On January’s Eye on Privacy webinar, TRU Staffing Partners’ Founder and CEO Jared Coseglia welcomed Michael Fitzpatrick, the chief privacy officer for the City of New York. The duo discussed all of the data privacy industry trends that happened last year along with predictions for what they expect to see in 2025. Coseglia began the discussion by welcoming Fitzpatrick and explaining where TRU team members gathered the data for the trends and statistics presented here.
Coseglia: We’re going to cover the information in the above slide in the next half hour. Some of this data from the IAPP's salary surveys, which we’ve co-created with them in years past. We also pull info from our Data Privacy Jobs Reports for last year and the one we’re preparing for 2025. Lastly, this data comes from all of the job seekers we work with and communicate with regularly as well as the employers we represent. We've represented more than 3,000 people on opportunities, and we're excited to share all that information. So let's jump right in and cover what the big takeaways were from 2024.
I think the first one is a big shocker for people. It’s surprising that there were actually more opportunities for contract staffing or contract-to-hire staffing than there were for full-time, direct-hire jobs. Talk to me a little bit about what jumps out at you, Michael.
Fitzpatrick: From the government and City of New York side, our privacy workforce is largely operating in the world of full-time employees. Pursuant to our local privacy law, every New York City agency has to have a privacy officer designated by their agency head. As a result, we've got a citywide network of about 200 privacy professionals operating on a full-time basis augmented by the staffing levels at their individual agencies, supporting a citywide workforce of about 300,000 for a city with more than 8 million people. So for us, we really look to the full-time space. The area that jumps out to me is that 80% of jobs were hybrid. That’s consistent with the evolution of how the city has staffed on a citywide level, but certainly from a privacy perspective. Over the last few years, we’ve gone through the collective bargaining process with the various unions that support the city's workforce. As a result, we've now got remote work instantiated across professional areas. And so for us, it's been an important workstream and getting and making sure that we're not interrupting city services while we're staffing up a structured hybrid model.
Coseglia: Was that just a retention policy? What won that good fight in terms of getting a hybrid environment approved?
Fitzpatrick: The hybrid model was born out of the Covid experience. You had a workforce that transitioned for very important reasons, and then the environment evolved.
Coseglia: There's a new normal, which is hybrid. It is not normal to require an employee to come into an office 4 to 5 days a week anymore. We're seeing this adoption in our business across all verticals, and we staff for cities, corporations, and law firms. Employers with a 4 to 5 day in-office requirement have an infinitely smaller pool of candidates who will consider those opportunities. Now, having said that, it is worth noting that when you look at what jobs are most likely to be fully remote in the privacy sector, those jobs are largely contractor positions. Most direct hire and full-time roles do have that hybrid requirement, and even the contract jobs sometimes require a hybrid touchpoint, but much less so.
I also want to draw attention to what we're calling the end of the privacy job market recession. We saw a big explosion of opportunities being advertised and accepted in the 4th quarter of 2024. What are you seeing?
Fitzpatrick: There certainly are opportunities. For us, it started with the efforts of the Adams Administration early on where the mayor brought together all of the city's technology and related entities into one agency, newly formed as the Office of Technology and Innovation. It brought together my office, the Office of Information Privacy, New York City Cyber Command and other technology-related stakeholders under one roof, reporting to the city's chief technology officer. The idea there is to put us all under one roof to drive more effective and efficient outcomes in city services, and that includes from a privacy workforce perspective. Our office holds a group membership within the IAPP, which has benefits inclusive of posting to the IAPP Job Board. As a result, in our relationships with our agency privacy officers, they are able to socialize up when they've got vacancies on the horizon, and we're able to amplify through our privacy network being the city centralized office to support, filling those roles as appropriate.
Coseglia: Let's look ahead into 2025. It's going to be a very different few years for many reasons. It's important to note that in the US, we're going to see some deregulation, which will mean that we’ll lean toward litigation to solve problems. In preparation, we're going to see AI governance role definitions start to codify. But it's been all over the board. I think it's been difficult for employers to know what they should be paying for these opportunities, and what job seekers should be looking for as they begin to evolve their skillsets.
Contractor work is going to be the primary way people get hired. We're seeing more opportunity for contract than FTE. Contract roles get filled very quickly. and there are a number of privacy professionals who are choosing contract as a lifestyle choice. Also, we believe that executive-level opportunities will continue to be scarce. I think what we're going to see is executives start to reinvent themselves. AI governance is a piece of it, but not the only piece. Another big pivot here has to do with bullet point number one where, as we go into an area and a culture of deregulation, the shift of focus to really looking at business outcomes and not just a compliance play is going to begin to play a factor in who's getting budget and buying additional headcount and growing their departments, Michael, which one of these jumps out at you the most or speaks to you the most. Do you feel like is an inevitable outcome in the year ahead?
Fitzpatrick: I'll kick off with the IT/cybersecurity point. Security will increasingly own privacy and information governance. For us as a city and with the current technology strategy of this administration, it's not necessarily about IT Security owning privacy. It was about bringing together each of those constituent parts under one roof to work together, seamlessly recognizing the inherent responsibilities that exist within those offices. So, for example, the Office of Information Privacy is a charter agency in New York City. We have responsibilities that we are charged with executing, pursuant to local law with a reporting structure up to the mayor and senior city leadership. Likewise, my counterpart on the cybersecurity side of the house has her agency equally positioned. It's not necessarily about ownership in one vertical or another. It's about positioning the stakeholders to operate in a collaborative way and fulfills the responsibilities that we each have.
