Editor's note: The Academic Spotlight Series highlights past IAPP Westin Scholar Award recipients, sharing their academic journeys, and Higher Education institutions with compelling privacy and data protection programs. The series is sponsored by IAPP Academic Relations, whose mission is to help advance privacy and data protection curricula and transition students into careers in the discipline, emphasizing equity, inclusion and diversity.
Tiffany Sze is one of the University of Auckland's first Master of Information Governance graduates, and she is already pursuing contributions to the privacy field after her coursework identified "deficits in real-world issues."
Sze's final course paper found several issues with consumer loyalty programs in New Zealand, including unclear terms and conditions, ambiguous privacy policies, and inadequate processes for obtaining shoppers' informed consent. The recent graduate is now working with privacy expert and University of Auckland Business School associate professor Gehan Gunasekara to publish a paper titled "A privacy trojan horse? Consumer loyalty programmes in the grocery sector and data privacy." She said it feels "incredible" to think her work could make a difference in the world of privacy and data protection.
"Knowing that the research I've done could contribute to the broader academic and professional conversation is exciting," said Sze, who has a bachelor's degree in international business and information systems from the Auckland University of Technology. "The idea that my findings might help shape better data privacy practices and policies is really motivating. It's one thing to learn about these issues in a classroom setting, but knowing that my research could have a real-world impact takes it to another level."
The Master of Information Governance program launched in 2021, after three years of rigorous planning and design that included review before five university-level committees and the Committee on University Academic Programmes, which approves university qualifications. University of Auckland Business School Assistant Dean, Postgraduate Research, Alan Toy began designing the program when he was postgraduate director in the commercial law department. He said the idea bloomed from a doctorate program he completed in 2016, during which he "identified the need to create a community of practice around practices such as privacy auditing and other aspects of information governance."
Seeing the first two students complete and graduate from the program was a very proud moment, Toy and Gunasekara said.
"It's the biggest contribution that we've made to academia. You know, we've got our research, our other teaching, but we were over the moon to see these students come through," Toy said. "It was so amazing because we've been part of their lives, and they can go on to create this community of practice that we've always been searching for. So, we're so happy about it."
Students can complete the 180-point Master of Information Governance degree, the 120-point Postgraduate Diploma in Information Governance or the 60-point Postgraduate Certificate in Information Governance. The Master of Information Governance degree offers students a continuing pathway directly to a doctorate program, which Toy said is an unusual opportunity.
"The master's degree "is quite innovative and unique in its pathways," he said.
The cross-disciplinary program focuses on governance and regulation, exploring concepts including information governance, technologies and compliance, global citizenship, and artificial intelligence regulation, and helping students develop the skills needed to manage privacy and information governance programs in businesses and organizations.
"That's the beauty of our program. It's not only privacy. Of course, privacy runs through as the golden thread," said Tana Pistorius, the director of the Information Governance program. "But apart from privacy and the processing of personal information, we have courses on AI regulation, dispute resolution and mediation, blockchain, cybersecurity and data ethics."
Pistorius said "an interesting collection of research" is emerging from students' research essays, which explore a wide array of subject matter from the "privacy paradox" to facial recognition technology surveillance in supermarkets to digital sovereignty. She said the university is "very proud" the students' work and is looking at ways to showcase it.
"A number of essays address AI, including Te Ao Māori perspectives on the New Zealand government's AI tools, academic misconduct through generative AI and students’ privacy and ethical considerations of explainable AI in security applications," she said.
The Master of Information Governance program is fully online and accessible to students from all over New Zealand, which Gunasekara said is its "greatest strength." Students are not only those continuing their education after obtaining a bachelor's degree, but parents looking to return to the workforce and professionals expanding their knowledge. Students are also coming from tribal communities around New Zealand.
"What was surprising to us was the students coming into the program are already practicing in the privacy profession," Gunasekara said, while Toy added, "Some of them are at very senior levels of their organizations."
"What they've told us is they're often doing this program because there is no other existing program that can validate their skills," Gunasekara said. "And, obviously, if you obtain a master's degree from the University of Auckland, people will take you more seriously in terms of your credibility."
Sze, who had no background or experience in information governance, said she first faced a "steep learning curve" with studies analyzing various aspects of data privacy laws and then identifying deficits in real-world applications. The "comprehensive approach" led to an opportunity to "uncover gaps in the legal frameworks and propose recommendations for improvement," she said.
"My interest in privacy and data protection started out of curiosity. I initially didn't really grasp how crucial data privacy is in our digital world. But as I delved deeper into my studies, it became clear how intertwined our daily activities are with data privacy — from the cards we carry to the forms we fill out," Sze said. "This realization was pretty eye-opening for me. It showed me how easily we can expose our personal information without even realizing it and highlighted the vital role data privacy laws play in safeguarding our personal details. The more I learned, the more fascinated I became with how these laws work and the impact they have on our lives."
Gunasekara said he was pleased to see Sze research consumer loyalty programs, work he had been pondering for some time.
"Not surprisingly, she has uncovered some very serious deficits in the data sharing ecosystem within the customer loyalty program in New Zealand," he said. "We can't speak in detail about the actual conclusions because we wait for the publication to validate what we've done, but we've identified some very interesting case studies that the Commerce Commission and the Australian regulator have found involving what I would call classic examples of surveillance capitalism. Data brokers are building very detailed profiles. It's getting to the core of some of the key legal issues about data privacy and advertising."
Explaining an example, he said, brokers obtained 20 years of grocery and supermarket spending by individuals who lived at particular addresses and compared that with information about their properties, while also accounting for their entertainment expenditures like movies and dining out. Through changing consumption patterns, they were able to identify likely recent empty nesters who may be willing to sell their family homes. These individuals were then targeted by real estate agents on social media.
"Now that to me was very interesting because it was kind of creepy that they would know that," Gunasekara said. "It's that kind of thing which Tiffany's paper opens the lid on. I'm very pleased that she has uncovered these things."
Sze said the program gave her the confidence "to tackle real-world challenges in information governance."
"I also learned just how critical data privacy and information governance are in our digital world. (It) opened my eyes to the complexities and nuances of the field and equipped me with the knowledge and skills to make a real impact," Sze said.
She is excited to pursue a career in data privacy and information governance, a field that is "becoming increasingly important as more organizations recognize the need for strong data governance and privacy measures." She's looking for a role in which she can influence data privacy policies and practices within an organization, promote responsible data handling practices and ensure personal information is protected effectively.
"I aspire to be a leader in the field, guiding policy development or heading an information governance department," she said.
Jennifer Bryant is an associate editor at the International Association of Privacy Professionals.
