As we peruse job advertisements and speak with privacy professionals, we have observed how some view privacy professionals as data compliance, data security officers or data management specialists with only secondary responsibilities related to privacy.
We believe privacy analysts should be more than just compliance officers.
suggests that privacy analysts “typically manage the legal and operational risks related to sensitive and critical information assets, continuously assess business unit operations, develop policies, procedures and training; oversee data agreements, and execute projects while consulting on new business initiatives.” These qualities are important. However, we believe privacy analysts must also rely on the ability to conduct the detailed research and analysis of sensitive data.
As intelligence officers with decades of experience classifying and protecting national security information, we intend to develop more robust analytic tradecraft standards for our privacy analysts, which will center on using advanced analytic techniques to acquire a deeper understanding of personally identifiable information (PII), electronic-protected health information (e-PHI), PHI and sensitive corporate information (SCI). We will also require our privacy analysts to employ sound anticipatory and predictive analytic techniques to detect, alert and warn of emerging threats to PII, e-PHI, PHI and other SCI. These skills will highlight that any data, when viewed in aggregate, might create a “mosaic effect” that exposes critical data to compromise and exploitation.
We believe the intelligence analyst career field serves as a model for transforming privacy analysts. With intelligence analysts, compliance is only one aspect of their responsibilities. Their primary role is to provide leaders with accurate, timely and relevant information to enable informed decisions. Privacy analysts should have similar roles as they provide their corporate decision-makers with alerts and warnings of potential risks, threats and vulnerabilities to critical data.
Today, a significant distinction exists between the intelligence analysts’ core competencies and those of privacy analysts. David Moore makes a clear distinction between the skills of the intelligence analyst and those of the information professional in his paper entitled, “Species of Competencies for Intelligence Analysts.” He writes, “Intelligence analysts are the critical element in this dynamic. They are more than information professionals, more than collectors and couriers of information to couriers. Intelligence analysts select and filter information; they interpret the resulting evidence, put it into context and tailor it to meet their policy-making customers’ needs. In short, analysts and analysts only, create intelligence.”
We derived the proposed privacy analytic core competencies (See Figure 1) from Moore and Krizan’s “Functional Core Competencies for Intelligence Analysis Model.” Our goal was to identify functional core competencies for our ideal privacy analyst. Our privacy analysts will conduct similar anticipatory and predictive analyses to counter the risks, threats and vulnerabilities to their most critical asset, data. We are leveraging decades of unique experience in transacting national security intelligence to develop our privacy analyst.
Figure 1: Proposed Privacy Analyst Core Competencies
We believe privacy analysts must analyze, prioritize and convert information into knowledge as part of a modified privacy operational life cycle: Assess,
Analyze and Understand,
Protect, Sustain, and Respond. Russell R. Densmore in the text entitled,
, provides an in-depth discussion on the importance of assessing, protecting, sustaining and responding “to data privacy and the many management aspects necessary to protect the data.”
We propose including a fifth factor called “Analyze and Understand” (See Figure 2). This step requires privacy analysts to analyze and understand the critical data identified during the “Assess” phase. They will use qualitative, quantitative and knowledge management analyses to determine the criticality and true value of critical data. These new skills will allow these privacy analysts to assist their technology counterparts in customizing information and network security management systems during the “Protect” phase.
Figure 2: Modified Privacy Operational Life Cycle
Tomorrow’s privacy analysts will have vastly different roles and responsibilities than those of their predecessors. These privacy analysts will do more than just classify and categorize sensitive data. They will possess the ability to conduct anticipatory and predictive analyses of pending threats to sensitive data. They will analyze the results of privacy audits, privacy impact assessments and privacy risk assessments to assist their technology counterparts in customizing information security approaches. They will apply explicit and tacit knowledge management skills to better understand the actual value of sensitive data. Tomorrow’s privacy analysts will educate their organizations’ leaders of the criticality of their data and of its value to adversaries seeking to acquire and exploit it. They will serve as their organizations’ “Praetorian Guard”, using myriad skills to protect data from compromise or exploitation, regardless of the threat.