On this episode of SPARKS, Deans Melanie Leslie and Carey Bertolet Grand spoke with Olivia Greer '12, Head of U.S. Privacy & Cybersecurity at Weil and a partner in the firm's Technology & IP Transactions Practice. Technology in the legal field is rapidly evolving, with a major impact on privacy, cybersecurity, and the use of artificial intelligence – hear more about how firms are answering these questions.
This episode of SPARKS features Olivia Greer '12, Head of U.S. Privacy & Cybersecurity at Weil and a partner in the firm's Technology & IP Transactions Practice. She also serves as Co-Lead of the Firm’s Artificial Intelligence Task Force.
Her work spans transactional work, advisory practice, incident response to data breaches, and artificial intelligence.
Olivia discusses how she was drawn to intellectual property while she was in law school and how that initial interest shaped her approach to privacy law in her career. She also touched on the evolution of technology in the workplace, notably AI, and how it can strengthen the user’s thinking when used as a tool to support conclusions rather than reach them.
Dean Melanie Leslie
Hello, I'm Melanie Leslie, Dean of Cardozo Law School.
Associate Dean for the Office of Career Success Associate Dean Carey Bertolet
I'm Carrie Bertolet Grand. I'm the Associate Dean for the Office of Career Success.
Dean Melanie Leslie
Welcome to SPARKS, where we ignite your passion for the practice of law.
Dean Bertolet Grand
Today, I'm very excited to introduce Olivia Greer, who is joining us. She's a partner at Weil, and Olivia, you're going to bear with me, because I'm going to talk a little bit about some of your accolades and your roles. You're not just a partner at Weil, you are the head of U.S. privacy and cybersecurity, you are a partner in the Technology and Intellectual Property Transactions Group. You are the co-lead, and we have a million questions for you about this, the firm’s artificial intelligence task force, and among other accolades, you are a Next-Generation Partner for Media Technology and Telecommunication Transactions by Legal 500 U.S., I could go on and on. I'm going to stop there. But welcome. Thanks for coming to our podcast.
Olivia Greer
Thank you so much for having me.
Dean Bertolet Grand
So, here's my first question, which is all of those things that you do, privacy and cybersecurity and AI. If I'm your client, what is it that you're actually doing for me as your lawyer? What's the lawyering that you do on a day-to-day basis?
Olivia Greer
I like that question, because the real answer is, it depends, which is like the classic lawyerly answer. But I sort of chunk my practice into a few different buckets. One is transactional work, so all corporate transactions, strategic M&A, private equity investing and acquisition, IPOs, you name it, any sort of corporate transaction that the firm handles, my team is involved from a privacy and cybersecurity perspective, and what that means in practice is understanding sort of the privacy and cybersecurity posture of a potential target or potential sort of merger partner, and understanding where there may be risk, where there may be opportunities for improvement. We're trying to help our clients, if they're on the buy side, to think about their acquisition or their investment in terms of what are we looking at with respect to the privacy posture of this company? Are there areas where we're going to need to pay attention once we've closed and we own it? What would that look like, right? Or is this company subject to the GDPR in Europe? Have they understood that, and have they put in place the policies and processes that are required, and if not, how risky do we see that as being? Is it going to impact deal value, or is it simply something that we can fix once we own the business? That's bucket A. Bucket B is what we think of as our advisory practice, so that is clients who come to us for help with their own compliance posture. So, sometimes that looks like drafting privacy policies, sometimes that looks like working through cybersecurity readiness. What does the incident response plan look like? Is the business positioned to implement that plan if there were an emergency, and sort of do all manner of things around that. We do a lot of product development related counseling, so we're building a new tool. It's going to touch personal information of consumers. How do we need to think about the privacy implications of that, and what should that look like? And then the last bucket I would say is focused—well, I haven't even gotten to the AI, so maybe it's not the last bucket—but the third bucket is focused more on the cyber side, in terms of incident response work that we do, so client has a data breach, and we act as first responders in terms of helping them understand it, contain it, get the right advisors in place, and sort of manage the long tail of dealing with it. And then the last piece, which you asked about, of course, is AI, which maybe I'll just pause, because that's a separate conversation.
