Sibenco Legal & Advisory

The Information Governance Primer

Information Governance

by

A comprehensive guide to build and improve information governance within organisations

The Information Governance Primer provides a wide-ranging overview on the fundamentals of good information governance.

In today’s digital environment, the growing number and complexity of challenges associated with data and information have outpaced traditional information and records management practices.  The Information Governance Primer address these challenges by providing a guide to developing a holistic enterprise-wide system to mitigate risks and maximise opportunities.

The COVID-19 pandemic has highlighted the importance of access to accurate and real-time data for decision-making by senior executives and boards, access and reliability of organisational systems and information for employees to carry out day-to-day work and for decision-making at all levels throughout the organisation and information security and the increasing cyber risks arising from working remotely and the increasing use and reliance on third-party platforms and software.

The Information Governance Primer addresses these unfolding issues and provide practical guidance in how organisations can implement robust governance to mitigate risks. It will assist you to develop a well-executed IG framework and program, with appropriate leadership to deliver effective security and control of data and information by reducing costs of holding information and maximising the value of information held by your organisation.

The Information Governance Primer not only articulates persuasively the rationale for implementing good information governance, but aims to equip IG practitioners with the knowledge required to build and improve information governance across a range of organisation types including government, corporates and not-for-profits.

The Information Governance Primer provides a general overview of information governance, covering a range of important factors including the key drivers of IG, benefits of successful IG implementation, an outline of IG models and frameworks plus the role of IG leadership in establishing robust information governance.

The Information Governance Primer is available on the InfoGovANZ website.

by

Data and information are increasingly becoming the lifeblood of organisations.  However the exponential amounts of data being collected by companies and government alike, together with the risks and costs of holding and securing this information, have created a new set of issues for those responsible for organisational governance.

A healthy circulatory system increases overall health and improves our ability to function. Likewise, the optimal use of data and information will improve the effectiveness of an organisation.  This article explains why identifying and co-ordinating the areas, people and technologies responsible for keeping the lifeblood of your organisation in good health is key to effective information governance (IG).

IG provides a unified strategic framework for the control, security, optimisation and effective use of information.  It is an essential part of good corporate governance, assisting organisations to maximise the value of information while minimising risks and costs by providing a mechanism to align policies and processes, people and technologies across an organisation.

The IG diagram below shows different areas and activities within an organisation responsible for the security, control, optimisation and risk management of data and information.  There may be more or fewer areas according to the type and size of the organisation.  The key to implementing an effective information governance framework is to first identify all the areas and professionals responsible to ensure the areas are aligned and can collaborate to deliver on organisational objectives.  With this in place, policies and processes also need to be aligned across the organisation in accordance with overarching organisational strategic goals.

With a strong IG framework in place, IG projects can then be prioritised within the purview of the senior executive with overall responsibility for information governance and/or the IG steering committee with the involvement of appropriate cross-function professionals.  Projects involving data and technology are planned and executed addressing the needs of business users, technology and cybersecurity, legal/privacy regulatory compliance, lifecycle management, records compliance and long-term preservation.

The InfoGovANZ Elements of Information Governance diagram depicts the alignment and coordination required between different IG areas and activities. This visualisation, which can be adjusted as necessary to align with the areas within your organisation, provides a clearer understanding of how an overarching IG Framework enables alignment of policies, procedures, people and technologies.

Information Governance Framework

Figure: The Elements of Information Governance diagram

 

Each area of IG is like an organ in the body of the organisation – each with its own purpose, and together they combine to form the life-supporting systems which carry out the organisation’s vital functions.  Just like the body, the functions of these essential systems overlap, interact and rely on each other to support life. Understanding the interrelationships and dependencies of the system as a whole:

  • Provides a useful framework for implementing a cohesive and comprehensive IG framework;
  • Helps to prioritise and guide projects that link to information governance;
  • Makes it easy to recognise and adapt to technology trends and best practice IG;
  • Ensures organisations have a strong IG framework that protects them, their employees and the customers they serve.

Often organisations focus on only a few elements or areas of the information quagmire.  Enhancing the value of data being optimised through the use of technology and data analytics to deliver value and returns directly to the bottom line is a common driver due to the financial benefits.  Investment in enhanced cybersecurity to prevent cyberattacks and data breaches has also increased over recent years due to mandatory notification regulatory requirements and more visible cyber-threats.

However, more than a third of data breaches are caused by human error rather than a technology-based exploit. When phishing attacks are included, about half of data breaches can be attributed to human error.  These breaches are entirely preventable but remain a significant risk to organisations.   Privacy-by-design, security-by-design and privacy impact assessments (PIAs) are core to the best practice of managing personal information.  Effective IG can assist organisations to ensure that personal information breach risks, which can be life threatening to an organisation, as a hemorrhage is to us, are identified and resolved.

Getting to Know the Information Governance Elements

The Elements of Information Governance diagram is a tool for organisations to use when establishing information governance for the first time or to ensure all aspects of information governance have been included in an existing information governance framework.

Information Governance (IG) is front and center and is represented by a digital pine cone, ‘the third-eye’.[i]  In IG, the pine cone analogy is fitting as it represents the center or navigation starting point of all activities. It demonstrates how a robust IG framework provides the structure and mechanism to enable insights and effective guidance and control.

Six Icons surround the IG centre – here’s what they represent in relation to information governance:

The People icon highlights effective IG is impossible without the involvement of the right people. It is situated in the upper left position of the IG centre next to elements that demonstrate the important role people play in an organisation, both internally and externally. Internally, the people icon represents the collaboration across organisational silos and the effective innovation with security by design and privacy by design, and importantly the protection and security of information by employees.  Externally, people in an organisation must protect consumers’ and citizens’ privacy by ensuring compliance with privacy regulations, act socially responsible and adhere to the ethical use of data.

The Lightbulb icon is located above the IG centre just under the top line connection of elements. It denotes new, innovative and impactful activities and technologies.

The Dollar Sign icon is in the upper right position from the IG centre, parallel to the people icon. It is close to those elements that identify the value from data optimisation (i.e., data analytics), as well as controlling and minimising costs by reducing risks.

The Cog/Gear icon is at the lower right of the IG centre near those elements that are largely procedural functions. This icon represents the internal workings and processes of the organisation, meaning the data and information being used across the organisation and the need for collaboration and alignment with strategic organisational goals.

The House icon is directly under the IG centre and atop the bottom line connection of elements. The house icon serves as a reminder that robust IG requires a top-down strategic approach built on a strong foundation of clear policies and procedures.

The Lock icon is in the lower left position of the IG centre, parallel to the cog/gear icon. Its protective function symbolises the importance of security of data and information.

The Elements link to the icons and the IG centre in a continuous chain. All of the elements must combine and connect to provide an effective information governance system. This requires the interaction and collaboration of relevant professionals in order for an organisation to have a complete information governance framework.

The elements on the top and middle rows to the left reflect people-focused activities, while those to the right are data-focused activities. The elements on the bottom row are information-focused and reflect foundation services.

