-Hi.
I'm really excited to have you all here.
Thanks for coming to our panel on the Privacy Landscape,
State and Local Perspectives. I'm Sarah Carrier.
I am the city of Seattle's privacy
and responsible AI program manager.
And I'm going to be moderating if you can't tell.
So really excited to have you guys here today.
Appreciate you taking the time on a Tuesday evening
in Downtown, Seattle.
Thank you very much.
So today, we're going to be discussing
the privacy landscape and kind of
how it's evolved over the last x amount of years, 10 years or so.
Hopefully, you'll have questions,
you'll learn a little bit,
and you'll feel inspired to continue to engage
with the fine folks on the panel and also the office --
your privacy offices at the state and local level.
So hopefully, you know,
this will be a great event for you guys.
A few logistics; there are notecards and pens.
If you have questions,
you can just jot them down on the notecards,
and put them over on the table,
and we'll collect them at the end.
And we can have about 10 minutes at the end for Q&A for folks.
So we'll try to see how much time we have,
but we can definitely get to those questions.
I'd love to just go ahead and start.
Hi, come join us. Hi. Introducing our panelists here.
We have Ginger Armbruster, Zack Hudgins, and Katy Ruckle.
And I would just -- if we can go down the line,
I'll let you guys do an introduction.
Tell us a little bit about yourselves,
who you are, and we'll start with Ginger.
-Hello.
And thank you all. Can you all hear me okay?
Did I do that? All right. Okay.
I did the first thing right tonight.
That's good. I got the button turned on.
I'm Ginger Armbruster.
I'm the chief privacy officer for the city of Seattle.
Been in role and we've had a program going here
for better part of a decade. So I don't know.
How many people were aware that we've had a privacy program
that's run that long?
Is that new news for many?
All right. I came to the city as an intern.
I was a mid-career change professional
and had an opportunity to build this program,
take a little time out to go to Microsoft
and learn about privacy at the private sector.
And then came back
and have been enrolled as chief privacy officer since.
And I'm really happy to be here because it's Privacy Day
and we get to talk about what we do with people
that are interested in hearing more.
And I'm very much interested in hearing questions
you might have about our program.
-I'm Zack Hudgins.
I'm a privacy manager for the state of Washington.
I work for the Office of Privacy and Data Protection
for our Chief Privacy Officer, Katy Ruckle.
And I do a lot of work with local governments.
And I do a lot of work in the overlap
between privacy and cybersecurity.
So folks are kind of more aware of cybersecurity these days,
but you get a twofer when you do some of the privacy work.
It's also in line with requirements and needs
of the cybersecurity discipline. And so we're seeing more
and more of a split between those two as they develop
and mature kind of in both of those areas.
But that's a lot of the work I spend my time on.
-Good evening, everybody. I'm Katy Ruckle.
And I'm the state's chief privacy officer.
I have been lucky enough to work for the state
for 18 years now and five years in my current role.
And I am technically in statute,
the director of the office of privacy and data protection.
And I have Zack to be grateful
for that he helped get that office created in law
when he was a legislator.
So it's been fantastic to have Zack on my team
and get all the history there,
but then also have enjoyed working with Ginger
over the years too,
in terms of how the state and local governments work together.
So excited to be here tonight.
-Yes. And we are excited to have you all.
Thank you.
Before we launch into questions,
I want to just kind of set the stage a little bit.
Ginger, I think you referenced it.
It's been about 10 years since the city of Seattle
has started our privacy program.
So 2025 is our 10-year anniversary,
and I think the state is coming up pretty quickly here too.
-2026. We're just a year behind you.
-Yeah. So really, really close.
And things have changed a lot in the privacy space
over the last 10 years.
And that's some of what we're going to talk about today.
But you know, privacy has kind of become its
own separate discipline in that time.
We have professionals from all different domains,
from legal to compliance,
to software development and engineering, right?
And I mean -- I bet, you know,
if I were to ask you about privacy-enhancing
technologies or PETs 10 years ago,
you probably would've raised your hand
and told me about your cat or your dog, right?
Maybe some of you still will.
I mean, I don't know. Not after today, though.
But I think a lot of that change
that we've seen over time has really been driven
by laws and regulation globally.
So thinking about things over time
that have happened to really drive the domain
and the discipline forward
around the general data protection regulation in the EU.
And then I think it's around 20
or so state comprehensive privacy laws
that we have around the United States right now.
And I think that's really put privacy on the map
as a separate domain.
And that's some of the change that we've been really seeing.
So I guess just kind of, you know, starting there,
I guess I would like you all's opinion on
how you guys have seen the privacy landscape change
over the last, you know, 10 years, 15 years or so.
And if that's specific to here in Washington, great,
or even just more broadly.
So Zack or whoever wants to start.
-Thank you.
So I'll start a little bit further back,
but I'll move very quickly.
A hundred years ago when people talked about privacy,
it was thought about as sort of the right to be left alone.
A problem that we would recognize today
was that Chief Justice Brandeis' daughter had a wedding,
and a bunch of the paparazzi took pictures of the wedding,
and he got bent out of shape about it
and sort of formed up our modern-day of privacy
of the right to be left alone.
If you think about where things were 50 years ago,
as computers and big databases started to be formed,
the federal government adopted their first privacy laws
and the first principles around that data
and how it should be used in a mutual beneficial way.
So the folks that had the data
and then the subjects of that data,
it should benefit both sides of that.
If you look back 10 years ago,
the Office of Privacy and Data Protection in Washington State
wasn't created until 2016.
So it wasn't even around in practice in Washington State.
And when it was created in 2016,
we were the second state, I think,
to have an official office and everything.
And at the time, it was one person,
and they were largely focused on consumer privacy,
which is important, and it's still part of our mandate,
but it wasn't as structural or sort of framework, right?
It wasn't about building out towards that maturity.
If you look at where we were just in the last year,
we've built out at the state-level privacy principles,
a privacy framework.
We've got five years of data of surveys
across the state agencies,
across the enterprise of where we are.
We've celebrated Data Privacy Day.
We've sort of plugged into other states and what they're doing.
