-Hi, I'm Martin Rust with the Security and Policy Institute for Professional Development.
My guest this afternoon is Sheila FitzPatrick.
Sheila is the worldwide data governance and privacy counsel for a company called NetApp,
a very significant technology player certainly, here with the Canadian government.
We're talking this afternoon about the balance between the security, national security and
privacy, and the information that's collected.
And I know, here in Canada, the topic is: I, as an individual, want to have some control
over the information that I hand over to the government.
So, I think people look at that as a privacy issue.
But then, they have an expectation, I think, that the government provides a level of security
of that information, and they're going to protect it.
So, now, I know that we're using different terminology.
So, help us understand what these different things mean.
-Right.
People get confused when they talk about data privacy and data security.
Oftentimes, they think it's the same thing.
And data privacy and data security are actually a little bit different.
They're tied together.
Data privacy is the umbrella and data security is...
If you look at, like, spokes in a wheel, data security is one spoke.
It's how you protect that data from unauthorized access.
So, it could be the encryption, the tokenization if it's in the cloud.
It could be the firewalls, it could be the passwords.
It's that fortress of keeping that data safe.
Data privacy is legislation.
It's the protection of that data from various levels.
It's, what data are you collecting on me, what are you doing with that data, what are
you using the data for, who are you sharing that data with, where is it being stored,
how long do you keep it, what's your records retention program.
So, data privacy incorporates not only the security aspect, but it's the data that you're
collecting.
And people do have an expectation of privacy.
They think that they're sharing the data with the government for... you know, whether you're
an employee of the government or whether you're a citizen and you need to... you know, for
taxation purposes, for employment purposes, they have to have some data in order to manage
the relationship that they have with you.
So, the government needs your data in order to manage the relationship they have with
you as a Canadian citizen.
But what you have to understand is: your expectation of privacy and the expectation of privacy
of the government may be two totally different things.
Because you may not know exactly what they're doing with your data.
-And I think a reflection of that is that when we hand over our information to that
government, we have an expectation that even within government that they have access to
share that information back and forth.
And yet, you know, the tax information that you're talking about, for instance, is only
held in one place, and the information for another department is only held in one place.
And in fact, across government, they don't share that information.
That is a function of the privacy of that information, correct?
-Absolutely.
Absolutely.
Because, again, it's limiting the access.
So, you're talking about privacy.
Your job under privacy legislation is to make sure there's no unauthorized access, use,
loss or destruction of that data, and that you always are transparent about what you're
doing with the data.
And part of the problem comes in as new technology comes out, like, say, for instance, the cloud.
Everybody's moving to the cloud.
And they think about the security around the cloud, but they don't think about the privacy
around the cloud.
So, if the government is moving to the cloud environment, into a shared services environment,
which I know part of the Canadian government is moving to, and that data is going to be
stored in the cloud, who's going to have access to that data?
So the government is now giving control of that data to a third party cloud provider
that may store that data in their data center that may or may not be located in Canada.
And they may say, for instance...
I'll give you a good example.
NetApp is one of the biggest providers to the federal government, not only in Canada,
but in the U.S., and part of the issue becomes when customers start to look at the big cloud
providers in the world.
You know, there's a few big ones out there.
And they'll say: well, we'll build a data center in your location, in your environment,
so that you control that data, you own that data.
But what you don't ask further is: where's that data backed-up?
So that you may control the physical location of the data center and say: I want my data
to be in Ottawa.
But what you don't know is that data may be backed-up in, say, Washington.
It may flow through Chicago before it even gets to...
And if it's going from, say, Ottawa to British Columbia, it may flow through Chicago before
it even gets to the data center.
And that becomes a privacy and data sovereignty issue and not a security issue.
And people are starting to become more aware of that.
-I certainly hope so.
And, hopefully, lawmakers are paying a bit more attention to that and are hopefully coming
up with some solutions.
-Lawmakers in Canada absolutely are.
They're starting to pay attention, because within your privacy laws, you have the regulation
around data sovereignty, which means that data has to stay in the country of origination.
So, within Canada, the data has to stay in Canada.
If you want to process that data outside of Canada, in some cases, you're going to have
to get the consent of the individual to do that.
Or, you're going to have to be transparent where the individual knows: O.K., the Canadian
government is going to process my data.
That data may very well be processed in a data center in the U.S., but individuals have
a right to that data.
But the government is really starting to pay attention to, you know, that balance of, how
do we take advantage of technology, how do we cut costs, but yet, how do we still, you
know, enforce and protect and maintain the laws on data sovereignty and data privacy.
-Clearly, this is an issue that's going to be hot for some time, and we'll continue to
talk about it.
-Great.
-I'm Martin Rust with the Security and Policy Institute for Professional Development, here
at the University of Ottawa.
My guest this afternoon is Sheila FitzPatrick, who is the worldwide data governance and privacy
counsel for NetApp.
Thank you very much.
-Thank you.