Today, few senior decision-makers within technology businesses go more than a day without being faced with the issues of privacy and security.

The world has become so digitally interconnected that the role of the chief data officer (CDO) has shifted from being about meeting operational requirements to performing the difficult balancing act between ensuring compliance and helping deliver the organisation’s strategic goals.

Understand the Request

In line with this, it is crucial that CDOs avoid simply vetoing projects or putting the brakes on them due to compliance concerns. Instead, when dealing with any data request, they need first to understand what are the goals or objectives of the person making the request and then try to facilitate the request in a way that drives the operational goal, but at the same time protects privacy and safeguards security.

It could be that a direct approach does not work, simply because the law prevents it, but there may still be another way to achieve the same result. For example, most global laws stipulate that certain types of information cannot be used without the express consent of the individual. Yet, there may be related types of information that can be used under the right circumstances.

Answer the Object

In the healthcare space, it is not unusual to receive requests for records showing a patient’s date of birth for use in specific kinds of project. Typically, in such a case the CDO will ask the obvious question: “Why do you need this piece of information?” to which the answer will generally be: “Well, we need to know how old somebody is.”

In reality, the date someone was born does not tell you that. It tells you how to calculate how old they are. The data you are really looking for is, in fact, the person’s age. And this information is less critical and less sensitive than date of birth. This is a perfect example of how a CDO can help to find another way to get to the objective without exposing sensitive data and potentially breaching compliance requirements.

Another example of this is if someone from the business asks for the names and addresses of everyone in a given area with a view to understanding how many people in this area are buying a certain product. Again, by looking at the objective rather than just the request, the CDO can discover that the person doesn’t actually need any personally identifiable information. They don’t need to know who these individuals are, but simply how many of them bought the product.

Goals Rather Than Inputs

Ultimately, the role of the CDO should never be simply to block progress but rather to help people within the business understand what they are looking to achieve and if there is another way of doing it that better meets compliance needs. Defining the objectives in terms of the goals rather than the inputs.

The negotiating and consultancy element of this is important because many people within the organisation immediately focus on the data that they think they can access rather than looking first at their end goal and what they need to achieve it. An important part of this role is to help de-conflict ostensibly opposing needs for compliance and business benefit – and ultimately still get to the same result.

Of course, there will inevitably be certain objectives that simply can’t be fulfilled for compliance reasons. But for the most part, if organisations are acting ethically and within the law, there will be a way that they can achieve their business goals with respect to data.

At the end of the day, the CDO needs to understand what the organisation is trying to do and give them the ability to do it in a way that is not only compliant but also builds trust. Not only for the organisation and its customers and consumers, but also for their own role within the organisation.

Trust is fundamental to the success of any organization. For patients, customers, employees, and other stakeholders, privacy and security are key elements of trust. At InterSystems, Global Trust means meeting or exceeding legal and regulatory requirements for privacy and security anywhere in the world.

InterSystems IRIS is the next-generation data platform that makes it faster and easier than ever for developers to build enterprise-class applications. Try it now or explore our developer resources.


Ken Mortensen

Data Protection Officer Global Trust and Privacy, InterSystems. As an attorney and engineer, Ken Mortensen is a privacy and security professional with over 20 years of legal and over 30 years of IT experience. Based in Cambridge, Mass., Ken currently leads Global Trust and Privacy at InterSystems as the Data Protection Officer. He works globally across the company to enhance information privacy, governance, and cyber risk processes. Before InterSystems, Ken served in a number of chief privacy and security roles at PwC, CVS Health, and Boston Scientific.

Categories

Subscribe to hear more from us

Subscribe to our email newsletter to receive useful articles and special offers.