AI Governance, Privacy Placebos, and the Global Legal Career with Tainá Baylão

Welcome to Studying Law Around the World. I'm Claudio Claus. In each episode, I talk with lawyers, law students, and professors from different parts of the world to talk about legal education, careers, and what the profession looks like in real life. I talk about the hard parts, the surprises, and the decisions that shaped their paths. Whether you're planning to study abroad, thinking about working in another legal system, or just curious about how law works around the world, this podcast is for you. Today I have the honor of hosting Taina Bailão. She has an incredible international career in privacy and data protection law. She's a specialist in the field, is a dual qualified lawyer in Brazil and Portugal, a certified information privacy professional in Europe. She's a privacy manager and has many other roles and certifications that we'll be talking a little bit about during this episode. She also has two LLMs focused on the topic of data protection and currently is a global privacy counsel at a multinational company. Thank you so much for making the time to come to the podcast today, Taina. Thank you so much for having me, Claudio. I'm happy to be here. I must start this podcast by saying welcome back. I had the opportunity to interview Taina back in 2022, and I've been so lucky to see all that you've accomplished in your career since then. So I'd love for you to introduce yourself to our listeners. Yeah. So hello, everyone. My name is Taina. Claudio already shared a few words about myself. I'm originally from Brazil, so 30 years old, reaching that age for career progress, I would say. Yes. So I lived in Brazil most of my life. I did move to Canada back in 2019. So just a bit before the pandemic, I was there for a few months, just meant to revamp my English skills after some years without practice. And I was there for six months. Eventually I actually engaged into a business management course to try to understand a little bit of a different perspective regarding businesses. Yeah. And then from there, I moved to Germany to pursue my first master program in IP and IT law. I didn't actually need the whole course online because of COVID, but it was still an enriching opportunity and I eventually managed to land a job in Germany as well. So I was there for three years, living in Munich, working as part of the data protection officer team in a semiconductors company. And then more recently, so it's been a year now that I moved to Switzerland. And then I'm here at Roche, a big pharma company working as global privacy counsel. Amazing. So from studying English in Vancouver during the pandemic to advising one of the biggest healthcare companies in the world on privacy and AI governance, your journey completely changed in a few years. It's amazing. I'm curious, what are maybe some of the biggest misconceptions that international lawyers might have about holding a global legal career, in your opinion? I would say that most people have the impression that they can only practice in their own countries because they graduated there and they only know the local law. So how come they could build an international career? So I get those kinds of questions all the time from fellow lawyers in Brazil and people that were in university with me. So how come? So I think it really depends also on the area that you decide to practice. So actually if you're going into privacy and data protection, which is the area I am in, if you're going into the area of contractual law, if you're going to international law, if you're going into arbitration, there are many areas that are very international that are based on international conventions and then there are more standardized around the globe. So if you have a general idea of how it works, even if it's in your own country, it's very easy to transition and then leverage that knowledge you already have into another jurisdiction. Yeah, of course, if you're more into constitutional law, administrative law, something that's more specific to your country, that's harder, but you can anyhow leverage those skills and learn a new practice, right? If you're interested in it. One of the things that I often share here in the podcast is that credentials matter, but communication matters more than credentials. And I wanted to discuss that a little bit with you. I know you hold multiple privacy and AI certifications, two LLMs, and you speak regularly at international conferences. And I find that the area of, specifically in the area of privacy, it really is a field that developed a lot of the different certifications that you can take, which I don't see as much in other areas of law. What are your thoughts on that, on the need for those certifications? And it seems like they really do make a difference in the privacy field. And also, if there is really a space for communication, for curiosity, and that might matter just as much as the technical knowledge in a way, what are some of your thoughts on that? Yeah. I think for certifications, I would say it's because privacy, it's such a dynamic field. I think one of the most dynamic fields in the area of law, especially now that many of those privacy professionals are starting to also do AI governance, which is, again, the newest frontier in the law. So I think being in this area where there's a lot of uncertainty, a lot of gray areas, every day. If you even take a two, three weeks vacation, it feels like you lost an entire life of content because there's things happening every day. There's judgments, there's guidances from authorities, and it's changing constantly. So if you don't keep studying, and if you don't keep upskilling yourself, it's impossible to keep up. So a privacy lawyer that doesn't like to learn, well, you're in the wrong area, seriously. Because there are other areas that you can certainly go for. For example, I have friends working in contracts. It's an area that's been solidified and consolidated for several years now. The main ways and principles of doing contracts are the same all over the globe, and nothing changes there. There's no, okay, now everything is different. It's not like this. So my friends that work with contracts, they say, we barely have any conferences, we barely have any webinars. I have no idea of certificates I can take. I get that, because things have been around for such a long time. And privacy is somewhat new. The developments are somewhat new, because the technology is new. So