On the first episode of 10 Questions to Cyber Resilience, Assurance IT invited Chief Privacy Officer, Heather Federman, from BigID, to chat about the responsibilities and scope of a data privacy role.

In this episode, Heather Federman from BigID and co-founder of Assurance IT, Luigi Tiano, discuss: 

1. The evolution of Heather’s data privacy career 
2. How Heather’s passion for data privacy started in law school 
3. How the CPO fits in with the rest of the IT team 
4. How a CPO interacts with other departments  
5. How not to get overwhelmed with the different data privacy laws 
6. The possibility of a GDPR for the US 
7. Examples of employee protection under different state laws 
8. How BigID plays a part in data privacy 
9. The current demand for experts in data privacy 
10. Privacy laws in Canada 

Resources: 

Heather Federman’s LinkedIn: https://www.linkedin.com/in/heatherfederman/

BigID website: https://bigid.com/

Luigi Tiano’s LinkedIn: https://www.linkedin.com/in/luigitiano/

Assurance IT Website: http://www.assuranceit.ca/

About Heather Federman: 

Heather leads the privacy strategy and program at BigID - focused on internal compliance and data risk, product development, go to market strategy, business development and privacy evangelism.  

About 10 Questions to Cyber Resilience: 

Twice per month, learn about how IT leaders are strengthening their cyber security practices. Every episode comprises of 10 questions that get you one step closer to cyber resilience. Subscribe to stay up-to-date with hot topics in cyber security. 

About Assurance IT: 

Assurance IT (www.assuranceit.ca) specializes in data protection and data privacy for the mid-market in Canada, since 2011. The Montreal-based company’s unique approach to helping customers become cyber resilient is called the PPR Methodology which stands for Prepare, Protect and Recover. Based on industry best practices, the PPR Methodology is an easier way to achieve cyber security and compliance objectives.

I wanna start by asking you, introducing

So who is Heather?

And tell us a little bit about your role and

Sure.

And thank you for having me here as well.

So my name is Heather Federman.

I'm the Chief Privacy Officer here at BigID.

And I essentially function as our leader internal data

In addition though, as we are a company that

I work very closely with our product team on

I work with the marketing, sales folks on business

Wow.

Okay.

Interesting.

It's an interesting title.

I, I really like the Chief Privacy Officer.

Can you talk to us about some of the, you know, your highlights

because I've, I've looked through your, through your

So maybe some of the big accomplishments or highlights

Yeah.

I mean, I I'd say I kind of have different ones at

I started as a legal and policy fellow at the

And I think for me, that for highlight was really, um, getting

And at the time it was around

mobile app transparency.

It was with the NTIA, which is a subunit of the department

And I I've just never seen so many adults argue over like one

So it was this huge lesson in how to work with people.

And the fact that we even did something to me

And for me, I was part of leading that for our organization,

So it was a really huge kind of trial by fire experience.

I mean, I was at American express then, I was on the global privacy

And so it's just to me, it's just kind of cool to see how, like,

And then after that I spent, a good amount of years at Macy's

And I know this might be like a, a silly example.

One of the big things I was tasked with was actually

And, um, it, it was a huge thing because for that, you have to

we are okay with what's in your privacy statement, cause it's

Right.

And while I think like 0.01% of people might

Well, some of the people that read them are plaintiffs,

So you really need to make sure that everything in them is okay.

So getting all of that consensus and then even just

We need to let you know about it.

Again, it was just this huge exercise in consensus

And then also just another highlight from that career,

type program because Macy's is a massive company and we were

So basically embedding privacy experts within the business.

So, and, and not expecting them to necessarily be experts

Let me notify the privacy office about this.

So to me, that was also a huge success.

Here at BigID anytime we launch some sort of privacy

I just, I feel a sense of pride with it.

I work very, very closely with the product team.

I know how much blood, sweat, and tears that they

They genuinely care about making this right for our customers,

So I'm, I'm usually in beta mode and testing these things out.

So anytime it's out there that we're hearing positive

That's amazing.

Yeah.

You, you mentioned something really interesting, Heather,

A couple of questions stem from that.

So to be a CPO Chief Privacy Officer, I mean, do you absolutely

Um, I, I

don't think so.

Uh, a lot of folks in privacy do have a legal background, but

It helps to understand the law, but again, it also really

I mean, I could easily see in the next five, 10 years folks

I, I think it depends upon the needs of the organization and,

And.

I mean to me, I also, I I've never actually worked as, even

... Luigi Tiano: interesting.

Okay.

Which is funny to me, but because of that, also,

Because I, I mean the law tells us one thing and, and I'm not

hahaha

but at the same time, I mean, you have to do what

Right.

Okay.

And, and you mentioned something.

I was actually gonna, my second question was having some kind of

So it sounds as if you, you, you definitely do have

Uh, both.

