0:01

1 second

Sharon: So when you do the redaction, is it as quick as like redacting it like within a second like this? 

Patricia: Yes. 

Sharon: It's that quick.

0:10

10 seconds

Patricia: Yeah. Well, it depends on the size of your data, but yes, it is. 

Sharon: So, I mean,

0:13

13 seconds

if it's this quick, guys, this is like 50 cents. You could do this, No?

0:20

20 seconds

So, our next guest is such a special treat. I think a lot of you know who she is. She is the co-founder 

0:27

27 seconds

Of Private AI. She has received so many awards and recognitions and I see her right there. Let's get her in the car.

0:35

35 seconds

Hey, you need a ride? Hi, come on in.

0:37

37 seconds

Patricia: How's it going? 

Sharon: Good. How are you? Are you ready? 

Patricia: I'm very ready. 

Sharon: Okay. I read

0:44

44 seconds

that you were named one of the top 100 Canadians shaping our country by MacLean’s magazine. Like, that is unbelievable.

0:55

55 seconds

Congratulations.

Patricia:  Thank you. It was such an honor. 

Sharon: Yeah. No kidding. Um, and very well deserved, of course. So, a woman

1:04

1 minute, 4 seconds

who is shaping our country, I can only imagine that you have some crazy ideas

1:11

1 minute, 11 seconds

and a huge vision for what you're going to be doing next. What is your next thing? Like, can you redact me or

1:19

1 minute, 19 seconds

something? 

Patricia: Sure can. 

Sharon: Um, I think you redacted me too much. Can I come back? Oh my god.

1:28

1 minute, 28 seconds

That was crazy. Who are you? Can we maybe talk about the difference between anonymization and pseudonymization?

1:36

1 minute, 36 seconds

Patricia: Sure. 

Sharon: Okay. Do you know how to spell pseudonmization?

Patricia:  I do. 

Sharon: How?

Patricia:  P S E U D O N Y M I Z A T I O N.

Sharon: I'm going to assume that's right. Okay, cool.

1:47

1 minute, 47 seconds

Congratulations. That's That's kind of huge. I have an idea. 

Patricia: What

Sharon:  do you want to pseudonymize ourselves? 

Patricia: Yeah, let's do it.

2:01

2 minutes, 1 second

pseudonmization there's a way to link back to the original entity. 

Sharon: So the idea is that it's identifiable and then becomes unidentifiable or deidentified.

2:14

2 minutes, 14 seconds

Did I say that right? Unidentifiable.

2:16

2 minutes, 16 seconds

Patricia: Yeah. That's okay. Yeah. It's a form. It can be a form of deidentification depending on the regulation.

2:24

2 minutes, 24 seconds

Sharon: Okay. Yes.

Patricia: So it can be an umbrella term to cover. 

Sharon: Yes

Patricia: So pseudonymization you can think of things like tokenization

2:30

2 minutes, 30 seconds

for example. So you you have um a a scrambled replacement that you could link back to the original data. 

2:38

2 minutes, 38 seconds

You can think of um synthetic personal information that you might be might be unique to that particular thing that you're replacing. Um and the whole idea

2:48

2 minutes, 48 seconds

is you have some sort of database in the back that's storing the maps of the original data to the fake data. 

2:54

2 minutes, 54 seconds

Or you have some sort of a hash or a uh you could decrypt the pseudonym. 

Sharon: There are different ways to pseudonmize. Some of

3:04

3 minutes, 4 seconds

which is to remove some of the identifiers and store it elsewhere in a different room. 

Patricia: Yep. 

Sharon: Nowhere in sight.

3:11

3 minutes, 11 seconds

Patricia: Yep. 

Sharon: For the person who's going to be looking at the uh nonidentifiable information. 

Patricia: Yes.

3:19

3 minutes, 19 seconds

Sharon: But am I right that that information is still considered personal information?

3:24

3 minutes, 24 seconds

Patricia: It's still covered under the GDPR. 

Sharon: It really is because it's possible to reidentify. You can go back to that back

3:32

3 minutes, 32 seconds

room and put the data back together to reidentify the individual. 

Patricia: Yes. 

Sharon: Give me the elevator pitch of what your company

3:41

3 minutes, 41 seconds

does. 

Patricia: Fundamentals of privacy is what we're working on.

Sharon:  Okay.

Patricia:  Uh when you think about fundamentals of privacy, you really break it down. You're really talking about personally identifiable

3:49

3 minutes, 49 seconds

information. So PII, PII, what we do is focus on very very accurately identifying PII, PHI, protected health information, 

3:58

3 minutes, 58 seconds

PCI information, so payment card information. 

Sharon: Yeah.

Patricia:  and confidential company information within really messy data which is a very difficult problem to do because you're dealing with text,

4:08

4 minutes, 8 seconds

audio, images, documents. You're dealing it with it across different types of

4:15

4 minutes, 15 seconds

uh use cases across different uh you know different environments, different languages, different countries. So it

4:24

4 minutes, 24 seconds

becomes a really big problem with a massive search space for what you're looking for.

