Masters of Privacy

Jake Ottenwaelder is the founder and principal privacy engineer at Integrative Privacy, a premiere engineering-first data privacy consulting firm. Beyond his work as an architect of truly compliant and seamlessly scalable privacy programs, Jake is dedicated to expanding and elevating the field of privacy engineering.
Jake’s holistic, hands-on approach to data protection offers his clients the opportunity to honor the moral imperative of privacy and establish privacy programs they can be confident in.
References:
* Jake Ottenwaelder on LinkedIn
* Integrative Privacy
* USENIX Conference on Privacy Engineering Practice and Respect (PEPR), 2027 edition still pending publication
* Damien Desfontaines: Differential Privacy in Data Clean Rooms (Masters of Privacy, January 2024)
* Daniel Simmons-Marengo: Differential Privacy in practice (Masters of Privacy, September 2025)
* Privacy Engineering and AI Governance Program (Carnegie Mellon University)
* Signing up to the Privacy Engineering Bootcamp
* CIPT (Certified Information Privacy Technologist, IAPP) at DPO School (sporadically taught by Sergio Maldonado)
* DPO Central on TODO.LAW (build a privacy program in minutes)
**Will you be in the Los Angeles area on November 18th? Join us for breakfast! Register here: Breakfast workshop: Santa Monica November 2026**


This is a public episode. If you'd like to discuss this with other subscribers or get access to bonus episodes, visit www.mastersofprivacy.com/subscribe

This is a (remastered) repost of our last interview with Theodore Christakis earlier this year. Our guest rightly anticipated an avalanche of personal AI assistants, with a particular emphasis on healthcare, and we believe many more people (including our new subscribers) should benefit from his insights and associated research.
Theodore Christakis is Professor of International, European and Digital Law at University Grenoble Alpes (France). He holds, since 2019, the Chair on the Legal and Regulatory Implications of Artificial Intelligence at the Multidisciplinary Institute on AI (AI-Regulation.com). He is Director of Research for Europe at the Cross-Border Data Forum, a member of the Board of Directors of the Future of Privacy Forum, and a former Distinguished Visiting Fellow at the New York University Cybersecurity Centre.
His work focuses on the questions at the centre of today’s debates on digital sovereignty: government access to data held by private companies, international data transfers, the security and operational resilience of digital infrastructure, and the regulation of artificial intelligence. He served as an expert for the OECD in the process that led to the adoption, in December 2022, of the OECD Declaration on Government Access to Personal Data Held by Private Sector Entities. He was a member of the International Data Transfers Experts Council of the United Kingdom Government, and an expert for the High-Level Expert Group on Access to Data for Effective Law Enforcement established by the European Commission and the Council of the European Union. He has also served as a member of the French National Digital Council and of the French National Committee on Digital Ethics.
He has published or co-edited twelve books and is the author or co-author of more than 120 academic articles and book chapters. He has been invited to lecture and present his work at conferences, workshops and seminars on more than two hundred occasions, in over 38 countries.
As an independent expert, he advises governments, international organisations and private companies on questions of international and European law, cybersecurity, artificial intelligence, digital sovereignty and data protection.
References:
* Theodore Christakis’ SSRN Author Page
* Theodore Christakis on LinkedIn
* You Trust Your Chatbot With Everything. Should You? Part I: How The Controller Uses Your Chat Data (March 3, 2026)
* You Trust Your Chatbot With Everything. Should You? Part II: Governments, Courts and the Battle Over Your Chatbot Conversations (June 8th, 2026)
* The Health AI Agent Rush: Five Companies, Your Health Data, and the Governance Questions Nobody Is Asking (March 25th, 2026)
* Mikel Recuero: a deep dive into the European Health Data Space (ES, Masters of Privacy, June 2026)
* Multidisciplinary Institute on AI
* Université Grenoble Alpes: Centre d’études sur la sécurité internationale et les coopérations européennes.
DPO Central: build a privacy program in minutes (TODO.LAW)


This is a public episode. If you'd like to discuss this with other subscribers or get access to bonus episodes, visit www.mastersofprivacy.com/subscribe

Dera Nevin is Managing Director of Digital Insights & Risk Management at FTI Consulting. She is a data lawyer and expert with more than 20 years of experience addressing digital risk issues, including privacy, data protection, information risk management, e-discovery, advertising technology and the application of emerging technologies to the delivery of legal services and compliance programs.
Prior to joining FTI Technology, our guest was the Data Policy and Strategy Officer at Blackstone, Inc., where she developed and oversaw global privacy, data protection, information risk management and data science compliance programs.
She is a frequent speaker, writer, and teacher on how law responds to technological change.
References:
* Dera Nevin on LinkedIn
* FTI Consulting
* Under New Jersey’s data privacy law (Assembly Bill A.5328, enacted June 30, 2026), a “Data Collector” is a business collecting personal data directly from a consumer and selling or licensing it downstream to a data broker.
* What is the Model Context Protocol? (official docs)
* Introducing System One Models & Jev (TypeSafe): on “Classifier models”
* Jeffrey Bustos: Retail Media, privacy, and the future of addressability (Masters of Privacy, November 2023)
* DPO Central on TODO.LAW (hosted).


This is a public episode. If you'd like to discuss this with other subscribers or get access to bonus episodes, visit www.mastersofprivacy.com/subscribe

As we approach an important deadline in the eIDAS 2.0 Regulation that established the EU Digital Identity Wallet, we are republishing an interview that should help us get up to speed on the subject. By December 24 (this year), every EU Member State must offer its citizens at least one European Digital Identity Wallet -as a free app, certified against common European rules, that holds a person’s identity data and official documents, and lets them prove only what is needed across the EU.
Adrian Doerk is co-founder of Lissi GmbH and co-coordinator of the IDunion research project. He has extensive experience in the rollout of digital wallets, specializing in the European digital identity wallet (EUDI-Wallet) under the eIDAS 2.0 Regulation.
References:
* Adrian Doerk on LinkedIn
* eIDAS 2.0 Regulation
* Lissi
* IDunion research project
* What happened to the EU digital wallet? (Masters of Privacy, October 2026).


This is a public episode. If you'd like to discuss this with other subscribers or get access to bonus episodes, visit www.mastersofprivacy.com/subscribe

Attorney Heidi Saas (CIPP/US) has over twenty years of experience in consumer rights, eight years in data privacy, and five years of ethical AI and governance experience. Her projects currently involve working with CEOs, CTOs, CISOs, DPOs, and CMOs of companies in various industries on regulatory strategy, privacy program designs, risk management, implementation, and monetization of data assets within their privacy ecosystems. She also works with businesses to provide ethical AI advisory, and pre-audit consulting services, as well as regulatory compliance, legal consulting, and public speaking events.
References:
*What is a “data broker” under California law (CCPA as amended by CPRA)? A business that knowingly collects and sells the personal information of consumers with whom it does not have a direct relationship (thresholds: $25m revenue, 100k+ consumers/households, 50% of revenue originating from such selling or sharing of personal info).
* Heidi Saas on LinkedIn
* Tom Kemp (CalPrivacy): on the SECURE Data Act, CCPA whistleblowers, DROP, and AB 566 (Masters of Privacy, May 2026)
* Build a privacy program on TODO.LAW (DPO Central)
* Upcoming CIPT at DPO School (October 19th-20th, 2026)
* Heidi Saas: AI compliance for MarTech vendors and data controllers (Masters of Privacy, September 2024).


This is a public episode. If you'd like to discuss this with other subscribers or get access to bonus episodes, visit www.mastersofprivacy.com/subscribe