[00:00] Debbie Reynolds: This episode is sponsored by Jetstream Security.
[00:02] If you govern privacy or legal risk, you know the hardest AI question is who did what with whose data, on what authority Jetstream answers it.
[00:14] Every AI action attributable to an identity,
[00:18] every output traceable to a purpose.
[00:22] See how at Jetstream.security.
[00:26] The personal views expressed by our podcast guests are their own and are not legal advice or official statements by their organizations.
[00:39] Hello, my name is Debbie Reynolds. They call me The Data Diva. This is the Data Diva Talks Privacy podcast where we discuss data privacy issues with industry leaders around the world with information that businesses need to know.
[00:52] Now I have a very special guest on the show, fellow Chicagoan Sausan Yazji.
[00:59] She is a principal at AWS.
[01:02] Welcome.
[01:03] Sausan Yazji: Thank you. Thank you for having me.
[01:06] Debbie Reynolds: Well, we had a pleasure of meeting at a dinner actually of a dear friend of mine, Dr.
[01:12] Michi Kangala. And I was really fascinated by you and your work and you're just brilliant and so I love data people and so being able to talk with people who are are really interested in data really interest me.
[01:25] But tell me a bit about your background. It's so rich and fascinating.
[01:30] Sausan Yazji: Thank you Debbie. It was really nice meeting you at the dinner with Dr. Mickey.
[01:35] I enjoyed talking with you and when you asked me for joining this I was so excited. Like yes, I want to be part of this podcast. I am currently a principal at AWS and what I do is I help customers migrating to the cloud and utilizing the best and the newest technology from Generative AI while ensuring their data privacy and their data security is there and it is intact and there is no violation for their data access.
[02:07] Before joining AWS where I have been there for 10 years, before joining that I held several positions. I started as a programmer, then I went to architecture and then I went up the ladder to become a CTA for a big company, international one and here I am today.
[02:25] And in addition get to my commercial work, I do also academic work. I was a professor at NIU Northern Illinois University where I was teaching the students and the master's degree how to transfer the technology ideas into a business.
[02:44] So it was system transformation classes and I also taught data structure and data systems as well.
[02:53] It was hard to do both for a while so I stopped teaching about like a couple years ago and I continued right now in Northwestern where I got my PhD.
[03:02] I am on the board for the MSIT program.
[03:06] So I helped setting up the curriculum, I helped introducing industry information to the team and to the students and providing them with some lectures about how to apply the Technology knowledge in today's environment,
[03:20] Debbie Reynolds: that's a lot.
[03:22] I think that that is an amazing background in terms of the things that you do. And so that gives us a great thing that we can talk about.
[03:33] So what types of things that you feel like, people who aren't,
[03:38] who don't deal with data systems or don't deal with data every day, what don't they understand about the complexity of data systems and things like that?
[03:48] Sausan Yazji: Data and generative AI and systems have become available to everyone.
[03:54] If we think about technology and AI and data mining and data analytics, it is not a new concept. This concept has been there since the 60s. The idea, or even before the idea here is that having these technologies and these abilities in the hand of everyone,
[04:17] in the past it used to be in the hand of professionals who understand what is the technology,
[04:24] how it does the data classification, what does data classification mean?
[04:29] What does it mean when you are going to enter or access certain public data versus accessing a confidential data? Now these systems are in the hand of every single person in the world,
[04:43] which means that the rules for data privacy are not implemented in everybody's mind. And this is the biggest concern is that how we are going to educate the public about data classification, data privacy rules, how you can access data, what you can and you can't do with the data when it is in your hand.
[05:05] And if you are accessing certain private data,
[05:08] what is the next course of action that you need to do so that you will be protected and you will be protecting also other people's information.
[05:17] So having these tools in the hand of the public who are not educated about the rules and the privacy rules is the concern that I have today.
[05:28] Debbie Reynolds: That's definitely a deep concern,
[05:30] right? Because I think sometimes people feel like if I have data I can do anything with it. That may be technically true, but that may not be true in terms of like regulation or even expectations.
[05:42] Sausan Yazji: Exactly.
[05:43] Debbie Reynolds: Of a consumer. But tell me a little bit more about how privacy intertwines into your work.
