Data Privacy Tools Empowering Consumers – Aaron Mendes, PrivacyHawk

This is Techstrong tv. Hey guys, thanks for the throw. 7 million to, uh, fund future development of their platform.

We'll get into what that means in a minute, but Aaron, welcome the show. Thanks for having me. Great to be here.

We have seen a lot of passing of various legislation that affects privacy and data privacy, and everybody kind of nods their head and says, well, that sounds like a good thing, but do we really understand what it takes to manage that and achieve that goal? Because at least in my experience, we have 30 or 40 years of managing data poorly. Yeah, you're absolutely right and it, it's a step in the right direction that there's regulations, but unfortunately there's still a lot of work on the end of the consumer to actually exercise their privacy rights.

So What can the consumer do? What's the responsibility for them versus what might be the responsibility of the custodian of that data, and how do those two things intersect? Yeah, so the custodian of the data, their responsibility is to comply with the law, which is don't leak the data.

Don't sell the data, uh, unless you have permission, you know, get the, the, you know, have the proper disclosures in your privacy policy and things like that. But beyond that, the businesses that use our data basically try to extract as much money as they can out of it. Um, and a lot of these products are free.

So what I like to say is, if the product is free, you are the product as the end user. Um, so what consumers can do about this is now there's regulations in 140 countries that give you some fundamental rights. Those fundamental rights are the right to delete your data, the right to not have your data shared or sold the right to know what data businesses have about you and the right to not be discriminated against based on your personal data.

Now, the problem that consumers have is the average person is in hundreds, if not thousands of different corporate databases, and it's not practical to go read all those privacy policies and exercise those rights one by one. So it's, it's really only practical if there's like one or two businesses that you've decided you don't want to have your data, but that doesn't actually reduce your risk of being in a data breach or fraud or things like that. So what we at Privacy Hawk realized is that consumers need like a, an automated assistance to really go do this for them at scale and figure out all the various places that their data is and make it really easy to significantly reduce that digital footprint.

Okay, well that sounds like a massive task. So how does it work? How do you accomplish that?

Because a lot of the data may be in places that are not easily accessible. Yeah, so there's two different kinds of, uh, digital footprint reducers that we have. So the first one are what we call data brokers.

These are these shadowy companies behind the scenes that buy and sell consumer data. They, there's these background check websites and there's a couple hundred of these that make up most of the volume and we know who they are and pretty much everyone is in them. So we have a scan that enables us to scan their, uh, websites, find your profile that's exposed there, and then there's a lot more information that people can buy and then we automatically make the takedown requests on your behalf and then track to make sure that they've been taken down.

Now, the other thing that we do is what we call first party data. These are all the things that you've ever signed up for over the course of using the internet and things like retailers, apps, newsletters, uh, every service that you use, whether that's Netflix or Spotify or your bank or your grocery store, they all have some, uh, massive amount of your personal data to varying degrees. So how do we find out who all these businesses are?

So what we figured out is that the vast majority of your digital footprint can be found in your inbox because every time you sign up for something, you get an email. So we do a sync with your inbox and identify all the senders of all those emails and display those to you within the application, which in many cases is several hundred different businesses that have your data. So now you at least have it all in one place, and within a few minutes you have a nice summary of all the places that your data is.

Then you have options like, well, these 30 services I don't use anymore, so I don't wanna be in a data breach, so I want to them to delete my data. So from within the app, you can select, delete, delete, delete, delete, and then submit. And it sends out the requests to those respective privacy departments to delete your data and then enables you to keep track of that within the app.

Do you think flipping it the other way, some businesses might want to use your tool to figure out what data they have when they get a request from somebody? Cuz a lot of times they have no idea how many instances if somebody's data there is. So is there gonna be a, you know, business side to this motion?

Yeah, there's already a big enterprise business component to, uh, privacy compliance. There's a number of very large multi-billion dollar companies that are tackling that problem for businesses. And, uh, it's really good that that that's the case.

