The emergence of the Internet expanded the number of programs that needed privacy professionals. Brand, while still important, became second to a strategic alignment of privacy with business process and compliance to match new, or newly recognized, obligations.
The emergence of the Internet expanded the number of programs that needed privacy professionals. Brand, while still important, became second to a strategic alignment of privacy with business process and compliance to match new, or newly recognized, obligations. Privacy teams wrote ever-longer privacy notices, managed opt-out files and tried to understand the EU Directive.
Privacy lawyers began to emerge from the broader field of technology law. Education became important as privacy professionals needed to broaden teams to include marketing experts and engineers. Privacy leaders were both evangelists and managers who could organize basic business processes.
The new century brought a focus on compliance driven by the globalization of data and the California data breach law. The globalization of data meant compliance with laws in an increasing number of countries and the continuous drafting of legal instruments for data transfers.
The compliance side of privacy became king.
Law firms grew their privacy advising practices, and more companies looked to privacy lawyers to lead their programs. Legal compliance became a permanent and ever more complex organizational process. The privacy leader needed to be able to interpret the law, wrestle with conflicting processes and oversee the processes necessary to assure compliance.
However, as compliance was becoming the dominant theme, the data age was undergoing a sea change that I believe fundamentally changes the way we think about privacy leadership.
Observational technologies migrated from the cyber world to the physical world driven by RFID, facial recognition and location technologies. Furthermore, our ability to use unstructured data and merge very different data sets for analysis became possible. The term Big Data was adopted, and the nature of privacy changed significantly.
We are seeing the reflection of these changes in regulatory agencies, their enforcement efforts and policy direction. Lawyers are being replaced by technologists, and those technologies are taking the lead in investigations.
The Article 29 Working Party (WP 29) paper on compatible purpose is an interesting illustration of change in the way agencies are looking at risk and reinterpreting requirements. It was WP 29’s first attempt to come to grips with the inevitable pull of Big Data and the legal restrictions related to purpose specification. In the end, the paper left the reader with a sense that the compatibility of purpose relates to fairness. Fairness in turn is dependent on a multi-variable analysis. There are no checklists. There are no highly detailed privacy notices to get a company off the hook. Instead, the organization is required to make judgments that balance many different values.
So this returns us to the question of privacy leadership in complex organizations.
Big Data becomes the strategic driver of innovation and future growth. The privacy leader becomes the policy strategist. The external discussion becomes a debate about appropriate uses and intangible risks. The brand, with commercial customers, regulators and individuals, becomes a function of the quality of contextual analysis and the ability to demonstrate that quality to all constituencies. The organization owns the risk it creates for others in using information to drive innovation and must, at the very least, stand ready to demonstrate how it mitigates that risk.
While compliance with law, regulation and public expectations is required, it becomes a compliance function that is very different from other compliance functions. It requires an understanding of those obligations but also requires an understanding of those obligations within the context of ever-changing research projects and applications of data.
We are already seeing a number of organizations making the transition to strategic information governance being the dominant theme of a privacy organization.
That doesn’t mean privacy teams can ignore reputation, communication, incident response, preference systems, etc. It means those tasks are in support of a governance program that creates guiderails for innovation and protects individuals from harms and insults to dignity that might come from that innovation. Whether one’s background is the law, engineering, theology or anthropology, the successful leader will lead on governance strategy.
Organizations that believe privacy is just another compliance program will be sitting ducks for strategic errors that will get in the way of innovation.