[05:50] Sausan Yazji: For my work as a consultant at aws, which is like right now I'm not talking about as an AWS person, I'm talking about just as Sosan. So the privacy is very important when you are dealing with customers data.
[06:06] We are working with clients who are our customers who have consumers information.
[06:12] When we are dealing with a consumer information,
[06:16] it has information about their name, their address,
[06:20] even which is a PII information.
[06:22] Also it has information about their pfi, the credit card number,
[06:26] the Social Security sometimes.
[06:29] And yeah, so my concern is that when we are dealing with customers, our customers are companies who have consumers and these consumers will have their information saved in the customer information database.
[06:46] So we need to be careful about how we are going to handle the pii, the personal identified information for the consumers, whether it is their name, their Social Security number, their address, their email address,
[06:59] all of this is considered a privacy private information.
[07:03] And also we do have a PFI which is the personal financial information which is very important. The credit card number, the bank account,
[07:12] the name of the person on the account, the am of money in that account. All of this information also is very private. And if we are dealing with hospitals, we are having the phi where the consumer is a patient that we have their health story and their health information.
[07:28] So all of that is very big problem if we don't know how to handle it correctly. So in our work, the way that we do is that we say security is job zero.
[07:40] We are not allowed to touch this type of production information.
[07:45] So the way that we are handling this, we are hashing the information,
[07:49] we are creating a masking for the information.
[07:53] We are not touching any production system where it has the information coming all the time.
[07:59] And we are preventing anybody in our system or in our team to have any type of access to where it is read or write or even delete for the information.
[08:12] So the way we are protecting it is by setting up the rules, prevention of having access to this information and asking the customer to hash and to not only hashing, to have masking or any kind of information protection on their side before we touch it.
[08:30] Debbie Reynolds: I like that idea. So just using technology to help protect the data, to make sure that it is secure and it's not tampered with. So I definitely like that idea. I've always been a fan of that.
[08:44] I know like education is important as well in terms of letting people know what you can and can't do with data and why those restrictions exist.
[08:55] Do you find it difficult for people who don't understand the protections that are needed around that type of data?
[09:04] They may not understand why that's necessary.
[09:09] Sausan Yazji: Yes, actually you don't find this in the work environment because everybody is educated. You find this, as I mentioned, in the public area where people go to any AI platform and start asking personal questions.
[09:22] And in the beginning when these systems, I'm not going to call the names, these platforms were available,
[09:29] you would be able to go and search for certain person and get information about certain people, which is something that is really violating the privacy. Now it is not allowed and,
[09:39] but you can go around it and you can be able to find a way to get it.
[09:44] How to educate people not to use it is a big challenge because you can educate the people around you because you understand what it means, but you cannot go and educate people who are far away from you.
[09:59] This kind of education should go into the system of the education from early ages and it should be also showing the impact of that work on others and on themselves.
[10:13] So you will be considered as a hacker, telling the kids that you will be considered as a hacker. When you are doing this type of work, you will considered as a person who is stealing somebody's information.
[10:23] If you are doing this. This information is private. You need to protect your own data,
[10:28] not only protect the data of others, how to protect your own data so nobody can hack through it and it would not available for the public to search on you and to find information about you.
[10:41] Having the social media available everywhere, people are posting a lot of things on it.
[10:48] People are sharing a lot of private information.
[10:51] Data privacy becoming a big,
[10:54] big challenge. It is not the challenge that we used to have in the businesses before. It is the challenge that we are having with the public right now. So the only way to prevent and to protect the data, to prevent hacking and protecting the data is to protect your own data and being educated about how what to share and what not to share and where to save your information rather than not doing the work.
[11:20] So we need to be careful that educating people about what could be done with their data so that they will be able to protect it and limit the access for it from everyone.
[11:32] Debbie Reynolds: Absolutely. I think that's definitely wise and I think that's definitely needed for sure. What's happening in the world of data in general right now that's concerning you most,
[11:44] Sausan Yazji: the availability of the data.
[11:46] Okay, we talked a lot in the past about data democratization and data democratization means that the data should be available for everyone to use it. But people thought about the idea of everyone.
[12:01] That means everyone to do whatever they need to with it, which is not true. There is a lot of rules and restrictions around data democratization.
