Subscribe
Share
Share
Embed
Most companies trust their website. They shouldn't. The leaders who know better are rebuilding what it means to govern a website, and every week we sit down with privacy executives, compliance teams, and digital risk pros at the world's largest enterprises.
We dive into stories with the ones who caught a broken consent tool before the regulator did, traced a six-figure loss back to a failed tracking pixel, and rebuilt their entire data governance approach from scratch. The rules of digital trust are being rewritten right now. This show is where you hear it first.
Brought to you by ObservePoint, the web governance platform that helps the world's largest enterprises see exactly what their websites are doing, and prove it.
The Web Privacy Podcast - Will Clayton
===
Ethan Prete: [00:00:00] Good morning, good afternoon, and good evening, privacy professionals alike, and welcome to the Web Privacy Podcast, where I fulfill my dream of simplifying the web privacy space by bringing together privacy professionals from all over the world to share cutting-edge ideas. I'm your host, Ethan Prete, and today we're joined by Will Clayton, privacy director at Marriott Vacations Worldwide.
Will, as a marketer myself, I usually spend my time trying to figure out how to talk to people, whereas privacy leaders like yourself spend a lot of time figuring out how to make sure I don't overstep in doing that. I know that you sit well at the intersection of hospitality, guest trust massive regulatory complexity, and let me just start by saying welcome to the show.
But I'd also like to follow up with, would you mind taking a second, Will, and tell us a little bit about who you are, where you're calling from, and how you got into privacy?
Will Clayton: Yeah. So again, Will Clayton. I am privacy director at Marriott Vacations Worldwide, MVW and have been ~involved i-~ my whole career in the ad tech space and privacy naturally comes out of that. So very long background there. You [00:01:00] talked about being a marketer and having to worry about privacy and I think that's where we're seeing it all go, ~which is,~ which has been my career, again is seeing what are ~the,~ the privacy and ethical implications that, that come out of trying to, be an effective marketer for our stakeholders
Ethan Prete: Love that. And I know you're on the move right now, Will, but you're calling from which part of the country?
Will Clayton: What time is it now? ~I'm in~ I'm in Western Illinois right now but relocating to Orlando to MVW headquarters there. And you and I were chatting before we started here. I'm Florida boy and excited to ~get to~ get back down to warm country
Ethan Prete: On behalf of the podcast, we wish you guys a great move, and hopefully there's not a lot of broken furniture along that journey
Will Clayton: Thank you
Ethan Prete: Let me ask you a follow-up, Will, ~in ter-~ in terms of your background because your background is rather impressive. What-- do you feel like, again, as you started more in that ad tech space and now you're specifically on the privacy side, do you feel like there was an aha moment for you sometime in the last few years that ~ma- ~compelled you to make that change?
Or ~h- ~how did you make that jump from where you started to where you are now?
Will Clayton: Yeah, and~ it-~ it's interesting that you'll hear people [00:02:00] regularly say, "Oh, we're asking for a, a privacy professional with 10 years of experience, and there just is no such thing." And I say, "Yeah, there absolutely is. " So I started in in 2000. I was working for an ad server, and there was ~a~ a standard called the P3P, the Platform for Privacy Preferences, which some of the old-timers may remember.
Most people just won't. ~It~ it came and it went, but it was important. It was a legally binding statement of what we will do with your data. Again, this is 26 years ago. So young Will realized very quickly that this is a big deal. And over the course of my career I've worked for a number of different ad tech providers a few data brokers, ~and ~and now really dealing with consumers.
And it's really important that we keep an eye on that. And the aha moment, I think was maybe 10 years ago to realize this isn't going away. ~It's not a, it's not a side activity ~for the marketer or the ad tech pro. This is core. ~And~ and being the guy who gets why we're doing it, how we're doing it and how to do it legally and ethically is an important job.
