Data Privacy in the DMBOK - No Need to Reinvent the Wheel

Castlebridge Associates

Castlebridge Associates | Invent Centre | DCU | Glasnevin | Dublin 9| Ireland

Changing How People in Organisations Think about Information

DATA PRIVACY & THE DMBOKNO NEED TO REINVENT THE WHEEL!


© 2015 | Castlebridge Associates | Confidential

WHAT WE ARE GOING TO COVER

Why Data Privacy is Important

Data Privacy in the DMBOK

Some Other Concepts

Ethical Information Management



WHY DATA PRIVACY IS IMPORTANTSOME KEY TRENDS TO BE AWARE OF…



People have entrusted us with their most personal information.

We owe them nothing less than the best protections that we can possibly provide by harnessing the technology at our disposal.

We must get this right.

History has shown us that sacrificing our right to privacy can have dire consequences.

Tim Cook, CEO Apple



THE GLOBAL LEGISLATIVE TREND

7

17

36

68

111

0

20

40

60

80

100

120

1970s 1980s 1990s 2000s 2010-2015

Total Global Data Privacy Laws

Total Global Data Privacy Law

Within this, there is also continued evolution of existing Data Privacy laws(e.g. EU Data Protection Regulation)



ONE KEY TREND…

Global momentum toward the EU’s model of data privacy regulation has led to new laws and better protection for the consumer. Many non-EU countries have passed laws over the past 12 months that bring the world’s collective standards around data privacy closer to the high-water mark laid out by the EU’s overarching Privacy Directive.

For instance, countries such as Malaysia and South Africa have recently passed new data privacy frameworks that closely follow the EU’s lead. South Africa has even gone one step farther and implemented provisions that will likely be implemented by the future EU Privacy Directive updates.

- Forrester, August 2014


A FRAMEWORK FOR THINKING ABOUT INFORMATIONSt

rate

gic

Business Information Technology

Tact

ical

Ope

ratio

nsC

usto

mer

Business Strategy &

Governance

Information Strategy &

Governance

IT Strategy & Governance

Business Architecture &

Planning

Information Architecture &

Planning

Technology Architecture &

Planning

Management & Execution of

Business Processes

Management & Application of Information

Management & Exploitation of

IT Services

Process Outcome Information Outcome

Expectation

Based on Amsterdam 9-box model by Prof. Rik Maes et al

Privacy is Here



A SUMMARY MAPPING OF CORE PRINCIPLES

EU Principle OECD Principle(s) AICPA FIPPObtain Data Fairly Openness Notice ; Choice and ConsentProcess for a Specified and Lawful Purpose Purpose Specification CollectionDo not Process for an incompatible purpose Use Limitation Use, Retention, DisposalEnsure Data is Accurate, Complete, and Up-to-date Data Quality QualityPersonal Data should be kept Safe and Secure Security Safeguards Security for Privacy; DisclosureData must be adequate, relevant, not excessive Data Quailty QualityPersonal data must not be kept for longer than necessary for the specified purposes Use, Retention, Disposal

Individuals have rights of access, rectification, erasure, blocking Individual participation Access

Management; Monitoring & EnforcementPenalties & Civil liability & Enforcement Accountability Monitoring & Enforcement



One Stop Shop

KEY PROVISIONS OF THE DATA PROTECTION REGULATION

Core 8 Principles+

Accountability Principle+

Transparency Principle +

Article 7, 8 ECHR

Increased Penalties

Moves towards a “Risk Based” model

ExplicitFocus on

Governance

Principles DrivenPrinciples Driven

Enhanced Rights:Data Portability;

RTBF;

Risk & Penalty Mitigation

Docum

entation

Risk & Penalty Mitigation

Fines as % of

Global Turnover

General Data Protection Regulation – 1 Slide Summary



WHY DOES IT MATTER?



DATA PRIVACY IN THE DMBOK



DATA PRIVACY IN THE DMBOK WHEEL© DAMA International, used with permission



DATA PRIVACY IN THE DMBOK WHEEL

Remember to Respect Copyright






DATA PROTECTION THROUGH THE DG/IQ LENS

Current EU Data Protection Directive 95/46/EC



DATA PROTECTION: PRINCIPLES

Principle Governance QualityPersonal data which is being processed must be fairly obtained and processed XPersonal Data shall be obtained for a Specified and Lawful Purpose XPersonal Data shall not be processed in a manner incompatible with the specified purpose XPersonal Data shall be kept accurate and complete and, where necessary, kept up to date X

Personal Data should be kept Safe & Secure XData processed must be adequate, relevant and not excessive X XPersonal data should not be kept for longer than necessary for the specified purpose or purposes X X

Data Subjects have a right of Access. X



DATA PROTECTION: QUALITY PRINCIPLES






WHAT IS DATA QUALITY IN DMBOK?Definition:

Planning, implementation, and control activities that apply quality management techniques to measure, assess, improve, and ensure the fitness of data for use..