[12:11] Data is going to be available for whoever is going to be needing it when it is needed. And that's where the clashes between data governance and data democratization comes.
[12:24] How to set the border, how to do the balance, what to provide for the people and what that to provide. And as I mentioned, it is always under controlled environment.
[12:35] This data is protected. There are governance rules, there are privacy rules that are set. There are privacy laws and people are following it. So inside organizations the data is protected.
[12:50] Not 100% but it is protected. The data is not protected when it becomes public.
[12:56] When it is available for everyone and even the public data,
[13:01] it would be protected as long as you control who develop it.
[13:07] But when the public data access becomes for read and write, that's where the information,
[13:14] the misleading information can be generated. The wrong education for the public could be done. People who are going to, who are not informed are going to be publishing information about a subject that they don't have any idea about.
[13:30] So that kind of availability of the data and availability of the platforms for everyone to develop and to publish information that they don't know about,
[13:43] to steer the public knowledge,
[13:46] to change the public minds and steering it in a different direction. That is right sometimes and sometimes it's wrong. That is what I am concerned about is that the availability of the people to share data that nobody is able to validate and to control.
[14:06] That is my concern with the data.
[14:09] Debbie Reynolds: Yeah, I agree with that.
[14:10] Let's talk a little bit about data governance and their data governance aspects including like strategy, quality, access,
[14:18] policy and the technology.
[14:20] I feel like governance has always been there,
[14:25] but it hasn't been front and center in terms of the way people think about it. So now, especially in my view in terms of in the news about,
[14:36] we're hearing a lot about AI agents and agents doing things that companies don't want them to do. And now governance is more front and center in terms of the conversation around technology and you know, especially as companies are deploying a lot of technologies very rapidly, governance is starting to come more of a conversation,
[14:57] I feel in the public sector, hopefully. But what are your thoughts?
[15:02] Sausan Yazji: Actually governance used to be looked at as a restriction.
[15:08] So when you are talking about governance, you are preventing me from being able to do my job correctly, which is not true. It is making you able to do your job correctly without having any violation.
[15:20] Data lineage Understanding where the data is coming is a very good aspect of data governance. And nowadays this is very important because we need to know where is this data coming from and can we trust the sources of the information that it's coming from.
[15:38] So today data governance is very important and it is more important than it used to be because the policies have to be implemented everywhere.
[15:48] As I mentioned, and I can keep saying that again and again and again,
[15:52] the public availability of the data is very dangerous. The AI ability to go and dive deep into your data without your knowledge and share it with others is very dangerous.
[16:06] If you don't put the right governance and the right rules and the right policies,
[16:12] we are going to create a monster. We are going to go from oh great, we have the ability to understand how we are going to do this job to oh, I have all the information that I can hurt somebody with it, or I can use it for blackmailing people,
[16:28] or I can use it for getting, for putting some companies down. So this is why data governance and the protection of the data is very important.
[16:37] Developing the right data protection guidelines is very important.
[16:42] Having it with the AI and having an AI responsible rules. What does AI responsible mean?
[16:50] What does it mean to have boundary around what AI can do and cannot do, where the AI can get the data from and what are the rules that it has to be concerned about when it is getting the data, what AI can do with the data.
[17:04] When you are doing a generative AI and you are creating a new story,
[17:09] you are creating a new movie, you are creating a new picture, where is the copyright going to be? How you are going to protect the people who own some kind of prop,
[17:22] have IPs over their subjects and their materials, how they are going to protect that, where is AI limit and what is the rules around it? This is very important.
[17:34] Having ethical AI rules, having responsible AI is very important these days.
[17:41] Debbie Reynolds: My concern,
[17:43] and especially when generative AI was released to the public and now we're seeing companies trying to rapidly institute agents and things like that.
[17:53] The thing that concerned me, and you brought this up a bit,
[17:56] was that,
[17:58] you know though, to me those things were a lot of the AI systems were very purpose built and they were in the hands of experts that were building them.
[18:07] And so they understood the data, the data lineage, the data providence and things like that, and understood the data life cycle. So now you have a lot of people who have tools but don't have that knowledge.
[18:22] And that's very concerning for me, especially if you have people who don't have that data knowledge,
[18:30] especially in organizations that may not know what those rules are or may not understand the impact of what they're doing with data.
