Ethics Meets Innovation: The Human Side of AI Governance & Privacy - Emerald De Leeuw-Goggin - S9E36

0:00You can have the best policies in the world, but if no one's reading them or understanding them, you are in a bad place. Of course, it's also going to be a busy time for data protection and privacy people, but it kind of starts with making sure that that whole architecture is sound. Because if these things start going out on their own and making their own decisions and doing all of that, we better make sure that is all really secure. On top of that, making sure that you have the appropriate guardrails before these things are implemented. These are our responsible AI principles and we will build responsibly by adhering to them.

0:33The technology can move along, but these principles are stable. That's a very critical mindset shift for people. It's not that you're going to throw stuff that you value out the window because you have a new piece of technology in your hand. It can't be that way. On today's Legally Speaking podcast, I'm delighted to be joined by Emerald DeLeo-Goggin. Emerald is the global head of AI governance and privacy at Logitech. She's also the co-founder of Women in AI Governance, a professional network advancing women's leadership in AI regulation, policy, and governance. Emerald has been recognized as one of the top 100 European female founders to follow.

1:08She's been awarded European Young Innovator of the Year, Privacy Executive of the Year 2023, and Women in AI Ambassador in 2024. So a very big warm welcome to the show, Emerald. Thank you so much. I'm delighted to be here. Ah, it's an absolute pleasure to finally have you on the Legally Speaking podcast. Really excited for today's discussion. But before we get into everything you've been getting up to, which is rather impressive, we have a customary icebreaker question here on the Legally Speaking podcast, which is, on the scale of 1 to 10, with 10 being very real, what would you rate the hit TV series Suits in terms of its reality of the law if you've seen it?

1:47I've definitely seen it. Of course I've seen it. And, like, it's a great icebreaker. but like obviously it's like a fan fiction right but what is very realistic is how many people have pretended they read the whole contract so I kind of have to give it a two for that reason and I think it has also taught us all that the standards for dressing are high and it's given us great skills when it comes to I guess slamming a file shut and leaving the room with drama so we could arguably give it one more point for that so between a two and a three a very specific and Justify 2.5. And with that, we'll move swiftly on to talk all about you and your impressive journey.

2:28So Emerald, would you start by telling our listeners a bit about your background and career journey? Absolutely. So I'm half Irish and half Dutch. That kind of explains the Emerald de Leo part, though I am married now. So Goggin, I've hyphened on, but it often looks like super large. It's a long name. And also, obviously, people have known me by this name for quite some time now. So I grew up in the Netherlands, did my legal education there and moved to Ireland in 2012 to do an LLM. I specialized in that year on the GDPR, which if you know the timeline for the GDPR, it actually only became fully enforceable from May 2018.

3:05So 2012 was really quite early. And maybe out of the sheer sense of always wanting to have some autonomy and having nightmarish ideas about having a boss, which in reality really isn't that bad, trust me, I decided that I needed my own privacy technology company. The rationale for this was very much that I had spent so much time with this particular regulation that I was kind of going, okay, this is really complicated. It is going to have global applicability. And who has time for this? How do I scale myself? So I also had a fair dose of imposter syndrome because at the time I was reading fairly technical papers about like data fragmentation in the cloud because this was like when cloud computing was becoming a thing which just kind of makes me feel really old but basically I did another master's then in business information systems and I basically started my own company which put me on a fairly interesting trajectory of highs and lows but also gave me a lot of skills that are very useful to me today because I'm currently Chief Privacy and AI Governance Officer at Logitech.

4:17Now, I always say I like to have many spinning plates. So in addition to doing that, I'm also co-founder of an organization called Women in AI Governance. And I'm also a blogger for the past two-ish months, I would say, focusing on executive style and dressing. So I do a lot of different things, but I'm interested in a lot of different things and it's good to be busy. And that's where we bounce off each other because like you, I like to have various different interests and it's incredible what you're doing. So let's unpack some of that then. Let's start with Logitech because you obviously oversee the AI governance and privacy.