Dean Melanie Leslie
I want to follow up on the first two buckets. Give us some law. So, you say privacy. What does this mean? What are the applicable regulations you're worried about? What are the most common legal issues that come up under those contexts?
Olivia Greer
So, I'll back up just to say, when I was at Cardozo, I was very interested in IP, that was kind of my focus, but there was one class, and it was called Internet Law. This is 2011-ish and I took that class, and that was mostly like Fourth Amendment search and seizures, ECPA, wiretapping—like there was no US body of privacy law when I was in law school, and the speed with which that landscape has changed is astonishing, and probably second only to the speed with which AI has developed. So, what that looks like today is we have no federal privacy law in the U.S. We have a patchwork of laws that include some very specific, what we think of as sector-specific privacy laws. So, there are laws that govern financial institutions, for example, there are laws that cover various types of medical related information, and then we have this massive and growing patchwork of U.S. state privacy laws that really began in 2018 when California passed the California Consumer Privacy Law. Which was implemented in 2020, very quickly amended, and then sort of set in motion this trend of states passing their own privacy laws, and those laws are forged in the mold of the EU's GDPR, but different in really important ways, and equally importantly, they differ from one another, and so we work within this patchwork of law that you can't, as a business, simply say, "Okay, well, we're going to benchmark against the CCPA in California, and we're going to assume that that covers us state by state.” It simply doesn't, and so a lot of our clients are in a really challenging place of trying to find practical solutions to comply with this really massive set of laws in the U.S.
Dean Melanie Leslie
if you had to simplify the difference between the federal approach in the United States and the European Union, what would it be?
Olivia Greer
Yeah, so the EU, and it's now the EU and UK post-Brexit, have a law called the General Data Protection Regulation, which is a, for lack of a better word, a federal approach to privacy law, and so there is one privacy law across Europe, and in the U.K. We sometimes say, when we're trying to talk about this with clients, privacy is to Europe as the First Amendment is to the U.S. There is a feeling about a fundamentalness about privacy law in Europe and in the U.K., and the GDPR is very principles-based, meaning there are a set of guidelines, a set of principles that have to be implemented, and there's specificity with which they need to be implemented, but there's a lot of flexibility built in for different types of companies implementing in different ways, so for example, the standard might be different for a business that is collecting millions and millions and millions of pieces of consumer data versus business that's operating just be to be might have information about its employees, they'll all be subject to that law, but there's room built in for sort of a reasonable implementation based on those differences. In the U.S., it's a little bit different, the laws in the U.S. at the state level are built on those principles, but much more directed in terms of implementation. That's part of the challenge, is you have businesses that are technically caught by these laws, even though they may have very little nexus with the states, or with sort of the information.
Dean Bertolet Grand
it's such an interesting dichotomy to me that on the one hand your practice is sort of just the most traditional practice of law, which is avoiding risk and counseling your clients, and on the other hand, it's privacy and technology which is changing kind of every day, so it's completely novel, it seems to me, and I'm wondering, when you were in law school and you didn't know what privacy is, were you attracted to this idea of the practice of law and way that changes where you step into a different river every day, did you anticipate that you were going to be doing something that's such a quickly moving kind of legal environment?
