This article will explore lessons privacy professionals can learn from Wikimedia’s privacy program, including: how to build a privacy program from the ground up, how to manage an in-house privacy program, and how to find creative solutions to privacy challenges.
Challenges & solutions
The Wikimedia privacy team faced challenges when building the privacy program, and the solutions they found may teach privacy professionals to solve problems in their own growing programs.
One of the first challenges: getting people to understand why change was needed
The Wikimedia Foundation and community were already privacy conscious, so some people didn't believe more formal privacy programs were needed. Some teams were concerned that the legal team would begin creating mandates or that other stakeholders’ voices would not be heard. To solve this challenge, the privacy team spent time talking with stakeholders, staff members, and the community at large. They found it particularly important to speak with teams that had privacy concerns or sensitive data. For all privacy programs, it's important to make sure that all stakeholders know their voices are heard. Conversing with stakeholders to understand their needs will also increase the likelihood that other teams prioritize privacy issues during the implementation stage of the program.
The second challenge: building the privacy program
Third challenge: maintain and progress the privacy program as the organization and community continue to develop
This continues to be a challenge. Paulson explains: “As budgets, priorities, and head counts change, [privacy professionals] need to make sure plans stay up to date with what happens in companies and adjust accordingly.” Many companies nowadays experience increased turnover as well as changing resources and attitudes. In order to overcome these hurdles, privacy professionals must implement specific protocols with buy-in from other department stakeholders, while simultaneously being amenable to changing course as necessary.
What privacy pros can learn
- Determine priorities – Before embarking on any long-range strategy, take time to determine your priorities. Broad research and discussion with other stakeholders will help you understand current privacy practices and areas for improvement.
- Cater to organizational needs – Every organization has a unique community/user base. Do not simply follow the model of other companies. Rather, adapt your internal and external privacy strategy to cater to the unique needs of your organization and users.
- Consider a consultation period – When creating or updating privacy policies for online communities, consider a consultation process where community members are informed and/or asked for feedback before policies are finalized. Implementing an initial input period prior to drafting policies will provide stronger credibility and comprehensiveness to policies, especially for mission-based organizations.
- Assess different viewpoints – Consider how privacy affects, and is affected by, your organization’s operations and products. For interdepartmental projects (such as organizational privacy strategies or programs), talk to point people in each affected team before and during launch. Make sure you address specific concerns and get team buy-in from each of the affected stakeholders before convening interdepartmental meetings.
- Be decisive –Be a strong decision-maker in the face of conflicting opinions. Even if you are only consulting with others within your organization, obtaining consensus can be difficult when you are asking a large group of people to comment on a relatively complex and controversial topic. Use your privacy expertise and buy-in from internal stakeholders to reach consensus.
- Confirm allocation of resources – From a practical standpoint, it is important that you speak to team leaders to make sure resources are allocated and budgets are set to include the elements of your privacy strategy. Check in frequently to confirm that different teams’ goals and timelines are aligned. For example, if you want to roll out a new policy that will include communication with press, make sure that the Communications or Public Relations team has properly allocated the project within their resourcing and budget before you launch.
The privacy program at Wikimedia has come a long way, but there is always work to be done. As Paulson says, “Privacy and freedom of expression are so integral to [Wikimedia’s] mission to disseminate knowledge globally. People will not contribute and help Wikipedia and other Wikimedia projects grow if they are scared to speak on certain topics or viewpoints. That’s why privacy has been so important to the Wikimedia movement, and that’s why we work so hard to protect it."
If you want to comment on this post, you need to login.