[18:38] But let's talk a little about business process transformation.
[18:42] So companies are transforming more rapidly than they were before.
[18:47] So we're seeing unprecedented flow of companies trying to implement a lot of new tools and technology.
[18:55] And you know, the cloud, obviously I think that it parallels the cloud in some way, but I think that especially with AI now we're seeing a lot just more rapid deployment or more rapid embrace of changes.
[19:10] But I think that that has a big impact on kind of the business in terms of the process. But what are your thoughts?
[19:17] Sausan Yazji: Actually, business process transformation is a big deal right now. And if we want to get the benefit out of the new technology and out of the AI and generative AI, we need to start thinking differently.
[19:30] The idea is that automating the current business processes and doing the same thing, but with automation will not provide us with the value. The main concern or the main value that the AI brings is that for the business process, that it will be more efficient, it will be more accurate and we will be able to produce the data faster and more accurately.
[19:57] If we are going to utilize the same manual processes of checking and validating manually for what the AI is doing will not provide us with the real value of AI.
[20:10] It will be helping with 10, 20%. It will not be able to help with 100 and 150 and 200% improvement.
[20:20] So that's why people have to start think differently. We need to change our way of thinking. We cannot do the same thing the old way in a new way. So that is the biggest the challenge that I see when I work with customers that they have a process that they are very proud of,
[20:41] that has been working for 12 years very well and providing at the end a very good result.
[20:48] But this process taking,
[20:50] let's say process for migrating systems, you are going from an old system to a new system.
[20:57] So you need to look at your applications. You go and start meeting with the owners. You are going to ask them for the technology they have, ask them about the time,
[21:07] ask them how they are using this application, what are the systems and validate if the data in the systems are correct or not. You are doing all of that manually and then put the architecture and review the architecture with them and then go and migrate to the new system.
[21:24] All of that is great and it proved success in the old times when you don't have ability for a system on its own to go and scan your code and define what the technology it is used and define all the required connectivity and all the APIs in your system and then create an architecture on the new system immediately.
[21:47] If you have these tools,
[21:49] you don't need to go and do these meetings again and again and again.
[21:54] And what I see is that people are using these tools and they keep going through this step one, step, step two, step three. When in reality you don't need to.
[22:06] What you need to is just do one step and do the validation after it is done. You don't need to do the validation every small steps.
[22:15] So that would help you with 200 300% improvement in your process.
[22:23] So thinking about it, that what, how can I reinvent my business process is very important.
[22:32] It is not only that I need to implement the tool on the current process,
[22:38] I need to reinvent my tool. I need to reinvent my business process in order to be, to adapt to the new technology,
[22:46] not having the new technology adapt to my process.
[22:50] This is a big challenge that we are seeing,
[22:54] especially with companies who are,
[22:56] who are very successful companies who have been doing this for a long time and doing it right now. The adoption of the new technology is a little bit hard because they believe everything they have been doing what led them to be here.
[23:14] They are very successful because of this. And now we are telling them, you need to rethink it, you need to change it, you need to have something totally different.
[23:25] It is a big challenge that takes time in order for people to start to see the value for it and to give it a chance.
[23:33] It's going to be taking time.
[23:35] Debbie Reynolds: Right, I agree with that. I agree with that. I'm glad you brought that up. So I feel like sometimes with,
[23:43] I've been helping companies with digital transformation before it was even digital.
[23:47] So moving from like analog things to digital systems, and now we're digital systems to these more advanced computing environments. And what I find a lot of times what people want to do, they want to automate analog that they want to take exactly the same thing and then they want to try to throw technology on top of it.
[24:10] And it's like we're saying,
[24:11] you don't have to do that. Like the technology can do parts of this. Like, like for example, let's say, let's say someone has a workflow that has like 50 steps.
[24:21] And so you're saying, okay, if you implement this new technology,
[24:24] maybe you only have 20 steps now. And a lot of times it's hard for them to comprehend how to move from this old process that they're accustomed to to really leaning into the technology and trusting it enough so that they know that they don't have to do those other 30 steps.
[24:41] Sausan Yazji: Yeah, and actually I don't want to age myself, but I, I am very much into the same boat that you do where, where transformation has been in my career.
