IAPP Privacy and Freedom: A review by Lawrence Serewicz (@lldzne)

Posted on June 5, 2014 by lawrence serewicz

Here is my review of Alan Westin’s book Privacy and Freedom. I would welcome your views on the review.
I would be particularly interested in what you think of the following thesis. The privacy professionals have failed to deliver on the promise of privacy as corporations show a disregard for privacy. The work of Westin and others, while well intentions, has failed to deter the demand for personal data as a commodity and shows the weakness of the privacy compliance work.

The book remains important which is why I think the questions need to be explored.
Best,

Lawrence

Your Front Page For Information Governance News

The IAPP has republished Alan Westin’s best-known book, Privacy and Freedom, which was first published in 1967. Despite its age, the new version, it is the same text with several introductory essays, provides context for a reader coming to it for the first time. The introductory essays, which include one by Westin on how he viewed his work and its impact, provide a useful context for the author, the book and its relevance.

capture-20140605-122415

Although the introductory essays offer an insight into the book’s impact and the author’s contribution to privacy professional field, a critical essay would have been welcome because the privacy landscape has changed dramatically. The change is more than technological because it includes the change in cultural attitudes to privacy. The cultural and technological changes have undermined his definition.

For most readers, Westin and his book are best known for providing a robust definition of privacy. His book…

View original post 841 more words

Posted in Uncategorized | Comments Off on IAPP Privacy and Freedom: A review by Lawrence Serewicz (@lldzne)

8 Steps to ensure your investigation does not appear to be a cover-up

Posted on June 3, 2014 by lawrence serewicz

This post has been removed as it has been superseded by the post How to write transparent investigation reports.

I would like to thank Donna Boehme of the Compliance Strategists for comments on 8 Steps to ensure your investigation does not appear to be a coverup as I have used them to revise the post.  Any remaining mistakes are my own. 

Compliance Strategists are a leading consulting firm based in the metropolitan New York area, specializing exclusively in compliance, ethics, risk and governance practice.   http://www.compliancestrategists.com/

 

Enhanced by Zemanta
Posted in compliance, coruption, information management, learning organisation, local government, management | Tagged , , , , , | Comments Off on 8 Steps to ensure your investigation does not appear to be a cover-up

Has ECJ’s Google ruling made us forget there are other memories?

Posted on May 22, 2014 by lawrence serewicz
English: The Google search homepage, viewed in...

English: The Google search homepage, viewed in Google Chrome. (Photo credit: Wikipedia)

The recent ruling by the ECJ has raised some concerns about the right to be forgotten. Many commentators have suggested that this ruling means the right to be forgotten exists. However, they have gotten ahead of themselves, as the right to be forgotten, if it is to be created, will arrive when the EU’s latest Data protection directive is agreed. The ruling creates a precedent, but does not create a right. However, the issue is neither the right to be forgotten nor the greater power to remove links, as these are the practical concerns that hide the underlying issue. The focus on the search engine forgets that there are other memories that are not affected by this ruling that intersect with the search engines. Moreover, the role of memory is important so that people can be represented if they are not remembered, they cannot be represented.

What are the other memories?

There are three types of memories that dominate social media: Permanent, Corporate, and Individual.

Permanent

The permanent memory is the state. The state is *the* record keeper. The state made records and records make the state. The state holds your permanent record.[1] It is also the holder of the “official record” (See link on accountability). You can see it is permanent in the way that you cannot erase your birth or your existence from a state’s systems. They hold you in perpetuity. For instance, on the marriage certificates in the United Kingdom, different places record different information about the parents, which suggests the ways that the way the state “remembers” some people is a way to forget others.** In this sense, if the person is not remembered they cannot be represented, which raises secondary questions about the nature of democracy and the institutions that represent individuals.

Corporate

The corporate memory refers to memory held by companies such as Google, Facebook, Experian, and Zurich. Individuals are captured by this memory when they interact with them as customers and provide information. The idea of a corporation goes back to the middle ages.  In the middle ages, the corporation would have been a guild house that existed as an institution between the king and the individual. The ECJ ruling addresses this memory because Google is the one remembering the information even though governments, corporations, or individuals may have supplied it.

Individual

The individual level of memory is whatever anyone can retain or remember personally or within their digital memory. Some commentators have explored how this memory is growing and challenging the other two. The web allows such memories and knowledge to be linked in ways that allows individuals and corporations to challenge the other types of memory. The political and social consequences have been dramatic initially but it is still unfolding. States and corporations have succeeded by their ability to adapt to changes and they are still developing their response to this challenge. At an immediate level, we can see the challenge from individual memories in the way that they can use the web and their enhanced memory capacity to challenge the official history of events like Hillsborough and other incidents where an official version exists but is contested. The individual can create a memory and *share* it through links that challenge the state’s role as a gatekeeper of knowledge and memory. The ECJ has an indirect effect by limiting what can be found by severing the link, but not removing the memory or the engram.

Our collective memory is more than Google. 

The discussion of the ECJ has overlooked these memories. Instead, commentators and analysts have assumed that because Google search engine will be changed that memories of genocides or disputed issues will disappear. However, this misses the wider context of memory that even Google exists within. One could say that the links Google holds are simply tears in an ocean of memory. However, the discussion of the three types of memory only captures the surface, or public, view of memory. We need to look beneath that surface and remember that the public memory, while vast, is only a fraction of the private memory that exists.

