Privacy in Practice

In this episode of Privacy in Practice, Kellie du Preez and Danie Strachan speak with Patricia Kosseim, Information and Privacy Commissioner of Ontario, about how privacy law operates across Canada’s federal, provincial, territorial, and sector-specific regimes. They discuss the interaction between PIPEDA and provincial privacy laws, cross-jurisdiction regulatory cooperation, Ontario’s PHIPA framework for health information, and what regulators may expect organizations to demonstrate in practice. The conversation also examines constructive engagement with privacy regulators.

Children’s privacy requires more than applying adult privacy rules to younger users. Age thresholds vary across jurisdictions, children may lack the legal capacity to consent to certain processing, and the methods used to identify young users can introduce additional privacy, security, and compliance risks. Addressing these challenges successfully requires coordinated decisions across legal, compliance, product and design, engineering, and trust and safety teams.

Hailun Ying, Head of Privacy and Security, Legal at Roblox, joins Kellie du Preez and Danie Strachan to discuss the global patchwork of children’s privacy laws, the practical challenges of age assurance, and why privacy-protective defaults need to be built into products from the beginning. Hailun also discusses why children’s privacy must be treated as a cross-functional responsibility rather than solely as a legal or compliance matter.

In this episode of Privacy in Practice, Kellie du Preez and Danie Strachan speak with Tom Kemp, Executive Director of the California Privacy Protection Agency (CalPrivacy), about California’s approach to consumer privacy rights and business compliance.

They discuss what regulators expect businesses to get right in practice, including functioning opt-out mechanisms, Global Privacy Control (GPC) signals, third-party vendor tools, California risk assessments, good faith compliance, and CalPrivacy’s work to make privacy rights easier for Californians to exercise at scale.

In this episode of Privacy in Practice, Kellie du Preez and Danie Strachan speak with Daniel Solove, Professor of Intellectual Property and Technology Law at George Washington University Law School, and CEO of TeachPrivacy, to debunk pervasive myths that undermine effective privacy strategies and leave businesses making weaker privacy and compliance decisions. Daniel is also one of the most cited legal scholars in the field of law and technology.

Gabe Maldoff is a Partner in Goodwin Procter, where he helps companies navigate privacy, cybersecurity, and AI governance in the context of data-driven products, corporate transactions, and regulatory investigations. He’s worked across the U.S. and the UK and advises clients on cross-border data transfers, international frameworks, and emerging technologies like AI, virtual and augmented reality. Gabe is also an Adjunct Professor at the University of Maine School of Law, where he teaches Global Privacy Law. This episode focuses on privacy considerations in M&A, especially from the perspective of startups preparing for acquisition and what acquirers really look for when evaluating privacy programs.

In this episode of Privacy in Practice, Kellie du Preez and Danie Strachan speak with Gabe Maldoff, a partner in Goodwin’s Data, Privacy, and Cybersecurity practice, about privacy in mergers and acquisitions Together, they discuss why startups and fast-growth companies should address privacy early, how to navigate privacy due diligence without derailing deals, and how clear confident answers about data practices can help build trust during a transaction.