 

Top Row:

Cybersecurity & Info Security – cybersecurity focuses on the perimeter, while information security secures the information within the system

AI & Ethics – implementing artificial intelligence through an ethical-based process based on a data impact assessment

Data Analytics & Infonomics – deriving the value of information from data analytics

Business Intelligence – the hardware, software, staffing and strategy used to glean intelligence from data

 

Middle Row:

Legal & eDiscovery – the identification and retrieval of documents for litigation and ensuring such documents can be readily identified and produced to reduce costs; incorporating the use of AI in eDiscovery

Privacy & Data Protection – privacy by design and robust privacy policies as part of the overall governance framework

Data Governance – controlling data at the data level and ensuring integrity through appropriate systems and processes

Risk & Compliance – a coordinated strategy for managing the organisation’s risk and corporate compliance with regard to regulatory requirements

 

Bottom Row:

Content Services – preserving and protecting content; information access, sharing and collaboration

Information & Records Management – how information is being managed and the activities to systematically control the creation, distribution, use, maintenance and disposition of information

Information Lifecycle Management – best practices for managing data and information throughout its lifecycle

Archiving & Long-term Digital Preservation – storing information in ways that can be readily retrieved many years into the future

Taken together, all the icons and elements represent the different interlocking areas and activities that deal with data and information in organisations.

A systematic approach to information governance begins with an Information Governance Framework that encompasses policies, procedures, people and technology. This includes:

  • Identifying all the areas and technologies within your organisation – that is, the IG Elements in your organisation;
  • Putting strategic objectives and priorities in place for managing, controlling and securing the data and information your organisation collects, uses and stores;
  • Implementing measures to protect the organisation’s intellectual property;
  • Complying with regulatory and legal obligations including record keeping obligations and, in particular changing privacy regulations;
  • Optimising the value of information to support the organisation’s objectives while managing risks and costs, such as those associated with a data breach and eDiscovery.

The key to ensuring the effectiveness of information governance is top-down board and senior executive leadership that supports robust policies and procedures that are aligned across the organisation and with overarching organisational goals, which deliver value to the organisation.  Top-down board leadership setting the overall IG framework is the ‘brain’, leading a data driven organisation with an ethical and privacy culture.

The senior executive with overall responsibility for information governance and/or the IG steering committee are the organisational ‘third-eye’.  They set IG project priorities, provide guidance and encourage cross-functional collaboration, oversee implementation and review outcomes.   Policies, processes, technologies and people all work together to enable efficient data flow including optimisation, regulatory compliance and appropriate data and information disposal.  When information is effectively governed with data optimised and associated risks and costs minimised, then the overall performance of the business will increase – delivering the benefits of a healthy data and information circulatory system.

 

Susan Bennett, Executive Director, Information Governance ANZ

Principal, Sibenco Legal & Advisory

 

[i]          Throughout history, the pine cone has been a sacred symbol of human enlightenment, viewed as an eye of higher consciousness – the ancient symbol for the third eye – and non-dualistic thinking. Many believe the third eye is at the geometric center of the brain and a symbolic representation of navigation.

by

Information governance reflections on 2020 and insights for 2021

Information governance, data protection and security, privacy, cybersecurity and artificial intelligence (AI) have all become critical topics for boards and government bodies to consider. Historically, the issues tended to be dealt with under either ‘IT’ issues or records and information compliance issues.  In recent years, the importance of cybersecurity, AI and data analytics together with changing privacy regulations have brought new governance challenges to the forefront of the minds of directors.

Top issues for Directors

There are common themes in the surveys of top issues confronting Boards of Directors, which have been carried out in recent years.  These include the opportunities and challenges arising from technology innovation and disruption, the overriding concern of cybersecurity and data breach, which is highlighting the importance of information security, and regulatory compliance including changing privacy regulations.

The Akin Gump Lawyers group in the USA report an annual “Top 10 topics for Directors” each year, which is published in the Harvard Law School Forum on Corporate Governance and Financial Regulation website.[1] The 2020 report, that came out in January 2020, placed cybersecurity at number 7 (the 2019 report had it as the number 8 issue). Similarly the EY Centre for Board Matters ranked “prioritizing cybersecurity and data privacy” as their number 4 key issue for boards.[2]

To add further evidence to the importance of this topic, Diligent, in its  2020 Foresight: year ahead in corporate governance report sets out that, “[t]echnology, processes and insights are the foundation  of modern governance, enabling boards to effectively navigate this changing landscape.”

The top law firm, King & Wood Mallesons, in its 2016 Directions report had listed digital disruption at number 3. By the release of its 2019 Directions: navigating a new order[3] report, the issue of managing IT and cybersecurity had moved to the number 2 spot as a priority for boards.  Adams wrote “The Top 2018 governance concerns”[4] with the acronym SEMTEX[5], of which the “T” was for technology and still is valid for all directors in 2020.

In 2019, the Governance Institute of Australia released its own paper, entitled “The Future of the Governance Professional”[6] and had three major themes – technological disruption was the third highest priority for governance changes into the future (2025). Over 75% of the respondents agreed that the issue was vital or very important due to “the use of new technology and its effects on the workforce, and also because the rate of change and implementation of these technologies is accelerating”.[7] The other themes of complexity and regulatory change are top of mind for many directors and governance professionals. However, it is the impact of technological disruption that is having far-reaching consequences.  This is seen by the growing use of AI and its earlier incarnation, machine learning, in business to change the role of the governance and compliance professional.  There is a role for humans and that is perceived to oversee machines and to make qualitative judgments.

There is acceptance that machines will be better than humans at some tasks, including taking minutes, gathering vast amounts of information and highlighting what is relevant for directors. But there will still be a need for emotional intelligence and creativity, which humans bring to the table (with bias and other unconscious attitudes). As well as AI, the developments in real-time information flows, big data analysis, increased automation and improved regtech with blockchain and voice recognition to all affect the governance role. The 2019 report notes that 39% of respondents thought it would make the governance professional role more interesting and high level, as well as 25% thought it would improve the quality of information that the board receives in its papers.

It is worth hypothesising whether the devastating impact on CBA for the AUSTRAC action for money-laundering in 2018[8] and the Westpac litigation for money-laundering and facilitating child-exploitation,[9] would have been avoided if the board had better digital disruption skills and knowledge. Hindsight is a wonderful attribute, but boards need to balance the fine detail with enough information to make informed decisions and to ask the right questions of management.

Corporate governance in the digital economy

Previously in 2018, the authors examined the link between corporate governance and the digital economy in Governance Directions.[10] The definition of information governance has generally been accepted as “the activities and technologies that organisations employ to maximise the value of information while minimising associated risks and costs”. This definition has been affirmed by 90% of the Information Governance ANZ (InfoGovANZ) survey report, published in 2019.[11] This survey built on the 2017 edition[12] and reinforced that information governance is an umbrella concept that describes all information management activities.

Over half of all respondents said that their organisations, both private and government, had information governance framework with policies and procedures in place.

Traditional governance processes are lagging behind digital innovations and so no longer meet the expectations of governments, regulators, owners and employees. There is a distinction between governance practices in the digital age and a framework for contemporary governance.

Information governance core to good business management

The 2019 InfoGovANZ survey report had 340 industry participants and highlights the importance of an information governance framework. Implementing such a framework was seen by 46% of industry professionals as the most important issue. The survey derived that the three main drivers for information governance projects were:

  • Good business management practices – 75% respondents in 2019, which reflected a 16% increase from the 2017 survey;
  • External regulatory, compliance or legal obligations – 75% respondents in 2019, which was 5% lower than the 2017 survey; and
  • Internal technology restructuring or transition – 55% respondents in 2019, which was a massive 21% increase from the 2017 survey.

Three main drivers for information governance projects graph

Over half of all respondents said that their organisations, both private and government, had information governance framework with policies and procedures in place.  74% had identified specific information governance projects to be underway or planned for 2020.

Information governance programs in organisations are now maturing, 54% of respondents indicated their programs were intermediate of advanced.