Public memories are dwarfed by the private memories

For governments, there are the private memories held by the government and not known or seen by the citizen. The private memory is not limited to intelligence work or investigations from regulatory bodies like tax agencies. Instead, this means the memories created and used in the course of the government’s work to deliver services to its citizens. These memories are created and used by the state without the citizen being aware of them except perhaps by their effect. Please note that this does not include the state using such private memory to punish or coerce through blackmail or repression. I mean this as the bureaucratic shadow that all citizens have but may not recognize.

Do we owe our digital soul to the company store?

For corporations, the private memories can be the work that they do with customer data for analytics or customer profiling. The recent news about actuaries and the work around health profiling has brought this information to the public’s awareness. Some people are aware of it because of the concerns over data mining and data analytics. This is often hidden from view and the public are unaware of it. One only need to see, in the UK, the work of the demographics users group that uses large data sets to profile people just as the credit companies do with work that the public do not usually see. This is not to confuse memory and data but to suggest that discussions about memory and links on Google overlooks that they are built from data. The data is the building block for a memory.

Private memories to challenge the official record

Finally, the ruling misses the private memories of individuals who can, as mentioned above, create rival memories to the state or to the corporation. They can take screenshots or set up memory sites that would not be seen by the individual. One effect of the ruling may encourage a private trade for such memories, where everyone has the potential to be an archivist or a private investigator. Here the ruling can never reach and this is the fastest and widest store of memory. While it is haphazard and less robust than either state or corporation memory, it is a reserve within which the state and the corporation exist because individuals can use those private memories to rally others and they act like engrams within a society. The private memories become like touchstones to remind people in a way that was previously limited to the public archives or even privately controlled archives.  The web allows private memories to become public or at least accessible in ways that were previously not available.

Forget about forgetting, we do not yet understand memory. 

Until we understand the full scale of memory as well as its public and private faces, we cannot address the true concerns about privacy and autonomy. In that sense, the Google ruling will simply make us forget memories and what they mean. What we need to remember is that the ruling and people’s reaction to Google is only a way in which the individual is trying to assert themselves within the community. One can argue quite persuasively that the ruling could eventually be applied to public archives to the extent that they are linked and searchable. Even though this is not discussed nor considered in this ruling, the challenge to memory means that in time the public archives will become as contested as the web. The more they become available, the more the individual will assert their self-professed “right” to control their identity and the community’s memory of them. In that sense, we are starting to see a new era of contested memories.

 

**I am grateful to Stephen Benham who made this point.

Scotland’s People <http://www.scotlandspeople.gov.uk/content/help/index.aspx?r=554&403> “…, name and occupation of father, name and maiden name of mother, …”

Daily Telegraph <http://www.telegraph.co.uk/women/womens-life/10594351/Why-cant-your-mothers-name-be-on-your-wedding-certificate.html>

“North of the border, in Scotland, and in Northern Ireland, if you are getting married you will be asked to name both parents on your marriage documentation. So too, across the UK, if you are entering a civil partnership. But when it comes to marriages in England and Wales, mums are left off the official paperwork. The only, rare, exception, is if a mother has been authorised by a court as the ‘sole adopter’, then a couple can make a special request to have her name included, but without court papers, you are stuck.”

Petition on Change.org <http://www.change.org/en-GB/petitions/mothers-names-should-be-on-marriage-certificates>

[1] We must be careful to remember that there are other institutions that create and retain memories. A well known institution is the church. As Jürgen Habermas pointed out in his book, the Structural Transformation of the Public Sphere the Church created a space between the state and crown in terms of public representation. In these rival spaces, the individual could have their identity protected and represented. However, as the state expanded, the crown and the Church, to some extent, have receded as representative institutions. However, they both remain as viable memory stores to rival the state.

Related articles
Enhanced by Zemanta
Posted in Uncategorized | Tagged , , , | 1 Comment

Thoughts on the Trust, Risk, Information and the Law Conference (#TRILCon)

Posted on May 11, 2014 by lawrence serewicz

On the 29th of April, I attended the TRIL Trust, Risk, Information and the Law Conference, in Winchester hosted by the University’s Centre for Information Rights.  The conference was well organised with about 60 attendees.  The day was structured with four sessions. The morning had the opening plenary and the first presentation session. The afternoon followed the same pattern with a plenary and a presentation session. The final session was the closing plenary. People live-tweeted from the event and their tweets can be found at the hashtag #TRILcon on Twitter.

The opening plenary was by Matthew Reed Chief Executive of the Children’s Society “The role of trust and information in assessing risk and protecting the vulnerable.” He gave an insight into how important information and the trust of children for the Society’s work. These are issues that resonate through presentations as trust is at the heart of concerns with data and surveillance. He spoke at length about child poverty, which helped the participants understand how large-scale data collection can build up a better picture of child well-being, which in turn can be analysed to look for trends and other issues.