Goals:• To measurably improve the quality of data in relation to

defined business expectations.• To define requirements and specifications for integrating data

quality control into the system development lifecycle.• To provide defined processes for measuring, monitoring, and

reporting conformance to acceptable levels of data quality.

Activities:1. Develop and Promote Data Quality Awareness2. Define Data Quality Requirements3. Profile, Analyze, and Assess Data Quality4. Define Data Quality Metrics 5. Define Data Quality Business Rules6. Test and Validate Data Quality Requirements7. Set and Evaluate Data Quality Service Levels8. Continuously Measure and Monitor Data Quality9. Manage Data Quality Issues10. Clean and Correct Data Quality Defects11. Design and Implement Operational DQM Procedures12. Monitor Operational DQM Procedures and Performance

Inputs OutputsInputs:• Business Requirements• Data Requirements• Data Quality Expectations• Data Policies and Standards• Business Metadata• Technical Metadata• Data Sources and Data Stores

Primary Deliverables:• Improved Quality Data• Data Management• Operational Analysis• Data Profiles• Data Quality Certification

Reports• Data Quality Service Level• Agreements

Metrics:• Data Value Statistics• Errors / Requirement Violations• Conformance to Expectations• Conformance to Service Levels

Tools:• Data Profiling Tools• Statistical Analysis Tools• Data Cleansing Tools• Data Integration Tools• Issue and Event Management Tools



EXAMPLE: MARKETING CONSENTS EXPIRE AFTER 12 MONTHS

0%

5%

10%

15%

20%

25%

30%

35%

40%

45%

12 months orover

10 -12 Months 6-9 months 3-6 months 0-3 months

Marketing Months since last contact

ePrivacy Directive Consent Tracker

30% x Avg uplift of €10 per campaign, 10% success rate, 1.2 million customers






DATA PROTECTION: DATA DEVELOPMENT






WHAT IS DATA DEVELOPMENT IN DMBOK?

Definition: Designing, implementing, and maintaining solutions to meet the data needs of the enterprise..

Goals:• Identify and define data requirements.• Design data structures and other solutions to these requirements.• Implement and maintain solution components that meet these

requirements.• Ensure solution conformance to data architecture and standards as

appropriate.• Ensure the integrity, security, usability, and maintainability of structured data

assets.

Activities:1. Data Modelling, Analysis and Solution Design

• Analyze Information Requirements• Develop and Maintain Conceptual Data Models• Develop and Maintain Logical Data Models• Develop and Maintain Physical Data Models

2. Detailed Data Design• Design Physical Databases• Design Information Products• Design Data Access Services• Design Data Integration Services

3. Data Model and Design Quality Management• Develop Data Modeling and Design Standards• Review Data Model and Database Design Quality • Manage Data Model Versioning and Integration

4. Data Implementation• Build and test Data Access Services• Validate Information Requirements

Inputs OutputsInputs:• Business Goals and Strategies• Data Needs and Strategies• Data Standards• Data Architecture• Process Architecture• Application Architecture• Technical Architecture

Primary Deliverables:• Data Requirements and

Business Rules• Conceptual Data Models• Logical Data Models and

Specifications• Physical Data Models and

Specifications• Meta-data (Business and

Technical)• Data Access Services



HOW DATA DEVELOPMENT AFFECTS PRIVACY

Obtain

Storage

Store/Share Apply



HOW DATA DEVELOPMENT AFFECTS PRIVACY -EXAMPLE

• EU e-marketing rules require explicit Opt-in consent for calls to mobiles and for SMS marketing

• Fixed line is Opt-out• Data Modelling decision required here…



HOW DATA DEVELOPMENT AFFECTS PRIVACY -EXAMPLE

Marketing Other

Call

SMS

Call

Opt-inIs this a nominated contact

for that purpose?

PurposesService Delivery

Record opt-in for service delivery calls

Opt-inIs this a nominated contact

for that purpose?Record opt-in for service

delivery calls

Opt Out Record opt-in for service delivery calls

Is this a nominated contact for that purpose?

Email Opt-in Record opt-in for service delivery calls


Postal Opt-Out Record opt-in for service delivery calls




HOW DATA DEVELOPMENT AFFECTS PRIVACY –A KISS OF DEATH TO USEABLE DATA…

Please tick this box if you would like us to not contact you

Blanket Opt-Outs applied at the PARTY Entity level, not at the contact point or in the context of a specific purpose….



WHAT CAN WE LEARN FROM DATA MODEL ABOUT PRIVACY IMPACTS?






WHAT IS DATA ARCHITECTURE IN DMBOK?

