the growing challenge of shadow AI, where employees use public AI tools outside approved enterprise environments. Patrick explains that organizations must understand which AI tools are being used, who is using them, and which systems and data those tools can access. The conversation also covers SEC reporting obligations, cross-border data transfer concerns, unauthorized access incidents, insider threat risks, and the growing need for organizations to monitor AI interactions with sensitive business information.

Patrick and Debbie discuss how organizations must rethink traditional security models because AI is no longer operating outside the corporate perimeter. Instead, AI increasingly functions as an insider with potential access to valuable data and systems. The conversation explores how organizations can improve visibility, governance, and oversight while balancing innovation and business objectives.

The discussion concludes with a broader examination of how society is approaching AI adoption. Patrick introduces the concept of a "Galbraithian inversion," in which organizations adopt powerful technologies before fully understanding how they work. Debbie and Patrick discuss why this creates both opportunities and challenges as companies race to deploy AI while simultaneously trying to understand its legal, security, privacy, and governance implications.

By popular demand, Debbie Reynolds Consulting is now offering executive briefings on emerging data privacy risks and how companies can avoid them. To learn more, visit the Executive briefings page on my website.

Support the show

Become an insider, join Data Diva Confidential for data strategy and data privacy insights delivered to your inbox.

💡 Receive expert briefings, practical guidance, and exclusive resources designed for leaders shaping the future of data and AI.

👉 Join here: http://bit.ly/3Jb8S5p

Debbie Reynolds Consulting, LLC

Send us Fan Mail

Michael Booden, Senior Technology Counsel

In this episode of The Data Diva Talks Privacy, Debbie Reynolds, The Data Diva speaks with Michael Booden, Senior Technology Counsel, about the evolving relationship between contracts, privacy, cybersecurity, and artificial intelligence. Michael shares his professional journey from litigation and appellate court clerkships to becoming an in-house technology attorney and adjunct law professor teaching contract drafting and negotiation. He explains how his litigation background shaped his approach to drafting agreements, emphasizing the importance of clarity, precision, and anticipating how contractual language will be interpreted when disputes arise.

The conversation explores how privacy and security requirements increasingly appear in technology agreements and why organizations can no longer rely solely on vendor representations regarding data protection. Michael discusses how he developed cybersecurity addenda to establish objective standards and expectations for vendors, including security controls, indemnification provisions, and requirements aligned with recognized frameworks such as NIST and ISO standards. He explains how these contractual protections help organizations proactively manage risk rather than simply reacting to incidents after they occur.

Debbie and Michael examine the growing role of AI in organizations and the challenges associated with managing data privacy and security risks when using AI tools. Michael discusses the development of AI-specific contractual provisions designed to address issues such as data handling, retention, outputs, transparency, and vendor accountability. The discussion highlights how organizations are increasingly being asked by customers, regulators, and business partners to explain how AI is being used and what safeguards are in place to protect sensitive information. Michael shares how his organization developed client-facing AI disclosures to provide greater transparency and build trust around AI usage.

The episode also explores the importance of selecting enterprise-grade AI solutions rather than public consumer tools, particularly when organizations are handling confidential, proprietary, or personal information. Michael explains how privately licensed AI environments can provide stronger protections against data leakage and unauthorized use, while also enabling organizations to take advantage of AI's productivity benefits. Debbie and Michael discuss how AI is transforming work by helping employees automate lower-value tasks, improve efficiency, and access information more effectively, while emphasizing that organizations must establish clear policies, governance frameworks, and contractual protections to ensure AI is used responsibly.

The conversation highlights a broader trend occurring across industries: organizations are increasingly pushing privacy, security, and compliance requirements down through their vendor ecosystems. As privacy regulations continue to expand globally, companies are using contracts to establish expectations for third parties and create more consistent protections for personal data, confidential information, and AI-enabled workflows. Michael emphasizes that strong contracts remain one of the most effective tools organizations have for managing technology risk in a rapidly evolving environment.

By popular demand, Debbie Reynolds Consulting is now offering executive briefings on emerging data privacy risks and how companies can avoid them. To learn more, visit the Executive briefings page on my website.

Support the show

Become an insider, join Data Diva Confidential for data strategy and data privacy insights delivered to your inbox.

💡 Receive expert briefings, practical guidance, and exclusive resources designed for leaders shaping the future of data and AI.

👉 Join here: http://bit.ly/3Jb8S5p

Debbie Reynolds Consulting, LLC

Send us Fan Mail

Marcus Wells, vCSO, Wells Secure IT (Identity Security)

In this episode of The Data Diva Talks Privacy, Debbie Reynolds, "The Data Diva" speaks with Marcus Wells, vCSO at Wells Secure IT, about identity security, digital transformation, artificial intelligence, and why identity has become one of the most important foundations of modern technology environments. Marcus shares his career journey through cybersecurity and explains how he gradually realized that identity was at the center of nearly every security challenge he encountered. He discusses how identity extends far beyond traditional access management and why understanding identity requires a broader view of people, devices, systems, applications, and data.

The conversation explores how organizations increasingly rely on digital identities to support business operations, cloud services, connected devices, and emerging technologies. Marcus explains his framework for understanding identity, including the ability to access, store, and connect to data and networks. Debbie and Marcus discuss how identity applies not only to people but also to devices, applications, and non-human entities that participate in modern digital ecosystems. The discussion highlights the growing importance of context when making decisions about access, permissions, and trust.

They examine how artificial intelligence is creating new identity challenges, particularly as organizations begin deploying AI agents capable of performing tasks, accessing systems, and interacting with data. Debbie shares examples involving AI agents granted broad access to systems, including incidents in which agents reportedly deleted databases or were granted extensive permissions without appropriate controls. Marcus discusses the risks associated with treating AI agents like traditional software or human users and explains why organizations must carefully consider how identities are provisioned, managed, and monitored in AI-enabled environments.

The episode also explores the concept of trust in technology and why AI systems introduce new categories of uncertainty. Marcus argues that traditional software is generally predictable and produces repeatable outcomes, whereas large language models and AI systems often generate probabilistic results that cannot be guaranteed. This creates unique governance, security, and risk management challenges that organizations must address as they accelerate digital transformation initiatives. The conversation highlights why identity, context, trust, and governance will become increasingly important as AI systems gain greater access to organizational data and decision-making processes.

By popular demand, Debbie Reynolds Consulting is now offering executive briefings on emerging data privacy risks and how companies can avoid them. To learn more, visit the Executive briefings page on my website.

Support the show

Become an insider, join Data Diva Confidential for data strategy and data privacy insights delivered to your inbox.

💡 Receive expert briefings, practical guidance, and exclusive resources designed for leaders shaping the future of data and AI.

👉 Join here: http://bit.ly/3Jb8S5p

Debbie Reynolds Consulting, LLC