Questions to consider

An interesting question to consider from this presentation was how to understand the child as both a data subject and a legal person. We need to consider them as an individual, a legal person, for data or information purposes yet still regard them as a child in other contexts. In the context of the Data Protection Act (DPA) the test for a subject access request from a child usually relies upon the age of 12 years old where a data controller needs to consider whether they can decide whether their own interests regarding the request. Yet, society sees a different age for other legal acts such as sexual consent is 15 and the age for voting is 18. At the same time, though a child is a data subject from birth even though an adult with parental responsibility will have a large influence on the child’s access to data and their existence as a digital individual. Therefore, a child in care has to rely on the organisation or the state to act as their parent for data protection purposes.

The opening plenary helped set the stage for the first set of presentations. The schedule can be found here.

The conference had a number of presentation strands and had depth and variety. I attended my panel, Surveillance, encryption, State secrets & fashion! The first paper was on Spain’s transparency laws. The paper suggested that political culture’s view of transparency shaped the public’s understanding of its success and possible constraints. The challenge was whether the public could look beyond the headlines when the Spanish government appeared to have a greater influence over Spanish media than UK media.

My presentation was on Blinding the Leviathan: Encryption Surveillance and the Digital State of Nature.  In that presentation, I argued that surveillance was necessary to fulfil the sovereign’s fundamental responsibility and contract with the citizen. The sovereign is created to deliver public safety and because it had the right to determine peace and war within the state, it had to have the means to ensure that it was not threatened which included surveillance of the public space. I then suggested that the digital state of nature DSON, which is similar to the state of nature that Hobbes argued man escaped by creating a sovereign, presented a new challenge. The DSON blurred the clear line between domestic and foreign, public and private, and friend and enemy. Therefore, the Leviathan’s surveillance has to extend into these areas. Yet, when individuals used encryption to thwart the state, it blinds the Leviathan and limits its ability to protect the individuals. A blind Leviathan was still strong enough to deliver the benefits people wanted, their many and expanding rights, but unable to look into any areas that the individual, rather than the state, decided. The result, though, will not be increased freedom and autonomy but the opposite as the state lacks the means to deliver the many and expanding rights of citizens.

The next presentation was excellent. The University of Winchester and London College of Fashion collaborated on the paper. The multimedia presentation offer a fashion show to explore the ways in which wearable computing, like Google Glass and other devices, was changing how we hide from surveillance and the ways in which it enhanced surveillance. A number of interesting points and ideas were presented on the way that data, trust, risk, and information could and did intersect with our most intimate experiences.

Questions to consider

What is the relationship between fashion, our identity, and surveillance? If we wear various personae to fit within different contexts, does ubiquitous surveillance, through our lifestyle devices, penetrate those personae to reveal us? Our concern with surveillance may result in an iterative relationship, where technology defeats technology, so that fashion to thwart surveillance is only available to a few in much the same way haute couture is only available to a few.

 Afternoon Plenary: Statistics

The afternoon plenary looked at the use of statistics in law looking at the Bayes Theorem and Likelihood tests with a presentation by Professor Norman Fenton “Improving probability and risk assessment in the law.” As the presenter explained, the problem of using the statistics was not just the public having difficulty understanding the maths. Instead, it showed how statistical experts often presented the theorems and the inferences incorrectly, which created problems. As many businesses, such as Amazon, use algorithms and Bayesian probability theory to help profile customers based on their interactions and purchase trends, the session was useful. Though focused more on the use of statistics in law it did show a wider application for other fields such as behavioural advertising and other predictive systems that rely upon big data.

 The Afternoon presentations.

I attended the session on Data linking, statistical disclosure control, Facebook privacy policies and the right to be forgotten.

The Facebook session looked at the problem of privacy statements being limited by what the customer could understand. In a survey of 100 university students (undergraduate and graduate) only 4% had read their Facebook privacy agreement. As a result, it may be difficult to assess how well these capture consent that is fully informed, specific, and freely given. Another problem highlighted by the paper was that privacy statements are usually written in English and then translated into a host country’s language. A poor translation compounded the difficulties experienced with understanding the consent. The user is then left vulnerable because they will not be aware of or able to understand the ways in which their privacy statement may have explained how their data is going to be used, stored, and potentially sold.

Questions to consider

An interesting question from this paper was the extent we take consent for granted in the digital domain. Even if we have well designed privacy notices and opt in or opt out statements, how well does this capture consent and would it really be able to capture any future uses? The deeper problem, perhaps at a philosophical level, is how we demonstrate consent to the other laws and to the government in general when we have to make repeated and detailed consents when our data is used but our other behaviour, such as driving, does not attract the same requirements. We start to see a possible tension between the physical and digital domains.

The next paper on Big Data and the right to be forgotten offered an insight into whether we can be forgotten with large data bases that link data. Another problem was the tension between the digital person and the public person in that a public act may be remember or forgotten in a way that is different from the way in which a digital act is remembered or forgotten.

Questions to consider

In the digital age, who remembers determines whether it can be forgotten. The “official record” may be expunged, but the individual can remember now as well as the state can. Will the right to be forgotten extend to the private domain where rival memories are created and maintained? If the concern about linking and big data relies upon data quality, can that quality be assured in the future? A further question is whether the linking and data can resist or overcome strategies to muddle the history or paint a counter narrative. In that sense, the session on statistics will help us determine whether the history we are reading, through the linked big data, is accurate.