4:54What does your role entail there? Tell us a bit more. So Logitech is a company that's active in 100 plus markets and many, many countries have laws that regulate data protection, privacy, AI. So me and my team were responsible for ensuring compliance across all of those regions. But I'd like to say that it kind of, the approach is not just law driven. We've taken a values based approach to our innovation. We've published responsible AI principles to kind of say, look, even if there's no law, we will adhere to the principles of transparency, fairness, privacy, security and accountability. And the reason we do that is because it's the right thing to do.

5:36The risks and potential harms of AI don't go away if there's no law. So making sure you have specific controls in place that do their very best to mitigate any of those harms, that's obviously really important. On top of that, obviously AI governance is a huge area now, right? And of course, responsible AI is part of that, but there's also just hardcore legal compliance with things like the European AI Act obviously being the most famous law and the most prominent one at the moment. So ensuring that product services and internal efforts comply with those laws is a critical part of what we do. And a lot of moving parts as well, particularly in the world that we're operating.

6:19And with that then, just again, because it's a really interesting role that you have and we try to get that career side of things. What does a typical day look like for you if there is one? Well, I'm really, obviously, because I'm the head of the department now, a lot of what I do is strategic. So deciding, okay, what is it that we're doing? What is important? What should be prioritized? How are we going about it? But then going a level deeper, I'm also still quite hands on. I don't want to say that, oh, I just delegate everything. Also, just delegating everything gets really boring and you lose your edge.

6:54So I would encourage any listeners to make sure you still get stuck in because like at the end of the day, this is moving super fast. And that's always a challenge, particularly if you're in technology law, it's moving at such a pace. It's very hard to keep up with everything. So making sure you're actually still doing real work. So what does the real work actually look like? So it could be anything from ensuring your policies actually align with the current state of technology and um i actually did a linkedin post about this it got a bit like it was very polarizing which in a way is a good thing right but it was about the concept of policy velocity and ensuring that you actually update policy more frequently now um basically in terms of what is allowed and what's not allowed and your opinion on these technologies so that's actually a big part of it making sure that we're responding to the market making sure we're responding to the business and what the business wants to be doing.

7:51I always am a big believer at running at the problem. So sticking your head in the sand and running away from your problems is a very poor strategy. Your problems only get bigger. So it's much better to look at governance and compliance as a business enabler and giving people clarity on what's right and what isn't right and where they need to reach out than being weirdly vague or ignoring it or being overly restrictive because banning also doesn't work because then you get a shadow IT or a shadow AI problem. So making sure that you're pragmatic and business focused. A huge part of it is training because you can have the best policies in the world, but if no one's reading them or understanding them, you are in a bad place.

8:37There's obviously a contractual element to this because everyone is developing AI terms, um ensuring your third parties are actually aligning what you need them to do if you're the third party making sure that you're adhering to what your customers um need you to be doing um and then there's ai risk assessments privacy impact assessments all of the things that come with a robust privacy program and there's responding to new legislation and tracking and monitoring that. So there's a whole bunch of stuff. So maybe what's helpful is if I kind of break down how our team is structured, because that might give you a little bit of a feel of like what this actually looks like in practice.

9:19So I lead the team. There's a privacy operations team that looks after data protection impact assessments, specific privacy related training, data subject rights requests. So things like I want to delete my data, I want a copy of my data, all of that stuff sits in privacy ops. Then we have what we call privacy legal, for lack of a better word. We're all part of the legal team, but that's very much the actual counsel. So the lawyers who are responsible for contracts, legal advisory, policy writing, all of that stuff. That's not to say that these people don't do training. They absolutely do. I have program management.

10:01So So obviously, project and programs need to be managed across the board. And then there's the AI governance team, which, of course, is growing and evolving at the moment because it's a new area. And that really consists of the people responsible for AI Act compliance and compliance with other AI laws, ensuring that our products and services comply with our own responsible AI principles. And that has been a structure that works really well. But the AI governance ops obviously sits in that team. And maybe in the future that will evolve like privacy did, but I'm a big believer in responding to business reality.

