Note that any "IPP" can not rule nor dictate over any of the affected parties, it does however provide a point of contact and expertise for those parties when working with information. The enforcement aspects come from a number of other places which we'll discuss in another article.
We structure the IPP into two parts: the programme elements and the knowledge base, both of which we will introduce here.
The Programme Elements are:
- A Reporting System
- An Information Distribution System
- A Privacy Committee
- An Inspection Programme
- Education and Training
- Accident Preparation and Investigation
The Information Distribution System is a mechanism by which privacy related topics can be communicated to interested parties outside of the IPP. Typically such information might be of the "interest" variety, eg: notification of new laws or relevant news articles, to the critical such as a notification of an information breach or threat which must be acted upon by any receiving parties.
The Privacy Committee is the one fraught with political difficulties, but a small (5-7 people) group from a cross-section of roles within the company. This is where many programmes fail because of placing management or non-technical staff here. The role of this group is not to manage the programme but to reivew incident/accident reports, review adequacy of corrective actions, hazard reviews, inspection reports, provide recommendations (based on information received via the reportins and information distribution systems) and to self-assess and improve the ways of working of the IPP as a whole. The committee is also the chance to bring onboard the expertise in the external parties from R&D, legal etc.
The Inspection Programme can cover many aspects, but is primarily concerned with auditing and providing mentoring/consultancy to external parties. Auditing usually takes place as part of the deployment cycle of a product for example. This area constitutes most likely the bulk of the work of the IPP.
Education and Training is always critical but often badly done (if at all). Developing relevant training for the external parties is critical to long-term success and accident avoidance.
Finally we get to Accident Preparation and Investigation. Hopefully data breach or similar incidents never happen, however having procedures to deal with these are critical to a good solution to any problem. Likewise, a good investigation procedure which not only traces down the causes but provides solutions is also critical.
This concludes the programme elements and now we move to the Knowledge Base which is where the tools, techniques, metrics and database for storing all of the required knowledge and wisdom for running the above element succesfully. We use the word "tool" in a loose sense - automation in any form might not be available, but things such as checklists or ontological structures/classifications are tools.
As a recommended minimum for databases: a database of relevant laws and implications (at an R&D level of detail), a database of reported risks and a database of investigation findings and so on.
All this is just an overview - specific companies, specific situations require customisation and we still have not discussed in any detail the content of the knowledge base nor programme elements let alone presented particular roles such as that of the privacy officer etc. What however should be clear is that a structuring is necessary and what have presented here summaries some of the best practices from an area that is already well versed with similar issues, that of aviation safety. [1]
References
[1] Wood R. (1997) Aviation Safety Programs. 2nd edn. Jeppesen.
No comments:
Post a Comment