 

The final plenary: [De]-anonymisation & technology panel*

The final plenary brought together a number of speakers on this topic. What was of interest was the presence of the ICO on the panel as they had set the code for anonymisation and psuedonymisation. They pointed that they were the first Regulator in the EU to publish such a standard.  The panel discussed the problems associated with the process and with making sure such data could not be identified by future, yet, unidentified methods.

Questions to consider

Can the tension between useful and meaningful data and personally identifiable data be reconciled? The richer the personal data sets being used the greater the potential to identify someone. Will the concern over data be mitigated by the natural law of data inertia or decay? The data quality could not always be assured so gaps and problem could render its use moot at worst or difficult at best. As the data decays or lacks a robust quality, can we be certain that the correct re-identified someone with great confidence.

Final thoughts

The conference was a success. I found the breadth of papers and presentations stimulating. In my session, I had a number of interested and insightful questions. All the papers sparked discussions and further ideas. The event was well managed and structured. I would recommend people involved with information governance to attend any future events. I have organised similar events and I appreciate the amount of work needed to host and run such events. The Centre for Information Rights offered an excellent day and a lot of stimulating content and discussion, which is exactly what you want from a conference.

 

Related articles
Enhanced by Zemanta
Posted in compliance, culture, data protection act, information management, privacy | Tagged , , , , , , , , | 1 Comment

What is a privacy strategist?

Posted on May 7, 2014 by lawrence serewicz
A Common Access Card, with personal data redacted.

A Common Access Card, with personal data redacted. (Photo credit: Wikipedia)

Business will need someone to help them deal with the increased risks associated with using personal data. They need someone who can help them exploit the business opportunities of personal data and assure customers, and employees, about their privacy concerns. The risks around personal data and customer privacy have increased. From the data breach at Target to Heartbleed across all industries, people are worried about how their personal data is being used. The NSA revelations woke many people up to the threats and made it a major concern for citizens, customers and employees. The public are concerned about the privacy impact of the ways in which businesses and governments use their personal data. If their personal data is being used as a commodity, how will it affect them? They know that companies want to profit from services and products that use personal, but that has serious risks for their privacy. To adapt to these new risks, and opportunities, companies need a privacy strategist.

You need more than data protection training

A privacy strategist will understand how the use or misuse of personal data will affect a company. If they work with government, they will also understand how the privacy of clients and employees is affected by the use or misuse of personal data. Data protection Act. They combine the following skills and knowledge areas as they relate to privacy as well the opportunities and risk with personal data.

  • Information Management: understanding the lifecycle of information
  • Reputation Management: understanding how to manage privacy breaches
  • Freedom of Information Act
  • Environmental Information Regulations
  • Human Rights Act
  • Training and presentation skills

Their knowledge of the privacy legislation will be important, but their role is more than a compliance officer or a regulatory expert. They will be able to advise organisations on the opportunities around personal data for products and services. By looking beyond regulatory compliance; the privacy strategist’s work links directly to the company’s business strategy. However, their work is not just about reassuring clients and customers. Their role covers how the company manages the privacy concerns of employees, which means they need to be able to explain and present this material. Like an information rights advocate, they will have a role in explaining the balance between the rights of the employees and the company’s requirements.

Public or Private Sector, you still need a privacy strategist

The strategist can work in private and public sectors because privacy remains constant. Even though governments may use personal data to a different end, they share the same risks and concerns as the private sector. To help the public sector manage those risks and opportunities, a privacy strategist will shape the organisation’s approach to privacy. They can advise on issues from a data breach to improving a policy’s privacy impact. An organisation can reassure clients and customers by show its commitment to privacy with a privacy strategist.

If personal data is the new commodity, then a new type of worker is needed. Can you succeed in the emerging market of personal data without a privacy strategist?

 

Related articles
Enhanced by Zemanta
Posted in customer service, information management | Tagged , , , , , , , | 1 Comment

Where do you discuss bad news?

Posted on April 14, 2014 by lawrence serewicz

In any organisation, you have to discuss bad news but few people consider where it is discussed. How you discuss bad news will influence, if not determine, the success of your company. The issue is more than critical upwards communication in which junior staff have to be able to report bad (or critical) news upwards either formally or informally. The issue is more than a concern with the learning organisation and double loop versus single loop learning where a company has to learn from its mistakes. Instead, it is something fundamental, which was missing at Enron. At Enron, there was literally nowhere to discuss bad news. Bad news was not suppressed staff had no place to discuss it outside existing management structures. The reporting lines within services and within organisations can reinforce the existing cultural or managerial expectations about bad news or good news. If there is no place for the junior or midlevel managers, who understood something was going wrong, to meet to discuss the issues, then the organisation lacks a critical core needed to deal with bad news. The critical core is rarely at the senior level because they usually do not know about the bad news or take a personal or organisational interest in managing such discussions.

How, where and why BN is discussed will tell you about the organisation and its health. If your management team meetings or extended management team meetings are only focused on good news or what is planned, you give the implicit message that only good news or approved news is to be brought to the meeting. The desire to hear good news, especially in collective meetings, is understandable. No one likes to hear bad news no matter how important it may be. The larger the meeting the less it will be an appropriate place to discuss bad news because it can be seen as criticism. If the bad news becomes a criticism, then in a large group setting it can become like a re-education camp where underperforming units are held to account or to blame. Such an approach will be unintended, but it can easily become the default setting when people set out to discuss bad news. The challenge is to find the right place, the right amount of people, to discuss bad news.