Olivia Greer
So, I loved IP, because, well, I think initially, because I felt like I sort of understood what it was. It felt very tangible, I could understand what a copyright is, right, and the content that is part of a copyright. I think sometimes when I talk with summer associates and junior associates and law students, I talk about sort of there's two different approaches to at least law firm work. One is you love to be a litigator, or you love to do deals, and you are a bit agnostic as to what the issue is, like, you want to go to court. Another is you are really invested in a particular body of law, and you are, you're going to practice that body of law and apply a bunch of different facts to it. And I think I've always been more in that direction. I loved IP because I felt like I can learn the law, right, like it doesn't actually change that much year to year. There's a couple of cases you keep track of them, you kind of like understand the landscape, and then you apply the questions that come to you within that very clear framework. And I think privacy is somewhere in between, because it is also like it's a body of law, you can understand what that is, you can get your arms around it, you can say I'm a privacy lawyer, and that's what I practice, and at the same time it's constantly changing and developing, so I've gotten myself caught, I think, in a little bit of an in between there, but I think that is ultimately what drew me to it, was I like that there is a framework and you can understand that framework, and then you're solving problems inside that framework,
Dean Melanie Leslie
What is the biggest mistake you see companies making when you're trying to do your due diligence and figure out whether the acquisition that's happening is a sound one or not?
Olivia Greer
There are a couple of different flavors of mistake, and I think it gets at what we try to do, which is really come at this practically. Some companies put blinders on and assume it's going to be fine. It will never be fine.
Dean Melanie Leslie
Do you mean you give them advice and they're ignoring it, or they just don't even think about it?
Olivia Greer
It's more that they don't even think about it. They're running their business, they figure oftentimes it's a business that's been running in startup mode for a long, long time, and they are moving quickly, and they're saying to themselves, "We'll fix this later, we'll deal with it when we get the next round of investment,” whatever it is.
That's common, and it's coming at this with some years of experience now. It never turns out okay to pretend it's not an issue, because the regulators in the privacy space are very, very active, California particularly, but really in all of the states that have passed laws, they pass them for a reason, right? And they are really active in pursuing enforcement. That's one that's like sort of the basic flavor, right? Is just don't pretend it's not going to be an issue because it will. But, there's a sort of pendulum swing to the other side of that, which is you also see businesses, and I see this more commonly than I would have maybe expected, who try to do the most, and so you'll see companies saying we're compliant with the GDPR, and we're compliant with the CCPA, and we're compliant with HIPAA, and then you get on a call with them, and you're like, well, are you subject to any of those laws? And they're like, we don't know, we just thought it would be good to say that we, you know, are doing it. So that's sort of like the other pendulum swing, which is like, don't do that either, because don't promise to be compliant with a law that you're not even subject to. That's like a whole other world of pain that you don't want to be part of.
Dean Bertolet Grand
So I'd love to move a little bit into the artificial intelligence space, and just to be vulnerable, I am a Gen X who, when people start talking about artificial intelligence, I'm kind of ambivalent. Am I embracing?
Dean Melanie Leslie
Ambivalent? You say to me, "You want me to refer to our corporate overlord?” Isn't that what you call it?
Dean Bertolet Grand
No, it’s our robot overlord. So, I am trepidatious let's say. Is that how I should be feeling?
Olivia Greer
Of course, yeah. I'm also trepidatious. We chuckle a little bit in my practice because we've been counseling clients on AI for over a decade. We just used to call it machine learning, but it was really the same idea, which is, how do we use data to build algorithms, and how do we use those algorithms to create content, to do analyzes, to tell us all sorts of things, right? And so, the, you know, it's funny, right, it goes back to the privacy thing, which is the legal issues, I don't mean to say that they're not different, but the fundamentals are the same. So, from a legal advising standpoint, I'm not as fussed. What is AI doing to the practice of law, what does that mean for attorneys, especially junior attorneys? What does that mean for law students? What does that mean to sort of the world as an existential question? I do really have more concerns, and we are, as a practice and as a firm, very actively engaged in figuring out how AI can support the practice of law and drive efficiencies for clients, in particular, and also, we are very clear-eyed about not just the risks that we see in the news, right? Yes, AI hallucinates. We all know that AI hallucinates, and you should not use AI to write briefs.
Dean Melanie Leslie
Say that one more time for our student listeners.