[24:52] In the beginning we were with the standalone systems, then we went to server client system, then we went to web system, then we go to cloud, and now we are talking about AI.
[25:06] So it has been a lot of transformation and this exact problem appeared with every single one of these transformation. When you are going from standalone system to the server client system.
[25:17] When you are going from server client to the web, or from the web to. Or when you are going from mainframe to, to the newest technology simulation on the cloud, that is another big deal that you need to start thinking about and think about how to purchase the hardware,
[25:33] thinking about how to do your financial processes with the new technology,
[25:38] thinking about how you are going to be doing onboarding people to your system. All of these business processes needs to be reinvented. You don't need to do orientation for a new employee in person, flying them to a room, to one room in certain building in your organization in order to do the orientation.
[25:58] Now anybody can do the orientation on their own pace,
[26:01] on their own date, on their own time,
[26:05] virtually. Now your onboarding process is created for you.
[26:11] You don't need to do the same onboarding process as somebody who have different level of knowledge in the same subject.
[26:18] Your education has been created for you, your path is created for you. Only that customization and that personalization is very important and it is generated by AI, by entering your data, looking at what is the role that you're going to be.
[26:34] And now your whole curriculum of what you need to do is there and it is customized for your need. That is totally different than the old business. If you are going to start bringing a bunch of people, giving them the same lectures, taking them to the same class, having them coming out with the same knowledge that can't be done correctly anymore.
[26:57] So we need to make sure that everything is changing from onboarding a new employee, to your finance, to your education,
[27:05] to your work, to your transformation.
[27:08] Everything going to be different and everything going to be more valuable if you rethink your business process.
[27:17] Debbie Reynolds: I want your thoughts about like end of life of data.
[27:22] So I feel like this is an area where so many companies struggle a lot because I think a lot of the emphasis for a lot of companies is on intake of data.
[27:36] So they want to get data in, into systems,
[27:39] getting people using it. But then at some point some data especially,
[27:44] I think this is very relevant for cloud where companies, I feel like, let's say in old days they were on premise and they were just. When their servers filled up, they just bought more servers, right?
[27:56] So when they're in the cloud, it's more of a, instead of a slunk initial cost of storage, they're having a recurring charge for what they put in the cloud.
[28:06] So they have to really think about what is in the cloud and what the value is of that stuff in the cloud. But I feel like a Lot of companies struggle with this end of life, like when things need to be taken off of systems or put on like cheaper systems or it's no longer relevant to the business.
[28:26] But what is your feel when you're talking with companies about that transition? So transitioning from a place where data is not, is no longer valuable, no longer needed. You know, how do you have those conversations with people?
[28:40] Sausan Yazji: Actually this is a big challenge because with the AI time,
[28:47] the more data, historical data you have, the more ability to train your program would be. The more our algorithm, the more ability to get an accurate data. So balancing between what is relevant and what is important and what is not valuable anymore is very thin.
[29:04] There's very thin line between these items.
[29:08] Nowadays.
[29:09] If we are thinking about a retail company thinking about collecting all the data that they need about their consumers in order to build a consumer profile, in order to do a prediction about what this consumer is going to need in the future based on their historical purchase is very important.
[29:26] But in the meantime, you cannot save the data for multiple years because after a certain period of time the consumer habit is changes,
[29:35] is changing, the consumer needs is changing. And you cannot utilize the Data that is 10 years old in order to predict what is going on. So there is something called the feature extraction which is identifying what is the value of the data and which data is valuable.
[29:53] Which field of the data and attribute is more important than other and where is the relevance? When we talk about data quality, we talk about relevance, we talk about time, we talk about completeness, we talk about uniqueness.
[30:06] So we need need to make sure that the data that we have have all that information.
[30:11] When the data is not timely anymore, it's not complete,
[30:15] is not relevant, we need to get rid of it. And that's where the laws are coming. There are some industries that they can throw away data because there is no need for it.
[30:27] For example, the consumer data, after three, four, five years, it's not valuable anymore. And you will not be, you don't need to keep it. So you will save money by not saving it in a storage that's going to cost you money.
[30:42] And then you're going to, you are paying for this data more than you are getting out of it. And that's where the balance should be. When we talk about students, students who in a university,
[30:53] you have the data for the students who graduated 10 years ago. Do you need to keep their information anymore? Is there a reason for to keep that information? You need to balance what is the value that you are having from this data versus what you are to do with the data.
