Data Protection Discussion with Lisa Daulby, PhD

00:00

Welcome to module 3.7

00:02

data protection discussion

00:04

with lisa Elvi Ph D.

00:09

During this module will discuss transitioning into a privacy role and how data protection plays a role in privacy management

00:16

and discuss the importance of data retention management and the value of data.

00:23

Without further ado,

00:24

let's get the conversation started.

00:27

Each one. Hello and welcome to one of our guest presenter chats with us. Dr lisa

00:38

Dolby. She is a professor at SAN Jose State University and she is a resident of Canada.

00:44

Welcome dr lisa.

00:47

Hello and thank you for the invitation. Yes, my name is Dr lisa del B and I am with the faculty at the School of Information, the high school at SAN Jose State University in the Masters of Archives and Records Administration Program which is known as Mara. The program is 100% completely online, which allows me to live and work in Toronto Ontario Canada.

01:12

Excellent, Excellent. We're happy to have you here and we're going to jump right into it.

01:18

Talked about talk to students about the importance of running a really sound, good privacy operation and you've got some really good advice I'd like you to

01:27

to uh importance today. So what advice do you have for individuals who are transitioning into a privacy role?

01:36

I would say that this is an exciting time to be transitioning into the role. Um privacy is such an increasingly important function in both private and public sector organizations.

01:48

And I believe the enactment of legislation designed to protect the privacy rights and freedoms and individuals like the european Union's General Data Protection Regulation G D P R um and the California Consumer Protection Act, CCP in the US are really changing the privacy landscape. So my advice would be, you know, to know your legislation. You know, these legal and regulatory requirements are important because they provide guidance for data collection consent

02:22

breaches, individual rights processing of data and the security of data.

02:29

And these regulations are impacting organizations globally.

02:32

I think we can all kind of reflect on the changes to personal information governance in an interconnected and virtually borderless world now and we really only have to look daily almost at media and news articles to see breaches in security violations that affect our own individual privacy.

02:54

So that is why organizations that collect personal data about their

03:00

clients and their employees must comply with these requirements. These regulations place a really strong emphasis on organizational data accountability and transparency. And in some cases, regulators can investigate and find organizations for violations

03:19

leading to great financial burden and often reputational damage.

03:27

Some additional advice that I would give for those entering the field

03:31

that I am seeing is this what I call convergence of roles and responsibility in the profession, especially in the area of risk compliance privacy records and information management and security. Um So no longer can you just you know, be trained to say be a privacy analyst.

03:53

But today that role would require you to have a basic understanding of some security practices, risk assessments, compliance roles, data governance and uh tension request requirements. Uh So I see the professional lines are blurring but in a very positive way.

04:15

Yeah, that's 100% debt. You know, you mentioned uh the importance of data retention in this position as it pertains to privacy. Can you expand on that a little bit more?

04:26

Sure, Absolutely. Great question. I would say that data retention and disposition as it pertains to privacy is so extremely important. You know, data retention and destruction is typically a key function of records and information management practice.

04:44

And as data is growing at this accelerated rate, knowing what data to retain and what to destroy is so important. Data retention and destruction is obviously it's the standardized process of creating, distributing using maintaining and disposing of data regardless of its medium or format or regardless of where it's stored. And usually this is done in a manner consistent with business,

05:11

these priorities and of course applicable legal and regulatory requirements. This is what I call the balancing act. Obviously there are legal and regulatory requirements that dictate. How long are you, how long you are required to retain data. But conversely,

05:28

they are also competing privacy requirements. And you heard me mention G D P R and CCP earlier that require you to delete data that is no longer required, especially if this data contains personally identifiable information or sensitive sensitive data. So that's why it's important for privacy professionals to understand data retention and destruction requirements and to really understand their organizational retention schedules and the rules that they contain.

06:00

But beyond just the legal and regulatory environment, which is obviously so important. We also have to be mindful of the information value. Uh data is a valuable resource. Um it has the ability to transform organizations, enables them to serve their clients better, plaster. It allows them to make smarter decisions and maybe even stay ahead of the competition.

06:26

So the key to unlocking the value of this data is to be sure that we are caring for it properly. And that includes developing healthy data retention and destruction habits.

06:38

As I mentioned with these increasing volumes of data and some organizations are in the terabytes. Now, all of this data could also come at a cost over retaining data can lead

06:50

to higher costs in storage space backups can take longer to run. A business continuity issues can take longer to rectify. So keeping more data than is required leaves us vulnerable to hackers event. And I say the more data you have from a cyber security perspective, the more you have to protect.

07:12

And also from a regulatory discovery perspective, the more data you have, the more that you have to produce or go through in the event of a legal investigation or audit. And most of all too much data with too much data, you will be like

07:30

wasting valuable time sorting through the mountains of information to find what you need um and less time focusing on the critical data and unlocking

07:40

its value.

07:42

So I would just say like to conclude um you know, data protection laws and principles and even potentially forthcoming new privacy regulations universally and data retention and destruction rules are all bound uh in complexity. For sure. This is complex

08:03

and this is also compounded by the kind of multifaceted and ever evolving data, environmental landscape that we find ourselves in. But I do think it's exciting to be a professional and be involved in this field right now. Thanks.

08:20

You know, I agree with you. 100%. And then you're, you're spot on, you know, when you're running a privacy program and and there's an intentional understanding of what information is being collected wide retained. You know, we started organizations to be

08:37

much more responsible, you know, with the data that we have and with that responsibility you pointed out, you know, the risk should go down the amount of storage that's data being stored, whether it's on site opposite in the cloud should reduce, which also reduces risk and expense. So I really appreciate you sharing your insights today. Is there anything else you wanted to add?

09:01

Nope? That's I think that's it. Thanks again for having me. It's been great. No problem. Thank you so much and enjoy the summer in Toronto awesome. Thank you. No problem.

09:15

So quick question. In addition to regulations, doctor lisa recommends we focus on the blank of data as it pertains to privacy management.

09:22

one encryption to type or three values.

09:28

The answer is of course

09:31

value.