Definition: Defining the data needs of the enterprise and designing the master blueprints to meet those needs..

Goals:• To plan with vision and foresight to provide high quality data.• To identify and define common data requirements.• To design conceptual structures and plans to meet the current

and long-term data requirements of the enterprise.

Activities:1. Understand Enterprise Information Needs2. Develop and Maintain the Enterprise Data Model3. Analyze and Align With Other Business Models4. Define and Maintain the Data Technology Architecture 5. Define and Maintain the Data Integration Architecture6. Define and Maintain the DW/BI Architecture 7. Define and Maintain Enterprise Taxonomies and

Namespaces8. Define and Maintain the Meta-data Architecture

Inputs OutputsInputs:• Business Goals• Business Strategies• Business Architecture• Process Architecture• IT Objectives• IT Strategies• Data Strategies• Data Issues• Data Needs• Technical Architecture

Primary Deliverables:• Enterprise Data Model• Information Value Chain

Analysis• Data Technology Architecture• Data Integration / MDM

Architecture• DW / BI Architecture• Meta-data Architecture• Enterprise Taxonomies and

Namespaces• Document Management

Architecture• Metadata



DATA PROTECTION: DATA ARCHITECTURE








THE ZACHMAN FRAMEWORKExecutive

Business Manager

Architect

Engineer

Technician

How(Action)

Why(Motivation)

Where(Location)

When(Event)

Who(Actor)

What(Data)

Enterprise

ScopeContext

Business Concepts

System Logic

Technology Physics

Tool components

Enterprise

Inventory Identification

Inventory Definition

Inventory Representation

Inventory Specification

Inventory Configuration

Inventory Instantiation

Process Identification

Process Definition

Process Representation

Process Specification

Process Configuration

Process Instantiations

Distribution Identification

Distribution Definition

Distribution Representation

Distribution Specification

Distribution Configuration

Distribution Instantiations

Responsibility Identification

Responsibility Definition

Responsibility Representation

Responsibility Specification

Responsibility Configuration


Timing Identification

Timing Definition

Timing Representation

Timing Specification

Timing Configuration

Timing Instantiations

Motivation Identification

Motivation Definition

Motivation Representation

Motivation Specification

Motivation Configuration

Motivation Instantiations

Inventory Sets Process flows Distribution Networks

Responsibility Assignments Timing Cycles Motivation

Intentions

Based on the Zachman Framework and content from Dennedy & Finneran’s Privacy Engineers Manifesto




Business Manager

Architect

Engineer

Technician

How(Action)

Why(Motivation)

Where(Location)

When(Event)

Who(Actor)

What(Data)

Enterprise

ScopeContext

Business Concepts

System Logic

Technology Physics

Tool components

Enterprise








Process Definition


















Timing Definition













Intentions

What triggers need for data?



• Why?• Balancing

priorities/goals• Purpose spec

Specified data, specified purpose

Specified data, specified purpose





Business Manager

Architect

Engineer

Technician

How(Action)

Why(Motivation)

Where(Location)

When(Event)

Who(Actor)

What(Data)

Enterprise

ScopeContext

Business Concepts

System Logic

Technology Physics

Tool components

Enterprise








Process Definition


















Timing Definition













Intentions

Data Classification

IN CONTEXT

How does the purpose get executed?





Business Manager

Architect

Engineer

Technician

How(Action)

Why(Motivation)

Where(Location)

When(Event)

Who(Actor)

What(Data)

Enterprise

ScopeContext

Business Concepts

System Logic

Technology Physics

Tool components

Enterprise








Process Definition


















Timing Definition













Intentions

Logical Schema Process Maps / Data Flow RACI Matrix





Business Manager

Architect

Engineer

Technician

How(Action)

Why(Motivation)

Where(Location)

When(Event)

Who(Actor)

What(Data)

Enterprise

ScopeContext

Business Concepts

System Logic

Technology Physics

Tool components

Enterprise






InvntoryInstantiation


Process Definition


















Timing Definition













Intentions

Where is your data stored?

What rules apply to that storage?







DATA PROTECTION: DATA GOVERNANCE






WHAT IS DATA GOVERNANCE IN DMBOK?

Definition: The exercise of authority and control (planning, monitoring, and enforcement) over the management of data assets..

Goals:• To define, approve, and communicate data strategies, policies, standards, architecture, procedures,

and metrics.• To track and enforce regulatory compliance and conformance to data policies, standards, architecture,

and procedures.• To sponsor, track, and oversee the delivery of data management projects and services.• To manage and resolve data related issues.• To understand and promote the value of data assets..