And [00:03:00] I really enjoy doing that
Ethan Prete: Yeah, of course. And you're spot on. It is definitely... There are benefits to both, and it feels like you timed that perfectly in terms of your career journey with it now being at the forefront of every major brand across the world.
Will Clayton: Oh, for sure. For sure
Ethan Prete: I was thinking, Will, and we kinda joked beforehand, but I think a lot of people when they think of, vacation ownership, they're thinking things like sandy beaches, resort pools.
I've ironically probably spent a third of my life in Marriott hotels, which is actually where I am right now, at a Marriott hotel. I'd imagine that's not exactly the case when it comes to the privacy landscape. ~W-~ would you mind actually just maybe first telling us a little bit of the difference between the Marriott side and the Marriott Vacation side, and then walk us through what the privacy landscape looks like on your side of the aisle?
Will Clayton: Yeah, sure. So MVW, Marriott Vacations Worldwide, was spun out and I was not there, so I'm not gonna name dates or details, ~but~ but was spun out of Marriott International. They're still a key partner of ours. We still work closely with those. Obviously we share a brand and have to make sure that brand is respected. But Marriott so MVW focuses in [00:04:00] vacation ownership. So this is the resort ownership side of the house. And it's a little bit more of a commitment when you say to someone, "Hey, come spend a night with us, it's a great place," versus, "Hey, come buy into, to this resort or this resort family." And so understanding who is this right for and how do we communicate with them is really important. And again I'm not on the, the marketing side of the house, so I don't wanna speak for my colleagues there either other than to say trying to understand consumers in any industry starts to get... there's a fine line between adaptive and~ y- ~caring versus being invasive or creepy. And so we always have to walk that line and say we want to adapt to you. We want to understand you," but without crossing that line ~in-~ into too invasive or creepy town.
Ethan Prete: Yeah, ~that, we,~ I just actually got off a webinar with IAPP where that was ~a talk,~ topic of conversation of where do you draw that line between the intersection of personalization and the intersection of privacy, and there's definitely creepiness somewhere in that same realm. But where do you draw the line?
[00:05:00] And i-in your case obviously again, ~y-you're now,~ you're not managing the typical because again you're spun out. You're not managing that one-time transaction, but you're actually managing a long-term relationship with guests
Will Clayton: Correct. ~Y-yes~ and they're not guests anymore, they're owners. So these become key stakeholders that we start by saying, "How can we understand you as, as a potential owner?" But once you're an owner then our job is to say, "How do we respect your choices? How do we understand what you're looking for?"
Which may change over time. When you show up with your toddler, that's a very different scenario than when you come to, ideally the same place that you bought into with your teenager, your young adult and your family as you grow and adapt. Understanding not just how to apply consent, over privacy choices but how do I identify preferences and really become an effective marketer?
Because, we joke about creepy, but creepy marketing is bad marketing and nobody wants that. Consumers don't need it, marketers don't need it and we need to have the tools to be able to be effective ~w-without~ getting close to that line.
Ethan Prete: [00:06:00] Sure. And I know you mentioned again, like with the having the kids and moving in because you have that long-term ownership relationship with them. One of the things that I've actually heard quite a bit, and the reason I'm in St. Louis right now is because I've been hosting these web privacy meetups all across the country.
So in the last three months I've been in New York, I've been in Boston twice, I'm in St. Louis today, we'll be in Atlanta next week, and the... One of the most common things we're hearing is which privacy policy do you use as your tier? So in your case I'm thinking, somebody may start their relationship with your group in California, but then they move to Virginia because, they want more space or something, or maybe jobs take them there, or maybe they move from California to Florida or to Europe even, where it's a different law.
How do you guys navigate how do you operationalize that whole process? And when you're moving within different states in the United States, how are you ~det-~ like determining which privacy policy to use?
Will Clayton: ~Y-~ yeah, that's a great question. And I love that you brought up ~o-~ operationalize because it, it really does come down to what are the specific rules for the [00:07:00] privacy regime where you live, and moving can change things dramatically. So for instance, historically a marketer who's trying to be ethical says, "Okay we message people unless they ask us not to."