What is bad news?

To understand the problem we need to consider the types of bad news. Broadly speaking there are three types of bad news (BN)

  1. BN staff know
  2. BN only managers know
  3. BN only senior managers know.

Bad news in an organisation is usually of three types, performance, external shocks, and internal shocks. Bad news is not idle gossip or personal problems of staff. Bad news is something that affects the organisation either directly, we are going out of business, or indirectly, division x has lost 10 billion dollars and we need to find the money from all budgets. In most cases, but not all, the bad news has a direct and immediate effect on the company’s reputation. However, bad news is not simply poor performance because performance related issues have an agreed process nor is it well known public news such as the outcome of a trial or a long awaited regulatory sanction.

We may believe that discussing bad news has an obvious reason. However, the reason for discussing bad news reflects an organisation’s cultural norms. This is different from a culture of good news. Instead, it is based on the idea that employees have to follow an internal cultural code that dictates why, how and where bad news is discussed. On the surface, this appears obvious because we discuss bad news when there is a problem to be solved. However, this overlooks the secondary issue of why is there a problem or more precisely “Why do you think there is a problem that needs to be discussed?” A cultural norm may suggest that why you discuss bad news can be understood depending on its context. Is it about under performance? Or is it a threat, a criticism or is it whistle blowing? Senior managers can be unwilling or unable to ask for bad news or to give bad news because the culture norms within their organisation create the fear that they will “make their boss” look bad or be seen as a trouble maker.

Bad news is always a challenge to the chain of command

A closely related concern is the chain of command. The chain of command provides a way to communicate and control decisions within an organisation. It also provides a place and a method for discussing bad news. The discussion will occur within the chain of command and be passed upwards or it is resolved at the proper level. The command level at each level is the place where bad news is to be discussed. One can be disciplined for violating the chain of command by telling a senior manager bad news that the middle manager will tell them. However, the command and control system has problems because it does not create a place for discussing organisation wide bad news.

Most bad news is hidden until it goes away, solves itself or explodes

In many organisations, bad news is kept in silos or hidden because of the chain of command. In some cases, the corporate or departmental culture wants to avoid bad news. If bad news is suppressed or hidden, it can reach dysfunctional levels. Most organisations are very good at single loop learning. They can solve a problem as it emerges. Many companies are not good at double loop learning where they prevent problems by modifying systems to remove the cause of the problems. If a company relies exclusively on single loop learning, then managers only deal with symptoms because that is what they are rewarded for doing. If bad news is not discussed openly or in a place where a wider perspective can be used, manager can learn that the best way to avoid problems is to avoid reporting them or discovering them and not dealing with the causes. They simply explain things are going ok and soften the news so that bad news is watered down into mild news or becomes god news.

 

A place to discuss bad news creates the opportunity to define its limits.

If senior managers do not have a place to discuss bad news they may hide it from other senior manages. In this case, the chain of command removes the places where bad news can be discussed.  As a result, senior managers only find out about bad news from external events, bad news in the press, or from external inquiries, like an auditor, who suddenly create a space where bad news can be discussed because individual managers who may be able to see the issue cannot meet to discuss the bad news. In these situations, the performance management system and performance information become a proxy for discussing bad news. The art of indirect reporting or simply focusing on the targets that are working well is rewarded. Instead of discussing bad news, the conversation is about under performance and a discussion focuses on the quality of the performance indicators and the performance management process rather than the actual problem, the bad news. People seek to change the target or say that the target is unfair or can be qualified in a variety of methods. Bad news is not discussed openly.

Are your corporate cultural norms keeping such a place from forming?

Culture norms in an organisation can inhibit bad news and remove the areas where it can be discussed. The culture norms of an organisation can make it appear that to discuss bad news you have challenged the organisation. You are a troublemaker. When these norms exist, bad news is only discussed by indirect means. People gossip about it or talk in the hallways but never in the meeting room. The bad news becomes capital or ammunition within the bureaucratic negotiations or battles within the organisation. For example, if a junior employee discovered a security leak. They would not have a place to discuss it. Instead, they would tell their senior managers so they can use this information and manage it. The demand that such actions be channelled upwards means that bad news is contained and managed within the chain of command.

What is to be done?

First, an organisation must create a place where people can discuss bad news. A formal meeting could prove counterproductive as no bad news is ever discussed. A place could be created indirectly; so that challengescan be considered to create, the space to discuss that comes from discussions that cover Strength, Weaknesses Opportunities and Threats (SWOT) meetings. At the same time, the organisation can look at how it does communicate critical informationupward and link that to the

English: Stokes, NC, 09/16/1999 -- Pitt County...

English: Stokes, NC, 09/16/1999 — Pitt County State Emergency Management Team and Emergency Management manager Bobby Joyner (R-Blue, glasses) and SERT Wesley Greene (red hat) meet with shelter officials at the Stokes Elementary School and discuss needs for housing 160 families. Photo by Dave Gatley/ FEMA News Photo (Photo credit: Wikipedia)

way managers meet to discuss topics. The best approach is for senior managers to convene off the record meetings where they ask pointed questions like “Tell me what is going wrong and what needs to be done.”  Such meetings cannot emerge overnight, as the senior managers have to be trusted not to be using this to seek out disloyalty or doubt and to be aware that few employees will speak the truth, at least initially, in such settings.

