In 2013, the Wikimedia Foundation (the non-profit organization behind Wikipedia and other free knowledge projects) embarked on something unprecedented: a large-scale, open, public consultation for a new privacy policy. This endeavor was one of many innovative privacy initiatives driven by General Counsel Geoff Brigham and Legal Director Michelle Paulson, with the support of many others throughout the organization and the community.
This article will explore lessons privacy professionals can learn from Wikimedia’s privacy program, including: how to build a privacy program from the ground up, how to manage an in-house privacy program, and how to find creative solutions to privacy challenges.
Challenges & solutions
The Wikimedia privacy team faced challenges when building the privacy program, and the solutions they found may teach privacy professionals to solve problems in their own growing programs.
One of the first challenges: getting people to understand why change was needed
The Wikimedia Foundation and community were already privacy conscious, so some people didn't believe more formal privacy programs were needed. Some teams were concerned that the legal team would begin creating mandates or that other stakeholders’ voices would not be heard. To solve this challenge, the privacy team spent time talking with stakeholders, staff members, and the community at large. They found it particularly important to speak with teams that had privacy concerns or sensitive data. For all privacy programs, it's important to make sure that all stakeholders know their voices are heard. Conversing with stakeholders to understand their needs will also increase the likelihood that other teams prioritize privacy issues during the implementation stage of the program.
The second challenge: building the privacy program
As the privacy team began updating policies and implementing processes, they realized that the organization lacked a uniform approach to privacy. To solve this, Paulson says, she “got away from the office” for some high level perspective and took a deep dive into determining what the privacy program should entail. Using the feedback from internal (staff) and external (community) stakeholders, Paulson and the privacy team developed a long-term, multi-year privacy strategy plan, incorporating projects ranging from updating the privacy policy to implementing Privacy by Design trainings for product and technology teams. Today, there are many resources designed to guide privacy professionals in building in-house privacy programs, including resources supplied by IAPP. Taking the necessary time to gain high-level perspective is a strategy that can work well for privacy professionals trying to create new privacy programs.
Third challenge: maintain and progress the privacy program as the organization and community continue to develop
This continues to be a challenge. Paulson explains: “As budgets, priorities, and head counts change, [privacy professionals] need to make sure plans stay up to date with what happens in companies and adjust accordingly.” Many companies nowadays experience increased turnover as well as changing resources and attitudes. In order to overcome these hurdles, privacy professionals must implement specific protocols with buy-in from other department stakeholders, while simultaneously being amenable to changing course as necessary.
What privacy pros can learn
- Determine priorities – Before embarking on any long-range strategy, take time to determine your priorities. Broad research and discussion with other stakeholders will help you understand current privacy practices and areas for improvement.
- Cater to organizational needs – Every organization has a unique community/user base. Do not simply follow the model of other companies. Rather, adapt your internal and external privacy strategy to cater to the unique needs of your organization and users.
- Consider a consultation period – When creating or updating privacy policies for online communities, consider a consultation process where community members are informed and/or asked for feedback before policies are finalized. Implementing an initial input period prior to drafting policies will provide stronger credibility and comprehensiveness to policies, especially for mission-based organizations.
- Assess different viewpoints – Consider how privacy affects, and is affected by, your organization’s operations and products. For interdepartmental projects (such as organizational privacy strategies or programs), talk to point people in each affected team before and during launch. Make sure you address specific concerns and get team buy-in from each of the affected stakeholders before convening interdepartmental meetings.
- Be decisive –Be a strong decision-maker in the face of conflicting opinions. Even if you are only consulting with others within your organization, obtaining consensus can be difficult when you are asking a large group of people to comment on a relatively complex and controversial topic. Use your privacy expertise and buy-in from internal stakeholders to reach consensus.
- Confirm allocation of resources – From a practical standpoint, it is important that you speak to team leaders to make sure resources are allocated and budgets are set to include the elements of your privacy strategy. Check in frequently to confirm that different teams’ goals and timelines are aligned. For example, if you want to roll out a new policy that will include communication with press, make sure that the Communications or Public Relations team has properly allocated the project within their resourcing and budget before you launch.
The privacy program at Wikimedia has come a long way, but there is always work to be done. As Paulson says, “Privacy and freedom of expression are so integral to [Wikimedia’s] mission to disseminate knowledge globally. People will not contribute and help Wikipedia and other Wikimedia projects grow if they are scared to speak on certain topics or viewpoints. That’s why privacy has been so important to the Wikimedia movement, and that’s why we work so hard to protect it."