it's even hard to keep up. The law is, especially with AI now, it's having a hard time to get there. So that was one of the reasons why here in Europe, the EU Act was reworked so many times, and they're still like, they already passed the law, and they are again, rethinking it, because the law, the technology is changing so much. So I think it's very, very important. And regarding communication, privacy is a little bit different than other areas of the law as well, because we give a lot of internal trainings, for example. We do a lot of awareness, especially if you're working in, but even if you're working in a law firm, there were many instances where I was advising a client, and they would say, okay, can you provide me an internal training for my company? And then it would go there and provide them a one hour awareness training. So it's very important how to communicate. And I also feel that privacy has this extra component for communication, because we are often in contact with the IT folks in the company, the marketing folks, and they don't speak lawyering, they don't speak legalese. If you don't talk to them in plain terms, you're never going to get it. I know that something that I saw you recently sharing on LinkedIn had to do with a technical topic and they used to intimidate you as someone coming from a law background before getting your privacy certifications. So I'm curious what helped you to stop seeing technology as someone else's department? And maybe how can junior lawyers build that confidence in these conversations? Yeah, so I feel that not knowing something makes me even more anxious than diving into something that is difficult for me, that's something that I'm not used to. So working with privacy, you cannot escape. You need to have a basic understanding of the technology, otherwise you cannot consult. Especially if you don't want to be a business blocker, because many times you'll be approached by the tech folks and they will say, I want to implement this in this feature and this is what I want to do. And just saying no is not good enough because otherwise you're a business blocker and no one's going to trust you and no one's going to want to talk to you because you're just going to prevent them to achieve greatness. So they don't want to talk to you if you're just going to say no, figure it out. You have to help them figure it out. So if you don't understand the technology, there's no way you can provide possible solutions. I don't mean that you have to be a super expert in everything, but for you to be able to chat with people on an eye level and understand why they are explaining that they cannot do something, that they cannot implement something, you need to have a basic understanding. And I think nowadays it's even simpler to get to that point because we have AI and AI can be extremely helpful. So if you talk to Gemini or ChattyPT about a topic, you know that they want to implement feature X in their website and then you can just ask Gemini, I'm not in the area of tech, I'm someone with a legal background and I need to understand how this works in order to be able to advise it. Could you explain to me in lay terms? And AI is going to give you a general explanation so you can go to that meeting more prepared. So before AI, I used to do that through Google. So I was like, how does this type of encryption work? What do they mean when they say that it's immutable? Like what is multi-factor authentication? So those kinds of things help you immensely when you're advising the business and also help them also see you with a different eye. So see you as a collaborator, see you as a partner and not someone from legal, they're just going to tell you, now you figure it out, but you cannot do it like that. I really appreciate you bringing that up, especially as you said, to be a business enabler that takes a lot of understanding and trying to see even the corporation or the daily workflows and processes by the eyes of those that are kind of really working on the weeds with that. I understand your work sits right at the intersection of law, AI, governance and business strategy in many ways. When legal teams discuss AI internally, what are some questions that maybe might be missing from those conversations? Yeah, I feel that a lot when it comes to AI governance resumes into operations and not so much into high level discussions. Because if you look at the UAI Act, for example, most of the obligations, most of the responsibilities and the big leg work that you have to do are for high risk systems. If you're looking at low risk systems, it's actually not that complicated. It's more about the operational day to day. So keeping an AI inventory of everything you have in the company. So that first exercise of mapping everything that has AI in the company, that's a huge leg work. But once you're through that, it's not that complicated in maintaining it. So you can set up a form and you create this questionnaire, and then people will just go there and then fill it out whenever they have a new tool. Can be something self-service, it could be something that your team is assessing. If it's something that, for example, has transparency obligation, even if it's low risk. So you might need to implement a disclaimer or well, something else according to Article 50 of the UAI Act. So some kind of metadata tag or anyway, there's many different technical ways that you can do that watermarking and such and such. So this is certainly something to think about that actually, if something's not that high risk, it's not that complicated. And I feel like a lot of what's missing in those conversations is how many of those UAI Act and AI regulations in general, they are actually something that enables the business. This is not something that's just because a law say so, it's not because there's a risk if you do not do it of not being compliant. Like many of those things are actually making your product better. They are actually making your system, your model much, much better. So for example, regarding where are you going to collect the data, garbage in, garbage out. So if you don't have a good data set, if you did not properly sanitize your data, you're going to get shitty results. Well, this is simply the truth, right? And of course, this is also a concern that developers have regarding accuracy, regarding hallucinations. Also, you don't want a system that's feeling biased results, because if it has a high level of bias, who's going to buy that system? No one wants