So that, ~U-~ US traditional, "Here's how we do privacy," we'll send you emails unless you opt out." ~B-~ but what if that person now moves to Europe and you haven't... All you know is this person never opted out. But you have a person who never opted in either. And so ~y-~ you go from a, ~a, a~ switch you're on or you're off, into to now, okay, you had nothing, so in, in the US I can message you, and in Europe I can't.
~And~ and now you, ~y- ~you start to explode your preference, the actual flags or attributes and you just have to. ~Y- ~and it drives some of ~the,~ the architecture folks who are awesome and are working to support the mission, but drives them bonkers to come and say, "Oh, hey, sorry, new law or different understanding.
We're gonna need to add a new field to every person that we know," which is a big deal. But that's how you keep up with, somebody moves and and if we didn't capture it right, then we just have to start over, [00:08:00] which is, that's hard for marketing too. So yeah, it really comes down to seeing it come ahead of time and anticipating that.
Ethan Prete: Yeah and that I imagine, again, talking from experience here on my own side, that is hard to do. I remember early on in my career in marketing rolling my eyes at my compliance team when they would tell me things like capturing consent, and I was like, "Come on is anyone actually doing this?"
Which sounds terrible now. Please, no one judge me for that. But you also mentioned the architects that are doing all this work on the back end to prepare as these laws are rolling down. And again, like you said, people are asking for privacy professionals with 10 years. Like you said, they ~d-~ they do exist, but it's not apples to apples in every single case.
A lot of these laws, again, are only a few years old, and so I'm actually curious when you guys are sitting there with your first 48 hours, and this is almost like a zombie movie or like a contagion or something, but that first 48 hours when a new state privacy law~ comes-- ~goes live, what does your day one triage look like as a privacy team?
Will Clayton: ~Th-that's~ a great question, and I will say day one [00:09:00] means carefully watching that day minus 200 went well. So and I've talked to people who were like this privacy law goes into effect tomorrow. Are we ready?" And of course they're not, and of course they fall on their face. And every time there's been a major privacy development with a few, unpleasant exceptions we generally get a pretty long runway. And this is where understanding that, hey, this is a big deal. And ~I've s- I've~ had not where I'm at now of course but in the-- like when CCPA went online, I had business stakeholders who just said, "Oh, this is not that big a deal.
We'll figure it out. Let's just keep doing business as usual." And you can't because the stakes are too high. And again, I talk about the ethical marketer, and I think very few people set out, to really be the shady sleazy marketer. But it's a very active process to be the ethical marketer who's actively following the laws, who's actively working with industry to find out is it a big deal or not. And to circle back and actually answer your question like I say, on day one, we [00:10:00] had the program all written out. Everything's been in place. It's implemented, and it really comes down to just carefully monitoring. Is it doing everything that, ~that we~ that we thought it would? And are we getting ready for day one of the next state law that's gonna happen in a few months?
Ethan Prete: Love that. And I wanna just call out that I am an ethical marketer, so I know I just self-proclaimed myself as I wasn't early on in my career, but I've grown. So please, everyone, give me some grace here. Will, if you don't mind me asking a follow-up question to that because again, I just... I got off the webinar with IAPP less than two hours ago, and this exact topic got brought up, and the question that kept coming through on the chat was, who do we need to have?
Who are the stakeholders to make this as important as it is internally? So if you don't mind me asking your war room in the preparation for this on day minus three hundred or whatever it is, ~who,~ who's included there? Legal, engineering, others, marketing, I assume
Will Clayton: Yeah, and it's interesting. So at MVW, privacy reports through our global technology office, which is a little bit unusual. But it's reflective of everything I've been saying that not only is this critical, it [00:11:00] is as critical as having a web presence, as having the ability to message our owners and prospects. But by rolling up through the technology organization, it puts privacy in position to understand not just what's coming tech-wise and how to adapt it, but to inject some of these requirements into very early planning stages so that nobody gets surprised when we say, "Hey, ~th-~ this is a major effort." And then to fill in, of course, legal is always~ i- is always~ really critical to have their... I was gonna say buy-in, but it's so much more than that. Legal is a, a key partner at every step of the way. And then the other one that, ~that ~sometimes people will differentiate between information security and privacy, but, You can't have privacy if you don't have information security.
