Privacy community mourns the loss of Brendon Lynch

From humble beginnings in a rural dairy farming region of New Zealand to a global leader in the privacy profession, the arc of Brendon Lynch's career spans a wide and impressive berth, one that influenced a generation of professionals in the space.

Lynch, who served as chief privacy officer for Microsoft and, more recently, Airbnb, died in late October after a long battle with melanoma.

The outpouring of support and condolences for his death have been felt across the industry, one upon which he has had a clear and lasting impact.

"Brendon was a uniquely talented leader in our profession," IAPP President and CEO J. Trevor Hughes, CIPP, said. "Beyond his remarkable professional contributions, Brendon was a genial and welcoming friend to so very many in our field. Too many hearts are aching right now as we process the loss of our dear colleague."

"Brendon touched a lot of people in the privacy community," said long-time friend and colleague Mike Hintze, who worked with Lynch at Microsoft. "He was a genuinely nice, kind and fun person."

Peter Cullen, who hired Lynch at Microsoft in 2004, said, "I was really impressed with him. He worked extremely hard, but his family was incredibly important to him. He will be sorely missed."

Microsoft Corporate Vice President for Global Privacy, Safety and Regulatory Affairs and Chief Privacy Officer Julie Brill said, "My colleagues at Microsoft and I are sending our condolences to Brendon's family. He left an indelible mark on Microsoft, our industry, and the privacy profession as a whole."  

"During his time at Airbnb, Brendon transformed how we think about privacy as a company, he helped us see it through a new lens – as a chance to earn our community’s trust," said Airbnb Global Head of Operations Tara Bunch. "Brendon’s list of professional achievements is long, but it was his approach to leadership that truly set him apart, bringing his signature warmth and understated humor to every interaction. He showed us that great work and joy could go hand in hand – that’s what I’ll remember most."

A burgeoning career

After Lynch decided to see more of the world beyond picturesque New Zealand, he made his way to London taking a position with consulting firm Coopers & Lybrand, now known as PwC. Though the privacy profession was still in its infancy, it became clear to Lynch that it was a rising trend. Recognizing an opportunity, he moved to New York while still employed at PwC and got his start in the embryonic privacy profession, working alongside other privacy pioneers Larry Ponemon and Brent Saunders, the latter of whom co-founded what eventually became the IAPP.

"It became clear to me while working with my clients that putting data privacy policies into operation was a challenge," Lynch said in a 2020 interview with the IAPP's J. Trevor Hughes. With a rapidly growing internet, more companies were going online and with that, more issues emerged with how people built them while collecting user data. At the time, he was looking for something in the tech space that could help analyze websites, which led him to a pioneering privacy technology company called Watch Fire in the early 2000s.

Though originally tasked with locating broken links on websites, in a joint venture, Lynch helped build out the privacy modules of their offering, called "Web CPO," which became an early privacy program management technology, years ahead of its time. "That was the jumping off point for me to get into the tech sector," Lynch said. "I got very passionate about that, helping to build and take that to market."

The Microsoft years

Moving from an entrepreneurial, startup space into a well-established software company like Microsoft was a big shift for Lynch.

In 2004, Peter Cullen recognized Lynch's talent and potential, and during an IAPP event in Chicago, convinced Lynch to fly out to Seattle, meet the Microsoft team and "get a feel for the place." Cullen's persistence eventually worked.

"My team was split into governance and tech enablement," Cullen explained during a recent phone conversation. "We needed more competency in the tech space and Brendon was already an expert on this with his work at Watch Fire, so he led the tech enablement team."

Lynch said a key motivation for him to take on the role at Microsoft was its focus on the value chain and customer relationships around trust in addition to its level of support for risk management and compliance. Seeing Bill Gates' trustworthy computing initiative in 2002 and learning that the privacy team was part of that whole mission was compelling, as was his personal relationship with Cullen.

"I played an influencer role," Lynch said about working at Microsoft, "but there was also top-down support and that helped pave the way for influence as well. And some authority came with it."

While at Microsoft and its large team of software engineers, Lynch also helped build an early, bespoke privacy impact assessment management platform that would help automate controls around risk. As with his work on Watch Fire, the PIA platform was a vanguard development in the maturing privacy space, years ahead of its time.

