This transcript was created with help from Ai. Please report errors to us and always refer to the video as your primary source.

Justin Brady: [00:00:00] I’m Justin Brady from Iowapodcast.com, and even an innocent, very productive use of AI in your workplace can put you in a fairly deep bucket of hot water. That’s what we’re talking about today with Joellen Whitney, of course, Dentons Davis Brown, one of our Wonderful collaborators here on Iowapodcast.com. Thank you so much for coming in the studio and talking about this. Thanks for having me today. It’s gonna be, it’s gonna be good. CISOs, um, at workplaces, the IT leaders, have been str- have been struggling for years on data privacy as it is now This is now with AI You know, having people click the wrong links and don’t- feed private information into this, you know, this database. This is already a struggle. It’s already a struggle, and now AI is here. So from a legal standpoint, organizations wanna protect themselves. Where do we st- where do we [00:01:00] start?

Jo Ellen Whitney: We have to care about data a lot more than we seem to care about data. So here’s the thing. People are terrible at abiding by the rules. They’re absolutely terrible about it, because I also do data privacy and security. I do HIPAA. I do those kinds of things, and I will tell you that when I get those calls where people are like, “Oh yeah, I knew that rule, but I, I didn’t think it applied to me,” you know, kind of thing. Um, and really what happens is it’s not convenient,

Justin Brady: Mm-hmm. and

Jo Ellen Whitney: so one of the things we have to do is we have to try to make the systems convenient for how people will comply, because the harder it is to comply, the less likely they are to do it, right? And so that requires understanding our systems, but also placing a much higher premium on how important data is in what we do. And I think one of the things we do is we don’t explain to people the why, right? We tell them, “Don’t do this,” but we don’t explain to them the why they can’t do it. Um, and I think a lot of people, they’re so used to p- posting everything, everything about their lives, everything that’s there, they don’t understand [00:02:00] the why of it being a problem. So I think that’s part of it too, is just helping them understand what it is and then monitoring it. I think it’s a big issue,

Justin Brady: Yeah. Um, what’s interesting is the convenience aspect. You wouldn’t expect that, like, an influential tech lawyer an AI lawyer like yourself ta- like yourself talks about this. But this is kind of what I would say is you’re trying to help leaders understand you, you don’t want us involved doing damage control. And so you’re saying m- just make it easy- and then you prevent some of this AI- …data privacy leak stuff.

Jo Ellen Whitney: Well, convenience is the enemy of privacy, right? Everything that’s convenient is not something we should be doing. It is the enemy of privacy. Think about all the stuff people download to AI. Um, I read a thing this morning where people are downloading all of their data so AI can do their taxes. Now, all of your d- yeah, right, all your data is out there for whatever you’re doing. They download all of their medical data. They download, and they have no idea [00:03:00] who can access it, where it’s going, if it’s being scrubbed. They have no idea, right? And so people don’t think big picture. They don’t think where it’s going, and they just think, oh, it’s easy today, right? And so what you have to do is make it easy. You have to help them understand why you do certain things, ’cause they won’t do it if they don’t understand it. Yeah. And then you have to give them real-life examples, and here’s the other thing. When you catch them doing it wrong, you have to do something about it. Mm. And too often we don’t do anything about it. We’re like, well, that was sort of complicated, or they didn’t understand about that. Well, fine, retrain them, and then when they do it a second time, ’cause I’m telling you now, they’re gonna do it again. When they do it a second time, you have to do something to prove that it’s important, right? It has to be important to you as the company if you wanna make it important to them as the employee.

Justin Brady: So basically start with goals. Like, what’s your goal at work and how, if, you know, from a, not just a legal, but how, from a tech standpoint, how are we getting in the way as an organization of that goal? Working with people that way to avoid the legal hot [00:04:00] water

Jo Ellen Whitney: So I also think– I actually think you wanna start even smaller than that. What do we have to protect?

Justin Brady: Hmm. Mm-hmm

Jo Ellen Whitney: too often we don’t know what data we have. We don’t know what data we need to protect. So what data do we have to protect? What are our goals to protect that? How do we make it easy for our people to buy into that and to know it and to understand the system? The systems, when they get complicated, they don’t work

Justin Brady: It’s very true. Yeah. So what legal– So y- we mentioned like, uh, I think you briefly touched on productivity m- m- uh, monitoring for a second maybe. Well,

Jo Ellen Whitney: can. I

Justin Brady: Um, w- We certainly can. Yeah. I thought, I thought, well, something mon- I think, I think data monitoring. You mentioned- data monitoring … Yeah. so my mind goes to productivity monitoring too, because people are using AI now, and they’re, you know, like, are they getting their jobs done? We’re Using AI to monitor screens and … are people remote work issues, are they actually doing You know, what legal concerns do we have on productivity monitoring then, and using AI to [00:05:00] monitor keystrokes and making sure people are actually doing what they’re supposed to Is this a legal concern at all? Is it, Is it a good thing to do? Is it a bad thing to do?