10:35And so far, we're in a good place. Yeah. And thank you again for being so thorough on that. And I love the point around the problem. And we've had Penny Mallory come on the show, who is one of the UK's first female rally driver championships. She used to race around the world with Colin McRae and various others. And she says, think about what is great about this problem, you know, and approach it from that perspective rather than, like you say, running away from it and hoping things might get better. And I absolutely echo what you're saying there. And you touched on AI governance, and I think still a lot of organizations are trying to tackle it.

11:06So, again, going a little bit deeper on that in terms of global AI governance frameworks that you've built, what tips or advice would you give for other leaders or senior people that are trying to think about actually building these out within their organizations? Well, the first thing I would say is stop looking at AI governance as something that's like the separate thing from the rest of the business. And I don't mean for that to be an abstract comment, because that actually really irritates me. I'm very pragmatic. But I think there's a real sense that like this is something that like this little team over here does.

11:39And that's not how this can work. I think the reason that you're seeing a lot of AI governance teams pop up is because somebody has to do the orchestration and somebody has to oversee that things are happening. But I'm certainly not arrogant enough to think that it's just me and my legal colleagues who do AI governance. That would be a very bad place to be. So I think it's to figure out that cross-functional team that needs to be in place to actually implement the controls. Obviously, it's the legal team's responsibility to clearly communicate what the law requires and to figure out who in the organization is best positioned and equipped to do those things.

12:21Like it's not a legal team who does technical monitoring of things or who does data cleansing. You know, it's not what we do. We just need to make sure that the right experts are looking at those things. And then making sure that you really have like good senior stakeholders who are driving those pieces. because there's no point in trying to like boil the ocean on your own. So you really need to have a good sense of partnerships across the company. And that was also true for privacy because obviously privacy by design comes with user interface implications, data collection implications. But I feel that AI governance is much more distributed again.

13:04so I think we always talk about soft skills and things like that I really despise that because I think they're more difficult to gain and often people are naturally good at some of these things absolutely learn them but that becomes incredibly important because your relationships need to be really really strong and then another thing I would say is make sure you're not behaving like the data police because that makes people afraid of coming to you and that's the very worst situation for you to be in I would much rather be in a situation where people come to me with something that they'd rather not tell anyone and that they feel comfortable enough telling me and then we can go and address it because everything can be figured out but making sure that you have those relationships and that you give people that sense that you can be a trusted partner to them that's worth investing time in.

13:58Yeah. And the culture piece is so, so true because that'll bring out the trust piece and, you know, be that collaboration partner rather than someone like you say, that's the police. Cause I think that can get people's backs up. It doesn't enhance adoption, doesn't create fusion, which you want. And yeah, again, I remember when a mentor said to me very early on, Rob, when it comes to things, you know, there's never anything wrong. There's just something missing. And I think that's very true in this regard as well. You know, sometimes, you know, it's just maybe that piece of information, that understanding of certain things, whatever it might be makes it a little bit challenging.

14:27Okay, now you're part of a global business and global frameworks, they ain't easy. So what are some of the challenges you've seen in terms of aligning frameworks across multiple jurisdictions and how have you managed to overcome them? Yes, I think that's a really important question. I might use privacy as an example here because obviously it's a much more mature discipline and maybe more relatable to people who are listening. So obviously one strategy, and not every company will want to do this, but one strategy that I find is helpful is to look at privacy as a business enabler and say, hey, why don't we just take our controls and implement them globally?

15:05So you're implementing some of the highest standards globally. That doesn't mean that you don't have specific local things you need to solve, but it does make that a lot easier. I think that there's a very strong argument to approach it that way, because people like to buy from companies they trust and ideally from companies that aren't creepy. And that's again, it ties back to your values. Like I kind of like to use a three step framework where I say values inform your culture. And then on top of that, you build your infrastructure. But if your values and culture are off, that infrastructure is not going to work.

15:41So I think that is also true for if you're implementing these global controls, because you're kind of saying to your organization, hey, this is how we think about this stuff. We think about this. We don't want to just give people rights over their data in a place where they have a UK GDPR or a European GDPR. We actually think people deserve rights to their data everywhere. Why don't we just say this is a global control? So that's one of the things that we've also done is we don't say, hey, can you like, we'll just hang on to your data, even if you don't want that. It doesn't make any sense because these people probably won't buy from you again anyway.