If you look at sort of where we were just a day ago,
I mean, this is how much it's sort of accelerated
where the discussion about privacy and AI
is in the news everywhere with DeepSeek and pop-ups
on people's computers asking you to accept cookies
and a discussion of GDPR and health data.
And people really have a different sort of vision
and understanding of privacy now,
and about the interaction with data,
and about consumer companies, about government,
and about who's got the data,
and is it correct, and can I correct it, and can I delete it?
No, I can't delete it. What's the transparency policy?
What's the accountability of all this?
So that's sort of some of the arc of going from just,
"Leave me alone,"
to now is about what's this relationship about data
and how does it interact with the individuals?
-I can add a little.
So 10 years ago when we started talking about privacy,
it really was around surveillance technologies.
That's where the conversation started.
I think this understanding
that cities are collecting a lot of information
and there's a need to do some of that
in protection of part of public safety, property protection.
And when I would speak to people about privacy,
everyone had a different view
and probably still do to some extent about what they mean.
And so I'd be in front of groups and I'd say, you know,
"If you had a list of 10 data points,
which are more important --
where would you draw the line about what is important to you
in terms of privacy?"
And for some, it'd be financial data.
Others would be, "My image."
Others would be like,
"Anything I do behind a closed door,
I'd have no room in the public space."
But everybody had a slightly different view.
And they might have a different view
if you asked about yourself, and then you asked about their kids,
or about your mom,
or about another relative who might be more vulnerable
and maybe not as tech-savvy.
So I think I've seen a real evolution in terms
of a better understanding of all the permutations of data.
And the other thing I think I can mention
is the conversation about data privacy,
I think for all of us,
has morphed a bit to encompass more of the ethics of data use,
the understanding of what should we be doing.
And I don't want to jump ahead in some of the questions
we're going to get to, but AI plays a place in that.
What can we do? What should we be doing?
And what do we need to be aware of?
Because as we often know, technology can be unleashed
before we're quite ready for all the unintended consequences.
And so our office has encompassed other issues
beyond just data privacy,
which now feels operationalized in many ways.
And we are way more than one
or two chief privacy officers across the country.
I remember that too.
We were the very first municipal privacy program really, I think,
in the nation that I was aware of.
And it was lots of fun to build, but it was also kind of lonely.
It was sort of me and the SharePoint guy.
How can we come up with, you know, some information?
And I had to get his time sort of allocated
and it was sort of me and him.
And that was it.
Now, we have a team of four who are focused.
And so the evolution is, it continues.
And I think as we have new technologies coming up,
new things to think about in terms of data use,
and as our awareness grows,
I think we'll continue to see it do that.
I don't know what you think. -Yeah.
I would say for my perspective on the evolution of privacy
is really through my career that I've been at the state
because my first intersection with privacy really --
because I'm an attorney, I have a legal background,
and it was really around HIPAA and health data.
And so I was also doing contracts at the time
and was doing business associate agreements,
which also then brought me into working with cybersecurity.
And so that's where I really started seeing,
I think, a parallel to sort of
where we are with privacy today to what happened
with cybersecurity.
Because now,
you know, cybersecurity is a given almost in
any organization. And a lot of resources and time
go into making sure everything is secure.
And I kind of feel like there was this awakening, you know,
10 to 15 years ago really focusing --
building our maturity on cyber.
And then cyber started to become more aware of getting
all these privacy questions.
And they were like,
"We need somebody that has a privacy background
and the discipline on privacy."
And so that's where I've seen the landscape,
at least in the professional field,
and seen it mature across industry and, I think,
in the government.
-And I can add just one more thing on the cyber question.
Early on, if it was a privacy question,
our cyber people kind of say, "Oh, yeah.
it's over there. Go talk to them.
I don't know what that is. That's something else."
I think now --
and we would kind of talk about we never go anywhere
without our cyber buddy.
Kind of like, if you are a diver,
never go anywhere without your buddy, right?
I think we've seen that shift to more of a partnership
and more of an understanding of the roles each of us play.
We can't have privacy without security.
And I think security is also recognizing the role
that we play to help secure systems.
So anyway.
-Yeah. Awesome. Thank you, guys.
So I want to kind of tease apart.
Zack, you started mentioning this,
the concept of privacy in the consumer space.
And I kind of am interested.
I mean obviously there's a bunch of public sector folks up here,
right?
So I'm kind of interested in what's the nexus
between consumer privacy and privacy in the public sector.
Like how do you guys view that overlap
or where are they different?
And how are your teams like thinking about those things?
-Right.
So I would say for our perspective,
we look at the laws that apply across both
in private sector and public sector.
I mentioned HIPAA.
We look at, you know, FERPA as the educational privacy law
and then, you know, GLBA for finance, and IRS 1075.
And those are the laws
that we're looking at a lot from the government side
in terms of making sure we're doing all
of the compliance pieces.
But we do get asked as well about some of the rights
that come with the consumer privacy laws.
And that's where Zack mentioned some of those principles,
the FIPPs, right,
the fair information practice principles
which we use to create the Washington State Agency
Privacy Principles.
And then those are baked into many of the consumer laws
that we see in terms of transparency and accountability,
due diligence, security, lawful fair and responsible use,
all these kind of ethical things that Ginger was talking about.
But how I try to talk to our state agencies,
especially about what's happening on the consumer side
of privacy laws, is to be ready
and be thinking about adopting those practices at our agencies
as well because we're trying to align them.
So there are some laws that don't necessarily apply to us
in the government,
but we still look at those principles
and incorporate them in terms of our handling
of personally identifiable information.
-I had a chance to speak with some other
chief privacy officers at an event in Washington, DC.
And one of the CPOs was from the state of Utah,
also have 100-year history in privacy,
but mostly around religious privacy
and the right of individuals
to have privacy of their own beliefs.
And a lot of that was the start of Utah.
And it was the first state CPO
I'd met that did not focus on consumer as much
as they focused on personal government-type tension
between information and privacy.
And it was really eye-opening to see a different perspective.
We have spent a lot of time on consumer privacy,
which does not apply to what we do.
Although here in the city of Seattle,
we are focusing on how we protect people's
information privacy for information of the individual.