Olivia Greer
Please, please, please don't use AI to write briefs. I don't know another way to say it, don't know why we can't all reach agreement on this point. What I worry more about is that AI makes us lazy, and it makes me lazy, so when I use, say, Chat GPT to gut check something, does the CCPA say this thing, and how is it different from, like, Maryland, and it gives me an answer, people talk about AI being confidently wrong, and that's what it is, right? It seems so clear. Yes, the answer is the CCPA says this, and it's different from Maryland in these three ways. I know generally enough, as a lawyer, at this point, I'm like reasonably confident that I know when it's wrong on that kind of point, or at least enough to be like, eh, I'm not so sure, I'm just going to go back to the statute. I think younger attorneys will just, it's not their fault, but they won't have that instinct to say, like, "Oh, that doesn't quite seem right, I'm going to go check.” And so, thinking for us about, like, how are we building those checkpoints? How are we mandating them, and how are we training lawyers to do that without having to think about it? That's the real challenge I think that we're facing, and really actively thinking about. I wish I had some really clear answers about it. I think we will have some better answers about it, but that's the real challenge. How are we, because you have to use it it's no longer a choice, but how do you use it? Well, and not in a way that is going to just be lazy and lead to ultimately malpractice, is the question.
Dean Melanie Leslie
So, of course, the big question, and everybody's getting a lot of ink out of this, speculating about the impact on hiring for junior lawyers next year, the year after that, the year after that, and of course, a lot of hyperbolic language about this is the end of hiring of junior lawyers. What are your thoughts?
Olivia Greer
Look, I will say that I don't see that here. We have a full summer class starting on Tuesday, and the thing that we keep talking about is there's all this talk about how if you have AI and a few really good senior associates, that's all you need, but how do you get senior associates without training junior associates? There's no answer to that question, and so that's going to even if that were the goal, which I would not, I would not argue that that is the goal, but even if we all accepted that that is the goal, that's going to take a long time to figure out how to implement, and in the meantime we still need your junior associates, and so that's not something that keeps me up at night today. I would say.
Dean Bertolet Grand
Do you have a sense of whether your clients who are not in the legal industry, are they ahead of us as lawyers in their use of AI?
Olivia Greer
Yeah, they are. I think by and large, and it depends a little bit on the industry, but for instance, I work a lot with clients who are in the private equity funds space, and they are early adopters, they're really sophisticated, they're building stuff in really interesting ways. Not all, I think there's a real spectrum, probably in every industry, but yeah, I would say non-legal professionals are way ahead of the legal industry, by and large. But we're catching up.
Dean Melanie Leslie
What advice do you have for our students about using AI.
Olivia Greer
Get really good at using AI.
Dean Melanie Leslie
What do you mean by that? And what is an unethical and bad or poor way to use it? And what is the way that you think they ought to be focused on learning how to use it?
Olivia Greer
Okay, so the way not to use AI is to use it to come to conclusions. If it's a question about analyze these two cases and make x y and z argument, AI is not appropriately used to drive you to the argument. AI can be appropriately used to say, here's the conclusion I'm looking to come to here's what I think the conclusion is. Here are the two cases. Help me pull out the best citations, and is there anything I've missed? This is what I think it's going to be. What have I missed in this argument? What will my opponent say about this case that is counter to what I'm saying? AI is a tool to augment a thought process. It's a tool to support a thought process. It's not the thought process. So, another example here would be, you know, in our practice, which is more corporate, I'm not really looking at cases much anymore, although not never, marking up a purchase agreement for a corporate transaction, we do in certain limited cases have tools that allow us to say here's the purchase agreement markup from the other side, here are the five things I'm most focused on in this agreement. Can you point me to where the issues are in this agreement and give me some suggested revisions. But then I have to read that agreement and make sure I agree with that approach, and so it's that step, I think, there are a lot of other use cases, but that is the final step, where you cannot allow the last step to be the AI edit.