Sharon: Okay. For those watching

4:32

4 minutes, 32 seconds

that don't uh have a clear understanding of what deidentified means, can you explain that to them? Patricia: Sure can. 

4:40

4 minutes, 40 seconds

It’s sometimes used interchangeably with the word anonymization. It it really depends on the regulation. Sharon: Yeah,

Patricia:  it's 

Sharon: it's complicated

4:47

4 minutes, 47 seconds

Patricia: It's complicated, but roughly speaking,, it can mean removing both direct identifiers and

4:54

4 minutes, 54 seconds

quasi identifiers. 

Sharon: What are quasi identifiers? 

Patricia: So quasi identifiers are things like uh your approximate location, your uh religious uh background, your political affiliation,

5:07

5 minutes, 7 seconds

uh your physical attributes, things that when combined together start increasing exponentially the risk of reidentifying

5:14

5 minutes, 14 seconds

you as an individual. 

Sharon: How many points of quasi quasi identifiable information do you need to identify someone? And I know

5:23

5 minutes, 23 seconds

that might not be like there may not be an absolute right answer, but approximately

Patricia: it really depends on the quasi identifiable question. If it's a

5:32

5 minutes, 32 seconds

physical attribute like you have an arm that that narrows it down but not by much.

Sharon: Yeah, fair enough.

5:39

5 minutes, 39 seconds

Patricia: If it's a physical attribute like uh you have a particular disability that and maybe that disability is rare, that really narrows it down. 

Sharon: Sure. 

Patricia: So that's

5:48

5 minutes, 48 seconds

what needs to be taken into account when you're understanding the reidentification risk of the piece of data and what you can or can't keep  depending on the use case that you want

5:56

5 minutes, 56 seconds

to use the data. And direct identifiers are identifiers that will directly identify an individual not not necessarily to one person but to a small

6:04

6 minutes, 4 seconds

group. Your full name for example uh your exact location. I mean there could be a few people in your house and uh and then the way that deidentification

6:12

6 minutes, 12 seconds

anonymization depending on on the regulation works is you calculate not an absolute no risk of reidentifying the

6:20

6 minutes, 20 seconds

individual. Um but generally there's a threshold uh so 0.04%. you know, 0.01%

6:26

6 minutes, 26 seconds

depending on the guideline. A lot of the cases where you see in headlines anonymization doesn't work because X company claimed to anonymize their data

6:34

6 minutes, 34 seconds

and it got reidentified, they're including things like full postal codes,

6:38

6 minutes, 38 seconds

things that are, you know, quasi identifiers or direct identifiers that they really didn't account for. And it's it's about trying to understand is the

6:46

6 minutes, 46 seconds

is the risk worth the reward? And it's not just anonymization that you should be doing. It's you should be accounting

6:53

6 minutes, 53 seconds

for who has access to the data. It's you should be accounting for is there encryption at rest. There's no fail

7:00

7 minutes

there's no method for privacy or security. That's perfect. 

Sharon: That's right.

7:05

7 minutes, 5 seconds

Patricia: If you have cryptographic keys, those cryptographic keys might leak. You might have password leaks. It's it's about making it harder and harder for the bad

7:13

7 minutes, 13 seconds

guys to be able to access data that you don't want them to access to while making it possible to innovate 

Sharon: In your situation or your client's situation.

7:22

7 minutes, 22 seconds

They want their employees to see some information but not all information.

7:25

7 minutes, 25 seconds

Patricia: Yeah. So, for example, if you are looking at customer service calls,.

7:29

7 minutes, 29 seconds

what you care about isn't necessarily who's talking in the recording. Maybe they're even sharing healthcare information because people do um maybe

7:37

7 minutes, 37 seconds

they're sharing account information. You don't need that information to know how well a customer service agent is doing.

7:42

7 minutes, 42 seconds

You don't need that information to know which project products were mentioned,

7:45

7 minutes, 45 seconds

what the sentiment is associated to those products, what the conversational flow was like. With unstructured data,

7:52

7 minutes, 52 seconds

there's so much rich content around the PII and the PI is really just blocking you from getting access. 

Sharon: Okay. Can you tell our audience what is the difference

7:59

7 minutes, 59 seconds

Patricia: Yeah. So, structured data you could think of as kind of kind of like databases that are uh very specific. Uh these are the rows, these

8:08

8 minutes, 8 seconds

are the columns. Um this particular entry is about uh SSN's for example this

8:15

8 minutes, 15 seconds

one's about phone numbers. So you have some structure to the data. Some labels have been associated

Sharon:  It's nicely organized. 

Patricia: One hopes.

Sharon: Okay. Fair enough.

8:25

8 minutes, 25 seconds

Yes. 

Patricia: Yeah.