And it's interesting when those --
they do intersect with a general understanding
that we all have a tolerance and a place where we're saying,
"Wait a minute, how is data being used?"
And in many ways,
and we're going to get to this in a few minutes,
I think at the consumer level,
it's almost a little easier to protect data
and to be aware of how data is being collected.
And I think some of that is due to the EU and GDPR,
the General Data Protection Regulation,
which has led the way in consumer privacy in some ways,
pulling it together so it's not a state-by-state argument.
But it's interesting to see how that has developed over time.
-I just -- what's interesting to me
is that individuals are the same
whether they interact with the government
or with sort of the consumer space with the private sector.
And so as we lay out these principles,
I think about how attitudes change,
but the laws can change those attitudes
on the expectations of what they think of as privacy.
And the example I think about is that there was a time
when folks said,
"Hey, we have these interactions,
let's collect as much data as we can on folks,
and maybe we'll use it later."
And so we have a principle about, you know, minimization.
You should only collect what you need
and then purpose limitation.
So you should only use it for what you say
you're going to use it for.
And so that attitude,
that expectation is that if we're going to use it
for something else, we have to go ask,
"Can we use it for something else?"
And so that relationship hopefully will bleed
out into the private sector a little bit.
And it's difficult when your data can bounce
through multiple private sector entities
or go through data brokers,
and it gets harder to keep track of who's got your data
and what they're doing with it.
But the principles will still apply.
And those expectations will still apply.
And it's a great place
to see where the government can be the model
through the principles.
And they're not new.
Again, they've been around for 50 years.
I think that the European Union,
with their General Data Protection Regulation,
their GDPR, has really kind of heightened awareness of it.
But the expectation and those principles
have been around for a very long time
and they're kind of worked out that people agree to them.
And so that's a great place
of watching the government space influence
that sort of private sector consumer space a little bit.
-Absolutely.
I'm remembering when we first stood up our privacy program,
it was very interesting to me
realizing early on what we are ready to give up
in the consumer space for convenience,
or fill-in-the-blank service, or for expanding,
or remembering people I knew in high school, social media.
What we are willing to give up
is very different than what we feel comfortable
perhaps with the government data collection.
And I remember early on somebody who was a very,
very vocal advocate for privacy in the city
and worked very much with the city
as we were standing up principles
was on a article on the front -- well,
not the front page, front page of that section
wearing Google glasses at the time.
And I remember thinking to myself,
"Wow, the amount of information
that that's being scooped up with that technology,"
which has probably moved on to other things now, right?
We have other versions of it,
"does not match what it is the city could possibly collect."
But that's different, right?
I'm willingly -- I'm writing off my right to some of that privacy
because I want that service.
And it's an interesting one to bring up
because government has a different role.
And it's the unknown. It's the concern.
It's the, "Where is it written?
Where did I agree?"
Some of what we collect
isn't really information folks are choosing necessarily.
It's not a service I'm necessarily connecting to.
Sometimes it is, sometimes it's public safety,
or it's health information.
We have different services we provide as government,
which changes that arithmetic. -Thanks. Yeah.
So principles, expectations, sectoral privacy;
little bit the same, a little bit different, right?
And so I want to kind of tease apart a little bit
of kind of the worlds I think all of us
live in every day up here around some of the unique challenges
that government has in the privacy space
that might be a little bit different
from the consumer side of things.
And that is kind of the natural tension
between our Public Records Act and privacy specifically, right?
So both rooted in transparency but very different acts.
So can you talk a little bit about what that looks like
and how that plays out with residents or the folks
that we serve in the work that we do on a daily basis?
-Yes.
So the Public Records Act here in the state of Washington,
I think, goes back to 1974.
The idea being you have the right
to know what government has on you
and you can make that request.
I might offer that in 1974,
that was probably some file cabinets, you know,
some paper records.
It's moved to pace in the last 50 or so years
about just exactly what the nature of those records are.
But the law hasn't really changed.
And so it's interesting for folks
who are very much committed to government transparency
to understand what that means for data collection
and the ability to protect privacy.
Almost everything we collect with not too many exemptions,
maybe there's 20 or so of them.
I haven't taken a look recently if they're broader than that.
Very narrow exceptions, can we really redact
or make information not available?
So pretty much -- don't hold me to this
and don't write down everything you want to know tomorrow,
come running at me with a public records request.
But we have to fulfill almost any request we get for data.
And really when you think about it,
that's not necessarily everything
the government is doing, it's people's information.
It's the information that we collect to deliver services.
So the tension between public records and transparency
that's designed to provide
can really limit what we can do from the privacy perspective.
What can I really promise?
And that's why I mentioned consumer privacy.
They don't have that same thing.
It might have subpoenas.
It might have other legal means of getting information
from a private sector company.
But it does make it very interesting.
So our conversations are around limiting what you collect.
And early on, especially,
we would sit down and consult with different departments
who had mission-driven services and solutions
they were coming up with to talk to them about,
"You don't want all the data you think you want.
Or at least let's talk about
how we might minimize what you're collecting
because here's what could happen on the other end."
It can be used for different purposes.
People can collect information with different ideas.
People may not agree with the business you're running
and they may want to harass you about it.
Federal government may come from information
without you intending for that information to be used the way
it may be from a different mission,
or a different service,
or different agency from a state or federal government.
Data brokers may collect your information
or may be able to collect information
through public records equivalent
and be able to request information
that we didn't intend to be used for the ways
marketing other things, other outreach.
So it puts a different spin on how we manage
and hopefully make people aware of what it is they're collecting
and how it may be used.
The other side to that is our record retention laws
in the state of Washington are very rigid.
So people aren't always aware.
We have data retention requirements
that range from six months all the way up to something like
30 years after the last relative in your family passes away.
I mean, this is a huge range of information.
Most of it isn't the last one,
but, you know,
this really means we have to be mindful
that we may have to hold onto this stuff
for a really long time.
And if I can say anything for my colleagues,
we are a lot of pack rats.
We are afraid to give up information
because you just know the minute you let it expire,
delete it, that's when someone is going to want it.
But we really struggle with those two principles.