[31:11] So talking about these items is not a big challenge when we are talking with certain level of people. But it would be challenging when you go down to the people who are doing the saving of the data and backing up the data and reviewing the data and processing it.
[31:33] They feel there's a challenge about their position and they don't know that their position is not in danger. It is what they are doing is in danger. But you can do something else with their knowledge right now.
[31:46] So that transformation is a problem. We see a lot of resistance from people who think that if I throw away the data,
[31:54] I'm going to be missing on a prediction.
[31:57] If I don't have all this data,
[32:00] I may not be able to do my job correctly or if I lose this data,
[32:05] my job is not important anymore.
[32:08] So that's where the ability to encourage the people, educate them about how you can utilize your skills in a new platform or what is the value of the data going to be when it is not relevant anymore,
[32:27] the timing of the data is not relevant anymore and the completeness of the data is not relevant anymore.
[32:33] So this is the information that we do talk with our business partners about.
[32:39] We need to make sure what is the quality of the data that you are saving?
[32:45] Because now we are collecting a lot of data and most of it could be noise doesn't add value.
[32:55] In the past we did an experiment, we wanted to.
[32:59] I was working for a company that wanted to know what is the the opinion of the public in its brand and what they are saying in the social media. So started collecting information about every time the name of this brand is on the social media, we collect the information,
[33:18] we read it, we analyze it and we found out that 70% of the time this brand,
[33:28] it was a restaurant brand, was mentioned as let's meet there it is next to that place across the street from it and stuff like that.
[33:40] So the data itself was not valuable for the brand name, it was more for allocation information.
[33:50] So this is very important to know that. Are you collecting the data because there is a value of the data or are you just collecting data for the sake of it?
[33:58] So when you find out that 70% of the data was not relevant,
[34:04] that was a big deal. So collecting data is easy these days, but what to do with it is the hard thing and how much to keep is a hard thing as well.
[34:16] Debbie Reynolds: Wow, that's an excellent example. If it were the world according to you, Sosan, and we did everything you said,
[34:23] what would be your wish for privacy or data anywhere in the world, whether that be human behavior,
[34:33] technology or regulation.
[34:35] Sausan Yazji: My wish is that keeping everybody informed about how to deal with the data and what is the danger of sharing information that is private on a public platforms. That's what I wish that everybody would do.
[34:54] I wish that it would be very controlled,
[34:58] that there will be laws that are going to criminalize people who are going to use the data that is private data and use it in a public form.
[35:12] So means like if you are not going,
[35:14] you should not be able to go and copy some people's information and share it with others. We see that a lot. We see people are taking pictures of others in a public place and posted on their own platform.
[35:27] Like who told you that you can take my picture and put it there? Who told you that that I'm okay with that.
[35:33] Who told you that you are allowed to start to in the first place to come to a public place and use your own camera? So this is the information.
[35:42] This is my hope is that we will have a law that prevent people from doing this and people will be criminalized if they are doing this work.
[35:52] Debbie Reynolds: That's a good wish. Yeah, we definitely need more control and we need people to understand the potential harm that can happen when data is misused. And then the education is really key at all levels.
[36:07] So I totally agree with that.
[36:09] Thank you so much for being on the show. You're brilliant. It's really great to talk with you and be able to share your insights with the audience.
[36:18] Sausan Yazji: No problem, anytime. And I wish everybody the best. And also,
[36:23] just like everything,
[36:24] data is a sword of two edges.
[36:28] You could use use it for information and you could use it for great things. And in the meantime, you could use it for very evil things. So you need to decide how to prevent the use of it on the evil things and how you are going to be encouraged to use it on the good things.
[36:46] Debbie Reynolds: Yep, I agree with that. I always say that too, that it's like a double edged sword.
[36:51] Sausan Yazji: Yeah, exactly. Exactly.
[36:53] Debbie Reynolds: All right, well, thank you you so much for being on the show. I really appreciate it.
[36:57] Sausan Yazji: Thank you. Bye
[36:58] Debbie Reynolds: bye. All right, good, good bye. Bye.
[37:00] Sausan Yazji: Bye
