Spotlight on Professor Lydia De La Torre, California Privacy Protection Agency Board Member

• Citation: Vol. 1
• Publication year: 2024
• Author: Jennifer L. Mitchell

SPOTLIGHT ON PROFESSOR LYDIA DE LA TORRE, CALIFORNIA PRIVACY PROTECTION AGENCY BOARD MEMBER

Written by Jennifer L. Mitchell*

Profesor Lydia de le Torre

Between Professor Lydia de le Torre's roles as a Board Member of the California Privacy Protection Agency (CPPA), the Founder of Golden Data Law, and a law school professor teaching novel courses on artificial intelligence (A.I.), there is no doubt that Prof. de la Torre is one of California's most influential privacy lawyers.

Prof. de la Torre was appointed to the CPPA Board by the California Senate President pro Tempore Toni G. Atkins in March 2021 and served on the Advisory Board of Californians for Consumer Privacy during the Prop 24 ballot campaign. She is an affiliated researcher at the Center for Data Science and Artificial Intelligence Research (CeDAR) and teaches privacy, data protection, and AI courses at UC Davis Law and U.C. Law San Francisco (formerly U.C. Hastings). Prof. de la Torre is the founding partner of the teaching law firm Golden Data Law (GDL). GDL serves clients in the not-for-profit sector, and its mission is to mentor a diverse and inclusive group of law students and recent grads so that they can grow into solid ethical professionals. Prior to her appointment, Prof. de la Torre served as an of-counsel to Squire Patton Boggs and had in-house counsel roles at several multinational organizations. Prof. de la Torre is an international expert in data protection issues and the European Union's approach to regulating data and A.I. in particular.

I had a chance to catch up with Prof. de la Torre to learn more about her distinguished career path, her background in comparative law, and her views on the future of privacy and the profession.

JENNIFER: Thank you for your history of supporting the California Lawyers Association (CLA), and we appreciate you taking the time to share your insights with us. Could you tell us about your background, starting as a European-trained lawyer, and how you ended up specializing in privacy?

PROF. DE LA TORRE: I was born and raised in Spain and completed my law studies at the Complutense Facultad de Derecho in Madrid, from which I graduated in 1995. I wanted to work for the Arthur Andersen organization, which in Spain at the time had three branches: an accounting/auditing branch (which collapsed in 2001 after the Enron scandal), a consulting arm (which later became Accenture), and a law firm (Arthur Andersen Asesores Legales y Tributarios.) With that purpose in mind, I enrolled in an LLM program in taxation offered by Arthur Andersen and joined the Arthur Andersen law firm arm in 1996. Shortly after I joined, the firm merged with the leading local law firm, Garrigues, the name under which the firm still exists today. Because of the merger, the corporate practice grew significantly. I was able to move from the practice of tax law to corporate practice by working under Pablo Olabarry, a now-retired partner who is one of the most brilliant corporate attorneys with whom I have had the privilege to work with and who, incidentally,

[Page 18]

was one of my teachers during the LLM program. Since I was highly interested in emerging technologies, I raised my hand, so to speak, to be called upon to do any corporate or transactional work that was connected to them.

One of the laws affecting emerging technologies that were in effect at the time was the LORTAD (Ley Orgánica 4/92 de Regulación del Tratamiento Automatizado de Datos), enacted in 1992. This Spanish law pre-dates the EU privacy directive of 1995. The LORTAD (like the GDPR) was not considered a "privacy" law because, in Spain, the right to privacy and data protection are enshrined separately as fundamental rights in our Constitution. The LORTAD regulated computerized data processing to ensure Spaniards did not see their other fundamental rights, including the right to privacy, eroded by technology. That is the core of the Spanish right to data protection as conceived by our Constitutional Court. The LORTAD did so by regulating how computerized systems handled data related to individuals, or in other words, by limiting how computers are allowed to "think" about us humans.

The LORTAD created the Spanish Data Protection Authority (AEPD), giving rise to Spain's legal data protection field. The partners at my law firm did not quite know what to do with the LORTAD, as it introduced what, at the time, were entirely new concepts into the Spanish legal system, e.g., controller, processor, and processing. That opened the...