Jo Ellen Whitney: Right. Um, so the first thing I always tell my clients when we talk about productivity monitoring is, what are you monitoring and what are you gonna do with it? I feel like people rush to s- kind of judgment. They buy a program, they buy stuff, they’re monitoring, but then they have no idea what they’re gonna do with the data. Yeah. Why am I paying for that data if I don’t know what I’m gonna do with it? Sure. Right? Um, because I felt like maybe somebody wasn’t doing their job, well, m- make them come in and work, right? I mean, I just, I think there’s a lot of it’s new so it must be better. Mm-hmm. Um, and I don’t think that always works. So first you start with the idea of, well, what am I gonna have? What am I gonna do with it? How am I gonna store it? How am I gonna keep it? And what are you monitoring? Right? When you’re just monitoring keystrokes, right, um, maybe I wanna make sure people know I’m doing that, what’s there, that kind of thing. But then if we get into screen mirroring, right, so where we’re actually taking a mirror image of the screen, we’re looking at the screen, that becomes more of an issue of [00:06:00] privacy concerns. I wanna make s- I wanna make sure that I have a consent signed for that. And it’s gonna matter, ’cause you know what you’re talking about is people are working remotely, right? Well, how remotely is remote? Are they working here or in Illinois or in California? Mm-hmm. Because the state law’s different.

Justin Brady: Oh, got

Jo Ellen Whitney: the state laws differ really considerably, even here in the Midwest, between what is a privacy violation and what isn’t. Iowa is a, what’s called a one-party consent state. So as long as one party to the monitoring is consenting and they’re present, that’s fine. Illinois is not a one-party consent state, and so everybody has to be consenting. So what that looks like is different than what it would look like here, and you wanna make sure you capture all of that.

Justin Brady: Does that matter- then if you start an employee, let’s just as an example, in Iowa, and then they go on vacation, or not go on vacation, but they travel to a business meeting in Illinois? Now are you in a gray area?

Jo Ellen Whitney: I- I… So it depends on who you talk

Justin Brady: So it depends on who you talk to. Ah, so yes.

Jo Ellen Whitney: Yes. Well, I’m a lawyer, so it’s gonna be this hand, that hand, and a couple more [00:07:00] hands, okay? Yeah. So I think there’s a de minimis amount, at least I think I can argue that there is a de minimis amount, that they went to a business meeting, they were there a couple hours, whatever. But let’s say their mama gets sick, and they go to stay in Illinois for five months because their mom is sick. Now I have an Illinois employee, right? And a lot of those rules are gonna apply. Different states also treat time in their state differently. Like California, it’s gonna capture everybody. You even think about California, and they might try to apply the law.

Justin Brady: Hmm. Mm-hmm. Right? But different states will capture that time differently. Oh, no, trust me, California’s applying all the laws. Um-

Justin Brady: blow across the health and safety final. Um- You thought about California last week. they have some questions for you. And did you get your proper OSHA training? You know, I mean, that’s just how that rolls, Yes, they have some questions for you. Did you get your proper OSHA training? You know? I mean, that’s just how that rolls. Yeah. Um, one of the things you said that was really interesting, you, just to summarize what you said, it’s basically more data might not necessarily be the solution. Like, what are you gonna do with it? And I think in some ways our ca- our, our organizations, we’re just like, “We just wanna capture everything, and then later we’ll decide what we’re [00:08:00] gonna do with it.” Are they Basically creating a, a, a larger haystack of issues? ‘Cause, you know, just collecting more things might not be good. Yeah. Mm-hmm All of April

Jo Ellen Whitney: Just collecting more things might not be good Right. I, I understand the impetus because when you’re an attorney, you want everything. You want all the paper. All the paper, all the documents, all the everything. You want that. But the problem is, is everything that you collect, somebody can subpoena.

Justin Brady: Sure. Oh,

Jo Ellen Whitney: Everything that you have can become part of a case. Everything that you have can be a foundation for some kind of claim for you, and what are you gonna do with it? How are you gonna store it? How long are you gonna store it? If the court knows you have it and you keep it, and then you don’t produce it, the court is gonna do what’s called an assumption against interest. They’re gonna assume that you’re hiding something,

Justin Brady: Oh,

Jo Ellen Whitney: right? So the more… It’s a problem with everybody. Like, again, lawyers, we keep everything, right? We even have some exemptions in, like, European Union rules about what we can keep and how we do it for lawyers. Physicians keep a lot of documents. We keep those for a long, you know, they keep them for a long time. But do you really need it, [00:09:00] right? I mean, do you really need some of those things, and what kind of risk are they creating by just sort of living in your metaphorical basement?

Justin Brady: Yeah, I would say even- from a tech side, if you’re collecting tons of stuff and you get hacked, that’s more vulnerability. But you’re also saying also from a legal side, you don’t wanna have everything because especially if someone’s working remotely at home, something happens at home, your company has some of that data, now You’re involved in this thing you shouldn’t be involved in That, like, it opens up a huge can of worms

Jo Ellen Whitney: and think about biometrics, right? So a lot of, when we talk about this stuff, we are also sometimes talking about biometrics, you know, where they’re gonna take your fingerprint, your face, that kind of thing. The laws between the states vary considerably on biometrics, and some of them require that that data be destroyed within a certain time period. And so you have this real discrepancy between, again, Illinois and Iowa or Texas and Iowa. You have a big discrepancy in the rules, so you have to think about, what else am I capturing, and is another state gonna have a problem with it?

