Privacy needs to have a seat at the C-Suite table
BigID’s first-ever chief privacy officer explains why the siloed approach to privacy needs to disappear and the ongoing challenge of cross-border data flows.
Heather Federman has had an extensive career in data privacy and protection, advising organisations of all sizes on cutting-edge privacy issues. She is currently the chief privacy officer at BigID, a data intelligence platform based in New York.
In this role, she manages and leads initiatives related to privacy evangelism, product innovation, internal compliance, and industry collaboration.
In addition to her compliance duties, she also works closely with the product development team on all privacy-related features of the company’s platform.
“I also regularly confer with BigID’s clients – some of the world’s most respected, innovative companies – on their top concerns and how our tools can facilitate their privacy and governance goals,” she told SiliconRepublic.com.
“This window into the data protection needs of companies in industries as wide-ranging as entertainment, security, and consumer goods has helped me quickly understand the topical concerns driving the industry forward.”
Oftentimes, the privacy office and the data governance teams work in different silos. This is like the left hand not talking to the right hand when we are all part of the same body.
But data processed by an organisation can range in complexity, from sensitive IP and business data to personal data like health records and shopping inferences. These teams, therefore, need to work together to address the common goal of having one standardised data taxonomy.
They should have the same understanding of what constitutes sensitive data as well as technical and business metadata. This can be done by a mutual data mapping exercise that creates a common data taxonomy, which can feed into an organization’s classification of data as well as its inventory.
Digital transformation is inevitable, and it’s up to the privacy practitioner to become more than just a compliance function. Otherwise, privacy becomes a thankless job – and no one gives you a gold star just because you saved your company from a regulatory fine.
Privacy needs to have a seat at the C-Suite table and become a corporate driver. Rather than saying ‘no’, they can present alternative scenarios. They can help their organisation understand the real risks associated with potential data uses and what reasonable guardrails are for using this data.
By focusing on business capabilities more than compliance concerns, the privacy officer can become a business driver by creatively working with internal teams to creatively leverage the organization’s data assets.
For half a century, organisations have relied upon – and governments have codified – internationally accepted principles for data processing. One of these is the principle of ‘data minimisation’, which essentially means an entity should limit the collection/use of data to what is directly relevant and necessary to accomplish a specific purpose, they should also retain that data only for as long as necessary to fulfill that purpose.
One main way to achieve sustainability is by following this principle. According to Solutions Review, the average cost of storing a single terabyte of file data is now around $3,351 per year. They also predict that the volume of unstructured data will grow to 175bn terabytes by 2025.
In addition, data storage can harm the environment as it takes up a lot of energy and electricity to maintain. MIT Press found that cloud storage has a greater carbon footprint than the airline industry – a single data centre can consume the equivalent electricity of 50,000 homes, and the overall electricity utilised by data centers accounts for 0.3pc of overall carbon emissions.
Unfortunately, many organisations still feel the need to hoard data for an undefined period of time “in case they need it”.
