Privacy - Word of the Year 2013

dictionary.com has selected "Privacy" as their Word of the Year in 2013

Interestingly enough, despite the very specific definition, data privacy is interpreted very differently by country, culture, region and even by organization.

The Ponemon Institute conducted benchmark research analysis on the cost of global data breaches in their 2013 study.  The highest data breach cost in 2012 by individual incident was in the US at $5.4 million and in Germany at $4.8 million.  Most of the data breaches were as a result of malicious or criminal act, not technical errors.    With this, there is no fail safe technical solution to support data privacy, except deny data access all together - which is obviously not an option,  but rather education and required accountability to minimize risk.   The European Commission stated it best:

"Sharing data has become crucial for economic growth. Privacy protection and the free flow of data are complementary not contradictory concepts."

With this, it is impossible to think about global human resource administration without thinking about how you will manage data privacy and security.  With the management of your workforce's data at your fingertips, the most important questions to ask are:

1. Who has access to view my data?
2. Who has access to change my data?
3. Who has access to download my data?

The ability to download the data is the greatest risk especially for the individuals with malicious intent.  Minimizing the ability to download or ensuring proper use is critical to minimize that risk.

Data privacy is a known global concern but also within the boundaries of a single country.   So even if an organization does not cross borders, data privacy should be a primary concern in the management of their worker data.    We are also finding that many countries are adjusting their data privacy laws as well as practices to work in this changing world and this is ever evolving.   The progression of data privacy laws and policies have grown exponentially in the past five years requiring organizations to regularly review and assess their policies and practices to ensure they are compliant.  

Let's look at some regions individually.  The European Union has set the standard for data privacy over the past two decades with the Data Privacy Directive.   The intent is not to restrict business but to respect human rights.    With this, many countries are evaluating and evolving their data privacy practices to support this view.  For example, in the United States, the state of Massachusetts implemented a data privacy law to ensure their residents data is secure.  Singapore has also established a Personal Data Protection Act to ensure the security of their citizens data.     Each country has established some sort of directive to protect personal data;  some with more interpretation requirements. 

I recommend organizations to regularly assess and review their own practices as they go through their implementation but more important as they support their global workforce.  This includes the involvement of not only HR but also local HR, labor representative (Union or Workers Council), legal department and Data Privacy Officer - if you have one.  Reviewing HR processing,  including who has access to what, when and how,  regularly is critical to ensure respect of this human right of your worker population.

What do you think?  In my next blog, I will look at individual country laws and practices.