And and most of the laws do actually touch on, if you have ~a~ a breach, you gotta report it, you gotta accompl- all the requirements there. Those are key stakeholders. And then~ y- y-~ you and other ethical marketers, ultimately that's who we're working for is how do we help you to serve customers?
[00:12:00] Are we doing right by our owners and by consumers? And if ~th-~ that is the role of marketing so they're a key stakeholder there as well to, to help them find that balance and continue to to run effective programs without stepping on any landmines.
Ethan Prete: Yeah, I love that. And again I just have seen time and time again just how critical that process is of getting the buy-in across multiple teams. A few years ago we've actually put together using statisticians, analysts, professionals that we had brought in as consultants to put together what we call the Web Governance Maturity Assessment.
And basically, the whole idea of that was how do we bring together these critical parties and say these are the pillars on which we think proper web governance is founded? And it's been cool to see actually. I've actually had people now who have had it taken multiple times. We recommend people take it every single year.
It's about a 50-plus question survey and to see the improvements across teams whether in Europe, the United States, other-- to actually make improvements and bring teams together where everyone is having involvement has been, it's been really cool to see. So l-love that you called that out, Will. Your footprint isn't unique in [00:13:00] that, there are a lot of companies that have been on the podcast and others who are all over the world, but I'm curious to hear your take on this again 'cause your response window might be a little bit different, but when you think about things like like handling data subject requests, like a DSAR workflow, obviously there are different areas that have the different response windows and deletion scopes.
What is your process for that? How, Are you guys just never sleeping or how do you handle all those?
Will Clayton: I'd love to talk a little bit about strategy. I think when we set up this interview, you had asked me, "Is there something really interesting that you've done?" And one of the really interesting challenges as a privacy professional is deciding ~n- not who gets what s-~ not who gets what rights, because the laws determine that.
The law says you have a right to this action, you have a... but asking yourself, "How do we apply this? And and what rights are we willing to extend that aren't required by law?" And so you say if someone in California has a right to delete, to access to~ y- ~extend rights under CCPA, if someone calls from a, a jurisdiction with no privacy statute, are we going to extend those, those same [00:14:00] rights to anybody?
And I think a lot of privacy pros follow this, this same approach, is finding what is the the commonality that we can say, "This is our policy. It satisfies the laws of all the places where we do business or want to do business, and ethically it lets us say, 'Look, we have one thing that, that we do.
It covers all the bases, and it respects you as the data subject.'" So how do we do that is really an, an exercise in finding that commonality, and sometimes you can't. There, there are times when you just say, "Hey this is a, a US data subject and we're gonna market them under the, the laws of the US. This is a European and we'll bifurcate." And but ask those, those operational marketers, ~"H-~ how do you like having two sets of data and having to follow different rules on how you set it and how you message it and how you..." Nobody likes that. So the more you can find a common language that is simply ethical privacy the less you have to worry about jurisdiction A or Z [00:15:00] or whatever in between.
Ethan Prete: Love that. And I know I got the chance to speak to Will offline even before we started this episode. Will is very good at simplifying these complex mazes of conditional logic. And so if you ever need help with that, I would recommend reaching out to Will. But if Will ever reaches out to you to play board games or like Settlers of Catan or something, do not play with him, 'cause this is like an area where I imagine he's quite good.
Will Clayton: Bricks and wood,
Ethan Prete: very strategic thinker here. Bricks and Wood, that's right. Bricks and Wood. ~O-on~ the simplification, Will I actually did wanna ask you, this is another topic that gets brought up as I meet with chief privacy officers and particularly analyst directors as we do these meetups across the country.
