In this exclusive VMblog interview, Gavin Quinn, Chief Strategy Officer at 360 Privacy, shares critical insights on the evolving data privacy landscape.
Drawing from his unique background in special operations and intelligence, Quinn reveals how his firm is protecting executives from increasingly sophisticated AI-powered threats. As data brokers make opting out deliberately difficult and social media creates unexpected vulnerabilities, Quinn explains how 360 Privacy’s combined approach of advanced technology and human expertise provides protection that goes beyond traditional enterprise privacy solutions.
From practical steps tech leaders can take to enhance their personal security to the complex challenges of navigating conflicting privacy regulations across states and countries, this interview offers valuable strategies for safeguarding digital information in today’s high-risk environment.
VMblog: What is the state of data privacy today?
Gavin Quinn: Data privacy is multifaceted. On one hand, we have consumer data privacy, where, for example, banks and car dealerships collect personal information to complete transactions. Privacy laws ensure they don’t share the data without consent. On the other hand, we have enterprise data privacy policies that firms such as Microsoft or Slack follow to keep employee and customer information secure.
Additionally, we have data privacy policies around health information, financial transaction data, and individuals trying to secure personal devices. The challenge lies in the overlapping policies from tech giants like Apple and Google, combined with varying national and state laws. For example, California leads in with the most regulation in the U.S., but many other states, such as Vermont and Texas, have their own laws, creating a complex legal landscape. The sheer scale of data today has made roles like Chief Privacy Officers (privacy domain experts) essential, especially for large organizations.
VMblog: Can we say that the proliferation of data has exploded due to the way individuals live their lives?
Quinn: Absolutely. A lot of this is driven by convenience and marketing. For instance, if you search for hotel deals in Las Vegas, Instagram could target you with related ads based on that browsing data. Most people are unaware of the vast amount of information they share daily through their phones, cars, or computers. Companies are leveraging this data to create tailored advertisements and introduce new features.
Regulation has lagged behind. International initiatives, such as GDPR in the EU, are more consolidated. State-by-state approaches in the U.S. create additional layers of complexity. This all adds to the volume of work that privacy practitioners must perform, including managing compliance, disclosures, and retention obligations.
VMblog: How has your team’s background in special operations and intelligence shaped 360 Privacy’s approach?
Quinn: Many see us as an enterprise-focused privacy solution. That’s true, but we’re quite different. Our roots in special operations focus on protecting people, particularly in semi-hostile digital environments. We safeguard individuals by understanding how digital identifiers (such as email addresses, phone numbers, or device IDs) can expose them.
Our team specializes in making clients harder to find and thus harder to target. We also tap into our offensive expertise, tracking adversaries through their digital footprints. Fundamentally, our mission revolves around protecting the “good guys” while countering the “bad guys.” Our approach surpasses standard enterprise privacy models by prioritizing human safety.
VMblog: High-profile individuals are often targeted, but how are similar privacy threats affecting everyday executives and their families? Are you seeing new trends in 2025?
Quinn: Executives are subjected daily to phishing and scams that AI makes appear more credible, enticing or tricking people into engaging. Generative AI has enabled attackers to generate realistic logos, credible emails, and malicious links, leading to improved targeting.
Social media can also play a role. For instance, uploading vacation pictures in real-time, signals that your house might be unoccupied. Once, there was even an incident where a client believed their address wasn’t visible, yet indoor photos they posted could be matched with data on Zillow. This is one way that otherwise innocuous postings can infringe on privacy and open doors to problems.
Additionally, executives are frequently the target of impersonation attacks, either during tax season or through spoofed messages of urgency. Scammers continually refine their methods, and AI has made these scams more credible in recent years.
VMblog: 360 Privacy offers combined technology and human expertise. Can you provide a case study where this approach proved crucial?
Quinn: Data brokers profit by holding large amounts of personal information. While they are legally mandated to offer removal processes, they intentionally make the process arduous. Some even ask for identity upload to opt-out, deterring bulk removals.
Our response leverages technology and human expertise to get around these barriers. Our computer systems handle bulk work, while our analysts focus on more complex removal requests and identifying new data sources. We’ve instilled a “digital targeter” culture across the firm, where each assignment is viewed as a mission to outsmart potential threats. This cultural focus enhances our ability to protect clients.
VMblog: What can tech leaders do to limit targeted attacks?
Quinn: Here are the key actions tech leaders can take to reduce exposure to attacks:
- Limit social media sharing: Avoid posting vacation pictures until you return. Don’t share photos that reveal the exterior or interior of your home. Ensure you family follows these best practices as well, especially kids who are active on social media.
- Use separate emails and phone numbers: Establish individual contact information for various subscriptions and avoid employing your primary email address for trivial sign-up activities.
- Toughen up your devices: Eliminate unnecessary apps and enable tools like two-factor authentication. Features like Apple’s “Hide My Email” can render your information unidentifiable.
- Implement carrier tools: Use services such as AT&T ActiveArmor or Verizon’s spam protection to block phishing calls and text scams.
- Monitor credit activity: Freeze your credit and set up suspicious activity alerts. Products like Aura or those offered by the big banks accomplish this with ease.
These steps, though simple, can significantly reduce vulnerability to targeted attacks.
##
