Regulatory Spotlight: Navigating data privacy, AI and compliance with Peter Leonard

In this edition of ADMA’s Regulatory Spotlight, we speak with Peter Leonard, an expert in data and technology and Chair of ADMA’s Regulatory and Advocacy Working Group. With decades of experience in business law and digital compliance, Peter shares insights into the shifting regulatory landscape, the growing focus on accountability and what marketers must do to stay ahead in an increasingly complex environment.

To start, could you share a little about your career to date?

I was a business lawyer for over 30 years. I was a founding partner of Gilbert + Tobin, which, when we were founded, had only four partners and now has over 100. I led their technology, communications and digital legal practice group for 28 years.

The common thread throughout my legal career was used by businesses across all sectors of consumer data. I started by acting for telco new entrants, companies like Optus in Australia, and similar companies in Malaysia and Indonesia, that were trying to gain new customers and compete against monopolies that controlled all the telco customer data and used that control to foreclose the new entrants. Telco competition was introduced country by country throughout Southeast Asia, and so I spent a lot of time working in the region. Then along came e-commerce, broadband, big data, social networks, smartphones and now AI. Suddenly, there’s consumer data issues everywhere.

So today, I run a consultancy called Data Synergies, which assists clients to move beyond compliance with data privacy and competition law and also implement processes for accountable and trustworthy sharing of data with other entities. A fair bit of my work is in adtech, martech, and digital marketing, but I also work across other sectors such as health, banking and financial services.

What have been some of the professional highlights along the journey so far?

What I enjoyed the most was working across Asian countries with my clients that were, almost without exception, locally owned new businesses. I was working with really smart and innovative young people that were trying to bring competition into their markets. I really enjoyed the range of cultures and different life experiences I found there.

Another highlight of what I do is that I seldom get to do the same thing twice. Every time I think I've got issues around data sorted out in my head, a new technology or business model comes along that completely changes everything that I thought I knew. I have to reinvent myself every few years, so I never get bored.

The regulatory landscape is rapidly evolving. What do you think are the most significant regulatory changes that are coming and how do you see them impacting the industry?

The biggest change is regulators very clearly pivoting away from focusing on what organisations say about how they are using consumer data, to examine the governance and assurance controls that organisations implement to assure that their uses of data are only what they say they are. This additional focus is on what some regulators call ‘organisational accountability’, and applies across many regulators: privacy, online safety, competition, consumer protection, home affairs and information security, etc.. As a result, it is no longer good enough to tell consumers what you're doing with their data: organisations need to be able to prove that their data systems and processes are effective to stop them doing anything else with consumer data.

This change is sensible and overdue. We all recognise that we don’t have time or energy to read all of those consumer terms, privacy policies and requests for consent. We increasingly rely upon regulators to ensure that organisations are doing only what they say they are doing, and to focus enforcement upon data use scenarios where consumers will suffer significant harm from what organisations are doing.

Regulators are also more focussed upon whether consumers are deriving real benefits in exchange for uses of data about them, and on which segments of consumers are particularly vulnerable to data-enabled harms. This new focus creates real challenges for digital marketers, who need to be ready to demonstrate that they have thought carefully about the audience segments to whom their marketing activities are targeted, and whether that marketing is fair and responsible. AI is a two edged sword: it enables both more fair and personalised marketing, or excessive and opaque targeting, depending upon how responsibly organisations evaluate and use AI applications. Marketers need to think carefully about categories of vulnerability: vulnerable people might be those suffering financial hardship for whom particular products are clearly unsuitable, problem gamblers, problem drinkers, children being exposed to services or products that are unsuitable for kids and so on.

What do you see as the biggest challenges for marketers navigating today’s regulatory and consumer trust environment?

Regulation continues to expand and become more complex. Consumer organisations and regulators have higher expectations as to responsible digital marketing practices. Data security and responsible AI concerns are increasingly impacting how CRM data may be made available and monetised. Marketers can’t be across all of the issues of marketing using consumer data. But nor can their lawyers and other advisers, who may not have a deep understanding of how digital marketing works, or of possible data assurance safeguards and controls that may enable a particular digital marketing practice to be legally implemented, because they effectively preclude other, impermissible uses or disclosures.