There's a lot of questioning around how the team's actually structured. And so I know you mentioned a little bit about the MVW team, but in terms of executive buy-in and just so you know full transparency, you're gonna make some friends, you're gonna make some enemies here 'cause everyone's looking for validation of how their team is structured.
But does your team then roll up into the CISO? Is it the chief privacy officer? Is it both? Or how does that look? [00:16:00] And does that, do you feel lend itself to help you make decisions to help de-complex, to make things less complex? I was gonna make up a word there, but I gave up
Will Clayton: Decomplexification is, yes. So I
roll up to... Yes, let us do that. I roll up through chief privacy, and then he rolls up to CTO within our organization. And again, I think that's a reflection of how much we rely on technology to reflect and to implement policy. And I've seen very successful organizations that roll up through legal as privacy and sometimes legal has some sway that even technology may not. So lots of valid places to put privacy. But I think no matter where you are, it's important that you understand the consequences 'cause it's one thing to say, "Oh, we gotta do this thing." And I will at a previous organization I had when it was CCPA, and when it came down I had a key stakeholder say, "Oh, those are hard things, and they're never gonna happen." Of course, they did happen because here is what will happen if we don't. It puts the entire mission [00:17:00] in jeopardy. And when you start to see it's not even a lack of compliance, but a lack of respect for consumer privacy becomes an existential threat you must communicate that upward.
And not it's not the sky is falling although we've had some crazy things come down. But to give an honest picture of if we don't do this, then we open up the organization, we open up the mission to these risks, and they're bad. So no matter where you fall, being able to accurately and succinctly describe the potential consequences is huge, and then being able to provide a roadmap that realistically and within your organization and technology footprint covers those risks, I think that's the key for anybody succeeding in privacy
Ethan Prete: Yeah, I love that. And again, taking this conversation from the marketing side, I feel like marketing more often than not has the reputation of being the ones asking the question of, do we really need that other opt-in box, or can we assume this, or can we do that, or can we add in this other pixel, or can we really afford to lose that tracking visibility?
And [00:18:00] obviously, these, these questions are unique to every organization. But again I know you just touched on this, Will, but I am curious again, as you guys walk through the ownership of that decision in your enterprise, like as various stakeholders are talking, calculating, trying to figure out, where are the risks and adding maybe dollar amounts to those, what does that dynamic looks like?
Does-- Is it a heated meeting? Is it not a heated meeting? Is there typically like a framing that you can do to kinda get your point more clearly across?
Will Clayton: Yeah, that's a great question and a lot of it n-not a lot, all of it is very iterative. And be-before we started, we were talking about the, the, the decades-long privacy professional, and th-there's a few of us out there. But e-even the new privacy professionals know that, "Hey, this is 10 years we've been dealing with this.
This is not new." And and so when developments start coming... and I realize I'm not answering your question, so I'll circle it back around. But as they show up, you've gotta involve those, those stakeholders. And for a marketer, when you say, "Oh, s-sorry, this new law came out, and you guys are just all gonna have to wear propeller beanies at all times as marketers.
[00:19:00] Sorry." And they don't like it, and they grumble, and then you help them understand the hoops they gotta jump through in order to continue being effective marketers and they get on board. And knowing that we as privacy professionals are not are not there to be the bad cop and we're also not there to tell them, "Oh, yeah, you can do anything you want."
We're there to help them find the balance between continuing to be effective and and being compliant and ethical in, in their privacy.
Ethan Prete: Yeah, I like that. And I know you use the word ethical a lot, and I love that. I'm actually probably gonna steal that from you if you don't mind, Will. I will credit you, but I will steal it as well, which maybe is not ethical. I've already failed. But in terms of a, a real-life example here you and I were talking offline, and this just happens to be the number one topic that I get approached for.