 

Bad news is a reality. What you can control is how you manage it. If you do not have a space for discussing bad news where managers can meet to explore the issue, then you may have more than bad news to manage.

 

Related articles
Enhanced by Zemanta
Posted in change, change managment, culture, leadership, learning organisation, management, renewal | Tagged , , , , , , , , , | 2 Comments

Is privacy the myth that encourages us to be the state’s standing digital reserve?

Posted on April 11, 2014 by lawrence serewicz
Cray X-MP/24 (serial no. 115) used by NSA

Cray X-MP/24 (serial no. 115) used by NSA (Photo credit: Wikipedia)

A recent story on the BBC highlighted the number of data breaches reported by Welsh local government councils. Aside from the questions about the breaches, how they can be prevented, and whether the reporting mechanism encourages or discourages organisations from self-reporting, a deeper question about digital privacy emerges. Does the Data Protection Act, a breach of it, or digital privacy even matter?

When a breach occurs and whether or not the organisation tells them or the regulatory, we face a problem. After the initial anger, though, the subject or victim suddenly realize they are literally powerless in the face of the breach of the principle or the law.  They have little basis for which to seek redress. Yes, they can file a complaint with the organisation. Yes, they can get the regulator, the Information Commissioner Office (ICO) interested in taking enforcement action, but that does not satisfy their injury. The data is still lost.

A data breach or lost data, so what?

At that moment, we start to see what is missing from the moral panics created by the Snowden affair and from the HMRC debacle.  So far, we have to ask who has been harmed and what types of harm have the people who suffered the breach experienced?  I do not mean that people are not upset by a council losing their data, or the NSA accessing their data, or even the HMRC losing their personal details, but what is the harm? As we reflect on this point, we start to realize that the loss of personal data is relatively inconsequential aside from the annoyance factor. We have to consider that our current digital development is relatively primitive so we have not seen the full range of ways that our personal data, even a small amount of it, can (and will be) exploited by the state or the private sector.[1]  The reason being is that there is a difficulty in showing the harm to our digital person in a way that we can show the harm to our physical person from a faulty toaster or a flawed car design where millions of cars recalled when someone gets hurt.

Privacy will not be created or defended by a regulator

Now, before someone asks the silly question that comes with discussions like this, “Well, would you want your data lost or published”, the obvious answer is no. However, that is not the question. The issue is what the redress is for someone who suffers a data breach or has their personal data exploited in ways they did not expect or want. So far, the redress is at best indirect. You can get the organisation to apologize. You may even find one or two that seek to pay you a small amount of money to avoid the hassle of dealing with any legal claims or the bureaucratic paperwork associated with dealing with a regulator. Look at how the banks regularly pay money as mitigation in regulatory investigations. A similar approach, from the regulator’s view is the use of deferred prosecutions.[2] The approach does offer tactical and strategic advantages for both parties except it does not satisfy the aggrieved. In other words, their access to justice is limited to what the regulator feels is in the public interest, which gives us an insight into the coming problems with personal data.

Leaving aside the regulatory pressures, the individual will have a hard time showing damage and distress unless they have experienced it directly, immediately and physically.[3] The problem, at least from those wishing to assert privacy as being control over personal information, is to define or suggest what damage occurs from losing your bank details or your pension details (remember the breach with the contractor who decided to dispose of them in the skip, the personal data was considered minor), thus personal data lost, but no big deal (yes it was a big deal for the Council and the ICO) but for the individuals affected, they had to live with it.[4]

Privacy but what is the damage and distress?

What further adds to the inadequacy of asserting privacy is based on control over personal data is that the loss of control or abuse of that control are not grounded in torts or the injuries to the digital person (or even the physical person) that are easy to know or quantify. In the UK, anyone seeking compensation must be able to show distress and damage.[5] For the most part, the distress never amounts to the damages required to create the basis for a compensation claim.  We can see this in the care.data furore. In this case, the public, or at least the data protection savvy part of the public, were concerned that the health data made available to health care providers would create discrimination against people with health problems.[6] So far, we cannot quantify or identify immediate individual harms based upon the companies having access to the database.  We can feel or believe that it is unfair, but we rarely if ever have laws that say “The community feel aggrieved and thus this is harm”. Instead, we look for individual harms have Mr. X or Ms Y suffered as a result and can they demonstrate it. The problem though is how do you demonstrate that Facebook is discriminating against you in their service provision because you happen to like or dislike something? What would be your evidence, what would be the harm you would show?

The bureaucratic tyranny at the heart of the modern state.

We arrive with the hidden issue. We seem to overlook or forget that data sharing and the use of our personal data for the public interest is embedded in much of the UK legislation.[7] So we may have a situation where we may be seeing our crime rates getting lower (or our health improving) because the police and the government, including local authorities, (or the medical professionals) no longer see as many problems, the fear or risk aversion from breaching the DPA are disappearing, and the willingness to share increases, *even at the expense of people’s rights*. As no one knows about it or even if they did the public interest supports the government (even if it does not condone it) or the effort to challenge by the individual is so far removed or difficult (if you are being done for murder are you really going to focus on the potential data breach?) the sharing becomes easier.  Thus, we see a bureaucratic tyranny emerging that is as silent and efficient as parliament has wanted given the number of laws that encourage (without demanding or explicitly requiring) sharing because they all serve the common good (even though they might have individual cases of harm).  From the perspective of the state, such legislation is the minimum it will tolerate for it does not want anything that will inhibit its ability to act. To an extent this is what the public want, but it shows the tension, if not the failure, of liberalism as the individual “rights” have to be balanced against state “authority”, especially as the state ensures the individual’s rights.