I mean, correct me if I'm wrong here, both from like a

Yeah.

You know, is that, so you, you actually have to have

I guess.

You do.

I, I mean, you have to kind of understand what is actually

And, and sometimes when, when, like when you can get really

And then things that you thought weren't that bad.

You really need to know what's going on.

Yeah, I see that happening a lot.

Okay.

All right.

We, we sometimes take things for granted.

Basically in, in, in, in the business, right.

Where easy stuff should be easy and it ends up being very

Yeah.

So you, you talked a little bit about your, your,

Maybe this is an easy question, maybe difficult, but when did

Like what was the moment where you said, wow, I really liked this.

That's actually easy for me.

Um, so in, in America, the way it works with law school is

And my first year, you know, I, I am a student of life, so I love

And I was arguing on the privacy side versus for

And I just found that I, I got really, really passionate as I, I

So we're comparing a cell phone to a laptop, to a briefcase,

I'm like, this is insane.

Like the iPhone had just come out and like, all your data

So I kind of just, and then, so, because I cared so much, I

And then there was a oral argument you had to do.

And again, I cared so much that I just, like, I put my

Amazing.

And I kind of just decided then and there

If I'm gonna be doing this legal thing, then I'm gonna focus on

That, that that's good story.

Yeah.

And actually the best part is I think it was like

I saw that the Supreme court unanimously affirmed the court case

So it was like a life altering moment.

It was pretty great.

That's amazing.

Congratulations.

That's.

Good for you.

Good for you.

So I can, I can tell the passion and when you speak about data,

That's great.

A lot of professionals have a tough time finding that

Mm-hmm . Um, my next question is more around the actual

You know, I, I talked to a lot of, a lot of different companies

So.

Can you maybe elaborate on what the Chief Privacy Officer

Like how close is your relationship with the CISO, the CIO, the CFO,

Um, so I mean, to me, CPO, the Chief Privacy

communications, and training when it comes to data handling

Um, and, and this role has been around for some time,

mm-hmm

and in states and whatnot, it it's, there's been

And to me, I kind of break it down in terms of, you know,

And we can get more into the weeds on that one if you want.

Um, but in terms of who we interact with in the business, I mean, we

and making sure that, you know, no, there's no leakages with the

Where are we getting this from?

Are we commingling this with other sources from other pipes?

And how long are we keeping it for?

And so we're the ones that are asking more of, of, of those sort

But you, I think you mentioned the CIO

right

so we might be interacting with IT to understand

also can sit in various parts of an organization depending on

That's what I've seen.

Yeah.

Yeah.

It's, it's all over the place.

So I, I have yet to see like one specific model for that.

Uh, but we basically interact with everybody to an extent.

Um, I, I, I mean, there's an concept under, uh, GDPR called

Right

so that basically requires you having to get in

So it, it's actually a very strong relationship sort of building

these various things that they're doing with data and have it be

So, as you're saying that.

So I see that obviously you're interacting with a

Mm-hmm

which is, which is obviously, I mean, it's

flows or data interacts with a lot of different organizations

Now do you sometimes see some reluctance or does it

Like everyone's kind of sensitive to what and how

Right?

You had, you said mentioned people, process technology.

Processing people, sometimes don't always work together.

So I'm just curious as to, do you see any contention

Yeah.

I mean, it definitely happens.

There are definitely arguments that come in.

Everyone has competing priorities.

Things need to have deadlines, need to be passed, have

You might be stalling business things.

Oh yeah.

I've heard it all.

I've heard

it all.

Yeah.

I figured it was a natural question.

It was an obvious question, but I just wanted to make sure that, you

And, and what I've seen is if it's something that comes

topic, right.

It just gets precedence.

It just gets.

You know what I mean?

I think, yeah.

Yeah.

So I I've just wanted to confirm that my, my, my

No, you're, I think you're right.

I mean, I think just kind of to that point, though, in terms of

them understand why, you know, you might need to do something

this might be an annoying thing, but the law says that we have

I mean, if your mom was gonna do this and walk into this situation,

Right.

So really kind of trying to get them to

viewpoints, because part of the role of privacy is to just

What if hypothetical scenarios

mm-hmm

it can be a bit of a job that requires some

Um, but that, but that's part of our role because most

I want the business to go out and, and, you know, make a

And so I'm not there to necessarily stop it, but I am there to make

So, you know, we don't get fined.

We don't end up with some terrible PR story or anything like that,

Yeah.

And you know what, that, that's a great way to approach it.

I mean, it's not about, and I didn't wanna make it sound

And maybe that maybe I didn't, you know, I didn't, I didn't mention

It's not about contention, but it's more about like having

And I think, like you said, I mean, if you, if you break it down to a

doing this or, or, you know, how they would be impacted by it then

Yeah.

So, and I appreciate that, Heather.