But we were talking CIPA demand letters and just how prevalent those are, and it feels like, again, that's maybe like a real-life example of the exact conversation we're having here where things like chatbots or certain pixels like the Meta pixel are being specifically targeted by these, these attorney groups.
What's been your guys' approach there? And is [00:20:00] that an example of the types of conversations you're having with marketing?
Will Clayton: Absolutely. And like I say we have involved marketing to the point where if we just have to tell them, "Look this is a big deal, and we need to respond to it in the following way." For instance, may- okay, we just, we need to start treating California the same way we treat Europe. We didn't see it coming. It was outside of statute. Anyone who looked at this would say, "This is crazy. This isn't wiretapping." But when it starts to involve lawsuits that are expensive to defend no matter how spurious then you start to, to say "Hey, let's adapt." And the, again, the stakeholders, they've they've been pushed around enough by these laws that, that they don't like it but they understand, "Hey, this is a threat and we are addressing it in the way that is least disruptive to you and is least disruptive to consumers."
Ethan Prete: I like that. And maybe on the same topic here, I don't think this is a loaded question, but o-on the topic of the preference centers and maybe even like the consent management platform itself what is your opinion of where that should sit within an organization? [00:21:00] Is that something legal should own, marketing, privacy to bridge that gap, or maybe a mix?
Will Clayton: I own the consent and preference center, so the, the correct answer is firmly within privacy. That is the one and all... No, it is not, of course. I will say, especially when it comes to to consent and to preferences, and this goes back to my earlier comment is, hey, I've gotta, I've gotta store these things, and if I'm using an external platform, I've gotta sync with that platform. I've gotta transmit that data securely. So there's a very strong technology component there to say are we collecting these and managing them right? But now again, it goes to, do my marketers know that I'm making these available and they're going to influence their campaigns? They're going to be taking people out of their prospective audience, but hopefully be giving them preference information of here are the destinations, the activities, the, the amenities that, that people are interested in so that they can be more effective in their marketing with the same resources.
Belongs to privacy wherever privacy rolls through but [00:22:00] marketing is a key stakeholder. Technology is a key stakeholder working with, again, legal is always there to to bless or to veto something that we do with the nuance of law
Ethan Prete: Love that. That was a good and also borderline political answer, Will. That was good. I loved your neutrality there while also giving an opinion. That was impressive. We might have the next future senator of Florida over here once you get to Orlando. A fo-follow-up question for you.
Again, and I'm poking at this relationship, Will, that you've created between the privacy team and the marketing team, because again, I think that's such an important dynamic here. But have you had any success in maybe that secret code of helping them find the tangible metric? As marketers we're always thinking in terms of MQL rates, click-through rates, open rates, et cetera.
Have you been able to quantify that unhappy customer to them? Even, maybe even when the law's not technically broken, but the ethical side of things
Will Clayton: See, you have now raised I've been talking about this for l-literally decades and it's especially prevalent in email marketing. But in direct mail we have the same problem, and I'm not saying that [00:23:00] my organization has this problem, I'm saying we as marketers have a problem of not understanding the cost of negative events.
And email is the classic example and I had a stakeholder many years ago who was like, "Will, email is just like direct mail only it's free, right?" I say, "Yes, except it's also extremely lightweight. There are laws attached to it. There's technology attached to it." If you get blacklisted at Gmail, you're blacklisted and that was not something that the law did to you, that, that was something your behavior triggered. And finding those metrics that really do recognize not only, what's my conversion, my open, my whatever rate, but what's my what's my bounce rate? Because that's gonna poison my sender score and things like that. What is my complaint rate? Am I seeing, direct mail?
Is my... Are my mailings triggering lots and lots of opt-outs at ANA or within other groups there? So understanding that that some of these miracle communications and all of [00:24:00] it's miracles, if we can reach people and help them to understand the benefits and the value of what we're Yeah 'cause one of the things that a lot of marketers they all pursue the positive metrics. My engagements and my purchases and it's way too easy to ignore some of the signals that you get. Your your bounces on emails, your complaints on your paper mail and your direct mail. And what we used to call the, the screamers, people who just call up and I hate you. I hate you. I hate you." And you don't wanna have those people. You wanna disengage and let them live their life before they start feeling bad. And we don't get too many of those, but but every one is is a hit against the success of your program.