Impact of Privacy Regulations

42% of the respondents stated that recent changes to privacy regulations had been a driver for their current projects in information governance. This could be identified by two significant changes that occurred in 2018.  The first was the European Union’s General Data Protection Regulation (GDPR), which came into force on 25 May 2018, imposing a significant change to privacy laws in Europe. Organisation that fail to comply with GDPR requirements (including non-EU country organisations) can face fines of up to 20 million Euros or 4% of global turnover. The other factor in Australia, was the implementation of the Notifiable Data Breaches Scheme (NDB Scheme) that came into force on 22 February 2018. The NDB Scheme requires organisations to notify the Australian Information Commissioner and individuals whose personal information is involved in a data breach that is likely to result in serious harm.

An interesting aspect is that those industry professionals that worked in the private sector (55%) were more driven by these changes to privacy laws than the government employed professionals (36%).  This may be due to a greater number of corporates handing personal information of EU data subjects and dealing with cross-border transfers of personal data as a result of the GDPR.

Information Governance Framework

Implementing an information governance framework was identified as the key area of importance by 46% of respondents.  Compliance with privacy regulations, data loss prevention and updating of policies and procedures rounded out the top four key areas of importance – 16.2% were driven by compliance with privacy regulations, 10.4% were driven by data loss prevention and 9% for updating policies and procedures.

Most participants believed that a chief information governance officer (CIGO) was essential to the information governance frameworks success within an organisation. The words “information governance” or “data governance” only appeared in about 12% or 11% respectively title for those with the accountability for the organisation.  But in 2017 survey report, the term information governance was only in 5% of job titles. More significantly, 41% of respondents who were accountable for information governance were part of the senior executive (C-Suite) team within the organisation.

Information Governance Maturity

Information governance programs in organisations appear to be maturing with 54% indicating their programs were intermediate or advanced.

Responses indicated a fairly even split between proactive and reactive approaches to information governance.  This was most in line with the previous survey results, however, participants appeared to have better clarity of their programs, with only 7% indicating they didn’t know compared to 16% in the previous survey.

This data can be compared to the USA, where ARMA International has published survey results in the Information Governance Maturity Index Report – 2020.[13] This survey had over 1,200 responses, which were subject to a gateway question (of qualifications and skills) and checks for duplications and incomplete answers to establish 912 full responses. The scale applied for all the domains were from level 1 (a non-existent framework) to level 5 (transformational). The middle level 3 was stated to be essential (which equates to a basic requirement in information governance to do the job).

Across all domains measured, including infrastructures, supports, processes, capabilities and a steering committee, 66.2% stated that their organisations were essential (level 3) or higher.  Within particular domains or attributes, ARMA found that having a Steering Committee, with information governance leadership, and links to information management and business unit applications, scored a maturity index of 62.7%. In the area of Authorities, meaning authoritative frameworks, privacy requirements and best practices, 72.1% scored essential level 3 or higher.  Finally for the attribute Supports, including change management and project management, the maturity score was 67.7% for level 3 and above.  The ARMA report highlights that a clear majority of respondents reported that their organisations have the essentials in place or better with respect to each of the domains and for their overall information governance programs.  All this data indicates the growing maturity of information governance within organisations and allows information governance professionals to assess how their organisation is tracking against the survey results of the InfoGovANZ and ARMA reports.

Alignment key to information governance

The key to good information governance is to align data and information governance with overall strategic objectives.  This requires organisations to identify and coordinate different IG areas and activities and activities.  The Elements of Information Governance diagram illustrates the various areas, which can be adjusted as necessary, to provide a clearer understanding of how the overarching information governance framework enables alignment of policies, procedures, people and technologies.[14]

The elements link to the icons and the IG centre in a continuous chain. All of the elements must combine and connect to provide an effective information governance system.  The elements on the top and middle rows to the left reflect people-focused activities, while those to the right are data-focused activities. The elements on the bottom row are information-focused and reflect foundation services.

The icons surrounding the IG centre represent information governance and the elements to be aligned:

  • innovation and technology initiatives (lightbulb);
  • optimising the value of data and minimising costs by reducing risk (dollar sign);
  • technologies, systems and people across organisational silos (cog/gear);
  • data and information security (lock);
  • people skills and collaborative culture with supporting structures (the information governance committee or equivalent) across organisational silos to meet information governance and organisational objectives, and an external focus on customers and citizens and the handling of their personal information and transparency (people);
  • policies and procedures (house).

The house icon services as a reminder that robust information governance requires a top-down strategic approach building on a strong foundation of clear policies and procedures.  The information governance framework enables Directors and senior executives to achieve organisational objectives and to optimise the value of data and information while minimising risks and costs by:

  • identifying all the areas and technologies– that is, the information governance elements in your organisation;
  • putting strategic objectives and priorities in place for managing, controlling and securing the data and information your organisation collects, uses and stores;
  • optimising the opportunities of new technologies and innovations to harness value and insights from data;
  • implementing appropriate risk management to minimise costs, such as those associated with a data breach and eDiscovery in litigation and legal proceedings.
  • implementing measures to protect the organisation’s intellectual property;
  • complying with regulatory and legal obligations including, record keeping obligations and, in particular, changing privacy regulations.

Conclusion

The key to good corporate governance is a strong information governance framework aligned to achieve organisational objectives with top-down leadership.   Effective information governance is when policies, technologies and people all align and work together to enable data and information to be optimised and regulatory compliance of privacy, record keeping and other information regulations to increase the overall performance of the organisation.  The key issues for directors confronting both opportunities from technology innovations, AI and data analytics and challenges arising from cybersecurity, data breach, privacy and other regulatory drivers can be met with strong information governance.

Authors

Professor Michael A Adams FGIA(Life) FCIS, Professor of Corporate Law & Governance, School of Law, University of New England and
Susan Bennett, FGIA, CIPP/E, Principal, Sibenco Legal & Advisory, Co-founder and Director of Information Governance ANZ

This article was published in Governance Directions, May 2020, Vol 72, Issue 4.

References

[1] Akin Gump, Top 10 Topics for Directors in 2020 – https://www.akingump.com/en/experience/practices/corporate/ag-deal-diary/top-10-topics-for-directors-in-2020-executive-summary.html

[2] EY Center for Board Matters, Eight Priorities for Boards in 2020 – Harvard Law School Forum on Corporate Governance : https://corpgov.law.harvard.edu/2020/01/14/eight-priorities-for-boards-in-2020/

[3] King & Wood Mallesons, Directions 2019: Navigating a new order – https://www.kwm.com/en/au/knowledge/hubs/directions-non-executive-directors

[4] Adams, M; “Top 2018 governance concerns: #SEMTEX” Governance Directions 2018 September

[5] SEMTEX stands for Strategy; Evaluation of risks; Multi-generational; Technology; Environment/CSR; toxic.