a biased system, or if it's a system that, okay, everyone needs to check any answers coming from the AI because we need human in the loop. Yeah, absolutely. But if you cannot trust the AI answer, because 80% of the times it is wrong, it's faster for a human to do it than ask the AI, because the amount of work you're going to have redoing it and revising it, it's actually more of a trouble than a solution. So you need to be able to at least rely a little bit in what's being spilled out of that solution. And I think a lot of people in the business fail to realize that. So we are actually telling you to implement this, not just because of compliance, but also because we want to make the product better. You've spoken about privacy placebo practices. I found that amazing, especially now working at a pharmaceutical company. I found it fascinating that it was especially focused on meaningless consent flows and privacy policy checkboxes that maybe did not really translate into real world practice or really into update legislation. How do you challenge the outdated compliance habits inside an organization without becoming seen as the person who's blocking innovation? Yeah, I think it's all about how you frame it, right? Because every time I see internally someone collecting consent or an agreement to a privacy notice, I just tell them, okay, but what are you gaining from this? Because you don't need to do that. If you really want to implement a checkbox, you can implement something such as, okay, I have read and understood the policy, that's fine, but why do you need that? You actually do not. You just have to make it available. You can just make it available such as, for further information, please click the link. But you know that in reality, most people don't read those policies, unfortunately, or well, we know that those policies are gigantic and no one has the time to read all of them. There are many researches around saying that, okay, if you were to stop and read every single policy for every single app or service that you're using, you're not going to do anything else and you're going to spend your whole time just reading this. It's not going to get you anywhere because, hey, you're going to contest it. You don't agree with it, but they're not going to change because one person complained. That's just the reality of it. So I just ask the teams and make them self-reflect. What are you gaining from this? Because if you're collecting any type of consent and people don't agree, then you're not going to get that person's access. You're going to lose a lead, a marketing lead, because the person didn't click. You don't need to do that, so why are you doing it? You have actually more downsides to it that actually benefit. And if an authority comes and audits you and then sees that, you're not getting anything from it and they're probably going to be judging why would you do this if you don't need it. So it's actually not good from a compliance perspective and it's also not helpful from a business perspective. Oftentimes here in the podcast, I'm speaking to law students or early legal career professionals, but looking back at your move from Brazil to Canada, to Germany, now in Switzerland, what is maybe an unspoken reality about de-adapting professionally in a new country that only people who lived it over and over again might understand? Yeah, I think the first thing you have to have in mind, it's not going to be the same as in your own country. Cultures are different. People will behave different and you need to know how to differentiate that and you need to know how to adapt. You need to be flexible, otherwise you shouldn't have left your own country because some things that for a German might be normal, might be seen as, well, super disrespectful in Brazil, for example. In Europe, they have a culture where they're more direct in their communication and in Brazil I feel like people are more like stepping, like stepping in eggs with each other because they're afraid of hurting someone's feelings. And I feel that they need to always be friendly or even too friendly with nicknames and such in our corporate environment. So I feel that there's this whole, we need to be friends, we need to be friendly. We can never say something that would hurt someone's feelings. So there's a lot of that in Brazil. While in Europe, no one cares about that. You don't need to be friends with people you work with. It's fine if you are, but you don't have to. There's no such expectation and you can just be co-workers. No one expects you to add them on Instagram just because you work together, which was very much a reality back when I worked in Brazil. Like if you don't accept someone in your Instagram, you're basically saying you're hating them. You hate them. It's not like this. It's just, you have a professional versus a personal relationship. And in Europe, like I see many emails that at first caught me a bit by surprise. Like I remember seeing, I was in the thread, it was not an email directed to me, but I remember seeing a German saying, I'm very irritated that you did this in such and such a way. And she said, like, I'm very irritated. She looks so angry when I read the email and in Brazil, like no one would ever say that unless it's something really serious, especially in a thread with 20 other people. And this was completely normal. She was just saying, yeah, you should have not done that. And this was fine. No, no, no feelings were hurt. This is just how people roll. And you have to understand this, that people are not too concerned about your feelings because, well, they're not getting their feelings hurt either. This is just work. This is completely fine. And this is completely different as well. So you need to understand that people communicate in different manners. So I also was chatting with a colleague the other day, and she said it's difficult for her to, when she's having conversations, especially with people from Asia and from Japan, because they're so polite, so extremely polite that you don't even know when something is wrong because they are trying to sugarcoat the whole thing in politeness, because that's just their culture. And then she often does not get when there's a problem because of the way that they communicate. While in Europe, if there's a problem, someone would just point blank tell you there is a problem. We need to fix it. You know, so totally different ways of communicating with each other. You need to understand that before you jump into