And so I think a good set of metrics s- focuses on both success that's happening and then the negative events, whether it's deletions under privacy law, whether it's just opt-outs. Any of that stuff i- is really indicative of hey, you're engaging with people that, that you really need to just, like I say, let them live their life and find people who are a better fit for your brand
Ethan Prete: I like that. It does feel [00:25:00] like there's almost a brand both internally and externally. It almost feels like a college football culture or something where you're trying to say "We're building towards these types of things." And I know you've mentioned again the word ethical a bunch of times. And maybe I'm pandering here, Will, 'cause I know I just threw that softball in the last question.
But a- as you look across the industry, obviously I think everybody can notice patterns and things across teams, departments, et cetera. Do you feel like from your experience there have been specific areas where teams consistently trip up with balancing the privacy versus the user experience?
Will Clayton: I don't know if there are areas where people consistently trip up, but I do feel like as as marketers, a- and there's some-- I work with really skilled people, and I have for many years at many companies. It's easy to fall back on, "This is how we've always done it, and it works really well, and I know how this goes." And and that's the kind of thinking that works great when things stay the same, which they never do. So the marketers who are constantly reevaluating not just what kind of a climate am I marketing in [00:26:00] but, what kind of programs am I doing and what what are my audience thinking and feeling? And people who are constantly reassessing and constantly reinventing the ways that, that they engage with their their customers and prospects, those are the ones who really succeed in privacy as well, because they're rolling with the punches and they're adapting.
Ethan Prete: I like that. Another question kind of al-along the same lines, but you've mentioned again, like there's your standard and then there's obviously the regulatory standard, and obviously you're familiar with both of those, and you've guided both of those across teams. What advice would you give to privacy leaders who are trying to build infrastructure today for regulations that are maybe in the draft phase or pre-draft phase and in the direction you think the market's going?
Will Clayton: Y- yeah, so part of it is anticipating. I worked in the past with a data broker and and Oregon came out with this law that said not only do you have to reveal the kinds of data and the kinds of recipients but you have to reveal the specific recipients. And that's a huge deal from a data architecture standpoint, 'cause now [00:27:00] you're saying, I used to have this little fixed set of categories.
Okay I report on those and now all of a sudden out of the blue you say, "Oh, and by the way, you have to report on the actual recipients," which is an open-ended set that grows and shrinks. A- and would be where I'd come to. And I talked about this earlier but engaging with your technology partners early.
And they may start with, "You're crazy," or, "You're killing me," or, this, "Privacy is a hurdle between us and success in our business." But but when you engage with them and when you help them understand, this is coming or even this may come. And my, my, my background is in product management, and you hate to build something, you hate to take precious resources from the company and build something that you don't know is gonna be necessary. But if you feel like you've got, a 50 or a 70 or whatever percent chance that you will need this technical structure or or this capability, you treat it like a portfolio and you say I'm gonna work these features and these [00:28:00] abilities," knowing that some of them we just will never need.
But if we build our systems in such a way that we're ready for things like that then you become much more nimble and much more I was gonna say reactive, but it's not, it's proactive. It lets you respond to things, the moment they come up because you're that closely engaged.
Ethan Prete: I like that. Proactivity to you can react to things, maintaining flexibility while also having the same standards across every team. We didn't talk about this well before the call, but I think it'd be a mistake for me not to at least try and pick your brain somewhat for our listeners today.
H-how is your team thinking about AI governance and what's coming down the pike there?