[6] GIA, The Future of the governance professional, August 2019 – https://www.governanceinstitute.com.au/media/884166/govinst_the-future-of-the-governance-professional_august-2019.pdf

[7] Op cit fn 8 at page 9

[8] AUSTRAC v CBA [2018] FCA 930 http://www.austlii.edu.au/cgi-bin/viewdoc/au/cases/cth/FCA//2018/930.html and AUSTRAC media release – https://www.austrac.gov.au/austrac-and-cba-agree-700m-penalty

[9] AUSTRAC media release https://www.austrac.gov.au/about-us/media-release/civil-penalty-orders-against-westpac

[10] Adams, M & Bennett, S, 2018, “Corporate governance in the digital economy: The critical importance of information governance” 70(10 Governance Directions

[11] Information Governance ANZ, IG Industry Survey, July 2019 https://www.infogovanz.com/wp-content/uploads/2020/01/IGANZ2019ReportFinal.pdf

[12] Information Governance ANZ, IG Industry Survey, August 2017 https://www.infogovanz.com/wp-content/uploads/2020/01/IGANZ_Industry_Survey_AUGUST_2017.pdf

[13] ARMA International, Information Governance Maturity Index Report 2020 – https://www.arma.org/page/ig-report

[14] Information Governance ANZ – https://www.infogovanz.com/information-governance/information-governance-optimising-the-lifeblood-of-organisations/

by

As we rapidly move toward a technology-driven, globally interconnected world, the exponential growth in data collected by business and government enables significant value to be derived from this resource. In December 2015, the Australian Government released its Australian Government Public Data Policy Statement as part of the National Innovation and Science Agenda, recognising data as ‘a strategic national resource that holds considerable value for growing the economy, improving service delivery and transforming policy outcomes’.

While there is the potential to derive enormous value from data, there is a fundamental requirement that data be secured, meaning both government and business must protect citizens’ and consumers’ personal information. Key to achieving the benefits of data optimisation and mitigating the inherent risks is governance. Good governance enables organisations to control data by securing, protecting, managing and optimising the value of data.

Digital Continuity 2020 Policy

Supporting the Australian Government’s digital transformation is the Digital Continuity Policy 2020, which applies to all Australian government agencies. The keystone of the policy is Principle 1, which states that information is valued. It requires by 2020 that ‘agencies will manage their information as an asset, ensuring that it is created, stored and managed for as long as it is required, taking into account business requirements and other needs and risks.’ This principle recognises that:

‘Information is a key strategic asset and economic resource of the Commonwealth and is as important as budget, property and equipment. Digital information management enables efficiencies in service delivery, increases opportunities for information sharing and can improve business decisions and accountability.’

Data Delivering Value

The following illustration shows that data or data sets from which accurate information and insights can be drawn is of high value because it supports and results in decisions that deliver on strategic goals.

 

Data Governance

To achieve the potential gains from the exponential volumes of data being created, collected and stored, it is essential to collect and manage data in accordance with appropriate policies and procedures. Doing so ensures the data is properly controlled, as well as accurate and reliable so that insights and information obtained are also accurate and reliable. Therefore, data governance is the way in which data is controlled, managed and optimised. It comprises policies, procedures, and the mechanisms by which these are coordinated within organisations to control and manage data. Importantly, the policies and procedures need to include accountability mechanisms.

Data governance requires clear policies and procedures, including:

  • Data policies;
  • Data standards;
  • Data roles and responsibilities; and
  • Accountability

Data that is no longer required to be retained for record-keeping obligations or business purposes – referred to as redundant, outdated or trivial (ROT) data – should be disposed of in accordance with accountable archiving and retention policies and disposal schedules.

Cybersecurity and Protecting Personal Information

Data needs to be secured and personal information protected. As David Fricker, Director-General of the National Archives of Australia, stated earlier this year in the Australian Strategic Policy Institute (ASPI) report, Identity of a Nation:

And more often than not, the intent that motivates a cyberattack is access to data. It’s the data that needs to be protected from exfiltration, manipulation, or destruction because it’s the data that holds information critical to Australia’s agency and success as a sovereign nation.

Therefore, cybersecurity and information technology policies and processes, together with privacy policies and processes, need to align and coordinate with the overall management of data. This includes privacy impact assessments (see Australian Government Agencies Privacy Code) and embedding privacy by design and ethics by design in governance policies and data initiatives.

Australian government agencies are required to comply with the Australian Government Agencies Privacy Code, which began on 1 July 2018. As the Office of the Australian Information Commissioner states, the Code ‘symbolises thecommitment of Australian government agencies to the protection of privacy, and helps build public trust and confidence in personal information handling practices and new uses of data proposed by agencies.’

AI Data Ethics and Governance

The UK Information Commissioner’s Officer report, Big data, artificial intelligence, machine learning and data protection, describes the connection between big data, artificial intelligence (AI) and machine learning as follows: ‘AI can be seen as a key to unlocking the value of big data; and machine learning is one of the technical mechanisms that underpins and facilitates AI. The combination of all three concepts can be called ‘big data analytics.’In the context of the significant value from AI and its potential for good (e.g., delivering improved services to citizens and consumers) and the risks (e.g., privacy breaches through reidentification of personal information, lack of algorithmic transparency or algorithmic bias and/or discrimination, increased cyber risks arising from the size and value of the data), there have been a number of papers and guidelines issued for ethics in AI. This includes, The Ethics Guidelines for Trustworthy Artificial Intelligence (AI), published in April 2019 and prepared by the High-Level Expert Group on Artificial Intelligence, which is an independent expert group set up by the European Commission; and Artificial Intelligence: Australia’s Ethics Framework, a discussion paper developed by Australia’s leading data innovation group, CSIRO’s Data 61, and released in April 2019 to publicize the government’s approach to AI ethics in Australia.In May 2019, the Organisation for Economic Cooperation and Development (OECD) adopted its Principles on Artificial Intelligence, the first international standards agreed by governments for the responsible stewardship of trustworthy AI. The standards include recommendations for public policy and principles to be applied to AI developments around the world. The principles ‘promote AI that is innovative and trustworthy and that respects human rights and democratic values’.

A key issue in considering the role of ethics in AI is the development and application of an ethics assessment as part of or in addition to the aforementioned privacy impact assessment requirement. The challenge for organisations across government and business is grappling with the myriad of data opportunities, new and rapidly changing technologies, and data risks. This can be addressed by implementing a unified strategic governance framework that is cohesive and features strong accountability mechanisms. Top-down leadership and collaboration across organisational silos and professional disciplines responsible for the different facts of information are key to successful implementation. This includes: information technology and cybersecurity, data/digital strategy, legal, privacy, records and information, innovation and other stakeholder areas within an organisation.

Information Governance

As part of the Digital Continuity 2020 Policy, Australian Government agencies are required to implement an information governance framework to manage information assets across the entire organisation to support its business outcomes. It sets out the steps involved in building a robust framework to ensure that the overall legal, regulatory and business contexts, within which information assets are created, are used and managed. This enables coordination, planning and leadership throughout the whole agency. The importance of governance and a whole-of-government approach is highlighted in the ASPI’s Identity of a Nation report as being necessary for ensuring robust and reliable management of national identify data.

Benefits of Good Governance

The benefits of good data governance include improved accuracy, reliability and integrity of data, and accountability.

The benefits of good information governance include a holistic approach for data and information throughout the organisation to improve accountability and reduce risk.

Good governance means a unified strategic approach that meets the organisation’s strategic objectives and, in the case of a government agency, the whole-of-government objectives. It includes cohesive policies, procedures and frameworks with top-down leadership, and well-implemented accountability mechanisms.

Good data and information governance requires effective implementation of policies and processes and robust frameworks, together with fit for purpose technologies and people equipped with the necessary data and information capabilities for the work they perform. All in all, good data and information governance enables whole-of-government innovation and provides value for growing the economy, improving service delivery and transforming policy outcomes for all Australians.

Susan Bennett LLM (Hons), MBA, FGIA, CIPP/E

Principal, Sibenco Legal & Advisory

Co-founder & Director, Information Governance ANZ

by

Ethics_FrameworkAs the law lags behind in rapid technology innovations, particularly in big data, artificial intelligence (AI), machine-learning and the Internet of Things (IoT), there is increasing awareness and discussion about the need for an ethical based approach to data analytics.

