Taking place March 12 and 13 at Park Plaza, Riverbank, London, PrivSec & GRC Connect London provides a platform for organisations to address the cumulative nature of risk. 

PrivSec & GRC Connect London’s comprehensive agenda is led by subject matter experts, business chiefs and industry leaders, giving attendees a deep-dive into challenges and solutions on the rapidly evolving GRC landscape.

Event speaker, Simon Hinks is Data Protection Officer (DPO) at fintech airline payments company, Swiipr. He was previously DPO at Monese – an online banking tool for those with no fixed abode, Global DPO for Zip Co, and more. Simon writes all required policies, builds and delivers training modules to colleagues, and lectures on GDPR at the Pittsburgh and Boulder Universities in the US.

Simon will be at PrivSec & GRC Connect London to discuss the threats and risks associated with third-party data sharing. Below, he answers questions on his professional journey and introduces the key issues of his PrivSec & GRC Connect London session.

Could you briefly outline your career pathway so far?

I started out as an accountant, but decided this was too one dimensional. I then moved into holidays and direct sell holidays, then into direct marketing and data. 

From here, I moved into personal financial services, banks and building societies. Then, 22 years ago, I set up on my own firm and began focusing on GDPR eight years ago. I haven’t looked back; I live and breathe GDPR and the rest of the world – it’s what gets me up in the morning.

How effective have data privacy frameworks such as GDPR and CCPA been in mitigating privacy risk within third-party data sharing?

Initially I saw the whole data broking, sharing industry in the UK close down after GDPR came into force.

I’ve not seen this come back yet but what I have seen since the regulation came into force is the scraping of data off social media platforms, which for some is now being outlawed. I’m still seeing the use of consent to allow third party sharing.

What technologies and practices should organisations focus on in a bid to mitigate privacy risks?

I think security is the big one; access to the data sets and the security of this data; ethics is another. I believe it’s about creating trust and communities of data sets – this is where we need to go.