(bouncy music)
- First thing to know is that I consider
the privacy officer role and the CISO role
flip sides of a coin.
They complement each other
and really you can't have one without the other
if you're gonna have good data protection,
good privacy and security practices.
The CPO role, or the Privacy Officer Role,
I really break out around policies and practices
related to collection,
and the use and the sharing of personal information,
as well as a large sloth of what I'll just blanketly call
surveillance and ethical considerations
that are particularly important in higher education.
The CISO role is really about protecting data
and sometimes it's protecting it according to law,
protecting it according to the policies and practices
that you'd have the privacy officer write for you.
So you can't really do one without the other.
I can have all the great policies and practices in the world
laid out before everybody,
but if I'm not actually securing the data in the background,
if I'm not encrypting it, I'm not using two-factor,
I'm not using those tools,
the data could all go away.
Flip side is, I could have all the greatest security tools
and techniques and technologies implemented,
but if my practice is to give away data
the minute somebody asks me to share it,
whether it's with business partners,
law enforcement without other best practices
to prevent such things,
then you really don't have privacy.
So they go hand in hand.
There's a lot that CISOs do
that could be extremely privacy-invasive.
We have a lot of tools and a lot of data
that could tell the private goings-on.
What does your email look like?
What are you writing?
Who are you writing it to?
What websites you're surfing?
All those are in my power to review if need be.
It's why you need a privacy officer to check that
and strike the right balance in the relationship.
So, overall, complimentary roles.
Partnership and collaboration is everything between 'em
and a healthy amount of tension isn't bad,
but ultimately they have to work together.
(upbeat music)
Some of the issues are just getting people to recognize
that privacy's a value.
It's a value that particularly in higher ed
underpins and supports values like academic freedom,
intellectual free-expression,
student growth and development.
All those that privacy touches
that are becoming more important as we move into an era
of big data, data science, analytics and oh, by the way,
officially there's privacy-related laws
we all have to pay attention to,
whether that's FERPA, or I'm-a-student-data,
HIPAA around health and medical data.
The common rule which talks
about human subject research data,
they all have strong privacy touches.
None of them are just there for privacy,
maybe the common rule's closest.
But there's a whole compliance piece
that we have to think about in the privacy world.
That said, when I think about privacy
in the higher ed context,
it does go back to what I would call the higher-level math.
So it's not just about meeting the spirit
and letter of the law.
If that's the only reason we were doing...
I was doing privacy in higher ed,
I wouldn't have come back.
It's about things like academic freedom,
freedom of expression, freedom of association,
student growth and development.
All of those have strong privacy components
and ethical data-use components
that if we don't pay attention to them
it changes what we do as higher education professionals.
(upbeat music)
I'm all for GDPR in theory.
And I think something that many
in the U.S. in particular don't understand
is sort of its genesis.
So the way we've approached privacy in the U.S.
versus much of the rest of the world, not just the E.U.,
but we'll stick with the E.U.,
it's fundamentally different.
We see privacy as a set of laws based on data
that are things we don't want shared.
Health information,
might be I want to protect
my educational records from my parents,
I don't want to share my loan information.
So it's something called a sectoral approach.
Privacy in the E.U. is fundamentally a human rights issue.
So think back to World War II, or even pre-World War II,
and the number of fascist dictatorships
in actually, pre-, during and post-World War II,
whether that's the Soviet Union, Nazi-Germany,
East Germany and the Stasi.
Salazar in Portugal, Franco in Spain.
The way they stayed in power was to devalue individuality
and to pry into people's affairs
and be able to hold that against them
to get them to conform.
It's a human subject,
or it's a human rights value.
And that this is now being pushed
as part of the conversation is really heartening to me.
What I'm, aside from just it being difficult
to actually comply with GDPR in the U.S.
and the E.U., frankly.
I worry that we treat it, in the U.S. more like HIPAA,
or for, that it's gonna be treated as a compliance thing
as opposed to the real, like in that higher subject stuff.
This is about human rights
and about valuing individuality as opposed to conformity.
(upbeat music)
We have privacy as a value and as a concept,
not just in our laws but in parts of our Constitution.
While the word privacy doesn't exist,
that we have concepts like no illegal search and seizure.
Are we gonna throw that out?
We have the Fifth Amendment and that you have a right
to not self-incriminate yourself.
Are we gonna throw that out?
Those are privacy values.
So, yeah, in a world of pervasive data collection,
big data, data science and value in it.
It's not just that it's being done against us,
it's being done for us.
I hate to throw out the concept that has gotten us,
it's fundamental in the way this democracy
and many democracies have grown.
(calm music)
Big data is actually breaking long-held privacy practices.
So the U.S. in the wake of Watergate,
and the wake of the McCarthy Era, set,
actually had a privacy commission that helped instantiate
fair information practice principles.
Those principles informed
how the E.U. has approached privacy.
And big, important values in those principles
were transparency.
You tell people what you're gonna collect,
why you're gonna collect it.
Use limitation.
You only use the data for the purpose you collected.
Don't share it with people you don't need to share it with.
In the big data world, that's turned on it's head.
We don't know what we want to use the data for.
Of course, we're gonna use it for other purposes
and we want to share the data
because there's such value in sharing of the data,
whether that's to inform how government happens,
how higher education happens
or even how we can take advantage
of consumers in businesses.
(calm music)
So the great part about being at Michigan
is we have a number of faculty that are privacy,
not just privacy aware but this is their field of study.
So probably the biggest thing I can think of
is we had a data privacy day.
So every year, January 28th
is International Date of Privacy Day.
So clearly, it's still a value out there.
And a faculty member and I partnered to put together
a half day's worth of program
that brought in expertise from both the university
as well as, actually we added some international folks
who videoed in.
And it was a event that surpassed our expectations.
We had hundreds of people attend, we had a lot of follow-up,
we actually sparked some interdisciplinary conversations
and research opportunities that,
if that hadn't existed, boy, you know,
things that might have been lost.
So that actually grew out of another
privacy-related, faculty-collaborative effort
that I co-convened with some faculty members
in our School of Information and our College of Engineering
and other departments,
where we, on a periodic-basis, put together conversations
at the confluence of technology.
Privacy, security, law and policy.
And so if you want to look it up, Dissonance at Umich.
Somewhere along those lines if you use those those two words
in whatever your browser or search engine of choice,
it should come up.
But we touch on a lot of the subjects,
whether that's the Apple and FBI encryption debate
to privacy in the big data world,
or in an internet of things world.
(calm music)