I happen to have the public records team
that supports 100 or so public records officers across the city
on my team with my privacy team. And we sit down
and talk about our different ways of looking at data
and what that means.
So it's an education kind of all around.
And, you know,
someday, I hope we do look at that old Sunshine Law
to see if there may be some things
we want to look at now that we have the ability
to collect so much info.
We have petabytes of information,
petabytes of data at the city,
and a petabyte is about 20 million four-drawer
filing cabinets if we were to put them in document form.
We have more than one petabyte of data.
So it's an incredible amount of information.
And it really means that not only
do we have the public records to worry about,
but it can take a really long time to sort through all that.
Redact what needs to be redacted,
protect what should be protected,
but still being transparent.
So I hope that gives you a little view into kind of
where those tensions arise.
Yeah.
-Yeah, I would say, you know,
we have all of those same conversations and tensions.
Of course, transparency is a fundamental value that we have,
especially in the state of Washington
as a part of our government.
But then also protecting information,
protecting personal information to the extent
that we can by law.
And so that's just the line that we cross and sometimes --
or the line that we walk.
And then I will say, we do get complaints sometimes.
And there are privacy complaints about records
that have been released.
But normally, they're public records
I've been asked before about.
"Why does Washington State have such open records
regarding property ownership?"
And we just had to explain this is a decision of the state
and this is the information that's available.
There have been some protections put around some of that,
I think, for domestic violence victims and people
that have been victims
that want to be able to own property
without having their name attached to it.
And so there is some protections
that more recently have been adopted.
But really, for a lot of those things we just explain like,
"This is the policy that we have in the state of Washington
in terms of transparency."
But there are protections for people's, you know,
most personal information as well, so.
I don't know, do you want to add anything, Zack?
-Well, I just -- maybe I can add an example,
which is that the principles,
the privacy principles that I talked to local governments,
we're based in Washington State law,
and practice, and culture, and everything.
So we didn't just pull something off the shelf
and throw these principles out there.
We looked at our Public Records Act
and we looked at our exemptions and we sort of,
how do we generally do business? And transparency is one of them.
I mean, transparency, and following the law,
and giving out the information that's required.
And this is a long-held law in Washington State
and sort of an ethos of having really open government
in Washington State.
Now, it costs money and some folks gripe about it.
But it's a good thing in general, right?
Sunshine solves problems and everything.
But there are also some exceptions to that.
And that tension between what's your expectation of privacy
and when should something be sent out or not.
And if somebody requests somebody's email,
that's pretty standard.
I want to see this in your email
and public records officers dig it up and send it out.
But if it's more sort of personal information about
where do you work, okay, that's also public records.
That's not a big deal.
But people were also getting birthdays of state employees.
And so there had to be
a specific exemption passed in law.
And it was a bit of a discussion in the state legislature
about whether to exempt that one piece of information or not.
And it's like,
"Why would the public benefit from getting the birthdays
of public employees?"
And so there is an exemption for that now.
And so somebody is like,
"Give me all the information you have on public employees."
And the birthday of public employees is not included.
So the transparency has limits and it's a good thing.
And if people complain about it,
we usually point to the exemptions and say,
"Well, do you have a specific exemption?
And if not, then you should talk to the legislature."
And there's a process for going to get an exemption put in.
So it goes back to this idea of what's mutually beneficial
to hold and to work forward on the data and on the information,
and then working through what the lawmaking process is
and making sure we respect the will of the voters
who passed the Public Records Act as an initiative.
And then there's also cost to doing the redaction and cost
to maintaining the records.
And all of that is wrapped into what people expect
should be private and not private.
So those are the complaints of saying, "Well, this is the law.
We have to make this public."
It's like, "This shouldn't be public, right?"
Around the property records would be a good example as well.
And at the same time, that information,
that data can be used to do businesses
and create benefit to the community,
and to track trends or other things going on in the community
that are beneficial to know about.
-They didn't want our birthdays to send us cards?
No.
Anything that can be used to steal somebody's identity,
create false records, et cetera.
You can understand how that would be part of it.
But I like the birthday card idea.
I'll plan it out.
-Well, and you could request right,
until, I mean, you know,
I say relatively recently, my son is like,
"Are you talking two years or like 25 years ago?"
I mean, it wasn't uncommon
for people to get social security numbers sent
out in public records requests, right?
And so there is an evolution as we talk about
where was privacy and where is it now.
And so there's a recognition
that maybe we shouldn't be sending social security numbers
to a foreign country just because they asked, right?
Like, "Let's have a discussion about this.
What does the law say? What do we have to do?"
Same with security protocols. And there's other things.
And there are exemptions around that.
But the default is always transparency.
The default is always to follow the law
and to send the records out as required.
-I think what you're also mentioning is what
Sarah talked about was
how do we operationalize privacy given the amount of data
that is out there to be sifted?
How do we make sure
that information doesn't go out that shouldn't?
How do we protect against social security numbers,
for example,
birth dates, other things
that can be used for nefarious purposes?
And that is becoming more and more important.
So this area of public records
has really changed to be highly technical.
There's a lot of high tech in there
to make sure that we can do the right thing,
sift through terabytes of information
in some kind of timely way
so that a request doesn't take 20 years to respond
to for the amount of data that might be sifted.
-So what I'm hearing is we are special.
Okay.
I want to -- I know we've been talking a lot
about the laws in consumer versus public sector
and things like that.
But I do want to just see if there are any other laws
you think might be applicable to let folks know
that we have here in the state of Washington
in terms of that folks can walk away with and say,
"Hey, I heard about this thing that could apply to me
as an individual and what that might look like."
I might be leading the question a little bit
in the health data space,
but I'll let you guys take it from here.
Are there any other laws folks should know about?
-Yeah.
So there's a few that we have in the state of Washington.
And one of the first, I think,
important privacy laws that we have that
I think has become more apparent now is our biometrics law
in the state of Washington
and the requirements for notice and consent
for private industry to collect biometrics
and use our biometrics.
And another important law is the facial recognition law
that we have in the state of Washington.
And that actually just applies to government agencies.
But there's a really strong, I would say,
philosophy as a part of that law to do community engagement,
if there's any decisions to use facial recognition.
