Taking a Leap to (Hopefully) Make a Difference

Why I've decided to stop being a DPO, and do more writing, speaking & advocacy instead. It's about the thing, damnit.

Greetings from the beautiful island of Madeira, Portugal. I am sitting less than 100 meters away from the sea, listening to the furious ocean break against black rocks and the steep face of volcanic outcroppings along the northwest of the island. The place where I’m staying is a tiny speck, pushed right up against the face of a cliff, and the thought dawned on me that at any time, rocks could come cascading down and kill me instantly.

But that’s ok, because it’s beautiful.

I’m here because I wanted to be somewhere warm in November, one of the more miserable times of the year in Ireland. I’m also here because I wanted to be alone with my thoughts, and my writing. To finish my various backlogged posts, and to sort out my next steps. And staring out at the sea in front of me, and the cliff face above, I realize that it was the perfect time to write about my own desires to take a leap.

A bit of warning: This post is about 50% data protection and 50% Carey Life Things (tm). It’s about reassessing priorities in life and new directions, and why I’m hopefully going to be writing more frequently going forward and moving away from consultancy work towards larger advocacy efforts.

I Started Writing Out of Frustration…

In April 2023, I wrote a long, impassioned piece on LinkedIn about why I was frustrated with being a data protection consultant. Specifically, why I felt like data protection practice has veered away from protecting human rights and fundamental freedoms towards being a thankless compliance slog.¹

Beyond Privacy Theatre, Or Why Our Laws Mean We Can’t Have Nice Things

This piece itself was at least a year in the making, but it took me some time to find a suitable reference frame to articulate my frustration. And then I read Zvi Mowshowitz’s brilliant ‘The Thing and the Symbolic Representation of the Thing’ and I had my framing vehicle.

Mowshowitz was referring to his own struggles at a medical device startup about meeting market demand. He and his team had created a diagnostic tool (the specifics I don’t entirely remember but don’t really matter), that could help people by providing information about health outcomes and how to improve. But people didn’t want the information. They wanted a pretty diagnostic report, light on substance, but able to signal to others (doctors, family, etc.) that they cared about their health. They didn’t want the thing. They wanted the symbolic representation of the thing.

At the time, and still, this need for the symbolic representation of the thing is pervasive in the world of data protection, privacy, and information security. As I wrote:

While most of us might intuitively think “I want the thing!” – it turns out in practice that we don’t. We (or the market, regulators, or even users) want the representation of the thing. As Mowshowitz notes, “the system is more concerned with making sure everyone is able to signal, to others and to themselves, that they care deeply and that they are doing everything they can.” 

The actual effects of the decisions involved are at best, secondary concerns. It’s the risk of not engaging in the theater that is the true mind-killer.

Mowshowitz again: 

[E]veryone involved [is] afraid of being sued (far beyond the statistical danger of actually being sued) every time they deviate from the standard of care makes this that much worse.

And me:

The world of data protection has largely fallen into this symbolic representation trap. This is made manifest in all the ways that organizations drown us in information to demonstrate compliance, and signal that they care about our privacy. Whether it’s the endless sea of privacy policies and notices that nobody reads, the non-negotiable e-book length data processing addendums, the cookie notice popups that never remember your preferences, the ‘risk assessments’ that don’t meaningfully evaluate risk, or the security white papers which might as well be marshmallow fluff. It's all so many words, with so little substance.
This is a broken model, and I've got some ideas for how to fix it.

Writing the Privacy Theatre article, more than anything else, inspired me to start writing in earnest in May 2023. And I’ve explored this topic quite a bit, discussing both the challenges and offering some modest solutions. For example:

Privacy Nihilism is Pervasive. Are Our Laws to Blame?