This article considers why an ethical based approach can build trust and transparency with consumers and citizens, and why it should be part of good information governance, as a means of maximising the value of information derived from data analytics while minimising risks.

Big data

Big data describes the large volumes of data held by corporations and governments. Using  analytics technology tools, insights and knowledge can be derived from the data. These insights can then be used to make informed decisions, for example, in the development of new or improved products or services providing a competitive advantage and ultimately delivering results to the bottom line.

In other words, there is big value in the information that can be extracted from data being collected and stored by both the corporate and government sectors.  The Australian Government as part of the National Innovation and Science Agenda recognises data as ‘a strategic national resource that holds considerable value for growing the economy, improving service delivery and transforming policy outcomes’.[1]

IoT, AI and big data analytics

A large contributor to the exponential increase in data held by organisations is the growth of the Internet of Things (IoT).  Cisco has estimated that by 2021, the total volume of data generated by the IoT will reach 3.3 ZB per year – ‘the gigabyte equivalent of all movies ever made will cross global IP networks every minute’ – and, global IP networks will support more than 27 billion devices connected to the internet (up from 16.3 billion in 2015).[2]

The IoT is the interconnection of devices to the internet and involves the transmission of data between the internet and those devices – e.g. smart devices in factories, healthcare and smart buildings.  Increasingly, it involves the connection of devices, i.e. ‘things’ and people in various aspects of their lives – e.g. through fitness trackers, medical devices and Google Maps.   The IoT enables the seamless integration of our devices with the internet, and with it our data.

The UK Information Commissioner’s Officer report, Big data, artificial intelligence, machine learning and data protection, (ICO Report) describes the connection between big data, AI and machine learning as follows:  ‘AI can be seen as a key to unlocking the value of big data; and machine learning is one of the technical mechanisms that underpins and facilitates AI. The combination of all three concepts can be called ‘big data analytics’.[3]

Privacy challenges for big data

A key concern about the IoT and big data are the challenges it presents to maintaining privacy of personal information, particularly when analytics and profiling are involved.  This is because the collection of personal data may involve not only data that has been consciously provided by individuals, but also personal data that is recorded automatically (e.g. tracking of online cookies), or derived from other data or inferred through data analytics.

A comprehensive list of privacy challenges in big data were identified in an International Working Group on Data Protection in Telecommunications report, Big Data and Privacy: Privacy principles under pressure in the age of Big Data analytics, (Big Data and Privacy Report) follows:[4]

  • Re-use of data for new purposes – that organisations which use collected personal data as a basis for predictive analysis must ensure that the analysis is compatible with the original purpose for collecting the data.
  • Data maximisation where the value of data is linked to potential future uses -this can challenge the privacy principle that requires the processing of data must be adequate, relevant and not excessive for the purposes that have been defined and stated at the time of collection.
  • Lack of transparency – lack of openness on how data is compiled and used may lead to consumers to decisions they don’t understand or have no control over – for example, in relation the use of data by data brokers and analysis companies.
  • Compilation of data may uncover sensitive information – that a compilation of bits and pieces of information, which may not be sensitive themselves, may generate a sensitive result – such as being able to predict a person’s health.
  • Risk of re-identification – through compilation of data from several sources, there is a risk that individuals may become identifiable from data sets which appear to be anonymous at first sight.
  • Security implications – the challenges of the additional infrastructure layers needed to process big data and encryption of large data sets; data breaches may have more severe consequences when large data sets are involved; and organisations that acquire and maintain large sets of personal data must be responsible stewards of that information.
  • Incorrect data – the risk that decisions are based on inaccurate information, particularly when information is obtained from online sources and not official registries – for example, credit agencies.
  • Power imbalance – between those that gather the data (large organisations and states) and individuals.
  • Determinism and discrimination – because algorithms are not neutral, but reflect choices, among others, about data, connections, inferences, interpretations, and thresholds for inclusion that advances a specific purpose. Big Data may consolidate existing prejudices and stereotyping, as well as reinforce social exclusion and stratification.
  • Chilling effect – this is the effect that people will restrict and limit their behaviour if they know or think that they might be surveilled.
  • Echo chambers – which may result from personalised advertising, search results and news items so that people will only be exposed to content which confirms their own attitudes and values.

Big Data – Transparency & Trust

The lack of transparency, as identified in the above Big Data and Privacy Report, in addition to trust, are key issues for consumers when it comes to providing personal information to organisations and can provide an important competitive differentiator. The ICO Report refers to ICO-commissioned research that shows ‘the more people trust businesses with their personal data, the more appealing they find new product offers such as smart thermostats and telematics devices in cars’.

A Harvard Business Review article, Customer Data; Designing for Transparency and Trust, referred to numerous studies having ‘found that transparency about the use and protection of consumers’ data reinforces trust’.[5] To assess this affect, the authors carried out their own international survey to understand consumers’ attitudes about data and what they expected in return for providing it.  The authors concluded:[6]

‘A firm that is considered untrustworthy will find it difficult or impossible to collect certain types of data, regardless of the value offered in exchange. Highly trusted firms, on the other hand, may be able to collect it simply by asking, because customers are satisfied with past benefits received and confident the company will guard their data. In practical terms, this means that if two firms offer the same value in exchange for certain data, the firm with the higher trust will find customers more willing to share.’

The concerns around use of personal information is supported by the Office of the Australian Information Commission’s (OAIC) longitudinal surveys into Community Attitudes to Privacy, and the Consumer Policy Research Centre’s work, which reveal Australians are increasingly aware and concerned about the use of their personal information.  The former Australian Privacy Commissioner, Timothy Pilgrim stated in 2015:[7]

‘The majority of Australians – 60 percent – have decided not to deal with an organisation due to concerns about how their personal information will be used. And significantly, 97 percent of Australians don’t like their personal information to be used for a secondary purpose. This is critical to big data. Because big data projects will often involve secondary use of data.’

The Australian Community Attitudes to Privacy Survey 2017 revealed that 79% of respondents were uncomfortable with businesses sharing their personal information with other businesses, 49% were uncomfortable with government sharing their personal information with other government agencies, however, that number decreased to 40% where it was disclosed that the information was being used for research or policy-making purposes.[8] The Consumer Policy Research Centre survey in 2018, revealed that at least two-thirds of respondents indicated they were uncomfortable with most types of information being shared with third parties; and 95% of respondents wanted businesses to give options to opt out of certain types of information collected about them, how it can be used and/or what can be shared with others.[9]

Apart from the legal requirements to collect data in accordance with applicable privacy legislation, the Australian survey results and research referred to above reinforces the importance of explaining how personal information will be used and the purpose of any secondary use at the time data is being collected. In May 2019, the Consumer Policy Research Centre published its report ‘A Day in the Life of Data’ stating that, ‘opaque business practices and undisclosed data sharing arrangements do not encourage trust.’[10]  It identifies that, transparency and implementing minimum protection standards will be key to building trust, by supporting informed consent and enabling consumers to identify the benefits for themselves as well as broader societal benefits.[11]

How can big data be used in ways that respect the privacy of individuals?

An approach aiming to build trust and based on concepts such as fairness and respect, go beyond legal compliance and support an ethical based approach.  Ethical considerations in relation to processing of personal information in big data are currently very topical and have been the subject of increasing global discussion and development.