And a lot of businesses are putting things in place to make sure that they can figure out all the places that your data is and make sure that it's really being purged when they say it is. Um, and there's very steep penalties for not complying. It's in Europe, it's a percent of your revenue and in the United States and many states, it's the, uh, thousands of dollars per infraction.

So they're heavily incentivized, incentivized legally to make sure that they get it right. What we're focused on and the need that we see is that there's nobody out there helping the consumer and that's where we're focused. Do you think lawyers might be using your tool to kinda help with class action lawsuits to figure out, you know, how many people are involved in a particular violation of something?

Because it seems like they too are in the discovery business. Yeah, I mean, they wouldn't be able to use our tool to do that because they would only be able to look at their own data. They can't go look at everyone else's data.

But one of the things that we have thought about is, you know, we wanna be a force for change in the industry and make sure that help make sure that corporations are abiding by these rights and making sure that people that do want to exercise these rights can do it and businesses are complying and there may be a world in the future where we're working with regulators and, and lawyers to help pressure companies that aren't doing a good job of complying to get them onto the right side. There's a lot of interest in all things AI these days. Do you think that that has a role to play in this going forward?

I mean, for all, I know you're already using algorithms, but, you know, how do you think this might all evolve? Yeah, so there's kind of two discussions on the AI front. The first is how might AI threaten our privacy and our personal data and the future?

And the second is, how are we using AI to protect, uh, people's personal data? So I'll start with the, the first one. So we have a lot of personal data on the internet.

All a lot of our social media posts, our profiles, uh, public records, these data broker websites, things like that. These AI models are just crawling the internet and gobbling up everything, which includes a lot of our personal information. And that information can be used in malicious ways to not only manipulate the public en mass, but also identify victims for potential fraud and things like that.

And so that's why we really encourage people to reduce their digital footprint so they're not the low hanging fruit when these models are studying to be used to target people. Now the way that we use AI is to ensure compliance and help, uh, facilitate the process of reducing people's digital footprint. For every single request that you make, there is a bunch of steps and there's communication back and forth between the company, and that's very arduous for a consumer to deal with.

We can use robotic process automation and natural language processing to basically do that for the user to make sure that they do successfully get their privacy rights exercised without them having to read and field a bunch of emails and fill out forms and things like that. Do you think as we go along that more people will get paid for using their data? I know they give up their rights sometimes when they, uh, look at those licensing agreements that nobody reads, but if we come more aware of the privacy issues, maybe people will eventually get paid for their data.

Yeah, that's, uh, an interesting topic. So the reality is that an individual's data is not worth very much, it's only in mass when there's billions of people's data that it becomes really valuable. So your data might only be worth 50 cents or a few dollars.

And the question is, is is that enough money for you to be willing to give it up? And to the, the answer to most people is no. And the more affluent you are, the less likely you're gonna need that small amount of money, but also the more valuable your data is.

And so if you think advertisers would want to, uh, you know, incentivize people to share their data, they don't want the less affluent people that don't spend as much, they want the more affluent people who don't need the money. So, um, it's, it's an interesting question. Could people sell their data?

But the reality is it's at an individual level. It's not worth very much money. It's more, but it is worth a lot to someone that wants to commit fraud.

What is the connection between data privacy and cybersecurity and fraud? It seems like we're very focused on, uh, protecting the data from a privacy perspective, but there's a whole other element to this about cybersecurity. So where does that play in?

Yeah, that's actually our primary purpose. So we are a privacy company, but the purpose of privacy for us is to protect people from the bad things that can happen when their personal data is accessed by bad actors. So if I know a bunch of things about you, so the, the number one cause of fraud, whether that's identity fraud or phishing scams or or hacking or stealing money from people is social engineering, which means that you're effectively tricking someone into giving you unauthorized access to sensitive information, particularly financial information where they can steal your money.

