One of the interesting things about working in privacy is how often privacy teams are asked to help find a way to do something the business have already decided they want to do.
A new technology has been identified, a business case developed, or someone has come up with an innovative way to use the personal information the organisation already holds. The privacy team is brought in to work out what needs to happen to make it compliant. Often, with the right controls, processes and documentation, there is a way forward to comply with the Privacy Act.
However just because something can be made compliant doesn't necessarily mean it is a good idea. Increasingly organisations are becoming very focused on what the law allows us to do, rather than whether we should be doing it in the first place.
Take employee monitoring as an example. There are increasingly sophisticated tools available that allow organisations to track computer activity, measure time spent on tasks and generate reports on individual productivity. There may be legitimate reasons for wanting better visibility of how work is being done, particularly in organisations with large or distributed workforces. Depending on the circumstances, some forms of workplace monitoring may be lawful. The organisation is able to assess the privacy risks, establish appropriate controls, communicate with employees and ensure the relevant legal requirements are met.
However, put yourself in the employee’s shoes, none of the proposed controls change the experience of working somewhere that monitors your every move, nor does it necessarily make the organisation a better place to work. In fact, increased monitoring may even achieve the opposite of what was intended, with employees becoming more focused on appearing productive than actually being productive.
Facial recognition is another example. We have seen increasing interest in using this technology to address retail crime, manage access to premises and improve security. There can be genuine and important reasons for considering it, particularly where staff safety is concerned. However, introducing facial recognition can mean collecting and analysing biometric information about large numbers of people who have done absolutely nothing wrong. An organisation might be able to demonstrate a lawful purpose, put safeguards in place and satisfy the relevant privacy requirements. That doesn't automatically mean the scale of the intrusion is justified or that the people affected will consider it reasonable.
Technology can now generate insights about customers and employees that would have been difficult or expensive to obtain only a few years ago. Some of those insights may be useful. Others may be intrusive, inaccurate or simply unnecessary.
The fact that a vendor’s product offers a feature, or that an organisation already holds the information needed to use it, is not a particularly compelling reason to proceed and use the new features.
A privacy impact assessment (PIA) should not simply be an exercise in finding ways to justify a proposal. It should be an opportunity to consider whether the proposed activity is necessary, proportionate and appropriate in the first place. If a PIA is considered a tick-box exercise to confirm compliance a significant amount of the value of the exercise is lost.
Completion of a PIA sometimes results in recommending a different approach to solve a business problem. At times it can even mean recommending that the organisation doesn't proceed at all. That last option can be particularly uncomfortable when significant time and money have already been invested in a project and highlights the importance of starting a PIA early in a project. By the time a supplier has been selected, contracts negotiated and a launch date announced, there can be considerable pressure to find a compliant solution rather than reconsider the decision itself.
There is also a tendency to confuse transparency with acceptability. Organisations sometimes seem to believe that if they tell people what they are doing with their personal information, that makes the activity acceptable. A paragraph is added to the privacy notice, a consent box appears on a screen, or employees are informed about a new monitoring system. Transparency matters, but it doesn't make an intrusive activity less intrusive. People being informed about something doesn't necessarily mean they are comfortable with it.
Privacy law provides an important framework for protecting people and establishing what organisations can and cannot do. But it is not intended to make every business decision on an organisation's behalf. There will always be activities that are legally permissible but may not align with the organisation's values, the expectations of its customers or the relationship it wants to have with its employees.
An organisation can spend considerable time and money demonstrating that a particular use of personal information is compliant, only to discover that its customers find the practice unacceptable. The resulting damage to trust and reputation may be far more significant than the original privacy risk assessment anticipated.
Privacy professionals also have a role to play in changing the conversation by challenging the business to consider the bigger question “Should we?”
Ultimately, compliance is the minimum standard an organisation needs to meet. It shouldn't be the only standard it uses to decide how to treat people's information.
The most responsible use of personal information isn't always the most sophisticated, the most profitable or the most legally defensible. Sometimes it is simply knowing when not to use it. Just because you can, doesn't mean you should.