Selling Data? HIPAA, CCPA and GDPR Rules You Must Know
AITrainingDataBroker.com
Sell Company Data to AI?
HIPAA, CCPA, GDPR
Rules You Must Know
Rules You Must Know
What each rule asks, how de-identification helps, and where owners go wrong
Jimmy Lin
Sell Company Data to AI? HIPAA, CCPA, GDPR Rules You Must Know
Before you sell your company data to an AI lab, do you know which privacy rules your data has to meet?
In this video I will explain HIPAA, California's CCPA and Europe's GDPR in plain words, and how de-identification helps you meet them.
Stay to the end, because I will also show 3 mistakes that make owners believe their data is clean when it is not.
The video
Full script
Before you sell your company data to an AI lab, do you know which privacy rules your data has to meet?
In this video I will explain HIPAA, California's CCPA and Europe's GDPR in plain words, and how de-identification helps you meet them.
Stay to the end, because I will also show 3 mistakes that make owners believe their data is clean when it is not.
Most owners think about compliance after a deal is signed, but by then the data is already out of their hands.
So the real question is what your data contains before anyone outside your company sees it, and which rules apply to that.
I will name the public source for every rule, so you can read it yourself, and none of this is legal advice.
First, you should know who is telling you this.
I'm Jimmy. I have worked in data at Fortune 500 companies, as a data analyst, a data engineer and a software engineer, and I am trained in data science. I am also a Canadian military veteran, where I specialized in data analysis and reporting.
Are you selling your data? We are your broker and technical advisor. We get you the best price, and we guide your team through the technical side, including compliance.
Are you buying data for an AI lab? We find the right data for you and see it through to delivery, so you can focus on advancing AI research.
Let us start with why this matters when you license data to an AI company.
Your data holds personal information, like customer names, emails, phone numbers, and health or money details, even when you never think of it as personal.
Which rules apply depends on your data and on where the people in it live, and that is a question for your own lawyer.
What I can tell you is the step that helps with all of them, which is to de-identify your data before it leaves you.
Next, the 3 rules that owners ask about most.
In the United States, HIPAA covers health information held by providers, health plans and their business partners, and the Department of Health and Human Services gives 2 ways to de-identify it, called Safe Harbor and Expert Determination.
In California, the CCPA, as changed by the CPRA, says data is deidentified only if it can not reasonably be linked to a person, and you make 3 promises.
You take reasonable measures, you commit publicly to keep it deidentified, and you bind everyone who receives it by contract.
In Europe and the UK, the GDPR says data is outside the law only when no one can identify a person from it at all, and that is Recital 26.
The European Data Protection Board also has a new draft on this, still open for comments until October 30.
What counts as personal information in company data? The list is longer than most owners expect.
HIPAA's Safe Harbor list has 18 items, like names, dates other than the year, phone numbers, email addresses and account numbers.
California and Europe add things like IP addresses, device IDs and location, and Europe also gives extra protection to health, genetic data and beliefs.
NIST, the US standards body, adds one more point in its guide, which is that a company can be identified from data too, and not only a person.
Here is one note, before and after.
Say a clinic writes, Hassan Bakr, born April 17, 1962, in Duluth, phone 555-0188, asked for a refill.
Blacking out the details ruins the note, because nobody can tell who did what, and the data becomes much less useful for training.
So we de-identify your data with a stand-in, which means Hassan becomes Patient 6014 in every note, the date becomes the year 1962, the city becomes a region, and the phone number is removed.
That follows the shape of HIPAA's Safe Harbor list, and your lawyer decides if it is enough for your data, with an expert where one is needed.
How does de-identification work in practice? There are 5 steps.
First, we find where personal information hides, like signatures, email headers, file names and the text of messages.
Second, we clean it with consistent stand-ins, and third, you review a sample before anything leaves.
Fourth, we test it the way a determined outsider would, which the UK regulator, the ICO, calls the motivated intruder test.
Fifth, we write down what was removed and how, because your lawyer and the AI lab will both ask for that record.
Which industries ask about this most? Healthcare and medical practices come first, because HIPAA applies there.
Then insurance and finance, where customer financial information is protected, and accounting and law firms, where client information is protected by professional rules.
Staffing and recruiting companies hold resumes and background checks, and software and retail companies hold customer accounts and orders.
Property, logistics and construction companies hold tenant, driver and homeowner details, and marketing agencies hold client work, so each industry has its own sensitive items.
I put a free list of them, by industry, on Hugging Face, and the link is in the description.
Here are 3 mistakes that make data look clean when it is not.
First, hashing, where an email turns into a string of letters, but the Federal Trade Commission said in July 2024 that hashing does not make data impossible to trace.
The same input always gives the same output, so a person can still be tracked, and common items like emails and phone numbers can be guessed and checked.
Second, swapping names for codes, and the European Data Protection Board says data with codes in place of names is still personal data.
Third, relying on a list alone, because free text hides clues, like the only licensed electrician in a small town, and no list catches that.
So can you do this yourself? You can, but many owners ask us to do it.
We also offer data de-identification as a service, which means we do the work with your team, and you approve a sample before anything leaves.
It can be its own project with its own fee, or part of a licensing deal, where the AI lab usually pays for it, decided case by case.
Where a rule needs an expert to sign off, like a HIPAA Expert Determination, a qualified expert signs it and not us, and your own lawyer still decides if it is enough.
That is where a broker and technical advisor comes in.
As your broker, I bring your data to several AI companies and AI labs, get competing offers for you to compare, and work through the terms with you, and you make the final call.
As your technical advisor, I guide your team through the technical side, which means what to export, in what format, how your data is cleaned, and compliance.
We move forward only after your team signs off, and the terms are agreed case by case.
And you do not pay anything for the broker work: AI companies pay my fee.
Now, is your company data ready for the rules that apply to it? We need a sample to tell you, so start with the free estimate today.
We also de-identify data as a service, so if your industry is on the list, ask us about it.
If you run a company with 30 or more people, the data you already have could become a new revenue stream.
Want to find out?
You can check if yours qualifies, for free, at AITrainingDataBroker.com.
If you have further questions, leave them in the comments, and I will answer them in the next video.
Thank you for watching.
I will see you next time.
More slides
AITrainingDataBroker.com
AI Labs Want
Your CAD Files
Right Now (Oct 27)
Right Now (Oct 27)
An open request for CAD files, what it asks for, and what to do today
Jimmy Lin
AITrainingDataBroker.com
What Is Recursive
Self-Improvement?
Your Data Matters
Your Data Matters
AI that improves itself, 3 real examples with sources, and what it means for your data
Jimmy Lin
AITrainingDataBroker.com
AI Labs Reject
These Industries'
Data First in 2026
Data First in 2026
Which industries get turned down most, why, and what gets you in
Jimmy Lin