And that includes notice
and then ongoing conversations and consultations
with the community before making decisions
and then being really transparent about the technology
and false positives and those types of things.
So it's a pretty, I would say,
comprehensive law in terms of what a government is expected
to do to be able to use that type of technology.
And then most recently you mentioned the data law
or the health data law.
So last couple years -- couple years ago,
couple sessions, they had My Health My Data,
which has become a very,
I think, well-known privacy law for --
it's put Washington on the map.
And I say that because I have been
at a few national conferences and people are like,
"You're from Washington?
Did you have anything to do with My Health My Data?"
Because there's a lot of attorneys and companies
that are looking very closely at that law
and the requirements to treat health data,
consumer health data in particular
in a very respectful way, really.
And so the pieces of that law
that I think are so interesting was,
it was real -- it was part of --
partially a reaction to the Dobbs decision
of the Supreme Court
to protect specific reproductive health data.
But also, it was much broader than that.
And it was really meant to fill the gap of --
I mentioned HIPAA earlier,
and a lot of people think that HIPAA applies
to all of our health data,
but it really only applies to our health data
when it's in healthcare providers, or insurance,
or pharmacy, some sort of covered entity under the law.
But all of the devices,
you know, I do wear an Apple watch that collects, you know,
all of our health data or Fitbits
and all these devices that we use or different types of apps
we may need or use for our health,
this law now applies to that.
And there's certain rights that come to that,
including your right to ask to see that data,
the right to revoke consent from sharing that data,
and then also asking them to --
asking companies to be able to delete that data,
which is not necessarily a right, you have under HIPAA.
So it's sort of an interesting piece in terms
of the consumer side versus the government side.
So I think those are all important laws that we have.
And I think the other thing
that puts My Health My Data on the map as well
is the fact that it does come with a private right of action,
which very few consumer privacy laws have.
And I think this is one of the main ones that has that, so.
-Yeah.
-In fact,
the reason we don't have a state privacy law
is that private right of action argument, correct?
That's one of the many reasons,
but that's a hard thing to agree to, right?
-That has been a sticking point, I think,
for the law in Washington, yes,
for a broader privacy consumer law.
However, there was a bill dropped today
that expands the My Health My Data
to be broader than consumer health data,
even though consumer health data is defined very broadly.
So we'll see what happens, but it's still a conversation
that we're having in the state of Washington.
Yeah. -So more to come.
Yes. See you guys next year. Okay.
-Can I mention -- so you're talking about like consumer?
-Yeah, absolutely.
-And Katy mentioned some of these,
but there's many federal protections
that apply of course, to Washington State.
And Katy mentioned educational is FERPA.
The finance staff is Gramm-Leach-Bliley, so GLBA.
And HIPAA, of course, is healthcare, which is --
if I'm at a cocktail party and they say, "What do you do?"
I say, "I work for the state."
"Oh, what do you do for the state?"
And I always reference HIPAA.
I have nothing to do with HIPAA or healthcare
generally speaking,
but people know that HIPAA has protections for them.
And so I say,
"Well, I kind of do like HIPAA stuff for everything else."
You know, I mean, like, it's a point of reference.
And I think HIPAA was passed in about 1996, right?
So pre-internet boom, pre-data collection boom,
pre-big data boom.
But people know that there's protection there.
And so HIPAA is for healthcare.
We got education.
And then there are other federal laws as well as
the Federal Privacy Act
that protect Washington State consumers.
And then we see the marketplace shifting
because other states have passed what they would call
comprehensive data privacy or California has.
And so we see some consumers getting the benefits
of a California law or a Virginia law or other places.
And then there's a continuing discussion,
whether it's in our state or at the federal level,
about sort of standardizing those
and trying to figure out what can we agree
on protections for data, on use of data,
on access and rights to data.
And that's why I kind of keep pointing back
to our privacy principles because it's a great place
to find agreement, right?
Like if you're looking for a discussion,
where do we start in agreement that we can move out for?
How do we operationalize this framework?
How do we operationalize these principles?
How do we operationalize best practices
that have been in place,
maybe in other states or at the federal government for 20,
or 30, or 50 years?
-I think also, I was at Microsoft for two years
when the GDPR was somehow being operationalized
and they were in a panic over there.
"How in the world are we going to do this?"
Well, the answer was, we're going to do one thing.
So I don't know what the United States is going to land
on in terms of federal law if we ever get there,
but the one thing we do know is we want to work internationally.
Therefore, GDPR becomes a standard.
And that idea of having kind of a baseline,
which is pretty high bar, it's not a low bar,
did help with a lot of large international companies.
So we have seen some bleed over for privacy
where we can't quite get it together on a federal basis,
but you know what?
We do have some international precedent
that helps companies target one approach.
Yeah. -And Washington --
-Sorry, what is GDPR?
-The General Data Protection Regulation, GDPR is a EU,
a European and more,
set of regulations about protecting consumer law
and gives you rights around your own information.
-Yeah. I was just going to say
that Washington State is leading the discussion
in the other Washington.
Cathy McMorris Rodgers and Maria Cantwell as Democrat,
Republican House senate have really thrown in a lot of ideas
in a lot of discussion,
are leading the way to try
and find some kind of federal agreement on it.
And so like here we are in Washington State,
we're leading the nation in implementing our privacy office,
in municipalities setting up their privacy office,
in laying out principles that other states are adopting.
And our federal legislators are working on it
as well because it's important to folks in Washington State.
-More to come, indeed.
So this has all been so rich in terms of information.
I'm kind of wondering when we all leave here tonight,
where can people learn more?
I just want to throw this out in the middle of the conversation.
Are there resources available that you
or your teams have put together
or are publicly available
where folks can learn more about not only
some of these privacy laws,
but also what the programs are working on,
what those principles are, Zack, those types of things?
And how are you guys approaching the resources
that are made available to the public?
-Well, it's Privacy Week so it's super easy
to find privacy resources right now.
And Katy mentioned biometrics.
We've got an expert that we're going to talk to
about biometrics this week.
And we've got some fun games on our site.
So you can go to the privacy website at WaTech.
