|
Privacy and data protection. These words should provide a sense of safety and trust on personal data processing and the company responsible for undertaking it. However these days, for many individuals, they give grave cause for concern.
How can we be sure that details of transactions cannot be detected, that data is used in line with users’ expectations and that confidences are kept? How confident can we be that companies will willingly be accountable for guarding our privacy?
Recognising such concerns, HP is taking steps with Center for Information Policy Leadership (CIPL) and representatives from major industry partners, consumer protection groups and regulatory agencies to develop a Working Paper that sets out the essential elements of accountability in privacy governance. The paper is still being developed, but the goal is to present a comprehensive set of recommendations to privacy regulators before the end of the year.
Daniel Pradelles, Certified Information Privacy Professional (CIPP) is Privacy Officer for HP EMEA and he explains why HP takes such a strong stance on the issue of privacy and accountability:
“In the middle of last year we began working on the design of a Working Paper that aims to address issues of accountability. It was becoming clear that everyone – individuals, regulators and companies – was progressively agreeing on the idea of accountability, but they had different views of it. They all had different policies and practices on privacy and different visions and context, and therefore their solutions to effective data protection management were different.
"How can anyone be sure that such solutions are adequate and that they are completely accountable for their actions? We felt there was a need to formalise the concept and meaning of accountability and to do the best to harmonise the different approaches.”
A group of experienced people were brought together, all of whom work in the field of privacy and accountability, and met in Ireland to discuss how best to develop a Working Paper. About 40 specialists were invited, from data protection authorities, consumer protection Non Governmental Organisations (NGOs) and regulators to multinational organisations and small businesses.
Daniel continues: “We discussed accountability through several specific themes. These focused on how it links to Privacy Governance issues, what the essential elements of accountability are linking to trust in data management, how to measure accountability, key linkage with another major concept named ‘privacy by design’, what the main incentives for privacy accountability are and finally the challenges of certification and oversight.
"We wanted to really work on the definitions and the key elements of accountability so that we can prepare a comprehensive document which will contain new trends, practices and opinions on accountability that will be commonly accepted.”
Once completed, the Working Paper will be submitted for consideration and discussion to a number of major privacy regulators and international organisations, all of whom work to ensure consistent accountability strategy. These include:
•The Working Party on Information Security and Privacy
• The OECD through the BIAC
• The Spanish Data Protection Agency (for discussion at the International Conference of Data Protection and Privacy Commissioners next November 2009 in Madrid)
•The Data Privacy Subgroup at APEC
New accountability tool
HP’s own belief in the need for accountability materialised in the design and development of new automated software named ‘Accountability Model Tool’. This tool, which is being developed by HP Labs following specific recommendations from HP’s Privacy Office, is an intelligent context-driven checklist of privacy and accountability actions, which will assist and drive business decisions.
Once the list of actions has been completed, the employee checking the list is held accountable and responsible for ensuring their implementation is adequately completed and privacy standards are met. Currently in its testing phase, the tool will be ready for use at the beginning of next year.
Daniel continues: “We know that, depending on their business sector and privacy maturity, some companies may have issues on agreeing a common accountability strategy. But accountable they must be at institutional and individual levels across all the company.
"We strongly believe in the need for transparency and the need for certification on how a company complies with its accountability commitment, which is why we want to work closely with regulators. We need to share views, concerns and objectives in order to find the best solutions for addressing current and future privacy issues."
The importance of such an approach, which is at the heart of HP’s plans, has been acknowledged in the recently released ‘Review of Data Protection Directive’ study undertaken by Rand Europe for UK ICO Richard Thomas, UK Information Commissioner. He stated in his foreword: "A vital theme is accountability. Primary responsibility must be placed on organisations to get it right and they must be held to account if they get it wrong. Organisations must deploy the right technology and have a privacy-by-design approach at the heart of their plans."
|
Printable version