Dean Melanie Leslie
I think one thing that struck me so much in trying to use AI, it would be the human equivalent of confirmation bias, where it's trying, it's so cheerleadery, and so I now take everything everybody sends me, where I think they've used AI, and I run it through AI, and I say, "Tell me what's wrong with this critique, this from the following four perspectives.” Even when I'm using it for something, I say, “Here's my instinct,” not is it a good idea, because I will get a resounding yes, but why is it a bad idea? It's so important because it's kind of stunning how it's programmed to make you feel so, so, so smart, like all your instincts are right.
Olivia Greer
I really like it, and maybe this is helpful for law students, I hope it is, I really like it for when I have to look at a bunch of things across. So, my example is like I'm often in a situation where I'm looking at asked to help a client think about vendors that they may onboard, and let's say they've got like five different vendors, and I want to understand what the data rights are that those vendors are claiming, are they allowed to use customer information to train AI, and I will give those URLs to Chat GPT and say, can you please go through and pull out the data rights clauses for me, so that's just making something faster, it's not doing the thinking, then I've got the different rates causes, and then it's sort of what you said, like, where are we poking holes, where are the issues, and they can point to it, but it's going to tell you what you want to hear, unless you ask it to interrogate its own thinking.
Dean Bertolet Grand
I'd love to just turn a little bit, because it's so interesting to hear you, your expertise, and the confidence, and I'm wondering if in your path to get where you are now, have you ever had a crisis of confidence? Have you ever felt not as sure, or stumbled a little bit on your way to where you are?
Olivia Greer
I mean, the short answer to that is yes. The longer answer, in many, many cases, I mean, there are a lot of spots where I've just messed up, but I think bigger picture, and maybe what I would want take away is my career took a long time. Partly because I didn't really know, like, I went to law school late, I was out of school for like five or six years before I went back to law school, so that's to begin with, right? I had a whole path and then a total pivot, and then I really had a long, long time before promotion, before being partner, before being in this seat, and I think there's a lot of bumps in the road in any career for me. I think the reason I've been at my firm for my whole career is because I've felt very supported in, in particular, my parenting path, and sort of being able to pull back, take real parental leaves, come back, come back slowly, and that has meant that it's taken longer, and throughout it people have sort of been like that's fine, it's really okay. It's going to take the time it takes, but that's a hard thing to hold on to. I think, as a person who is ambitious and who is watching peers kind of go along other paths, and so I think maybe that's the one thing I would really want to share, in terms of like lows, is careers are long and they also happen at the same time as your life is happening. I think often we get a narrative that's about ambition and just like following the path, but there is not actually a path. I think that's the thing that I've learned, and maybe what makes me feel confident now is like there really just isn't. It's a false construct, and there have been so many moments where I did not know if I would stay in big law. I did not know if I would ever want to be, let alone be, a partner at a law firm, and I had a lot of feelings about that. Right, like, is that a failure if I decide to off-ramp? Like, what would that look like? And then there's moments, too, where you kind of decide you're going to dig in and push and make it happen, and then that has consequences in other parts of your life. So, somebody said to me, a mentor, when I was having my first kid as a fairly junior associate, a partner who was also a mom said, there are going to be times when you choose your family over work, and it will have been the wrong decision, and there are going to be times when you choose work over your family, and it will have been the wrong decision. The message was like, you're going to mess it up, and you're going to feel terrible about it sometimes. That's life, and I think the more I've been able to be comfortable with that, sometimes it just doesn't look the way you want it to look, the easier it gets. But yeah, I mean, I would say that, like, those are the lows of sort of sometimes it's because you decided to duck out of a meeting and get home to see the kids, and you realize, like, I really should have been that meeting was like not a great look, or you stayed in the meeting and you missed bedtime, and then the next morning somebody is like, "Where were you?”
Dean Bertolet Grand
But you've learned to give yourself grace in all those moments.
Olivia Greer
I mean, have I learned it fully? No, but that's the goal. That's the goal.
Dean Melanie Leslie
I wish we could talk forever. Thank you so much for spending time with us today.
Olivia Greer
Thank you both. It's really, truly, truly a pleasure.
Dean Bertolet Grand
It's been a joy.