Activities:1. Data Management Planning • Understand Strategic Enterprise Data Needs• Develop and Maintain the Data Strategy• Establish Data Professional Roles and Organizations• Identify and Appoint Data Stewards• Establish Data Governance and Stewardship Organizations• Develop and Approve Data Policies, Standards, and Procedures• Review and Approve Data Architecture• Plan and Sponsor Data Management Projects and Services• Estimate Data Asset Value and Associated Costs2. Data Management Control• Supervise Data Professional Organizations and Staff• Coordinate Data Governance Activities• Manage and Resolve Data Related Issues• Monitor and Ensure Regulatory Compliance• Monitor and Enforce Conformance With Data Policies, Standards,• and Architecture• Oversee Data Management Projects and Services• Communicate and Promote the Value of Data Assets

Inputs OutputsInputs:• Business Goals• Business Strategies• IT Objectives• IT Strategies• Data Needs• Data Issues• Regulatory Requirements

Primary Deliverables:• Data Policies• Data Standards• Resolved Issues• Data Management Projects and

Services• Quality Data and Information• Recognized Data Value



SOME KEY GOVERNANCE FUNCTIONS FROM PRIVACY PERSPECTIVE

Co-ordination of Data Privacy policies and standards

ISO29100 is a good core starting point

Ensuring staff are trained

Acting as “honest broker”

Ensuring appropriate risk posture in relation to privacy compliance

Ensuring processes for personal data are documented

Ensuring key controls are defined, operate, and are validated



STEWARDSHIP FOR DATA PRIVACY

Strategic

Operational

Tactical

Doers Definers Deciders Co-ordinators

3DC Stewardship

Defined not by WHERE they are in organisation, but by ROLE in relation to Information



A DATA STEWARDSHIP MIND MAP

Governance & Stewardship

Data Use Steward (Doer/Definer)

UX Requirements

Privacy Reporting

Screens & Reports Quality

Screen & Reports Content

Design & Aesthetics

Data Governance Reqts(Co-ordinator)

Data Standards Compliance

Use of Metadata Documentation

Metric Driven Quality Assurance

Data Management Structure

Data Collection Steward

(Doer/Definer)

Data Classification (PII, Sensitive)

Encryption

Business Content Rules

Privacy Rules

Privacy ReqtsSteward

(Decider/Definer)

Purpose

Notice

Consent

Transfer (3rd Party)

Access/Correction/Deletion

Proportionality

Retention

Responsible Action

Based on work by M. Dennedy & Tom Finneran



THE DATA PROTECTION OFFICER ROLE• On the Executive Board?

• Reporting to Executive Board?

• Must be Independent

• Technical and Business skills

• Accountable for the System of Governance

• “Statutory Tenure”



SOME FINAL CONCEPTS



PRIVACY BY DESIGN

What is it?Privacy by Design is a philosophy for systems engineering which takes privacy into account throughout the whole engineering process.

Why is it Important?Privacy by Design establishes 7 guiding principles for development of systems that respect and enhance privacy as a quality system

What is it?It is just QUALITY MANAGEMENT applied to Information, with PRIVACY as a “critical to quality” characteristic



PRIVACY BY DESIGN

'You cannot inspect quality into a product.' The quality is there or it isn't by the time it's inspected.



PRIVACY BY DESIGN

Focus on defining processes & rules, not

correcting errors

Privacy as a quality characteristic

A function of process design, not an after

thought

Things need to work without undue

invasion of privacy

Information Asset Life Cycle thinking

Communicate, Document,

communicate more!

Focus on the Customer –Customer determines

Quality /Privacy



PRIVACY ENGINEERING

What is it?Privacy Engineering is the discipline that ensures the gathering and application of privacy requirements has the same primacy as other ‘functional’ requirements in processes and systems and incorporates them into the project, product, system, or information life cycle.

Why is it Important? It is the glue that makes PBD operative in an organisation

What is it?It is just QUALITY ENGINEERING applied to Information, with PRIVACY as a “critical to quality” characteristic



ELEMENTS OF PRIVACY ENGINEERING MAPPED TO JURAN

Enterprise GoalsUser Goals

Privacy Policy

Requirements

Policies and Procedures

Privacy Mechanisms

Privacy Awareness Training

Quality Assurance

QA Feedback

Improvement



ETHICAL INFORMATION MANAGEMENTTHE NEW EIM




Society’s Ethical Framework

Organisation’s Ethical Framework

Regulation & Laws Lobbying

Stra

tegi

cTa

ctic

alO

pera

tions

Cus

tom

er

Standards & Codes

Standard Practices

Business Strategy &

Governance

Information Strategy &

Governance

IT Strategy & Governance

Business Architecture &

Planning

Information Architecture &

Planning

Technology Architecture &

Planning

Management & Execution of

Business Processes

Management & Application of Information

Management & Exploitation of

IT Services

Process Outcome Information OutcomeCustomer Feedback

Customer Education

Expectation