Coseglia: I think there's probably a lot of privacy leaders that are very envious of that posturing, which is a beautiful thing.
Fitzpatrick: I'm truly lucky to have a great counterpart on the security side of the house citywide, and that reaction is one that we actually do get frequently. Folks who meet with us for the first time will often remark that it's odd that you're not only sitting next to each other but are in the same room. I know that's not the usual experience. But it's the norm for New York City.
Coseglia: What a great advertisement! All right, let's take a look at more data. Let's dive into the contract versus direct hire, because I could see that's piquing a lot of curiosity. This is the whole year.
You’ll see the shifts in the dynamics and just how much contract staffing surged at the end of the year. A part of this is the holidays/end of year with people delaying start dates or decisions into January.
In 2025. You can see in December just how few people accepted full-time permanent jobs based on our tracking, and how many more accepted contracts. The speed is part of that and the time of year is part it. But this is a trend that's accelerating now into 2025, and I'll be honest. I didn't think it was the trend that we were going to see. I think the election results have a huge impact on this trend, and a lot of people who are looking to hire more compliance attorneys are going to find themselves trying to find someone who is versatile. Right now, we're at 4.1% unemployment. People are choosing to move to contract work and we're seeing people leave full-time jobs to take contract.
We're seeing 40% of those people getting offered within the year of conversion into a full-time employee. So the strategy is working for some employers and employees in a mutual way. We anticipate that we'll see a slight reversal of this by the end of 2025. But I think for the first six months of this year, it's going to be very heavy contracting.
Michael, I know you don't use contractors. Have you considered doing so? I’d love to hear what your impression of these metrics are.
Fitzpatrick: Absolutely. We're prioritizing a number of things since I've been in the role. Among them is the resiliency overall of the citywide privacy program. We are coming at that in a number of different ways, such as through investing in our existing workforce and trying to attract new talent. But another critical component of that, particularly as our maturity increases and we start to make headway on those other fronts, is adding some additional tools in the toolbox to enhance that resiliency. That's where there is opportunity to have resources available to augment staff as situations call for.
Coseglia: Yeah, it's a great point, many reasons employers choose contractors is not having full time headcount, at least for the last year. Another one is simply to up-level their existing staff.
Here's a few more interesting statistics. 65% of our clients are using both, which I think is fascinating. 92% of our contractors actually finish the assignment or get converted or still billing.
Very few contractors are just leaving and taking other jobs. You can see that 3% take other jobs at around 260 days. So it's right in between that 228- and 271-day count.
These are the motivations for 2022 versus 2023. You can see, even in 2023, working remotely was still a primary motivator for job seekers. Then, in 2024 burnout was the top reason with much less hiring, less mobility, but more work. Most job seekers came to us because they were burned out. Money is the second motivator for most job seekers. Working remotely is not on the list anymore. The privacy community has accepted that if they're going to make job moves, they're going to have to be hybrid, and they know if they want to work remotely, they need to work in contract roles to achieve that goal.
Michael, any takeaways from the motivations? Does this resonate with what you're seeing and hearing?
Fitzpatrick: From the public sector perspective, quality of life is important. When we're connecting with incoming staff or interviewing, the motivations that we experience are really mission-driven. We're encountering folks who have a wealth of experience in other areas that are non-governmental but who are passionate about getting into city service and helping the public.
Coseglia: Privacy compensation benchmarks for the year. We broke them into separate segments where the comps are similar, just to make it digestible information.
The market has not moved in terms of comp ranges for new hires in data privacy. So let's take a look at AI governance.
We haven't seen as many people take these jobs. We're not able to track that as rigorously as we can privacy. But what we've seen in AI governance is what's advertised. Most of these jobs are in the median range, where the median is much closer to the minimum than it is the max. So if we assume that these ranges are wide because employers don't really know what to pay people for these jobs, we try to align them with data privacy jobs that have similar skill sets.
You'll see what a difference there is in the mean salaries advertised in AI governance versus the mean salaries at the point of hire that people are actually taking that we're tracking in privacy, and with the exception of the middle in the management level, there's a big gap at the early entry level. We believe in 2025, we'll start to see that rectify itself either by salaries going up in AI governance, or privacy people will be willing to take a little bit less money in order to move exclusively into AI governance. Michael, what do you think the more likely outcome is in this sort of compensation conundrum?
Fitzpatrick: I wish I had that crystal ball. The privacy line is so well established, and the regulatory environment is a very complex one. I think that line is likely to hold, particularly if you see increased enforcement actions. It is less likely on the federal level, but more on the state. And then certainly the international environment is what that is. But I think the privacy benchmark really does have that opportunity to help drive that enhanced AI governance, because there really is such an interconnectivity to the role. With the teams, protection of privacy and protection of identifying information are cores in the privacy professionals work.
Coseglia then encouraged the participants and everyone interested in learning more about the emerging trends in data privacy to connect with him on LinkedIn, via email, or to reach out to the TRU team at info@trustaffingpartners.com.