The Council of Europe’s Consultative Committee Convention 108 in January 2017 issued ‘Guidelines on the Protection of Individuals with regard to processing of personal data in a world of Big Data’.[12]  The first principle of the Guidelines is the ethical and socially aware use of data.  It stipulates that in the processing of personal data, controllers should adequately take into account the likely impact and the broader ethical and social implications, and that it should not be in conflict with the ethical values commonly accepted in the relevant community or communities and should not prejudice societal interests, values and norms, including the protection of human rights.

This year there have been a number of papers and guidelines issued for ethics in AI globally by governments and organisations including; ‘The Ethics Guidelines for Trustworthy Artificial Intelligence (AI)’, published in April 2019 prepared by the High-Level Expert Group on Artificial Intelligence, which is an independent expert group set up by the European Commission[13]; and ‘Artificial Intelligence: Australia’s Ethics Framework’, which is a discussion paper developed by CSIRO’s Data 61 released in April 2019 to inform the Government’s approach to AI ethics in Australia.[14] In May 2019, the OECD adopted its Principles on Artificial Intelligence, the first international standards agreed by governments for the responsible stewardship of trustworthy AI, which include recommendations for public policy and Principles to be applied to AI developments around the world.[15]  The Principles ‘promote AI that is innovative and trustworthy and that respects human rights and democratic values’.[16]

In the United States, The Information Accountability Foundation (IAF) has been working on a Big Data Ethics Initiative since 2014. The IAF’s goal is ‘to achieve effective information governance systems to facilitate information-driven innovation while protecting individuals’ rights to privacy and autonomy.’[17]  The IAF sets out the ethical data use principles in the paper, ‘Decisioning Process, Risk-Benefits Analysis Tool for Data Intensive Initiatives – Achieving Legal, Fair and Just Use of Data & Appropriate Individual Engagement’.[18] The ethical principles articulated are that data use should be Beneficial, Fair, Respectful and Just, Transparent and Autonomy Protecting and performed with appropriate Accountability with a Redress Provision.  These are core ethical principles, which are also found in other ethics guidelines being published.  The considerations for each of these ethical principles as proposed by the IAF are set out in the table below.

Table_Framework


Ethical framework considerations

The need for an ethical based approach and the formality of the process will depend on the context, such as the size of the data set or sets and the amount of personal data to be processed within them.  Whether a formal ethical framework or an ethics committee should be established will depend on the type and recurrence of data analytics being carried out and will vary across industries as well as government departments.

A comprehensive approach would include an internal ethics committee for the collection of data and data analytics.  The ICO Report points out that ‘a large organisation may have its own board of ethics, which could ensure that its ethical principles are applied, and could make assessments of difficult issues such as the balance between legitimate interests and privacy rights’.[19] Universities have a long history of research ethics committees and there are examples of medical and health organisations with an ethics based approach to the collection of data and data analytics.  For example, researchers at the Centre for Epidemiology and Biostatistics at the Melbourne School of Population and Global Health at the University of Melbourne developed the Guidelines for the Ethical Use of Digital Data in Human Research.[20] 

In the EU, the ‘Guidelines on the protection of individuals with regard to processing of personal data in a world of Big Data’ recommend the use of ethics committees where it is assessed there is likely to be a high impact of the use of big data on ethical values, as a means of identifying specific ethical values to be safeguarded in the use of data.  The Guidelines at 1.3 provide that the ‘ethics committee should be an independent body composed by members selected for their competence, experience and professional qualities and performing their duties impartially and objectively.’[21]

As the ICO Report points out an important issue ‘is the organisational relationship between the ethics board and employees with responsibilities for data and analytics, such as the chief data officer and the data protection officer’.[22]   This highlights the importance of an overarching information governance framework with appropriate formal structures including robust policies and organisational structural mechanisms to ensure appropriate leadership, and a multidisciplinary approach.   To both maximise the opportunities and value from data and to minimise the risks, a collaborative approach supported by formal mechanisms to facilitate effective working groups is essential.  This will involve collaboration through working groups overseen by a steering group (for large organisations) between those who manage the data, those responsible for its protection – that is, the chief privacy officer and legal team, those performing the data analytics and those using the information obtained to ultimately derive value from it.

Information Governance

One of the key challenges facing organisations in the information age is the ability to set and implement an organisational strategic approach to information governance to effectively maximise the value of information through data analytics while minimising its risks. These include the costs arising from:

  • Data breach, particularly in respect of personal information;
  • Other breaches of privacy or other applicable legislation;
  • Compliance with mandatory data breach notification requirements;
  • Responding to regulators;
  • Responding to and dealing with adverse publicity arising from perceived misuse of consumer information;
  • Costs arising from an actual or perceived loss of trust by consumers and negative impacts, such as, ongoing damage to reputation and/or a negative impact to the bottom line.

Information governance, which includes governance of data and information across organisational silos, and the strategic management of data analytics initiatives need to be aligned with overall strategic objectives led from the top down, that is it requires Board and C-suite leadership. Good information governance enables organisations to meet their regulatory obligations in respect of privacy laws and record retention and disposal requirements, as well as achieving an effective ethical based approach and self-regulation in accordance with overall organisational strategic objectives.   An ethical based approach should be embedded into the organisation to enable employees working on data initiatives to have a clear mandate to apply guiding ethical principles or an ethical framework as well as clear data governance (that is, the rules around use, access, accuracy and availability of data) and privacy and record regulatory compliance.

The way in which an ethical based approach may be embedded into an organisation will vary according to the types of data initiatives being undertaken, the volume of personal information involved or the potential to identify personal information through data sharing or combining data sets.

Ethical based approaches

The types of ethical based approaches include:

  • Ethical value or policy statement for data initiatives, which can be used as a reference point for employees in any data initiatives to guide decision making and data impact assessments;
  • Ethical frameworks and/or checklists for use in data initiatives – see for example: Data Impact Assessments including ethical aspects below; and Part B in the Guidelines for the Ethical Use of Digital Data in Human Research, which sets out five categories of ethical issues and guiding questions when conducting research involving digital data covering: consent, privacy, ownership, data governance, and data sharing;[23] and
  • Ethics committees or internal ethics boards.

Data Privacy Impact Assessments

As the IAF paper sets out whether the project is a core product review, the broader use of information, or a big data analytics project, an assessment process is required to address the legal, ethical, fair and other implications of information use.  Privacy Impact Assessments (PIAs) are required to be undertaken by APP entities under the Privacy Act 1988 Cth and Data Protection Impact Assessments (DIAs) by organisations that are controllers under Article 35 of the European Union’s General Data Protection Regulation (GDPR).  Pursuant to APP 1, reasonable steps must be undertaken to implement practices, procedures and systems that will ensure compliance with the APPs.  OIAC explains that a PIA is ‘a systematic assessment of a project that identifies the impact that the project might have on the privacy of individuals, and sets out recommendations for managing, minimising or eliminating that impact’.[24] The OAIC guides sets out in detail the matters to be considered, assessed and addressed, and provides a recommended report format.

The IAF paper proposes a Comprehensive Data Impact Assessment (CDIA), as set out in the figure below, for data intensive initiatives to adequately and systematically (operationally) determine interests and impact to stakeholders, including specifically the individual.  The CDIA below is designed to analyse ‘whether the individuals’ interests, those of society and those of processors are assessed in a manner that demonstrates legal, fair and just use of data and are risks identified and appropriately mitigated’. The figure below is helpful in showing how an ethical based assessment component can be added into a PIA/DIA.

