Most privacy talks are about one person's laptop. This one is about a company. When an organisation picks its tools, it makes a privacy decision for everyone downstream, employees, contractors, clients, none of whom were asked. For example, a security company has to take that seriously, because other people's security depends on its own, and privacy is part of it. But running everything yourself is too much overhead when you are moving fast to secure a client, so outsourcing is the convenient answer, which only moves the question to who you outsource to.

The talk is what that was actually like: what was painless, what we underestimated, and what is still unsolved. Things like external calendar invites, shared document editing, clients who only send Google Docs links, services that assume Google SSO, and more.