[music]
[Kirk] We’re fortunate today to have as a visitor at the Markkula Center for Applied Ethics, Scott Taylor,
who is the chief privacy officer of the Hewlett-Packard company.
A company which operates, uh, in, uh, uh countries all over the world and has hundreds of thousands of employees.
Scott, let's, let's just focus on a couple of things about privacy.
What is privacy, and why is it important to a big company like HP?
[Scott] Yeah. Well, you know, privacy I think more and more, um,
as business models and technology is changing,
is the stewardship of the data that's provided to us and the trust that we build into that process.
[Kirk] Mm-hmm.
[Scott] Um, ultimately, privacy is about interacting.
It's about understanding people and adding value based on that understanding.
But most important ensuring that there's fundamental trust in our ability to collect
and to manage that data in a way that does not harm any individual,
and provides them with meaningful choice about how that information's used.
[Kirk] So I need to know how you're going to use this data you have about me because I've bought from you,
or I've interacted with you on the website. Does that mean I get ultim--
uh, free choice? I can-- I can decide anything I want regarding the use of that data?
[Scott] You know, meaningful choice, I think
you know, a way to frame it that is very helpful,
traditionally we’ve thought of notice and choice.
And notice has lead us to these very long legal notices--
[Kirk] Mm-hmm.
[Scott] --that most people don’t read.
[Kirk] Yup.
[Scott] Uh, we got very used to the, the notices we receive from credit card companies.
But if you go onto the website,
there's multiple scrolling pages of notices and they are not very meaningful.
It's really created an issue for transparency.
We like to think about choice in the context of data use.
[Kirk} Mm-hmm.
[Scott] So if you think about different simple use categories.
One use would be fulfillment.
[Kirk] Mm-hmm.
[Scott] Another use might be marketing or branding of, um,
retargeting of information or remarketing of information.
There's a big difference between the use of data for fulfillment--
[Scott] --and the use of data for marketing.
In fulfillment, the user would expect
to actually have the product shipped to them [laughter] that they’re going to provide data--
--and they have a basic understanding of how you're using that data.
[Kirk] Mm-hmm.
[Scott] Marketing is a whole different type of use.
[Kirk] So if I hear from some company I've never heard of because you’ve given them my data--
[Scott] Exactly.
[Kirk] --then maybe I want a meaningful choice on that.
[Scott] Absolutely. So I think that choice really becomes--
needs to become granular, and it needs to be framed in the concept of use.
[Kirk] One of the things that distinguishes HP from many of the other companies is that
you’ve taken privacy, which is often looked at as a compliance issue,
and made it also an ethics issue.
In fact, you report to the ethics officer--
[Scott] Yes.
[Kirk] --of Hewlett-Packard.
Wh-what does it mean and why is it important
to put ethics around what seems to be a compliance issue of complying with privacy laws?
[Scott] Well, I think given the changes with the Internet,
and data flows around the world, business models, social network, user-generated content,
this is fundamentally changing how we’re exchanging information--
[Kirk] Hmm.
[Scott] --all around the world.
Individuals, companies.
And traditionally,
organizations have thought about privacy as compliance with the law.
[Kirk] Mm-hmm.
[Scott] The problem is law is not keeping up--
--with the movement of technology, and the movement of these new business models.
It's lagging behind.
Most of the privacy laws were written before the Internet existed.
[Kirk] Mm-hmm.
[Scott] And so if you think about turning to the law for guidance,
there's going to be a tremendous gap between that
and the practical realities of decisions that we have to make every day.
[Kirk] Mm-hmm.
[Scott] So I would argue that
we can’t think of privacy any longer as a compliance function.
We actually need to think of it as both a compliance function,
but also a function that helps to integrate the values and the ethics that a corporation holds.
The values and ethics that apply to the data subjects of the countries where we operate,
cultural differences.
So I would argue the privacy has to move out of this realm of liability or compliance,
and start to enter into the realm of trust and ethics.
[Kirk] E-- HP is a huge company,
and you’ve got these hundreds of thousands of people all over the world.
And you're sitting in Palo Alto as the privacy officer,
and you want them to have privacy as an ethical concern.
[Scott] Mm-hmm.
[Kirk] How do you do that?
How do you-- How do you get a-- 3, 400,000 people around the world
to think privacy in this way?
To think of it in an ethical and a values perspective?
[Scott] You know, there's traditionally been a training program
where we require every employee every year
to take training that relates to privacy, but
I would argue that with the complexities of different contextual situations--
--where data might be collected or used, that doesn’t go far enough.
[Kirk] Mm-hmm.
[Scott] Um, what we have done at HP is
we’ve worked with our HP labs organization, our R&D team,
to actually help use the same technology that's being used on the Internet today to
ensure that we’re able to guide and educate our employees in the context of how they might be
collecting or using data.
And connect that to the appropriate policies in the company,
the appropriate laws and regulation,
and the jurisdictions that they work in.
But more importantly,
to build into that context questions about ethics and values.
Questions like, is this something that might surprise the data subject?
[Kirk] Mm-hmm.
[Scott] You know, to think about if it was your mother or your child
that would be receiving this program or this product, would it--
--surprise them? Would it be something that you'd be proud of--
--and that you could stand behind?
So we’ve used this technology to actually mandate that employees come in,
do an assessment that helps to connect these policies, laws, and ethical guidance to that context.
[Kirk] Any time I have a new piece of data or I propose to use data in a new way,
I'm supposed to use this tool and run it through this decision process?
[Scott] Absolutely. Absolutely.
It's the only way that we feel we can drive accountability and proper guidance to the lowest levels--
--of the company.
[Kirk] Does this tool produce an answer?
In other words, I just answer all the questions that it asks me and out pops the answer?
Do it, don’t do it, or modify it?
[Scott] It does.
You know, the front-end is this set of contextual dynamic questions.
You come in and it's-- imagine getting a cold call into, into my team of I have a question about privacy, or, or--
[Kirk] Mm-hmm.
[Scott] --collecting or using data.
It starts with the most simple question and starts to build out dynamic questions based on how you’ve answered prior questions.
[Kirk] Mm-hmm.
[Scott] At the appropriate point in time, it starts to connect the rules that sit in a back-end database. Again, based on
--laws and regulations, but our policies and our own values. Our code of conduct.
It connects these two and it does provide an output.
That output is in the form of a report that right at the top is either a red, green, or a yellow.
And if it's a yellow or a red, they cannot move forward with the project.
And it lists out the reasons why it generated that red or yellow color,
and then provides a checklist for the things that need to be done--
--to mitigate the issue.
But more importantly, is it connects them to the people on my team that are--
--responsible for that business, country, region, or function.
And creates that connection to a human being--
--that can help ensure that the decision is made in an ethical and responsible fashion.
[Kirk] It drives them both towards the laws and the values and the ethics of HP.
It also drives them to get the human help that they need.
[Scott] Absolutely.
[Kirk] Scott, thank you very much for being with us.
[Scott] You're very welcome. I appreciate being here.
[music]