16:20So I think there's a real argument for just having a gold standard and implementing that globally. And then obviously taking a risk based approach to your other markets and making sure that you look at any local discrepancies and implement those specific controls in those regions. That's one strategy. And I think that there's a lot to be said for that. Yeah. And it's clearly been working and everything you've been doing seems to just touch the gold. So, you know, congratulations on what you've been getting involved with. We're going to talk about the acts now, Limitmore, Dieter, and some of your kind of general thoughts, because the EU Artificial Intelligence Act, European regulation, first comprehensive regulation really on AI.

16:56What effects have you seen it having on legal and tech industry specifically? Yeah, it's a good question. I think that there's a bunch of different things going on. I think a lot of, there's always a lot of people freaking out about new laws. So it's very recognizable from GDPR. I think it really impacts organizations very differently. I think if you look at how it's structured, right, there's basically no risk. Then there's what I would call transparency or deception risk. And then there's high risk and then there's completely prohibited. Those are kind of the various buckets that your efforts could fit into.

17:39Obviously, almost all obligations are tied to high risk AI systems. And I think the panic is a little bit unnecessary because a lot of the themes you see in those high risk AI systems, you kind of in your gut already know that that's something you might need to look at because it's things like, you know, biometrics, emotion recognition systems, using AI systems for hiring, promoting, firing. So things that like can really have a meaningful impact on people's lives. So given the fact that the controls are really tied to things with, I guess, big impact, That doesn't really surprise me. I think where we so that's kind of obviously there's a bunch of work you need to do if you do fall into those buckets.

18:27But I think if we are to give people protections in those scenarios, it's not completely unreasonable to regulate those areas. I think then the other piece, then the transparency risk, that's things like what it's called deep fakes in. But that's not just the deep fakes as you might know them in popular culture. You know, it's not just a politician saying things that they didn't really say. It's also images of objects that don't really exist that should be labeled. So it goes quite far. And I was I was quite surprised myself when I saw how broad the definition of that was. But at the end of the day, you're kind of labeling AI generated content.

19:07And that particular obligation comes into force from August of next year. and again that again doesn't seem unreasonable to me to just not want to not deceiving people with content because I think everyone and I like not in not with my corporate hat on I think everyone is a little bit kind of going okay with how great this AI is getting how are we gonna know what I can actually buy um like is this really achievable if I see beautiful imagery is that real is this person real um we should at least know like i don't think that it's binary that ai generated content is bad or that it's good i think it always depends on the context and the purpose and also in some cases how transparent you are about it but i think again regulating that is not that strange but most of the stuff a lot of companies are doing is actually not that heavily regulated.

20:06So I think there's a lot of panic initially, and then people kind of sit down and go, okay, maybe it's not everything that's in scope of all of these obligations. Maybe it's only certain things where the impact on people could be high. And that to me is very European. Today's episode is brought to you by Clio. Are you frustrated with your current legal management software? You're not alone. And thousands of solicitors across the UK feel your pain. However, the hassle of moving all their existing client and case data holds most back from switching, prolonging the frustration. Clio is here to help.

20:43Their dedicated migration team will be with you every step of the way while you transfer your information. And if you have any questions, you'll get award-winning support available 24-5 by live chat, phone and email. So help is always there when you need it most. It's no wonder Clio is consistently receiving five-star ratings with ease of use and top-notch service. If you're ready to leave frustration behind, visit clio.com forward slash UK to learn more and see why Clio continues to be the go-to choice for solicitors across the UK. Now back to the show. Let's stick with the European theme then with the, but from a sort of corporate perspective, thinking of the EU AI app then, because there's going to be lots of areas or what areas do you think tech companies will struggle to comply with, particularly in relation to the act?

21:31I personally think that if you have your ducks in a row you should be able to do it. It's a lot of the time people not looking into this early enough, not like thinking that they're gonna stop the clock. I know that there's still some discussion about that so I can't comment on that personally because obviously I don't work at the European in commission, but that seems to be still a point of discussion. At least I see it pop up in the media quite often, but I think you just like everything else, you need to get ahead of it. And again, it's always people, processes, and technology, and you see in that order.