Share because it is better to trample a few rights than have a murder.

One need only note the near seismic shift since the Bichard Enquiry on the police approach to sharing. One could put it crudely to say that the shift has been from share very little to share everything. The logic for the police being it is better to have the occasional person complain about rights being trampled (Mr. Catt[8]) than to explain to everyone why their failure to share allowed someone like (Mr. Huntley) to kill young girls[9] or a relative kill a child (Victoria Climbie).[10]  At the same time, we see this tension in the NHS, trying to protect Sensitive Personal Data (health data) (your data is confidential you will consent to any use of it)[11] even as the UK government wants to open up health databases to be harvested and exploited for the public good.

We come to the realization that the UK’s excellent medical databases become another resource to be exploited by the state. Instead of coal or North Sea oil, the UK will use their data (the personal data of its citizens) as their comparative advantage, the natural resource, to be exploited to make the UK economy run.[12]

The dual impasse inadequate laws to deal with being the standing reserve

Thus, we arrive at a dual impasse. First our laws are developed for our physical person. We do not yet have a way to protect our digital person except to the point it relates to our physical person. Thus, as the demands on our digital person grow and we find it difficult to trace it back to our physical person and even if we do we find it difficult to show the harm. Any attempt so far has shown the incoherence of the concept of privacy and leave unresolved the horrific consequences of reducing us to a digital person. Second, we want to protect personal data (the autonomous individual is sacrosanct so we must believe from Mr Snowden) except that it (the individual) is now the standing reserve to be harvested so that the economy and the state, can deliver better outcomes and deliver the services the public want.[13]

The terms and conditions of the modern state.

What we now have is the dawning realization that the terms and conditions of the modern state are coming due. Our personal data, beyond taxes, is what makes the state move and we want the state (and the wider economy) to continue to provide us with our benefits so that our rights are enforced and expanded and we want our Facebook, Google, and Amazon preferences tailored to us as individuals. Even if we wanted to recast the social contract, how can we if we do not, and never have, controlled our personal data as these breaches demonstrate and the right to be forgotten reminds us?

 

[1] Yes, we can show examples of people suffering bad things. But for the vast majority of breaches, we still do not have a clear cause and effect between breach and harm, which is the point I am arguing. (The harm from the Snowden issue is not on the wheat, but on the chaff.  They have probably harvested my details but so far neither Seal Team 6 nor the SAS has been in contact nor do I expect them to be.)

[2] See for example this analysis which suggests that they are used excessively for fear of a criminal conviction becoming a “death penalty” Markoff, Gabriel, Arthur Andersen and the Myth of the Corporate Death Penalty: Corporate Criminal Convictions in the Twenty-First Century (August 20, 2012). 15 University of Pennsylvania Journal of Business Law 797 (2013). Available at SSRN: http://ssrn.com/abstract=2132242 or http://dx.doi.org/10.2139/ssrn.2132242 As well as a similar analysis that suggest that it is open to abuse. Uhlmann, David M., Deferred Prosecution and Non-Prosecution Agreements and the Erosion of Corporate Criminal Liability (October 1, 2013). Maryland Law Review, Vol. 72, No. 4, 2013; U of Michigan Public Law Research Paper No. 352. Available at SSRN: http://ssrn.com/abstract=2334230

[3]Yes, there is a recent case where a group of people sued Islington Council and sought damages for having to move because their personal details were disclosed. However, this is one case in the thousands of data breaches that have been reported. Perhaps, most of these cases are resolved beneath this level, the small payments to avoid the drawn out legal or bureaucratic processes (the crude cost-benefit approach), but that seems unlikely given that the public sector, in particular, are loath to spend money as freely as the financial sector or rather the financial sector calculates the cost benefit analysis quicker or has less ego in trying to solve a problem. J

[4] As this analysis shows, there is a weakness at the heart of the ICO’s enforcement system. http://amberhawk.typepad.com/amberhawk/2013/08/does-quashing-the-scottish-borders-monetary-penalty-mean-a-change-to-ico-enforcement-policy.html

[5] The central case in this issue is Johnson v. Medical Defence Union. See this blog for analysis of recent developments on this area as it relates to Data Protection law in the UK. http://informationrightsandwrongs.com/2013/05/17/damages-under-s13-data-protection-act-an-opportunity-lost/

[6] The data sharing programme was halted until the communication could be improved and the concerns by interested parties were addressed. http://www.telegraph.co.uk/health/healthnews/10634539/Crisis-of-confidence-in-NHS-database-warn-GPs.html

[7] See for example, Children’s Act 2004 section 11 http://www.legislation.gov.uk/ukpga/2004/31/section/11 See for example, Crime and Disorder Act 1998 section 17 http://www.legislation.gov.uk/ukpga/1998/37/section/17 coupled with section 115 http://www.legislation.gov.uk/ukpga/1998/37/section/115

