From compliance to strategy with Fenwick & West

Summary What happens to a privacy program after it declares itself ready for GDPR? According to Marcus Morissette, a privacy lawyer at Fenwick & West who was a CIPP before there were slashes, most of them stop evolving. Host Ethan Prete sits down with Marcus to unpack privacy 2.0, where compliance is table stakes and the real job is getting the business to its goals inside the company's risk appetite. Marcus explains why he told his eBay team never to say no and never to say yes, why the enforcement everyone feared turned out to be security's problem, and why the next generation of privacy lawyers has to understand the technology, from hashing versus encryption to the fact that no US law contains the word cookie. He also walks through Maslow's hierarchy of data, the four-layer pyramid he built with Aaron Weller at Concise Consulting, and why a company still worried about the CIA of its data isn't ready for AI governance. Along the way: the CIPA consent banner trap, an AI drone use case that sounds like science fiction, hiring for business acumen over law degrees, and how to make a company regulator-proof. Essential listening for privacy professionals, marketers, and anyone deciding where privacy should sit in the org. Chapters 00:00 Introduction 02:35 Doing privacy before privacy existed 05:45 Why marketers should own privacy 08:10 How GDPR built programs that stalled 10:45 Privacy 2.0 is business enablement 12:30 The hashing versus encryption test 13:15 No US law regulates cookies 14:30 The CIPA consent banner trap 19:50 Maslow's hierarchy of data 24:15 What AI governance actually means 28:15 Building and funding a privacy team 34:15 Predictions for the next three years 37:30 Making your program regulator-proof Takeaways - Compliance is table stakes, not the finish line. Privacy 2.0 is business enablement: getting the business to its outcome inside the company's chosen risk appetite. - Privacy teams are guidance, not decision-makers. Never say no and never say yes; act as a risk Sherpa who presents the upside and downside so the business can decide. - The renaissance privacy lawyer has to know the technology. If you can't explain hashing versus encryption or follow the ad tech spaghetti diagram, you can't advise your business through it. - No US law regulates cookies by name; they are regulated as a sale because regulators didn't understand the tech, and consent banners deployed where they weren't required have become CIPA litigation bait. - Maslow's hierarchy of data runs security, privacy, information governance, then AI governance. A company still worried about the confidentiality, integrity, and availability of its data is not ready for an AI governance conversation. Connect with the Guest Marcus Morissette LinkedIn: https://www.linkedin.com/in/mmorissette/ Company Website: https://www.fenwick.com Sponsor Brought to you by ObservePoint, the web governance platform that helps the world's largest enterprises see exactly what their websites are doing, and prove it. Learn more about ObservePoint: https://www.observepoint.com/