Author: Dr. Philip Cao

Privacy has made headlines for years now, and the rise of social platforms like Facebook has brought the issue into focus. In 2016, I expect privacy to remain at the forefront of technology news, especially with increasing digitization and technology innovations like Smart Cities, digitized transport and the Internet of Things (IoT). These technologies are generating amounts of data previously unknown. IT analysts International Data Corporation (IDC) state that by 2020 the IoT will account for 10% of all the data generated on Earth.

One of the most impactful changes in recent years, which affects privacy gravely, is the massive increase in data theft. Since 2013 there have been a staggering 3.7 billion records stolen. This heady mix of technology innovation, data generation and sophisticated cyber threats is creating new challenges for the privacy agenda.

Here are the key privacy issues emerging or consolidating in 2016:

Blurred Lines:  Data and the Corporation
The lines between data ownership are blurring. Personal data under the corporation umbrella become a corporate asset, yet they are still owned by the individual, and there can be serious impacts on that individual if the data gets into the wrong hands. And data are valuable to all interested parties, from the original owner, to the corporation that can potentially use or sell those data, to the cybercriminal who can extort money from the data through the black market. The privacy implication of this triad of interests is clearly complex, creating blurred lines of responsibility and ownership.

The way privacy is addressing these complexities in 2016 and beyond involves technology, visibility, laws, regulations and guidelines.

Corporate Obligations and the Privacy Policy 
Obligations are most often set out in a privacy policy. However, the issue of privacy policy creation has been in flux for years, creating confusion amongst the general public. The evolution of the privacy policy has greater importance as data sharing has increased with social platforms. This evolution took off in 2008 when the Patient Privacy Rights (PPR) Trust Framework was developed. The PPR Framework gave a working set of guidelines, which could be applied to privacy policies to create a clear, user-accessible policy.

Since then, platforms such as Facebook and Google have pushed the limits of privacy policy politics to the nth degree, and much debate within the technology and legal communities has ensued. The Federal Trade Commission (FTC) has instigated a number of legal actions against technology platforms, including Google, for misuse of users’ data. These actions have been partly responsible for a more respectful view of user data by the likes of Facebook and Google, who are starting to take heed and create better privacy policies which, at least on paper, make the companies look like they take user privacy seriously.

While the US continues to have no overarching privacy law, relying instead on a mosaic of federal and state laws, the humble privacy policy remains a very important legal document for redressing privacy violations. In 2016, more than any time in history, the privacy policy needs to be a means of privacy respect and control, as it sets corporate obligations and practices. However, privacy policies issues go beyond words on the page. There should be a user-centric approach to privacy policy engagement that ensures the user understands what the policy covers and how their personal data may be used.

Privacy Laws and Regulations
As I said, the US lacks a holistic privacy legal framework. A number of industry specific guidelines and regulations, such as the Health Insurance Portability and Accountability Act (HIPAA), the Children’s Online Privacy Protection Act (COPPA) and the Americans with Disabilities Act (ADA), can be used to develop privacy approaches within a given context, but no single law exists. It will be interesting to see how recent events, such as the Snowden episode and the Apple vs. FBI privacy battle, shape the privacy landscape. The time feels right for a single US privacy law, and the work done in California might be the template. The state of California is setting standards across the board in privacy, including the handling of personal data by online services and online protection of minors.

It looks like 2016 will be the year where at least EU-US communications and privacy will have some positive outcome. The infamous Safe Harbor collapse of last year left EU-US data communications in flux, affecting many companies on both sides of the Atlantic. However, the announcement on 29 February by the European Commission of the EU-US Privacy Shield, which will replace Safe Harbor, is good progress. This agreement sets out the obligations and mechanisms needed to guarantee safety and privacy respecting EU-US data transmissions.