 

 

[8] Mr Catt is a non-violent campaigner who found out that his DNA was on a police extremist database even though he had done nothing criminal to warrant the inclusion on the database. http://www.bbc.co.uk/news/uk-england-sussex-21783596

 

[9] See the Bichard Inquiry http://en.wikipedia.org/wiki/Bichard_report following the Soham murders. http://en.wikipedia.org/wiki/Soham_murders

[10] http://en.wikipedia.org/wiki/Murder_of_Victoria_Climbi%C3%A9

[11] http://www.hscic.gov.uk/confguideorg

[12] See for example Francis Maude’s award from the Demographics Users Group in 2011 https://www.gov.uk/government/news/top-companies-commend-francis-maude-for-open-data More generally consider the report from World Economic Forum http://www.weforum.org/reports/personal-data-emergence-new-asset-class

[13] Martin Heidegger foresaw this development in his work on the Question Concern Technology which he presented in 1955. In the essay the key passage for our concerns now is the following This danger attests itself to us in two ways. As soon as what is unconcealed no longer concerns man even as object, but does, rather, exclusively as standing-reserve, and man in the midst of the objectlessness is nothing but the orderer of the standing reserve, ten he comes to the very brink of a precipitous fall; that is, he comes to the point where he himself will have to be taken as standing-reserve. P.26-27 (Harper Torchbook Martin Heidegger The Question Concerning Technology and other essays.)

Related articles
Enhanced by Zemanta
Posted in data protection act, information management, local government | Tagged , , , , , , , , , | Comments Off on Is privacy the myth that encourages us to be the state’s standing digital reserve?

Improvement

Posted on April 10, 2014 by lawrence serewicz

This blog post captures the move to a modern approach to work where location does not matter because what matters is the ability to be connected either digitally or physically with colleagues. Work is not about place. It is about the room for improvement. Have you thought about whether you have room for improvement.

Thoughts from a Guerrilla Worker

Day 9 of the A to Z Blogging Challenge.

The biggest room in your business should be the room for improvement. Is it? I hope it’s bigger than the room for complacency. Perhaps this is a big room where you work. It shouldn’t be. Haven’t you heard it said that there is no room for complacency?

We have a room for improvement. It used to be my office.

I didn’t want an office. My work doesn’t require me to be alone. My work doesn’t require me to have status. We needed a place to meet with people. In a building filled with unoccupied desks there is surprisingly little meeting space and so I changed my office into a meeting room. It has its own booking system as well as tea and coffee facilities but it still had my name on the door and the cynics and the doubters said…

View original post 230 more words

Posted in Uncategorized | Comments Off on Improvement

Why your boss is a jerk (and what you can do about it)

Posted on March 15, 2014 by lawrence serewicz

Managers need to exercise some control to deliver the results that are requires and to help their works achieve their potential. However obedience can have a dark side unless it is tempered by judgement. Good managers encourage and train their staff to use their judgement and to act with bounded independence. Bad managers demand rote obedience and suppress judgement to mere rule and procedure following. This article by John Stepper shows the dangers of obedience.

John Stepper

Complete this sentence: “My boss is a …”

Did you say “role model”? Or “true leader”? No. When you start searching the Internet for “My boss is a…,” the most common completions are “bully,” “idiot,” “jerk,” “liar,” “psycho,” “moron,” and some other words that aren’t very nice.

Every day, millions of people are subjected to work situations that rob them of control and often their dignity. Maybe it’s a boss who mistreats you. Or rules that tell you what to do and when to do it. Or management systems that force you to compete with colleagues, bringing out the worst in human behavior.

Here’s why your boss is a jerk – and how you can fight back.

The perils of obedience

The Milgram control panelIn July, 1961, three months after Adolf Eichmann went on trial for Nazi war crimes, the psychologist Stanley Milgram began a series of experiments on obedience to authority figures…

View original post 774 more words

Posted in Uncategorized | Comments Off on Why your boss is a jerk (and what you can do about it)

The future of Records Management (A youtube video)

Posted on February 19, 2014 by lawrence serewicz

I thought it was time to join the YouTube generation and post a video.

I narrated a PowerPoint presentation and converted it into a video. Although these tools have been around for a few years, I did this for two reasons.

First, I wanted to see how it was done. The ability to use social media technology and be able to present on different platforms is an important business skills. PowerPoint is a dominant platform in most businesses and a key management tool so I thought it would be good to see its potential. A narrated presentation can be sent to people who were unable to attend the meeting and to hear the presentation in their own time at their own pace.

I hope I have avoided the twin dangers of a powerpoint presenation. The first is reading the slides line by line. The second is having visuals that are so abstract that the presentation does not match the screen display.

 

The second reason I wanted to do it is that I wanted to share my enthusiasm for records management and its future.  I made this presentation two years ago for a conference and I wanted to share it.  I cover three areas, culture, technology, and legislation. I sketched out some developments over the next five and 10 years.  I hope you find it of interest and use. 

As the original contained copyrighted material I had to take those out and replace them. (The artists were paid in milk and cookies.)  I would welcome your comments.

Posted in information management, learning organisation, records management, Uncategorized | Tagged , , , , , , | 1 Comment