It’s been a little over 18 months since I started this exercise. I started out with five subscribers that I auto-subscribed (including my mom, Husbot, and a few friends I knew would be game and whose honest opinions I value). Since May 2023, I have grown my readership (I’m over 300 subscribers now, with 17 paid subscribers!) I say this out of gratitude—thank you all (free and paid) for believing in me, or at least finding what I have to say interesting enough to subscribe. It is an honor to know that so many people in the data protection, privacy, and adjacent communities like reading my brain dumps. Or at least politely conveying they do.²

And it is endlessly gratifying to hear from you, both in the comments, or in my cross-posting, or by sharing my work with friends. Some of you have even said nice things to me in person, which is both embarrassing as hell, but also exhilarating because I’m I weirdo who thrives on external validation.

… But Now I Write, Hoping to Fix Broken Things

As I said at the start, I began this exercise out of frustration, but I’ve learned over the last year or so that writing is powerful. It helps me clarify (and revise) my own views on things and identify structure and contours around what feel like amorphous, chaotic systems.

Writing also encourages dialogue, and shifts conversations.

And, if one is lucky enough, writing can also change minds and start movements.

I definitely can see the positive effects of the first category. I think I’ve made small strides towards getting conversations started and dialogue happening. But I want to do more. I’m enough of an ambitious freak that I would like to see even a single idea or two move us away from the twin forces of privacy theatre and privacy nihilism, towards meaningful and pragmatic efforts that actually achieve positive outcomes.

When I started this exercise in May 2023, I made a promise to myself: I wanted my writing to be truthful, honest, and a little raw. But I also wanted to make it public so that my peers can hold me to account when I get things wildly wrong or, as the Irish like to say, ‘start getting notions’. But over the last two years, I recognized in myself that, despite Voltaire’s very wise observation in Candide, I cannot merely cultivate my own garden any longer.

This is not to begrudge any of my fellow consultants, DPOs, lawyers, and practitioners — you are all doing important, valuable things. Some of you are indefatigable and are doing the evangelizing bit and the hard work. Some of you have roles in major companies who have the structure, clout, headcount, and financial resources to move things forward. And some of you are wisely heeding Voltaire’s advice and prioritizing other even more important things in your own lives (and probably living a saner life for it). You are all fighting the good fight. Keep being awesome at it.

But I’m not an endless font of energy anymore. I’m an exhausted, slightly-cranky, creaky-kneed, overweight, ranty 44-year-old woman with 9 cats, who tolerates only so much bullshit in her daily diet. And between the daily grind of fighting over DPAs and privacy notices, providing advice that often goes unheeded, endlessly clicking ‘reject all’ on cookie banners, and slogging through piles of outrageous data and privacy abuses, I need to make a change.

I need to be more strategic and mindful of the amount of energy I exert putting out all the small little fires that define DPO and consultant life. I need to step aside, take a bow, and stop engaging in privacy theater. And in news that will make Husbot proud, I also need to step away from the 24/7 horror show that US and EU politics have become, because although I openly mourn where the US and the world is heading, I realize that my time and energy should be directed to making positive changes in areas where I have a degree of competency, towards goals I can realistically hope to achieve.

And so, going forward, I’m going to focus primarily on reading more thoughtful works by others, writing, speaking, and probably … going back to school. It turns out, the regulators, legislators, and policy people tend to listen just a bit more if you’ve got fancy letters before / after your name.

I may not succeed. I may realize that this goal was itself too lofty given the constraints of, well, me. But I want to commit to it here, on the page first, and then see where I’m at at regular points over the next year or five.

I’m hoping that a few of you will also hold me to account as well, and remind me when I start getting notions.

Bonus cat picture:

Pictured: a tuxedo floof baby with bright yellow eyes that wandered into the restaurant where I was eating a mediocre burger last night. The restaurant owner calls him Panda, but he appears to be a very well-treated community cat. In total, there are at least 3 (but probably more) kitties that hang out along the narrow strip of shops in this part of Madeira.

1. I migrated it to Substack shortly after I launched the blog, because I liked it, and why not?

2. I would be remiss if I didn’t observe the fact that subscriber numbers, are after all, a symbolic representation of the thing, where the thing is the actual reach and effectiveness of one’s writing.