Will Clayton: Oh, yeah. I-in the entire world, of course, is thinking about AI and starting with what can we do with it and what should we do with it. So we have a dedicated resource within the team who's exceptionally sharp who engages not just with how do we regulate and be aware of what's coming for AI but again, that question of how should we be using it? And and that resource does a really good job of bringing the rest of the privacy team, and in a lot of ways the, the rest of the product team in, [00:29:00] so that when someone says, "Hey, we've got this, this AI-enabled vendor product," and it comes in for a, privacy impact assessment one of the first questions there, does it use AI?
What what data does it use to train? Is data coming from us? And so the-- just having the right questions to ask about AI makes it much, much easier for even the people, that's not their job but boy, they sure know that it's out there. And it lets them engage with the right resources to make sure that it's been thoroughly vetted and is the right solution when we do turn it on.
Ethan Prete: We talked a lot about team structure, so just one clarifying question here. You mentioned that you have this individual who's the expert on that. Where does that person live in your organization, and where do you think they should live?
Will Clayton: He's the director as well and and reports up to the chief privacy. So he's a peer to me, and I focus a lot more on operational aspects. S- so I would say within the organization, and I've seen privacy teams all the way down from, I was gonna say one person, but I've seen effective privacy teams that are fractions of a person.
This is [00:30:00] 40% of a resource. And that can work i- in some environments but as you get more sophisticated and there's more moving parts I do think that you need to have people who are responsible for the key swim lanes or things that, that you're gonna have to deal with. So yeah, absolutely making sure the team is very clear and very well laid out as far as who, who's responsible for what and, who's just helping.
Ethan Prete: Love that. I've picked your brain. Will, I've asked a lot of questions, but before I turn you loose, do you have anything, any advice you'd wanna give or any predictions you wanna make for everybody who's joining us today?
Will Clayton: No other than, anything I could predict is happening right now. And that's, I say that just to say we're gonna continue to see fragmentation. We all still hope to see a preemptive federal statute. But if you're holding your breath on that you're gonna get run over by state statutes. We are gonna see more and more people, we mentioned CIPA, and and I think we need to be ready for other things that are a stretch, that people are repurposing, that people are [00:31:00] weaponizing. I've seen situations where different privacy statutes end up again, I don't wanna be alarmist but there are people weaponizing this.
Anytime you put a you put a, statutory monetary amounts on it, people get dollar signs in their eyes and say, "How can I stretch this, extend this?" Just be on the lookout. I had a couple years ago we had, it was a Friday afternoon, ready to go home, and all of a sudden we started getting hu-huge numbers of privacy requests.
And the ability to see that and say, "Something's off. This smells like a problem. And may-maybe I should stick around and assess this instead of giving whoever's doing this two, two more days of lead time on their plan." And that's not to say that anyone who's trying to, exercise their privacy rights is an enemy, but be aware that there are people who are sure looking to take advantage of laws that are meant to protect consumers.
Ethan Prete: I think all, all these technologies present a lot of opportunity. So I think the vigilance is always smart. So
I love the advice. And Will, for those who are joining as well what is the best way to [00:32:00] find you, to connect with you? Is that LinkedIn or are there events you go to, conferences?
Will Clayton: Yeah, LinkedIn right now. I'm I'm insane. I'm I'm actually beginning a PhD in marketing in addition to my job. LinkedIn is a great way to connect with me, and I'm gonna see where where my time and effort ends up pointing out from there. Other than that, I will just be nose to the ground watching out for privacy developments and how to protect my stakeholders and keep everybody straight
Ethan Prete: Love that. Will, thank you so much. This has been a masterclass on how to balance the tough, complex compliance rules balancing with, the human-centric hospitality, which is the ethical marketing you keep talking about. Really appreciate it. For everybody listening in today, go and buy one of his vacation Marriott rentals.
Use the code Will Clayton. I'm sure there's a discount, and I'm sure that's not made up. Will, thank you so much, and thank you everyone for joining the Web Privacy Podcast, and we'll hear from you soon.
Will Clayton: My pleasure. Thank you, Ethan
Ethan Prete: Thank you