Privacy Challenges Ahead
Visibility of data:  As data generation increases, we need to understand where these data are stored, between whom they are transmitted and the end points being used. Data visibility is one of the keys areas that we need to be aware of to plan for privacy. For example, according to a recent IDC report, around 60% of all data generated by the IoT were duplicate data. Without understanding the data life cycle and where data flow, you can’t begin to truly protect an individual’s personally identifiable information.

The jurisdiction challenge:  The differing approaches to privacy, by jurisdiction within the USA, are a challenge that needs to be met in 2016. Bringing together a common law to manage public expectations is long overdue. The alignment of the planets, such as social media, increased public awareness of privacy, mass data generation and increased cyber threats, is bringing this need to the fore. The US government is taking cyber security threats seriously, with the introduction of the Cyber Intelligence and Protection Sharing Act (CISPA). Perhaps it is time for a similar action to protect privacy across the board.

Desai will speak on Data Privacy at the 2016 North America CACS Conference in New Orleans, 2-4 May.

Avani M. Desai CISSP, CISA, CIA, CIPP, Executive Vice President, Schellman & Company, Inc.

[ISACA Now Blog]

ISACA Now recently talked to Tim Sanders, a keynote speaker at the North America CACS 2016 2-4 May in New Orleans. Sanders is the New York Times best-selling author of Love Is The Killer App: How to Win Business & Influence Friends and an Internet pioneer. He advises Fortune 500 executives on leadership, marketing and new media strategies to grow business.

ISACA Now:  Your new book Dealstorming: The Secret Weapon That Can Solve Your Toughest Sales Challenges suggests a team approach to sales. What are the keys to developing a best-in-class team, no matter its function?

Sanders:  Effective problem solving teams are diverse in thinking and united in shared vision. So ask yourself:  Who has a stake in the outcome? Who has expertise about our problem? These are your blockers, tacklers and skill position players for your team. Every team has an overarching goal or purpose, so make sure yours cuts across the lines. In sales, you can’t lead with just the revenue opportunity; you need to elevate the discussion to winning a rivalry, pursuing excellence or building your brand. Same goes for any other problem area at work. A bigger why creates a stronger team, especially when finding a solution takes a lot of meetings and time.

ISACA Now:  You recently tweeted that nurturing team building and team players is more important than hiring rock stars. Why is that?

Sanders:  From business to technology, complexity is rising fast. This puts pressure on organizations to quickly innovate, keeping up with the times. In my research, I’ve found that genius is a team sport…not the work of a lone creative type. There are bodies of research (such as The Myths of Creativity by David Burkus) that debunk the stories of lone-invention. It’s a romantic notion, really. We want to think that the rock star programmer, sales person or marketer will save the day. But really, the effective team builder and player will harness group genius to move things forward more quickly. Additionally, many “rock stars” on paper are the product of their previous working environment. That’s why so often as they move to new opportunities, they can’t replicate their success. And making matters worse, because they were a rock star at their previous job, they’ve likely developed the lone-wolf mentality.

ISACA Now:  Many IT professionals are introverted or work remotely. How can they become lovecats?

Sanders:  A lovecat is a person who is strong and intelligent but at the same time, generous and empathetic to their colleagues. One way we can be generous is knowledge sharing or mentoring. This can be done now online, in a series of very helpful emails. For networking, another way to be generous at work, email introductions or LinkedIn endorsements offer a way to connect others that “should meet.” Finally, introverts are naturally great listeners. Helping others be heard is a valuable offering in organizations where there is constant change.

ISACA Now:  You will be speaking at the NACACS conference 2-4 May 2016 in New Orleans. Give us a brief preview of what you’ll discuss and what attendees will take away.

Sanders:  I’ll be talking about the power of great relationships, team work, collaboration and leading from the heart. Main takeaways will include insights on how to be an effective mentor, a power networker and a great listener. Also, I’ll reveal the collaboration process I’ve developed over my career, and how when fueled by relationships, it can triple your chances at solving your toughest challenges.

[ISACA Now Blog]