And the way that they do that is they basically impersonate someone of authority. Maybe they pretend to be someone from your computer's manufacturer or, uh, or from your bank, and they ask for credentials that you give them, and then they go log in and steal your money. Well, that all starts with canvassing someone or a group of people, maybe a family and looking at as much as you can learn about them to try to exploit them.

So if I can buy a background check profile of you and I know who you are, where you work, uh, your socio profiles, who your family members are, your contact information, I can use all that to target you, not me personally, but a a, uh, a bad actor could use that to target you and try to exploit you and steal money. When there is a breach of data involving my personal information, usually you get a note from somebody saying, we're sorry and we'll give you six months of, of free tracking service to make sure that you know you're protected. Do you think as we see violations of data privacy legislation that something similar might happen where companies are gonna say, Hey, we're gonna gimme six months of access to this tool to make sure that it doesn't happen again and we are doing everything we can to comply?

Yeah, absolutely. So the the credit monitoring, uh, services, kind of like the identity monitoring services is what you're referring to, and they, they do offer those for free when they have a breach. The problem with those is that they're reactive.

It's too late, you know, you're the, the genie's already out of the bottle. What we're doing is helping prevent the genie from getting out of the bottle in the first place. And so we see it as more of a proactive tool that banks and insurance companies and employers would offer so that they can prevent their customers or personnel from ever being in a breach in the first place.

So, uh, we do see organizations wanting to offer something like Privacy Hawk to all of their customers. So what is involved for me as your average Joe consumer to set this up? What do I gotta do?

How do I get involved? What's the, you know, what are the particulars? Yeah, so the goal is to make it as frictionless and easy as possible.

The whole purpose of our product is that it is much too difficult for an individual and much too time consuming to actually significantly reduce your digital footprint. So we try to make it as few steps as possible and as little work as possible. So it starts with, you can go to the app store and install the app, you can do a free scan, find out how many personal data exposures you have.

We have this thing called the privacy score. It's kind of like a credit score where you can find out, uh, where you, how bad or good your risk is. And it's also on a similar scale of like 300 to eight 50 and you got poor, fair, good, excellent.

And the more you reduce your digital footprint, the further you move closer to that excellent score. So to find out your score and to do those scans is free. If you wanna have unlimited removals and actually start reducing your digital footprint, we have a premium version of the product that's a pretty low annual subscription fee, and you can then have us automatically start cleaning up your digital footprint and then also monitor for new exposures on an ongoing basis to help keep that footprint small because it's not a one-time thing.

It, you're, you're constantly getting back into these databases, signing up for new things. And so it's an ongoing thing and our goal is to make it so that you don't really have to do very much work. We're kind of handling it all for you and making sure that your data stays protected as you go about your business and continue to use all these great internet services.

Do you think that this is yet settled law? I mean, I feel like we're gonna see a lot of lawsuits go back and forth and really come down to who has the right to own what data and use it, how, and whether or not a licensing agreement covers that or not. So are we gonna see lots of lawsuits going back and forth for the next few years before we sort this all out?

Well, it's gonna be an ongoing problem indefinitely because technology's always evolving and there's new kinds of data that, uh, need to be addressed. But the, the tide has shifted towards the consumer and there's pretty much broad bipartisan agreement that consumer consumers own their personal data and that they have the right to control who has it. And the lawsuits are various interpretations of the law or when, what we are seeing the most of is when companies are just not following it.

Like, Sephora just got dinged in California for a million dollars because they, they were kind of, they, they, they were doing things with their data that they said they weren't doing in their privacy policy. So there's gonna be a lot of lawsuits about violations and companies getting busted for violating regulations either intentionally or unintentionally. Um, the companies are gonna try to lobby to get as much freedom as they can get, but the public sentiment and the political sentiment is in favor of the consumer.

All right, folks, you heard in here, data privacy. It's coming whether you like it or not. So maybe it's time to figure out how you're gonna adjust your management policies of that data because consumers are getting some tools that's gonna make them a lot more aggressive than they have been in the past.

Aaron, thanks for being on the show. Thanks for having me. It was great.

All right, back to you guys in the.