By Deirdre Mulligan & Kenneth Bamberger, Privacy Perspectives
Our previous posts reported some initial conclusions from almost one hundred interviews of leading corporate privacy officers, regulators and other privacy professionals in five countries.
The second post explored one surprising finding—that the two countries in which privacy officers were most empowered were Germany and the United States, countries which couldn’t be more different in terms of their regulatory framework—and explored some of the reasons for privacy officer strength in Germany.
This final post explores a caution raised by privacy officers in both the public- and private-sector regarding particular risks created by attempts to ensure that privacy is part of high-level deliberations within a corporation—risks that must be managed in developing policy regarding privacy.
Specifically, our research looking at the work of privacy officers in U.S. federal agencies, found that injecting privacy into strategic organizational deliberations drives home the perception that privacy is a policy decision with unavoidable connections to politics and impact—for better and for worse—on the bottom line.
The combined insights from our work suggest that privacy work takes many forms in the firm. It must be represented in strategic conversations for it is there that privacy may be both most at risk and most effectively protected. However, participation in these high stakes, contentious battles over the firm’s values must not derail the day-to-day work of embedding privacy into firm practice. This daily work requires trusted insider status, not independence. It requires full and early access and ongoing dialogue with business units. This sort of work, our research suggests, is best accomplished by a diverse set of distributed employees with privacy training who are nonetheless viewed as part of the business team—not a barrier to their efforts, but a partner seeking to ensure that privacy is seamlessly integrated. Regulation can play a role in facilitating the adoption of such a model within firms, but a statutory command to have a chief privacy officer is unlikely, on its own, to do so.4/8/2013