misconceptions and create a bigger issue than it is. Taina, your posts on LinkedIn are incredible, and they oftentimes talk about curiosity, networking, asking difficult questions. So now for someone trying to enter privacy, cyber security, or AI governance today, what questions should they start asking mentors and professionals in general more often? It's not even questions about technical knowledge. As we were chatting earlier, I think personal branding and visibility are as important as technical knowledge, because, well, technical knowledge anyone can get, and communication is harder. You actually have to build on those soft skills, and people actually take it for granted all the time, because you might be the best person when it comes to technical knowledge within your job, within your country, your company. But if people don't have visibility of that, that's basically the same as not knowing anything, because there might be someone that has half the knowledge you have, but they're often sharing their accomplishments, what they did, how they solved an issue, and how that provided value to the business. Even though they did half the amount of work you did, or they are not as knowledgeable as you, they have that visibility because they are constantly shouting to the world, this is what I did, and this is how I did it, and this is how I aggregated value to the business, because it's all about being a business enabler. Corporate is a big game, and if you don't know how to play it, well, you're just going to get very frustrated. Even if you're the best regarding knowledge, even if you're working 20 hours a day, it's not going to be enough, and you're not going to get that promotion, because you're just not getting visibility. I think it's just as important to build your personal brand early on. I think it was one of the main differentiators in my career. That's one of the main reasons, actually, why I managed to get a job in Germany, even though I didn't have an EU passport, even though I didn't live here, even though I didn't speak the local language. And the same goes to Switzerland. Switzerland is actually even a closer market than Germany. It's harder to get a visa. It's harder to get a job. The country is smaller. There are less jobs, and somehow, I break through. But I think it's all about having that visibility, having that personal brand. So I think it's super, super important to network as well. So if you have a mentor that knows people, ask them to introduce you to people, ask them to be your champion, so that they can vouch for you, that they can talk about you, and this is going to help you so much with opportunities in the future. The technical knowledge, you're going to get there. Amazing. To wrap up today's conversation, I'd love to hear from you, somebody who might be going through this journey and might be looking around, they might see so many leaders in the field, so many lawyers who have been doing this for a while, who are now well in their careers, they might be full of different accomplishments and all of that, but there's always so much that goes into that. So I wanted to hear from you a little bit, if there's maybe a moment in your career that with something that you're just proud of in a way, but I'd love to end this podcast today on that note. Yes. So to get started, for everyone who started in the career, you need to stop comparing yourselves with people that are three or four steps ahead of you, because everyone started out of nothing. Everyone started with zero experience. Everyone got their first job once in the area. So it's not because this person maybe is the same age as I am, but this person has done this and this and that, and this person has X amount of certifications and LLMs. Yeah. But at some point I had nothing of that. I had to build this up. So you don't need to compare yourself because everyone is in different moments of their lives. So you just need to get started and eventually someone is going to be comparing themselves to you, even though they shouldn't, but that's just how it goes. And regarding challenges, well, moving to different places globally is always an adaption. It can be frustrating if you don't speak the local language. So when I moved to Canada, it was very smooth because it was English and I spoke English, so I didn't have any issues with that. But when I moved to Germany, it was so frustrating. Like of course, there's a lot of people who speak English there as well, but there's a lot of reluctancy as well regarding, well, you're in Germany, you should speak German. You should know how to, but it's also very hard for you to judge them because you don't know if it's that person's first day in the country or the 10th year in the country. It might be that they just got there and it might be that they didn't have the chance to study German before. Maybe they're there to learn German. They went to do a language course and I feel it's so difficult with the local language. So there is some frustration, of course, if you do not know this local language, because everything, even simple things in your daily life are going to get harder because you cannot communicate and you're going to feel frustrated. You're going to feel dumb and you're going to start learning the language and you're going to say a lot of things that are wrong. I think this is also stuff you're going to have to face and overcome. Otherwise, you either learn the language or you learn to handle the frustration of not knowing. Partly, right? But regarding your career, I think you also shouldn't rush. I had many promotions in this past year, but it could have been that I didn't. I always felt that I was already in a good place. So I actually, to be very honest here, I didn't have any big, big challenge or any big frustration when it comes to work. I was always very lucky, very blessed, I would dare say, because I always had incredible colleagues. I always had opportunities. I always had managers that believed in me. And I have a lot of friends that were in the same situation as mine, but with a completely different perspective, because maybe their team was not supportive, or their team was not friendly, and she felt as an outsider. So yeah, it's just life. I was very blessed. I really cannot complain. I always had the best experiences when it comes to jobs. And I guess like I said, it's just life. I really appreciate you making the time to come on the show today for tuning in and listening to today's episode. Thank you so much. Bye bye.