Pitfalls of, and Solutions to, Privacy Risk Assessment in Change Management

Landscaping a yard requires careful planning and site assessment. As the landscape matures, a gardener proactively assesses changes and addresses them. Privacy teams need a parallel approach—assess an initiative when beginning to plant in the privacy landscape and continue to assess how change impacts the entire privacy landscape. Assessing privacy risk associated with change challenges privacy teams, but they can take steps to cultivate an appropriate risk landscape.

The risk management survey from IAPP and Bloomberg Law did not fully explore assessing risk associated with change. If privacy risk is solely viewed as noncompliance with stated legal or security policies, standards or procedures, this would be natural. Once an assessed initiative is planted in the privacy landscape, there may be an assumption that its compliance is evergreen and changes will not impact its risk profile. My experience indicates this is false hope.

It may be tempting to rely on other departments in the business, such as IT, to alert the privacy team when a change in operations might trigger a need for a new risk assessment, but this is dangerous. IT may not be evaluating how changes affecting administrative and physical safeguards shape the privacy landscape. Marketing and sales may have IT systems outside of IT controls or oversight. Changes to nontechnical safeguards, or changes to systems not managed by IT, can have a dramatic impact on an organization’s privacy risk landscape.

Assessing change-related privacy risk requires synthesizing:

• Legal, regulatory and policy requirements
• What is changing from current to desired state
• Roles and relationships between IT systems, applications and jobs
• Roles and relationships between processes, procedures and tasks in business operations
• Change impact on business imperatives and support for business strategies

That assessment is difficult if a privacy team lacks appropriate cross-functional understanding or cross-functional points of contact to support the evaluation. If each privacy assessment is seen as an ongoing project in need of management, rather than a one-time assessment, this support and understanding comes more naturally.

A session at the IAPP’s 2011 Navigate noted, “Companies struggle to translate high-level principles into an actionable method of ensuring trustworthy privacy practices.” In deploying the discipline of project management, you have a framework for how to engage the business and be intentional and dedicated about how that framework is used so that privacy professionals can cultivate that actionable method.

In a 2012 KnowledgeNet presentation, I presented the following framework based on Who-What-Where-When-Why-How:

Q: Why use project management techniques?

A: Project management increases organizational effectiveness and efficiency, reduces organizational risk and achieves organization alignment.

Q: What projects should a privacy team monitor?

A: A consistent categorization of initiatives with privacy implications helps a privacy team identify who to work with, where to find them, when to engage them and how to begin using the framework.

Q: Who should a privacy team engage?

A: The categorization helps guide identification of contributors to all privacy projects.

Q: Where should a privacy team look to engage the business?

A: Initiatives can begin from informal planning, from planning at departmental or operational level or from formal corporate strategy, with each origination point requiring different techniques to ensure all initiatives are addressed.

Q: When should a privacy team engage the business?

A: Specific external and internal factors determine whether a privacy team should be involved early or later in the project.

Q: How should a privacy team begin?

A: External environmental factors and internal factors, such as organizational design and workflow, shape the most effective strategies to deploy when engaging the business.

Risk assessment when planting an initiative requires a specific approach and set of tools. Cultivating and maintaining the privacy landscape through ongoing risk assessment requires a different approach and a different set of tools. Change management requires privacy teams to proactively analyze the business and design an appropriate engagement strategy and then to diligently cultivate an understanding of business operations and nurture relationships with the people involved in initiatives with privacy impact. That understanding allows privacy professionals to prune unnecessary risks while allowing their organization’s plans to blossom and the privacy team’s value to the business to bloom.

Photo credit: Autumn purple via photopin (license)