Additionally, Kothari noted that data regulation intended to protect user privacy can also hamper company innovation around new data streams. “There is a challenge to protect data and implement new technology,” he said.

Panelists somewhat agreed that current policy around information security and regulation can create some unnecessary challenges. Because of the complexity and confusion created by current information security regulations, many companies feel they need to call in legal reinforcements to cope with extensive and perhaps excessive amounts of regulation.

“You need to have a good understanding of privacy law, because you’ll feel like your hands are tied,” Kothari added.

Bill Sieglein, founder of the CISO Executive Network, said his work as a CISO requires a balancing act. In investigating breaches, the CISOs Sieglein works with are looking to identify potential sites of a breach. In doing so, though, “you might be stepping on privacy’s toes,” he said.

Amie Stepanovich, U.S. policy manager for D.C.-based global digital rights advocacy group Access Now, said privacy and security should be considered less as conflicting interests and more as partners in policy. “They should work together,” she said. “There is a mutually beneficial relationship between privacy and security.”

Law enforcement’s access to user and company data has garnered increased scrutiny over the last few years, but panelists largely agreed that law enforcement have a key role to play in data security.

Paez suggested that law enforcement need substantial, if not universal, access to data across privacy lines because of their protective role. “It’s about guarding data from unauthorized access and use,” Paez posited.

Stepanovich added that user privacy is a “fundamental human right” and should be the foremost concern in developing policy around what data law enforcement can access. Though encryption does prevent law enforcement agencies from gaining full access to all data at any time, Stepanovich said there could be more problematic consequences to creating data security infrastructure with built-in holes for law enforcement to gain universal access.

Rather, Stephanovich suggested the legal industry shift the discussion around this issue to helping law enforcement protect against breaches and identify cyberattackers, rather than simply bulldozing privacy safeguards like encryption. Law enforcement need to “get the data they need to solve crimes, not to bypass encryption,” she noted.

Mikhail Dvilyanski, supervisory special agent of the cyber branch of the FBI, agreed with Stepanovich’s assessment, but urged audience members to consider what security problems could arise when law enforcement is unable to properly investigate certain breaches or crimes.

“We should think about the implications if we say that law enforcement is not able to get certain data,” Dvilyanski said.