So I've got official -- I paid for this.
Okay. It wasn't given to me. I'm a state employee.
I had to pay for my own WaTech outfit.
But the WaTech is the central state IT agency and privacy
is right up there with security and strategy.
If you just go to the WaTech website,
you can find all of our Privacy Week activities,
including discussions with national, international experts.
You can see what we've done in the past.
We reference all of the work that we do.
All of our webinars are on there.
I'll let Katy kind of explain as well what is there,
but it's a great resource.
And then we share.
So if you work for local government
and you want sort of best practices,
or if you're interested in how to measure privacy,
or what other states are doing,
we've got a lot of those resources
either in our webinars or in our papers.
Our reports are there.
So you can sort of see how the state agencies are doing.
Or recent AI report that you just worked on is there as well,
I believe, right?
And so what else would you -- I mean, it's all on the website.
-Yeah.
You could go to privacy.watech.gov
that will get you to the WaTech privacy resources.
I would say for the public as well,
this was a little bit of an older resource,
but one that we put out early days of the pandemic
when a lot of the Wi-Fi hotspots were being created.
We put out sort of a responsible or things to keep in mind
when using public Wi-Fi.
And we had that translated into 36 languages.
And so I just double-checked.
And it is still relevant, most of those tips.
So for general public purposes,
but otherwise, a lot of our resources,
too, are for government agencies,
but then also can be interesting watching
and learning for other ideas about building privacy programs
and those types of things.
-Awesome.
-And Sarah is responsible for our site.
So you can talk a little bit about where to go.
We do have a website in --
-Seattle.gov/privacy. -See, there you go.
And we have history of our privacy program,
where we came from, how we developed it,
a principles-based approach similar to what we saw
from our friends in the state.
We worked with folks from academia.
We worked with the ACLU,
we worked with folks in industry
to help us build those principles.
We also have information about the surveillance ordinance,
about responsible artificial intelligence,
part of our program.
We have all kinds of resources about what laws apply
and a little bit of information about these.
Do we reference back to the state as well?
I haven't looked recently. -Yes, we will.
-Yes. We will do that.
But anyway, you can find out more about the city.
You can find out more about us.
You can find out more about
Seattle Information Technology as well.
I will say that our chief technology officer is sitting
right over there.
And so Seattle IT is also a search
that you can do and find out a little bit more
about information technology at the city.
Probably the best thing about where we are now in the 10 years
that we've grown,
privacy is interweaving into how we acquire technology,
how we work on contracts, and weaving that into our awareness.
So a lot of information on that website about that journey.
And then how to contact us if you have any specific questions
that don't get answered today.
-Awesome. Thank you, guys. We do have a little bit of time
for a couple more questions, perhaps.
And what kind of 2025 panel event would this be
if we did not talk about the intersection of privacy in AI?
So here we go, winding up.
What impact do you guys think that the interest in AI
that we've seen kind of explode,
especially over the last few years,
what impact has that had on privacy,
the field or the domain in general?
-It's had a significant impact on my role in the state.
And speaking of chief technology officers, yes.
So while I do work closely
with our chief information security officer
for cybersecurity,
I would say right now I probably spend a lot more time
with our chief technology officer working
on our artificial intelligence initiatives
in terms of responsible use and adoption.
And we just published --
oh my gosh, I think there's nine different deliverables
that were a part of the Governor Inslee's Executive Order 24-01
on artificial intelligence.
And we have -- we're the lead agency for four
of those deliverables.
And they're now published on our website
under our artificial intelligence resources.
So those have just gotten published,
and now we're laying the groundwork for adoption
and operationalizing those types of risk assessments.
And really taking a look at how AI
and the intersection of privacy
especially are becoming inseparable.
I just did an exercise
where I looked at seven different
responsible AI frameworks and privacy is in each one of them.
So it's a very strong correlation.
And I would say transparency is also in each one
of those as well.
And so it has really taken over a lot of the work
that we're doing in our office right now.
But that, I feel like the taking
on the artificial intelligence side of things,
too, has really,
I think,
magnified how important it is that privacy work
with other disciplines as well
because it's such a multidisciplinary approach
that we need to take to adopt this technology responsibly.
So it is, you know, security, legal, technological experts,
our records people as well
were having all those conversations at the state.
-Awesome.
-I talked about AI as kind of a glitter bomb.
It kind of -- when it became --
when it hit the scene, it became everywhere all the time.
It couldn't get away from the idea of artificial intelligence.
It captured our imagination.
And we kind of laugh in privacy
that every year there's something new.
Well, this has been the something new,
I think for the last two or three years now.
There's such an interest in what this technology can do,
what problems can it solve.
And we have 42 or so departments,
depending on the time of year,
about 42, in the city of Seattle.
And each one has a mission.
And each one is interested in,
"How can I do more with my resources?
How can I use new technology to help me get where I'm going?"
So that puts a lot of attention
and focus on how information technology
all up between security, privacy,
other compliance structures.
How can we enable that?
How can we make that happen?
So while our folks are getting super excited
and vendors are running all over the place
getting people super excited,
we're trying to catch up a bit to make sure
that we are doing it in a responsible way.
And that's why you hear the words responsible
artificial intelligence.
I think maybe we all heard that most AI,
some of those large language models,
had gone through the internet
and sucked up everything it possibly could to get smart.
What's left?
Well, all the data maybe we have,
all the data that governments have.
And some of that information needs to be protected.
Critical information are protected from its individuals
whose information is being potentially exposed.
So we have those broad conversations
about these really big, large language models
and how do these solutions need to be responsibly used.
City of Seattle was one of the first
to come up with a generative AI policy
about how we would use generative AI
to make sure there's a person in the middle.
That's one of the largest parts of this,
that we are paying attention to potential bias.
We are looking at how these solutions can
or cannot be helpful and what they might do to be harmful.
So we select carefully and make sure that the solution
we are applying them to does not do harm.
So while we sound like the downers,
we're all very excited about also what
artificial intelligence can do to make our lives easier
from the privacy front.
I talked about all that data for public records.
We got to get some artificial intelligence in there
to help us make sure those requests can go quickly
with the amount of data we have.