So I wanna, I just switch gears here.

I want, I wanna keep the time on track.

So I wanna talk a little bit about data privacy laws, cuz

Given that the US does not have a singular data, privacy law, how

There's CCPA, HIPAA, FCRA and, and a whole bunch.

Right.

How, how does an organization keep up?

I mean, and you feel like you're

Um, but I think you'd feel that no matter what, I think it first

So, you know, I'm not in the business of dealing with kids

Right.

If I'm not dealing with health data, I'm

So it, I think it's first kind of figuring out where you can, you

Got it.

You know, what, what are the things you need to

regulated industry like finance or healthcare, like GLBA and HIPAA

So it's first kind of coming to terms with that.

I mean, paying attention to a lot of the state activity level,

sometimes what are the AGS are doing, enforcement actions, the

A lot of these comprehensive laws came out.

I mean, everyone was seeing what the FTC was doing because it was

So it it's just really kind of having to figure out what's

And, and again, like focusing on what are the key

And then also, I mean, just being in a, let's say a consumer

Versus

I was gonna ask that.

Yeah.

Yeah.

So, I mean, at, at BigID, this is B2B.

So the concerns that I'm dealing with here are very different

So there's still things I have to contend with.

It's just very different than what those roles required.

Interesting.

Interesting point there where you mentioned B2B and B2C, cuz there's

However, indirectly though, and we'll talk about how big ID helps

So you have to still understand what the impact is gonna

To the end end user, I guess.

Yeah.

I mean, you always have to be concerned about that.

I guess I think about it more in to the extent that like, if we

other new privacy laws coming out, the amount of DSAR requests

right.

Is very different then you're, if you're

Yes, I totally agree.

So, however,

to your point, as a processor or vendor in this space, I

Right.

And at the end of the day, a lot of actually

And that that would be a terrible thing for any company to go

So yes, you are totally right.

Okay.

Oh yeah.

I just, I see it from different different aspects.

So I wanna make sure that I'm not, I'm not forgetting anything.

The big question.

Uh, so right now there's a handful of states you mentioned

Do you see this continuing or will, will there be like a

I mean, is that, is that gonna happen or what do you see?

Um, so

I am deeply cynical that we're legislation, at least in the next.

If it happens maybe by the end of the 2020s decade.

Like, but I'm, I'm a little in the minority on that camp.

So just full disclosure on that one.

Okay.

Uh, I just, I don't have a whole lot of faith

Um, I think the other thing though, is that GDPR and Europe

I mean, they also come from a place where they had the privacy

And the idea with GDPR is that it was a regulation so now

They're all following the same law, albeit different

And it's enforcement with much more teeth, thanks to

Right.

And each member state has their own DPA.

Whereas here in the states, even though you're seeing these

And the AG has a ton of other competing priorities

So, I mean, we'll be lucky with each state.

I mean, and granted, they might come out and say like, oh,

And I believe that they genuinely do, but they

They have a limited budget.

So it'll be lucky if maybe we see like three to five

Okay.

Okay.

Interesting.

Okay.

Well, I, I appreciate your take on it.

Like I said, I don't think there's real.

There's no right answer to this, but it's just a matter of, you

And sorry, the, the, just one more thing.

The exception to that one though, is California because California,

Um, so I think everyone's kind of, and that goes into

So everyone's kind, kind of waiting and seeing how new

So I, I can't do that.

I, I think if I come back maybe in like three years from now,

Well, I'll take you up on that in three years

So just so for clarity, for some of the audience that may not

So when you have a state that has a privacy law, does it

mm-hmm

does it, is it, does it pertain to the enterprise

I think the enterprise, but I think usually

Um, and, and as of right now, I think it's kind of hard to

only going to offer this, these privacy rights for Californians and

right.

Or something like that.

I think the exception there though, is that the only state privacy

So many organizations, as of right now are considering just

So let me, let me give you a, a concrete example or

Mm-hmm

so if I'm a citizen of New York state and I do,

in California as a citizen of New York state am I protected

If, if something happens

I mean, technically a strict,

I, I would say maybe not because you're in New York.

Okay.

But I would like to think that many companies

An umbrella approach.

Yeah.

The umbrella approach and

Okay.

It's good to know.

It's it's cause it's a practical, it's a practical example.

Right?

And a lot of customers, we have the same, we have similar things

Mm-hmm

and we're seeing that, you know, the individuals

what happens if you're an individual from another of

So practical scenario.

So Heather, I got one last question or my second last question,

How does BigID or how does your team help companies keep up

We're a partner here at Assurance IT of BigID.

We love the solutions.

We think you guys are awesome.

But talk to us about the solutions you offer customers

Sure.

Um, so one of the things I, I actually love about BigID is

about knowing what data that you have that I can't really

I can't protect my data if I don't know what I'm dealing with.

