Why Carl for Your Privacy Audience
Privacy used to be about what the website disclosed. Today it's about where data actually goes — the analytics tools that share with sub-processors most organizations have never audited, the AI vendors processing PII through training pipelines, the SaaS platforms whose default settings expose data to integrations leadership doesn't know exist. The privacy program written five years ago doesn't match the data flows that organization actually has now. Most organizations don't realize this until something breaks.
Carl B. Johnson has spent 30 years inside the regulations that govern personal and sensitive data. As CISO at Cleared Systems, he leads privacy program engagements across healthcare, federal contracting, defense, and technology — the four sectors where privacy obligations cross-pollinate with sector-specific regulation in ways that make most generalist privacy guidance inadequate.
For privacy summits, compliance conferences, and corporate leadership audiences, Carl delivers privacy content that's actually about modern data flows — the practical exposure points organizations have today and the program-level decisions that close them.
Available Sessions on Privacy
Privacy, Technology, and the Risks Organizations Ignore
How modern technology quietly exposes data — and what leaders can do about it before it becomes a headline. Covers the data-flow patterns most organizations don't see, the analytics and vendor sub-processor risk that policy alone can't address, the AI integrations creating new privacy exposure, and the practical privacy-program moves that actually move the risk needle. Built from current engagements where these failure patterns are showing up.
What Boards Need to Know About Modern Privacy Risk
Briefing for boards and executive leadership on the privacy risk posture organizations actually have versus what their policies claim. Covers the disclosure obligations leadership should personally understand, the questions boards should be asking the chief privacy officer this quarter, and the governance patterns that distinguish organizations that handle privacy maturely from those that find out about exposure during a regulator inquiry.
Building a Privacy Program That Reflects Reality
Hands-on session for chief privacy officers, compliance leaders, and the cross-functional teams responsible for privacy program execution. Walks through data-flow mapping (the kind that actually finds the exposure), vendor and sub-processor governance, the cross-jurisdictional disclosure framework, AI-and-privacy intersection points, and the documentation patterns that demonstrate program maturity to regulators across CCPA, CPRA, GDPR, sector-specific rules, and emerging state laws.
Download the One-Sheet
Get a printable, shareable PDF of this topic — perfect for circulating to your event committee or program chair. Includes the same sessions, audience profile, and FAQs as this page in a 2-page format.
Who This Is For
Audiences responsible for privacy program decisions or the executive audiences whose oversight determines whether those decisions get the resources to actually work.
- Privacy summits and IAPP-style events
- Compliance and risk conferences
- Corporate leadership programs
- Chief privacy officer professional associations
- Technology and SaaS leadership events
- Healthcare privacy conferences
- Financial services privacy summits
- Boards and audit committees
What Audiences Walk Away With
- A working understanding of how modern data flows differ from what most privacy programs assume
- The specific exposure points created by analytics, AI vendors, and SaaS sub-processors
- A practical framework for assessing privacy risk that goes beyond policy review
- The cross-jurisdictional disclosure landscape and what's actually changing across CCPA, CPRA, GDPR, and emerging state laws
- The governance patterns that distinguish organizations handling privacy well from those that don't
- The board-level vocabulary for discussing privacy risk that translates to actual oversight