8:27

8 minutes, 27 seconds

One sometimes. And then there's semi-structured data which can be a combination of that plus what's

8:34

8 minutes, 34 seconds

unstructured uh within a database like a column of notes might live there. And so a common one is medical notes um in which you know doctors, nurses might

8:42

8 minutes, 42 seconds

type something up and structured data uh is things like um audio, images,

8:48

8 minutes, 48 seconds

documents, plain pure text where um you don't have those labels associated with it. There it's really complicated

8:55

8 minutes, 55 seconds

because you can have situations like oh yeah my credit card number is 593. Oops,

8:59

8 minutes, 59 seconds

I I dropped my credit card. Uh I mean that wasn't a five, that was a 56, you know. Oh wow. Yeah. So, you kind of pick all that up. Or, uh, another one is, um,

9:10

9 minutes, 10 seconds

when people say, "My name's A for alpha, um, B for beta," like all that, right?

9:16

9 minutes, 16 seconds

Sharon: Their name is not actually alpha or beta. Yeah. 

Patricia: But you still need to pick that up as part of their name. 80 to 90%

9:21

9 minutes, 21 seconds

of data that companies collect is unstructured

Sharon: 80 to 90%. 

Patricia: 80 to 90%.

9:28

9 minutes, 28 seconds

80 to 90%. 

Sharon: Wow. Okay. Yeah. Um, so someone told me that um you like to eat

9:35

9 minutes, 35 seconds

a little snack when you go on a road trip. So I put a little snack together for you.

9:41

9 minutes, 41 seconds

I can't tell. It was redacted. So 

Patricia: It's popcorn.

Sharon:  It's popcorn. That is that like Oh, thank you. Is that really like what you eat when you go on a road trip?

9:51

9 minutes, 51 seconds

Patricia: Hilariously, I will stop in a cinniplex and grab popcorn. 

Sharon: No, without even seeing a movie. Just like theater

9:58

9 minutes, 58 seconds

popcorn for for the sake of 

Patricia: Ya I’ll share it with my seven-year-old. 

Sharon: Oh my god.  So good. It's so salty. No. Do you put butter or no

10:05

10 minutes, 5 seconds

Butter?

Patricia:  Little bit. 

Sharon: Oh, I'm the no butter girl. No butter. No. Then it makes it soggy. Who wants like wet popcorn? 

Patricia: You don't eat it fast enough then. 

Sharon: What? As soon as they put it on,

10:15

10 minutes, 15 seconds

it's like it's wilted. 

Patricia: Just a little butter.

10:20

10 minutes, 20 seconds

Sharon: Popcorn is like privacy because 

Patricia: what a riddle

Sharon: Popcorn is like privacy because

10:28

10 minutes, 28 seconds

Patricia: every popcorn is different. Okay. Just like every identifier is different. 

Sharon: Yes.

10:34

10 minutes, 34 seconds

Patricia: And very difficult to find. 

Sharon: You can never find the same one because we're all so different. Mhm. And no two

10:43

10 minutes, 43 seconds

popcorn is the same.

10:47

10 minutes, 47 seconds

Okay. I like it. Mhm. Patricia, what great piece of advice would you have for a company that's collecting information,

10:55

10 minutes, 55 seconds

confidential, personal, whatever it may be? 

Patricia: So, a lot of people are thinking about how they're going to integrate AI

11:02

11 minutes, 2 seconds

into their companies.

Sharon: Yes. 

Patricia: How um they're going to get return on investment on integrating AI. And still

11:10

11 minutes, 10 seconds

data governance is still an afterthought.

11:13

11 minutes, 13 seconds

And in order to actually be able to move swiftly and be able to stay competitive, data governance is everything for AI.

11:21

11 minutes, 21 seconds

Good quality data is everything for you to be able to be competitive with AI. So mostly companies know how to do data governance for their structured data.

11:31

11 minutes, 31 seconds

Expanding that onto their unstructured data is what they need to do next. 

Sharon: So by governance, what do you mean?

Patricia: By governance I mean being able to understand uh where your data lives,

11:41

11 minutes, 41 seconds

what is it, how does it uh how to keep track of it properly with your master data management systems, with your data

11:48

11 minutes, 48 seconds

catalogues. Um it means being able to uh have appropriate access controls for that data and what that looks like in a world with AI is much more fine grained.

11:58

11 minutes, 58 seconds

So yeah, appropriate access controls to specific information within your unstructured data. Um, and being able to see whether or not you're following

12:07

12 minutes, 7 seconds

regulations for specific uh types of data for different tasks. Um, and just having all of that in place will make it

12:14

12 minutes, 14 seconds

so much easier for your organization to be able to adopt new technologies quickly. 

Sharon: Okay, so that's really great.

12:20

12 minutes, 20 seconds

Amazing. Thank you. 

Patricia: Thank you. 

Sharon: Okay, that's it. Boom. All right, let’s do it

12:27

12 minutes, 27 seconds

Patricia: All right.

12:30

12 minutes, 30 seconds

[Music]