In reflecting back on Lynch's imprint at Microsoft, Julie Brill said, "he helped create some of our first privacy frameworks and advocated for privacy protections that went beyond compliance and focused on trust. He helped grow a culture of respect for user data, and his efforts ensured that privacy was woven into the fabric of Microsoft's operations, making it a core value."

Airbnb's human-centered approach

In 2019, Lynch changed gears and joined Airbnb as its first CPO. "I wasn't necessarily looking for a new role," he said, "but an opportunity came up and I was intrigued by it for a number of reasons. It gets back to that orientation that drew me to the Microsoft role. It's a human-centered mission for the company to enable anyone to belong anywhere. The vision where the department should sit is in the trust division. ... Airbnb is a community built on trust and privacy really factors into that vision and mission."

Lynch also pointed out that Airbnb's business model means there are not only online privacy challenges, but an offline one as well. "It's about people coming together in the real world," he said. "That opened up new vectors of interest to understand what the privacy concerns might be and what opportunities to delight people might be."

After years leading a mature privacy team at Microsoft, Lynch said he cherished rolling his sleeves back up to dive deeper into the issues and challenges of leading the program at Airbnb.

"It's no secret what a spectacular executive and thought leader Brendon was," Airbnb Director of Privacy Molly Stout, CIPM, said in a phone conversation, "but if you talked to people who worked with him, you'd find that the work was not stressful, it was fun. He treated his employees like human beings and that was always his priority."

Stout first worked with Lynch while at Microsoft and said that after about two years, Lynch called her up to see if she'd join his team. "He was the only person who could have pulled me away from my job," she said.

Charisma and family first

In talking with several of Lynch's former colleagues, it's clear how important a role family played in his life. This was something Stout wanted to make clear during our phone conversation: "He cared so much about his family. He would light up when he talked about them. Getting to see him be really proud of his kids was incredible."

His love of family was something that Mike Hintze and Peter Cullen brought up in their phone conversations, as well. In fact, Lynch got ordained just so that he could officiate the wedding of Hintze with Susan Lyons Hintze.

When Cullen was trying to convince Lynch to join Microsoft 20 years ago, he invited his family to visit Seattle so Lynch and his wife, along with their young son at the time, could get to know the area. Clearly, it worked.

Cullen also highlighted some of Lynch's other skills, including his physical size. "He was a big guy," Cullen explained. "He had a commanding presence, and it was fun getting him to recognize that he could leverage that size without being overbearing. He became good at that, and it was one of the reasons he became so successful."

Stout shared a similar characterization about his presence in a room. "It felt like being around a celebrity during those public moments," she said. "He was so charismatic; he existed on another plane."

Legacy on the profession

Lynch has had a lasting impact on the IAPP and the wider profession, not only serving as chair of its board of directors in 2013, but also for his work in 2004 developing the original Certified Information Privacy Professional designation. He was also recognized with the IAPP Vanguard Award in 2017.

In reflecting back on his impact at Microsoft, Julie Brill recalled, "At a speech Brendon gave to our department during our annual Summit, he said, 'All data can be put to good use. But if used against us, it can impact our liberty, deny us opportunity, or unnecessarily filter our world view.' 

"His words are as true today as they were when he gave this speech to our department over a decade ago. Brendon's focus on the opportunity that data can provide and the importance of protecting people against its misuse serves as a poignant reminder of the impactful role a smart, dedicated, and nuanced privacy professional continues to play in this data- and tech-driven world."

As in other times in his career, Lynch had a strong vision for where the trends were heading. In an interview with the IAPP's Jennifer Bryant in 2020, he said, "I think (data innovation) is a fascinating area for privacy professionals going forward, and you layer on the new technologies that are getting used in processing live sets of data and deriving insights and proposing action — like machine learning and AI — and I think that really is in some ways expanding the definition of privacy and of privacy professionals into the data ethics space."

This vision was prescient, as the convergence of technological development and emerging regulations have created a complex digital entropy that is, as always, altering the privacy profession in newer and expanding directions.

"He started in the early days of the IAPP," Trevor Hughes said, "and rose to serve as Chair of our Board. During his tenure at the IAPP, our members saw unparalleled growth and strategic focus. I remember so clearly the day — late in his chairmanship — when he summed up our role for the organization: 'We just need to make this thing awesome.' Much of what is great about the IAPP has a direct link back to Brendon."