Jim Shaughnessy, Workday general counsel. Courtesy photo.

As an undergraduate, Workday Inc. general counsel Jim Shaughnessy studied political science and math. But he also found himself drawn to computers and information technology, writing code and programming.

“I developed an interest in information technology that I ended up putting aside in the first several years of my career,” he said. 

Decades later, Shaughnessy has made his mark in-house by merging that early passion for technology with legal knowledge. He's spent more than 20 years as an in-house lawyer at various technology companies, including Hewlett Packard and Lenovo Group, most recently joining Pleasanton, California-based cloud computing company Workday as senior vice president, general counsel and secretary in 2011.

In each of those roles, Shaughnessy faced new legal challenges as companies' needs, the tech industry and GC responsibilities changed. Lately, Shaughnessy's focus has been on privacy.

“Coming to Workday, given the amount of data we have and the sensitivity of the data, it's fair to say that we're more focused on privacy than any of the other companies where I worked,” Shaughnessy said.

“[That's because of] the nature of our company and the times. I think that people are more aware of the potential for private data to become public and they're making sure that laws are adequate to protect people's private data and that companies comply with the law,” he added. 

Shaughnessy listed privacy, cybersecurity and free flow of data as some of Workday's 2018 policy priorities. With the European Union's General Data Protection Regulation implementation date just days away, he's not the only legal leader with privacy and data on the brain.

Fortunately, Shaughnessy isn't new to the world of privacy. He said he's been paying attention to the privacy and data regulation space since around 2000.

“I think I first became aware of privacy as an area of practice, as an area that a general counsel needs to be concerned with, shortly after the [1995 European Data Protection Directive] was adopted in the early part of the century,” he said. “I was at that time working for Compaq and we appreciated the importance of privacy both for our own operations and our customers' operations as part of the legal management team. My involvement grew as my career progressed.” 

During preparations for GDPR, Shaughnessy said his team has ensured that Workday customers know how to use their tools to comply with GDPR, while also ensuring the company itself was compliant. He said many customers came to Workday with questions on how to comply with the right to be forgotten and how to manage HR data. His team helped answer those questions.

For Workday, Shaughnessy said GDPR compliance was less of a challenge, because the company has been focused on privacy from its start.

“We've been working on GDPR since well before it was finalized roughly three years ago, closely following the proposals and counterproposals on the proposed regulation the last four or five years, and I believe we're ready to facilitate our customers compliance,” he said. 

Last year, Workday offered a course for its in-house lawyers and privacy professionals to get certified by the International Association of Privacy Professionals and in 2016, Workday was added to the Department of Commerce list of self-certified Privacy Shield participants, indicating that it meets standards for personal data transfer between the EU and the U.S.

Shaughnessy has also advocated for free flow of data on Workday's blog and in company-hosted roundtables with EU representatives on data localization and flow.

For in-house leaders struggling to make sense of data privacy and GDPR, Shaughnessy said it's still possible to catch up.

“The good news is there are a great many resources available to help people get up to speed very quickly,” he said. “Many of the lawyers [who] work here and other privacy professionals belong to the IAPP, and it publishes materials that are quite good.”

The willingness to find resources and learn about new legal topics—privacy or otherwise—is important for those who want to excel in-house, Shaughnessy said.

“[A prospective GC should] really indulge his or her appetite for learning,” he said. “People who succeed as general counsel are usually among the most enthusiastic and active learners.”