The challenge about that is if you're going to implement the latest strategies for digital marketing in a responsible way, you need to understand the technical and operational aspects of managing data responsibly and how the regulation applies to that.

The classic example is the use of tracking pixels for marketing to individuals, where, depending on how you implement the use of tracking code, it can either be legal or illegal. Marketers need to know enough about how the regulation works that they can get the right advice about how to set up systems and processes so that they are not over-collecting, oversharing or over-retaining consumer data.

What is one thing you wish marketers understood better about privacy regulation?

The key thing to understand is the new regulatory focus on what fair and responsible marketing practices look like. The regulators also need to learn more about what is possible by way of privacy-enhancing and privacy-preserving digital marketing. I’m not just talking about the privacy regulator but also the E-Safety Commissioner who deals with children's safety, and the Australian Communications and Media Authority (ACMA), which addresses spam and the do not call register.

In other words, marketers have to be engaged with various regulators and should be more willing to talk to the regulators about what they are doing and why. Quite frankly, both regulators and marketers need to get out more and talk to each other, as well as to the regulatory and legal teams within organisations and their external advisors. Nobody can understand all of this stuff themselves.

What advice would you give to marketers looking to build their understanding in regulatory matters?

Over the past year, ADMA has had a big focus on building the capability of marketing teams - from CMOs all the way down to new people entering digital marketing teams. ADMA has continued to expand its range and depth of courses, course materials and other instructional material to assist in building marketers' understanding of privacy preserving technologies, data clean rooms, use of pixels and other tracking codes.

If I had to give one piece of advice to marketers, it's that you can't keep up just by reading the marketing media. You need to keep up with what's happening with business models, changes in the digital advertising sector generally and what new companies are doing. And it changes all the time, which is challenging, but it also means that this sector never gets boring.

What do you think will have the biggest impact on data-driven marketing over the next five years?

There are two really important trends.

One is that consumers, particularly consumer advice organisations like CHOICE, have a much better understanding than they had in the past as to the value of consumer data to businesses. That, in turn, is leading to an expectation by consumers that they will be given value in return for

the use of that data and that value might be economic or better access to benefits, such as through loyalty programs.

There is an expectation of reciprocity, and unless a business can demonstrate reciprocity, I think consumers will increasingly go to businesses that are willing to share real benefits back to them.

I also believe regulation will continue to get more complex. AI is going to be a really important part of this, it’s both a threat and a challenge for digital marketing. AI regulation will expand, so this won’t become any easier.

Digital marketers will have to get smarter to manage that complexity. There will continue to be plenty of interesting jobs in the digital marketing sector and plenty of demand for good digital marketers that are ready to embrace continuous change and reskilling.

Why do you think organisations like ADMA are so crucial for the marketing and advertising industry?

ADMA is important for a couple of reasons. One is that it helps us understand what’s happening in industries or business sectors that are adjacent to those in which marketers might be working.

For example, you might be working for a big brand like Procter & Gamble on their big brand consumer digital marketing strategy. You might not think that what Qantas or Woolworths are doing with their consumer loyalty data is directly relevant to what you do, but it probably is. There are often important lessons in other sectors.

An organisation like ADMA brings together these various industry sectors and enables cross fertilisation of ideas from one sector to another because learning about how best practice in one sector can be used as a model for best practice in another is incredibly useful.

ADMA also provides really important educational, regulatory and policy functions where it can present the voice of digital marketers across various sectors to government and regulators. As the government and regulators are looking back to businesses and saying, “Hey, improve your compliance practices.” Organisations like ADMA can really help them do that.

Lastly, what do you enjoy doing outside of work?

I do quite like work, but let me be quite honest: I enjoy my life outside work more than I enjoy my life inside work. I try to get on my bicycle on the hills in national parks at least twice a week. I try to kayak or stand up paddle board on beautiful Sydney harbour at least twice a week. My wife gives me tasks in the garden, which I am often not successful in avoiding. I love our outdoor life in Australia, and talking to diverse people at the dog park. I love the new Sydney Metro. Life in Australia is pretty amazing, really.