So many fronts and it all landed over here in privacy.
So Sarah was the one who worked with an external group of folks
who were experts in the field
to come up with that Generative AI policy.
And now, a general AI policy is next.
And then a program that helps our departments
who are very mission-driven,
figure out what solutions are appropriate
for what they're using.
Rob, my boss, here has made clear I'd like that
as many solutions made available as we can in a responsible way.
And so that's very much a focus of what we're doing.
So it's not only what it can do to help us do our job better,
but also how we can enable folks out there in department-led
as we like to say,
there are our internal clients get what they need.
And then finally, I think it is a train that's left the station.
Often technology --
new technologies kind of get going
before we're aware of all the things we should be aware of.
So we're staying very much close to our colleagues
making sure we're understanding what can go right
and what can go wrong.
Has everyone kind of been familiar with
when New York City went live with a chatbot
and some wrong information got shared?
Google that one for a minute or Bing it.
Take a look.
What happened is a reliance on information from an AI engine
for a chatbot for people to interact
and get questions answered
and didn't always give the right answers, as a matter of fact,
gave illegal answers occasionally.
Those are the things we want to be aware of.
We don't want that.
We really don't want to be on the front page
because we did the wrong thing.
We want to be on the front page
because we were thoughtful about how we did the right thing.
We're having some very productive
and good conversations.
We have 20, 30 some odd solutions
that are already approved in the city for very specific uses.
We're looking at how we can make more available all the time.
So that's kind of the AI, the glitter bomb that continues
that we are trying to use this technology.
Well, I don't know if anybody has had a chance
to use in your area of expertise AI and see what it generates.
What I can tell you is a SME is it's about 50% to 75% accurate.
And then I got to kind of make sure I look at what's
not correct,
or isn't my voice,
or isn't taking into account maybe the considerations
we have around other uses.
So a terrific tool,
but should not be on its own answering questions
without a smart person in the middle.
-For folks that are interested in the specifics,
they should look at the executive order
from Governor Inslee.
And they should look at some of these reports
because they're the specifics of what you should
and shouldn't put into these models,
of how you can use them efficiently and effectively
for benefit for folks,
of questions around using them for first drafts,
or not how they interact, or create public records.
So there's all sorts of pieces
that were addressed in the executive order
that are very specific
and that touched on many different agencies
at the state level.
And it's just really, I won't say groundbreaking,
but very important work for this glitter bomb
that is all over the --
I mean, it's a great analogy because it's all over the place,
and it's very sparkly,
and, you know, we like it until it's still, you know,
stuck in our hair three days later or something.
So that's a great place to look for the specifics
because sometimes, you know, the details are very important.
And in this space,
it's important that people are involved in it,
that the impacts are understood,
or that the possible impacts before they adopt it
are understood, and that they're following the law,
and that they're correct and accurate
and those sorts of things.
And that's like, as you said, it's about responsible use.
And so I'd go look at the work that Katy and Nick
have done at the state. -And a lot of other agencies.
-All right. Thank you all.
I'm not seeing any questions in the question box.
I promised around 10 minutes.
-A few hands.
-Yeah. We can just hand the mic.
-All right. I'll stand in front of class.
My name is Sabrina Roach.
I'm the statewide digital equity analyst
in the governor's office of equity.
And I have a little bit of a request actually.
I'm looking for guidance and resources with some urgency.
I'm getting requests from immigrant rights networks
from across the state for data security advice
for their organizations
and accessible consumer privacy education tools and curricula
for Know Your Rights trainings. And with Governor Ferguson's
newest executive order on protecting immigrant families
and responding to family separation,
will the family separation rapid response team include
a surveillance self-defense
education dissemination component?
Is that an opportunity?
And then broadly with less urgency,
like where does this live within state
and municipal government consumer education?
I know the AG's office used to do that during a week, a year.
And I think it's great
that it's somewhat distributed across various departments,
and communication channels, and direct service providers.
I would love to see or be part of a coordinated --
like distributed but coordinated body of work on this.
Thank you.
-I think we are all responding to variations of that question.
I think we'd like to probably take your information
and make sure we continue to have this conversation
about data, and privacy,
and other aspects of the equitable access to information.
-Yeah. And I love that idea in terms of
how distributed some of the resources might be
and trying to centralize those a little bit better
to make them more accessible for everybody.
And I do work with Megan.
We were -- your director and office of equity
was a part of the executive order
as well with the accountability framework,
which ties right into many of the issues
that you were raising.
And so I think especially around sensitivity
to collection and use of immigrant data
is going to be very important for the state to look at
how that's collected and used.
And it has always been a focus.
But I think particularly right now,
we're concentrating on sensitive types of data.
-So it's all happening right now.
We don't have -- I wish I had a handbook for you right now.
That's not there, but if you want to be a part of building
that handbook, I think that's something we should talk about.
-It's part of the body of work
you're talking about updating the questions from nonprofits.
-Of course. Yeah. -Okay. I see cards.
I see writing on cards happening for additional questions.
-So as privacy and data professionals,
what keeps you up at night? -What keeps you up at night?
-In HR, there are things that I think about
that I don't think the average person is thinking about
in terms of employment and things of that nature.
I'm wondering, are there similar things with privacy and data?
As you said,
the organization doesn't think about these things, but we are.
And I'm fearful about this. -We know what we know.
So what I don't know is what keeps me up at night.
In any organization, there's what we like to call shadow IT.
"Oh, I have a credit card; I can just go buy that thing.
No one is going to notice. It's really not a problem."
The work that we do at the city
really doesn't leave us a lot of places
where we shouldn't be concerned.
Not only about privacy,
but about records retention, public records,
if somebody asks for something.
So I have a hard time sleeping at night
when I spend too much time worrying about folks
that are not using the review process or find that cumbersome.
And so not only do we have privacy and, you know,
other issues around that, there's security concerns.
Not all solutions have the security requirements
we need or the compliance concerns,
operationalizing things,
and how are they supported or not supported.
My mother told me something true that I have carried with me,
and I will share with you
and you can see if this makes sense in your life.
A lot easier to get into things than it is to get out of them.