22:14So figuring out, okay, who needs to be involved? What are the processes that need to exist for us to do this? And then are there technology solutions we can deploy that can help us? And obviously, those markets are also maturing. Certainly, when I started in privacy tech, it was what, 2013? Privacy tech is a really mature market now. And there's a lot of stuff that can be used to comply. And some of those solutions might also help with some of the stuff with the AI Act. And I'm sure there's going to be even more advanced solutions in legal tech for compliance going forward. Because with new regulation, in addition to people complaining about being cumbersome, it also creates entrepreneurial opportunities for people to innovate and create new things to help.

23:01Because no matter what the law says, visibility of what's going on in your organization will always be important. So technology probably has a role to play here. So there's always an opportunity that comes with these laws as well. Yeah, I always say there's going to be the complainers and there's going to be the contributors. the people that are going to get busy kind of figuring it out and getting on with it. And something you've been getting on with and has been super successful, I want to talk about now is your women in AI governance. So what inspired you to co-found it? So we really weren't that intentional about it initially.

23:33So it really came to be when my co-founder and I said, look, it's a lot of the same commentary that was like pushed into our feeds on LinkedIn. It was always from the very same people. and both of us know a lot of leaders in this space who may not have been the ones that were constantly popping up so we said hey why don't we create a LinkedIn group and see if people just want to have some chats and kind of share their ideas because I think AI governance is more cross-functional and more multidisciplinary than any of the other disciplines I've personally ever worked on. So it's helpful to have philosophers, historians, people in procurement, technical people, lawyers.

24:19There's certainly not just the lawyers who should be doing this just because there's a law. The law is really important, but it's not the only thing that's important. So what happened was within a couple of weeks, it had thousands of members. What is happening? Because I remember when I had my startup, I had to push, push, push, push, push and everything was hard and now looking back everything makes sense because I was so early and also honestly so green I was just out of college I had no idea what I was doing but basically with this everything just kind of seemed to be inbound which is very different and then we were like okay we like now we have to really do it so there is now kind of like a membership website and things like that.

25:04But all of this is completely separate from my role at Logitech. I just want to be super clear about that. And basically, we've hosted various events around the world. And we have local leaders who kind of run their own chapters, because it's not up to us to decide what's important to them in their particular discipline or in their particular region. So it's kind of just doing its own thing now to a very large extent, which is really great to see. And it all kind of started from something really small. And that's how, you know, from acorns grow oak trees, as they say. And, you know, it's fantastic what you've done.

25:37And what I really like is, you know, I always talk about mission-focused organizations and companies. They're the ones that are really going to kind of cut through. And your mission is to foster an inclusive environment and true community where collaboration and shared expertise fuels advancements in AI governance. Love us. Absolutely love that. But tell us more behind the meaning of the mission for you. so i think a lot of the time particularly if you work in the space we work in um a lot of privacy people have started to take on ai governance that's kind of been like a trend in the privacy industry and there's absolutely nothing wrong with that but as i said earlier this truly is multidisciplinary and it really does take a village to figure out what we're gonna do with It can't just be the lawyers sitting there going, well, these are the things we think are important because there's also going to be the people who know an awful lot more about the technology itself.

26:34People who have seen maybe not AI, but things with similar impact do things in the past that we might need to be considerate of. And I don't think it's just up to one group to decide how all of this should happen. so the whole intent is to make sure things actually get better over time and you do that by bringing people together and we try not to script it too much and also to allow for serendipity to happen so i think that's been successful and really important i think also why people have gravitated so much towards it yeah and hugely successful and i couldn't agree more we is greater than me and i think if you can get a group of people together from different perspectives different thoughts.

27:17It's just amazing how you can fuel a really awesome community, which you have. What initiatives then has the professional network been involved with to build diversity into tech policies? So obviously, we don't pick our leaders based on, okay, how well known are you or how many followers do you have or how many years have you been in the industry? So we have been very open about saying, we want these positions to be held by people who would benefit the most from having that leadership position. So that's very different than saying, oh, we want the established leader to come and give us more followers or blow things up.