Figure 1 – IAF Comprehensive Data Impact Assessment

CDIA_Data_Initiatives

Assessment of ethical aspects

The IAF set out the following factors for consideration when assessing the ethical aspects of a big data initiative:

  • What aspect of collection/acquisition/processing/analysis or use of the insights could be considered unfair to the individual or to society?
  • Is the collection/acquisition/processing/analysis or use of the insights done in a way that is respectful to the individual?
  • Has the minimum possible amount of data been used?
  • Does the company have a legitimate interest in the processing of the data and the use of the insights?
  • After all mitigations have been applied, what is the residual risk to all stakeholders, particularly the individual – have the benefits and risks been effectively balanced?
  • Have the interests, expectations and rights of individuals been effectively addressed?
  • What additional, contextual based participation and choice (meaningful) with the individual should be considered?
  • Is there an effective redress option for the individual impacted? Has this use of data been transparent?
  • After considering all the above factors, is the project a ‘go’, ‘no-go’ or should some aspect be recalibrated to reduce the residual risks?

The challenge in relation to the above questions is in the careful consideration of the detail.  While the reasons or justifications for undertaking the data analytics may have apparent obvious benefits to those driving the data analytics project(s), further consideration may highlight ethical issues and unintended consequences leading to negative outcomes, including significant reputational risk  For example, it is important to know whether a project benefits everyone whose data is being processed, and if not, whether that matters.  In the corporate sense, benefiting only high value customers to the organisation, may be an acceptable risk although reputational issues will need to be considered.  In other situations, discrimination or determinism of individuals as a result of outcomes from data analytics projects will be unacceptable both for corporate and government.  Further and more detailed consideration may reduce the risk of unintended consequences and harms, particularly to avoid the risks of determinism and discrimination.   To ensure appropriate consideration, accurate assessments and risk mitigation steps are taken, it is key that relevant stakeholders are involved and there are robust policies that meet organisational needs to guide the stakeholders.

Conclusion

Organisations should implement strong information governance frameworks including privacy policies and PIAs/DIAs that include an ethical based approach where data analytics of big data involving personal information is being undertaken.

A unified information governance framework enables organisations to take a strategic approach to both maximise the value of information derived from data analytics as well as minimise the risks arising from the costs of legal and regulatory privacy compliance, costs arising from data breaches and/or responding to regulators, as well as costs arising from loss of reputation, particularly where there is a breach of trust with consumers.

The type of ethical based approach, such as, whether it is an ethical value or policy statement, or an ethics committee, and formal data impact assessments including an ethics assessment will depend on the types of big data initiatives being undertaken, the volume of personal information involved or the potential for personally identifiable information.

An ethical based approach will ensure that the processing of personal information in big data analytics is carried out in a fair, transparent, responsible and ethical manner.  The benefits of an ethical based approach and data impact assessments include the ability to build trust and transparency with consumers and citizens, ultimately delivering long term benefits to both the consumer and the organisation, and citizens and their government.

 

Susan Bennett LLM(Hons), MBA, FGIA, CIPP/E

Principal of Sibenco Legal & Advisory and co-founder of Information Governance ANZ.

Susan can be contacted on +61 2 8226 8682 or email susan.bennett@sibenco.com.

 

[1] Australian Government Public Data Policy Statement, December 2015 <https://www.pmc.gov.au/sites/default/files/publications/aust_govt_public_data_policy_statement_1.pdf>.

[2] Cisco, Forecasting the World’s Digital Transformation <https://www.cisco.com/c/m/en_us/solutions/service-provider/vni-complete-forecast/infographic.html>.

[3] ICO, Big data, artificial intelligence, machine learning and data protection <https://ico.org.uk/media/for-organisations/documents/2013559/big-data-ai-ml-and-data-protection.pdf>.

[4] International Working Group on Data Protection in Telecommunications, Big Data and Privacy: Privacy principles under pressure in the age of Big Data analytics, May 2014 <https://dzlp.mk/sites/default/files/u972/WP_Big_Data_final_clean_675.48.12%20(1).pdf>.

[5]  Timoth Morey, Theo Forbath and Allison Schoop, Customer Data: Designing for Transparency and Trust, Harvard Business Review, May 2015 < https://hbr.org/2015/05/customer-data-designing-for-transparency-and-trust>.

[6]  Ibid.

[7] Speech by Timothy Pilgrim to CeBIT, Sydney, May 2016 <https://www.oaic.gov.au/media-and-speeches/speeches/privacy-data-de-identification>.

[8] Australian Community Attitudes to Privacy Survey 2017  <https://www.oaic.gov.au/engage-with-us/community-attitudes/australian-community-attitudes-to-privacy-survey-2017>.

[9] Consumer Policy Research Centre, Consumer Data and the Digital Economy, <http://cprc.org.au/wp-content/uploads/Full_Data_Report_A4_FIN.pdf>.

[10] <http://cprc.org.au/wp-content/uploads/CPRC-Research-Report_A-Day-in-the-Life-of-Data_final-full-report.pdf> .

[11] Ibid.

[12] The Council of Europe’s Consultative Committee Convention 108, January 2017  ‘Guidelines on the Protection of Individuals with regard to processing of personal data in a world of Big Data’ <https://rm.coe.int/CoERMPublicCommonSearchServices/DisplayDCTMContent?documentId=09000016806ebe7a>.

[13]  European Commission, The Ethics Guidelines for Trustworthy Artificial Intelligence, <https://ec.europa.eu/futurium/en/ai-alliance-consultation/guidelines#Top>.

[14] AI: Australia’s Ethics Framework <https://consult.industry.gov.au/strategic-policy/artificial-intelligence-ethics-framework/>.

[15] OECD Principles on AI<http://www.oecd.org/going-digital/ai/principles/>.

[16] Ibid.

[17] <http://informationaccountability.org/big-data-ethics-initiative/>.

[18] IAF, Decisioning Process, Risk-Benefits Analysis Tool for Data Intensive Initiatives – Achieving Legal, Fair and Just Use of Data & Appropriate Individual Engagement’,  November 2016, <http://informationaccountability.org/wp-content/uploads/CDIA-Risk-Benefit-Tool.pdf>.

[19]  Note 3, para 176.

[20] Karin Clark, Matt Duckham, Marilys Guillemin,  Assunta Hunter, Jodie McVernon, Christine O’Keefe, Cathy Pitkin, Steven Prawer, Richard Sinnott,  Deborah Warr, Jenny Waycott, Guidelines for the Ethical use of Digital Data in Human Research, The University of Melbourne, May 2015 <https://ahrecs.com/resources/guidelines-for-the-ethical-use-of-digital-data-in-human-research>.

[21] Consultative Committee Of The Convention For The Protection Of Individuals With Regard To Automatic Processing  Of Personal Data, Guidelines on the protection of individuals with regard to processing of personal data in a world of Big Data, January 2017 <https://rm.coe.int/CoERMPublicCommonSearchServices/DisplayDCTMContent?documentId=09000016806ebe7a>.

[22] Note 3, para 176.

[23] Note 15, <http://ethics.iit.edu/codes/Ethical-Use-of-Digital-Data.pdf>.

[24] OAIC, ‘Guide to undertaking privacy impact assessments’, <https://www.oaic.gov.au/agencies-and-organisations/guides/guide-to-undertaking-privacy-impact-assessments>.

by

  • Corporate governance in the digital economyInformation is critical to decision-making and plays an essential role across all three pillars of governance.
  • The emerging driver of good information governance globally is compliance with regulatory obligations, particularly with the growth in global privacy laws.
  • Effective information governance requires top-down board and senior executive leadership.