Justin Brady: Oh, goodness. Um, one of… I remember I, years ago in another life, I went to design school and I [00:10:00] remember when 99designs came out, and I don’t wanna throw them under the bus, but there are tons of websites that do this, and it’s, uh, people from different countries, ultra-talented, And people that are just like have a side job and they’re just, like, doing some fun, stay-at-home mom maybe wants to s- Basically people who work for a little cheaper than an agency and they can create designs online For, you know, business owners or whoever. Yeah, really cool idea. The problem with that is that some people would just rip off designs they saw Elsewhere present them as their own work And if they’re in a foreign country, you can’t, you don’t have really legal recourse to do anything.

Jo Ellen Whitney: Right. It’s too expensive. AI does something

Justin Brady: It’s too

Jo Ellen Whitney: AI

Justin Brady: AI does something similar. AI actually kinda looks at what’s out there, re-ma- mixes what it wants to, kinda presents work as its own. So is this also, like… Who gets accou- wh- when there’s AI-generated work At your workplace, who’s actually accountable, and are we opening ourself up for legal problems from, like, a creative standpoint or a work product [00:11:00] standpoint?

Jo Ellen Whitney: This is a really big question, right? Like, this is an enormous question. Yeah. There’s loads of litigation on trademark, patent, copyright as it relates to the use of artists’ work. Um, how we trained AI probably violated all sorts of copyright rules. Oh.

Justin Brady: also true, yeah

Jo Ellen Whitney: just lots of things like that. So I think if we get down to the more just nitty-gritty component of it, I think some of it depends on what you’re doing. If you’re using it to create images, which you’re then gonna publish, right, you’re gonna put out in the community, your risk of a, an intellectual property violation is gonna be significantly larger. Mm-hmm. Right? And if you’re pulling stock photos, you’re not gonna be able to trademark that for your company anyway. Um, then you have the whole issue of what you use internally, right, and, and how we’re using it and what we’re doing it and w- what’s fair use. So it’s a very murky area. But here’s my other question back for that. Am I supposed to be giving AI the raise or the employee the raise when I get good work?

Justin Brady: [00:12:00] We can ask AI. Right.

Jo Ellen Whitney: You can ask AI. Right. I can ask AI. I think AI will take it, but I mean, I think that’s a real thing, right? Yeah. Like, it- who am I rewarding- Right … for this work product? When AI was first advertising a lot, right? It’s been a few years now, but when they, they had this ad where it was in a workplace, and this guy was a terrible employee, and he couldn’t talk to anyone. He insulted everyone, and then he ran everything through some AI program, and all of a sudden he was their star employee. And I remember turning around and talking to my husband and going, “Well, is he?” Like, is

Justin Brady: Right.

Jo Ellen Whitney: star employee, or is the AI the star employee? Right. Right? And, and so what am I rewarding? And also, if you don’t know how to do things, how do you do the next thing? Right.

Justin Brady: Right

Jo Ellen Whitney: So I listened to a really great science, uh, science article on the BBC, and they were talking about even though calculators can do all of our basic math, we still teach basic math to everyone. True. Because if you don’t understand basic math, how do you understand the rest of it? Yeah Right? And I feel that sort of with some of this stuff. If my employee doesn’t [00:13:00] understand the ideas, they don’t understand the connection, they don’t understand how you put things together, how do they advance to the next level? How do they do something that I can’t just have a computer do or have AI do, right? And how do I know they put the right question to AI if they don’t understand what they’re asking?

Justin Brady: Right. It goes back to- sit down for a second and ask what your employees’ goals and projects are, and basically solve those problems for them so they don’t have to turn to AI later and ask for things

Jo Ellen Whitney: Right. Well, and it’s how do you define success? Yeah. Right? Uh, g- when people started working a lot remotely during COVID, I had a lot of managers who were upset with that, and I would say, “Well, how are they not successful?” Mm. couldn’t tell me. Yeah. They were just annoyed. There’s no- Right, They were annoyed, but they couldn’t tell me what success looks like. And in a, in a world that’s inundated with AI, we’re gonna wrap that in, but what does success, not for the AI, not who’s the best user of AI, but what does success in that job look [00:14:00] like? What do you need to grow in that job? What do you need– What does that success looks like? Yeah. And so I think that means companies are gonna have to look at that a little differently.

Justin Brady: totally agree. Joellen Whitney, AI in the workplace, of course, is the topic. One of the employment lawyers over at Dentons Davis Brown. If you, if this is a little confusing or you think you’re maybe not in the best position here, you should probably call Joellen for also maybe leadership advice. You can come in. We can do that too. She can do that too. Uh, what’s the easiest way to reach out to you if people wanna get more information?

Jo Ellen Whitney: Um, so my email address is joellen.whitney@dentons.com, and then our firm number is 515-288-2500

Justin Brady: I would suggest you call her if you have some questions. Joellen, thanks so much for coming on the

Jo Ellen Whitney: Thanks for having me. I appreciate it