So we're the backend of somebody got into something
and now we got to dig our way out if there are issues
that we're not considered at the time of acquisition.
So stuff I don't know, credit card purchases,
we're not aware of;
it happened, it's out there and it's dealing with our stuff.
And I will probably not sleep well tonight
as I think about that a little bit more,
but that's really it, what I don't know.
What we aren't able to review and know about.
-I think that's a similar theme for us
where we still -- you know,
as much as we've tried and thank you, you know,
for there being International Privacy Day,
and people caring and interested in the topic,
we still are a little bit working to get
ourselves included, especially in big projects, right?
That's a real issue
where I hear that from all different levels
of privacy professionals is that I could have helped
with this issue that happens later
that you find out about if I had been, you know,
brought into the project sooner.
And so I think that continues to be an area
where we're trying to raise awareness
and then trying to make sure everybody understands
that there's a value add to having these conversations
when you're, especially, building new technologies;
because rework is very expensive, and time-consuming,
and especially being sensitive to all of the new laws,
and regulations,
and ideas about how data should be collected and used.
Having those conversations earlier in projects
is really where I still try to make sure we're at the table.
-And I'm going to add one other caveat
that some of us remember when you just weren't home.
Do you remember that?
When there -- you know, you just weren't home.
There was -- you got to call back, right?
We've gone into a space with the younger generations
that have always been connected, always online,
and have an idea that there is no privacy,
everybody has got everything anyway.
Well, when you bring that to the workplace,
that makes it difficult
to make sure they're connecting to professionals
around issues of data privacy, availability,
open -- all the things.
So I worry about --
that does keep me up at night sometimes too.
The evolution or lack of concern and personal privacy
that people might bring into the world.
Like please check your privacy settings on everything.
You know, that worries me
and bringing that into the professional world
where that can have an impact in the work we do.
-Okay.
We have like time for maybe one more.
-Yes. Go ahead. -Well, I'll ask a quick thing.
Thank you so much for the information you shared today.
You talked all about your principles in privacy foundation
for your different programs.
With the introduction of AI,
specifically Generative AI and all the work
you've done around policy,
did you find that your privacy principles were
flexible enough to be applied to AI
as a processing of personal information or data?
Or did you make updates to them as you applied
privacy principles to that type of processing?
-Yeah.
I'm going to try really quickly --
I have realized that I'm not sure if without the mic,
the voices carry appropriately.
So I'm going to try to just regurgitate a little bit.
Speaking a lot about the privacy principles,
you know, programmatically that we have,
have we found, since AI came around,
that our privacy principles are flexible enough
to be adaptable to address any kind of issues around AI?
Or are they -- have they needed to be updated
or a generation of new principles specific around AI?
Is that --
-And because she was so involved in this,
I can tell you we did have to add.
So general data privacy covers a lot,
but then there are other things like person in the middle,
bias concern;
things that AI can do
and generate that go a little beyond just the data privacy.
So it's data privacy plus some specific things
to that technology.
And so if you go on our website,
take a look at the Responsible AI program,
you'll see what Sarah crafted so carefully
around specifically accuracy,
some other things that we do around AI.
-Yeah.
And for us, too, it's a yes and.
So we have our privacy principles,
but we also -- we haven't formally adopted.
We have them in the interim guidelines.
The AI principles that we basically got from NIST
with the added one -- sorry,
the National Institute of Standards and Technology,
AI Risk Management Framework.
But we also added public purpose and social benefit
for us for an additional principle for the state
just because, for government, that's an additional principle
that we wanted to be added to our AI pieces.
-Okay. I'm just kidding.
I know we have like one minute over,
but I did see one more question.
Do you want to go ahead and ask? -Sure.
So as a technology partner supporting many municipalities,
cities, and state agencies,
what is your vision in your technology partners
that you work with throughout the year
on how to best align with the frameworks you've put in place?
Now, you've answered a few of them,
right, like the websites, the privacy websites,
but like you say,
you are worried about the person who's swiping the credit card
and -- you know,
what is your vision on
how best your partners can support your initiative
around the framework data, AI, and the future of technology?
-So we love our vendor partners.
They can get our clients really excited about solutions
before we've had a chance to say, and.
There's a privacy program.
There's a security requirement. If it has AI in it,
we should have a conversation about how that works.
So I think it's ensuring that there is a conversation
that includes information technology
before we get folks too excited about any one solution.
It's funny,
I think when we were doing a lot of work with intelligent cities
or smart cities technologies,
we would've folks that had developed products
for the private sector without consideration
for how that transfers to the government world.
And because of open records, because of public records,
because of privacy, because of security,
because of critical infrastructure,
and some of the things that are unique to government,
some of those products and approaches
don't translate exactly.
So it's being smart about the laws,
being smart about the connection back to working
with information technology and understanding
that we're really fast-forwarding on a lot
of technologies,
but we also have a lot of really old stuff
that we have to support because that's the only thing that works
to run certain programs or certain services we offer.
And it can be a really interesting
and varied environment.
So taking a little time --
and it takes longer to sell to government for a lot of reasons.
But one of them is making sure
that we can't really do the bleeding edge.
We need to kind of make sure
that whatever solutions we look at work with our environment.
-And that's a question that my boss,
the state CIO usually gets.
So I'm going to stick to his talking points on this one
because I have heard him give these answers several times.
So something
that he likes to emphasize for our technology partners
is that it's not so much a one-and-done anymore.
It's not going to be just a one-stop solution
to solve all of our problems.
It's the expectation that our partners work with us
and then with other partners as well to help integrate systems,
and work well across the enterprise,
and work together to achieve the state's strategy,
and then being familiar with the state's technology strategy,
and how we're trying to build projects
that can kind of go the distance,
and then also be agile and updateable along the way.
So that's sort of the vision that he shares.
-Awesome. Okay. Well, thank you all.
That ends our panel this evening.
So thank you, panelists.
And thank you all so much for coming.
Always reach out, email, website,
seattle.gov/privacy, and website.
-Oh. Yeah. And you can email us. [Indistinct]
-Yeah. Thank you all so much for coming.
Happy Day to Privacy Day. -Thank you for the time.
It's good to meet you all.