And BigID takes that theoretical concept and makes it a

We are actually able to know what data you have.

Our coverage is unmatched, structured, unstructured data,

And on top of that sit various applications and features that are,

So specifically with privacy, you can take that data

You can use that to help fulfill a data, subject rights request

And whether it's on the back end.

You need to get this data together, or if you want a front

Um, we have a, a data driven record of processing activity,

so it updates in real time.

If things are materially changing, we also have a, a PIA app.

The ability to customize various PIAs.

Because when I was working with the product team, for me, I

gonna be very different than one of our customers in financial

So that's just a smattering of some of the applications that we have.

And also the great thing is, you know, we started on the

However, we also saw that there are a lot of smaller, medium sized

So we have a whole smattering of offerings called small,

that you're using as well as doing the, the assessments and

So there's just, it's an extensive platform.

And I feel like I've only touched upon like one 10th of it, but

love the range of everything that we're doing and really that

So it's not like you're just getting one solution.

You're getting this whole suite of offerings that you can do

Interesting.

Yeah, I know.

I like that.

And, and you touched upon some of that's really important for

you know, the big ticket item and BigID really is, you know,

It really is designed for, for larger enterprises.

But the fact that you guys have introduced small ID helps some

And, and you can correct me if I'm wrong here, but

yep.

You know, small ID does offer a large enterprise

And that's one of the reasons why we, we like the fact that we can,

don't, you know, they can't afford, or they can't, they can't permit

Don't get me wrong.

It's just that they can't attain it.

Uh, so yeah, so the small ID solution, you know, paired up.

What the BigID offering is, is to, to me and, and my team, we,

And the number of data sources, I think, is something that,

Oh boy.

In the hundreds.

I, I don't, I don't, I can't even keep down.

Yeah.

I know.

I know there's a lot, right.

There's there's a ton it's structured and unstructured,

Yeah.

Interesting.

And, and to your point that you were saying about

something that I've heard from some other

there, um, in, in which you know that are looking for sort

And I, I think that's where small ID can really come in and, and

Because I mean, if you're, if you're a smaller company,

mm-hmm

of our enterprise platform.

Not yet.

Anyway, not

yet anyway.

Right.

Not yet.

So for, for both of us,

well, that's it.

Exactly.

And then that's what we like.

So we like to start our customers small and get them kind of used it.

I do have another question and I apologize, I'll be there

How does a market look are, are we, are we okay with, when

Cause I'm, I'm, I'm having trouble with that.

You know, I'm having trouble finding those individuals

So what's your take on that?

Yeah.

I mean, there's definitely a huge demand for, for

The supply side needs to catch up.

I think I saw some statistic, um, for IPP, the International

Wow.

Which me sounds like a lot, but I mean,

So I, I think this, I think we'll see the industry change

And, and a huge part is because of all these regulations

of course,

and that some of them actually require that

So like for the, the regulation actually says that.

So it's definitely changing the nature of the game.

Yeah.

Well, that's, that's interesting cuz here in Quebec, uh, every

So that's posing some big challenges right now.

So we're trying to see how we're, you know, how the

So there's a huge awareness factor that comes into play.

And then of course, a technical skillset, which we'll have

So interesting times up to come, that's for sure.

Heather, I've asked all the questions I want and I've taken,

Anything for me, anything that you may have wanted to mention

Um, is there anything, I guess from

Um, I, I know that there was supposed to be a federal law

Um, but that I've heard rumors that it's likely gonna come back.

and when I, at least the older version of it, I mean,

Would've been considered one of the strictest data protection

So I'll be very curious to see if there's any traction on

So the federal law, I can comment on that cause I've,

So Bill C11 was the one that was tabled at the federal level.

And I don't think it well, it hasn't made, obviously it hasn't

Here in Quebec.

They've, they've positioned or a revamp of law 25, which is

Um, and that has, has been put on the table and that's

And it is very GDPR S.

And it does have tremendous penalties associated with it.

So will the Canadian federal, you know, uh, law adapt some

Who knows, remains to be seen.

But, uh, yeah, I, I agree with you a hundred percent.

I think it's gonna come and, and it's gonna, and

And, and one of the things I we see is a lot of business in

So they have a notion of what GDPR is and they have a notion of

So that's, that's already putting them ahead of the game.

But from what I gather, there's gonna be some modifications

So they're gonna have to make sure that they're, they're ready for it.

So interesting times ahead for sure.

And, um, I mean, that's one of the things we do here.

We, we take data privacy and data protection very, very

It, it's not only a technical solution, but now it's

So I think we're on the right path here.

And, and again, I appreciate you taking the time, Heather,

More, more than happy to have that, that conversation.

Yeah.

Happy to thank you for having me Luigi.

It's a pleasure, Heather.

So with that, I'm gonna say thank you.