Good corporate governance in the data driven and digital economy poses significant challenges for Boards and seniors executives.  This article highlights the importance of information governance to ensure there is a unified strategy and framework to govern information effectively.  Good information governance enables organisations to maximise the value of information as a business asset while minimising risks and costs, particularly those associated with data breach.

Over the last 25 years there has a lot been written about corporate governance.  There have been debates about the value it adds to an organisation and even the share price on the Australian Securities Exchange (ASX). One fact that is not disputed is that the companies and organisations still fail, in a corporate governance sense.  This has been illustrated through the media in September 2018, with the Australian Broadcasting Corporation (ABC) public dismissal of its managing director and then the forced resignation of the chair of the board, a few days later. Similarly, the scathing criticisms of the four major banks and other financial services providers through the Interim Report[1]of the  Royal Commission into Misconduct in the Banking, Superannuation and Financial Services Industry (Hayne royal commission) in respect of their culture and corporate governance.

Previously, it has been noted, that there is a “three pillar”[2]approach to good corporate governance and sometimes, both management and boards, get a little confused as to the distinction between the specific pillars of corporate governance, due diligence and compliance. Before briefly explaining the importance of each of the three pillars of governance, it is essential to note that the role of technology in every organisation has changed how and why things are done and recorded. It is critically important that the board and by entension the whole organisation, understand information governance is key to good corporate governance. Unfortunately, research by the Information Governance ANZ[3]shows that there is confusion as to what this concept means and who should be responsible for it.

It is possible to express information governance as a component or one aspect of corporate governance, but this misses the point, that information is critical to decision-making and plays an essential role across all three pillars of governance from corporate governance to due diligence to compliance.  The importance of technology was explained in the 2018 directors’ top concerns, under the title #SEMTEX.[4]This will be explained in more detail below.

Corporate governance

The amorphous nature of corporate governance is what makes it simultaneously defies definition, but many commentators have attempted to definitively account for corporate governance.

In 1992, the now world famous Cadbury Report took a simple approach, proposing that corporate governance is ‘the system by which companies are directed and controlled’. In Australia, the ASX Corporate Governance Council’s Corporate Governance Principles and Recommendations, third edition adopted the following definition,

‘The phrase “corporate governance” describes “the framework of rules, relationships, systems and processes within and by which authority is exercised and controlled within corporations. It encompasses the mechanisms by which companies, and those in control, are held to account.” Good corporate governance promotes investor confidence, which is crucial to the ability of entities listed on the ASX to compete for capital.’

The fourth edition is currently under consultation and flagged to publish in 2019.

Our preferred academic definition is found in Cochran and Wartick’s 1988 publication Corporate Governance: A Review of the Literature, which suggest that corporate governance is “an umbrella term that includes specific issues arising from interactions amount senior management, shareholders, boards of directors and other corporate stakeholders”. There are numerous studies[5]as to the benefits of corporate governance for global entities, whether they be the transnational corporations or the more traditional multinational companies. Around the globe, by far the majority of business entities are privately owned, with a small percentage being quoted on a local stock exchange, in a single legal jurisdiction.

Corporate governance has many elements, including risk management, due diligence and compliance. They are not terms of art, but certainly three distinct, yet inextricably fused elements of corporate governance. With an overlay of information governance, it is easy to see how confusion can arise.

Internal Due diligence

Due diligence, in the corporate governance context has evolved beyond its original role as a defence for transactions (buying and selling businesses or fundraising prospectuses). Due diligence is now seen as within a corporation’s internal operations that the link governance (at the board level) to the operational compliance programs. The use of the expression ‘due diligence’ to describe the system implemented within a corporation of checking day-to-day legal statutory compliance. These risks and duties can cover a range of issues, but often are linked to legal risks, such as consumer laws, property rights, (including physical and intellectual property), employment relations, environmental, corporate and privacy law). Due diligence and compliance are related but not to be treated as one and the same.

A simplified internal due diligence risk model, would normally have six steps, commencing with a legal risk audit. This is followed by a compliance plan for the whole entity or particular operating divisions.  The next step normally involves the implementation of the compliance plan and at some stage (set time period) a review of the established compliance program. It is important that the compliance programs, through the due diligence process are formally reported to the board of directors. Finally, after a couple of years, any due diligence and compliance system should be re-evaluated and another audit of risk be commenced.

Compliance programs

All commercial environment have become increasingly regulated in recent years. The 2018 Hayne royal commission is illustrating that even Australia’s largest corporations are failing to have good governance and compliance systems, which have led to misconduct in the financial services sector. Compliance is demanded with a greater number of statutes, regulations, industry standards and principles than ever before. What is more, society is becoming more litigious, and regulators are having their arsenal bolstered by greater powers and a greater range of penalties. Although, there has been criticism of the lack of enforcement by ASIC and APRA, many other regulators regularly enforce their, criminal, civil and civil- penalty provisions.  Out of the Hayne royal commission, it is reasonable to assume that ASIC and APRA will be conducting much more enforcements of the law than in the previous decade. It can be presumed that shareholder class actions will continue where there have been corporate governance failures and breaches of the law.

Information governance

What has become apparent over the last decade is the importance of information relating to the organisation. There are many different priorities, but the impact of e-discovery in litigation and the traditional requirements of archiving records for future management, together with increasing numbers of data breach have led to an explosion of laws and compliance issues. The EU impact of the General Data Protection Regulation (GDPR) and the introduction of the Notifiable Data Breach Scheme (NDB Scheme) in Australia this year, are two examples of how boards have a much greater responsibility to have a systematic approach to information governance.

What is Information Governance

Information governance is the framework, policies, technology and roles for controlling and securing information throughout an organisation to optimise the value of information, meet regulatory and legal obligations, manage risk and support business objectives.[6]

The goal of effective information governance is to maximise the value of information, recognising the potential value of data as the ‘new oil’ and to minimise the risks and costs of holding information.  The risks and costs include: those resulting from data breach, eDiscovery (the production of documents in litigation and in regulatory inquiries), ROT – the storing of redundant, outdated and trivial data that increases data storage costs, the costs of eDiscovery, and the costs of additional internal resources to manage data.

Drivers of IG: Litigation, inquiries and royal commissions

The growth of information governance in the United States over the past decade was driven largely by the enormous costs of eDiscovery and document production in litigation and regulatory investigations.  The Hayne royal commission provides a current Australian example of the substantial resources and costs involved in document production. The Hayne royal commission which was established in December 2017, has now issued over fourteen hundred Notices to Produce to institutions, requiring them to produce documents within tight deadlines.  The notices have required production of documents in some instances covering a 10-year period.  The Australian Financial Reviewreported on 28 September 2018, that CBA had responded to 106 Notices to Produce to 30 June 2018.

The Hayne royal commission and large litigation matters involving significant and ongoing document production or large eDiscovery result in teams of people, including lawyers and internal resources, to assist in identifying, reviewing and producing documents, the extensive use of specialised eDiscovery technology, and substantial costs in the millions, and even tens of millions, of dollars.   These costs are minimised when there is good information governance, because ROT is disposed of and there is ongoing defensible disposition of data in accordance with records and information record retention policies.  This enables relevant documents to be more easily and cheaply identified and retrieved from the vast volumes of data being stored by organisations.

Drivers of IG: Growth in privacy laws and data breach

The emerging driver of good information governance globally is compliance with regulatory obligations, particularly with the growth in global privacy laws.   Good data governance and privacy compliance starts with knowing where your data is and mapping it, so appropriate steps can then be taken to secure and control it – for most organisations this is a significant challenge.

The GDPR includes expanded accountability and governance requirements including record keeping, privacy by design and privacy by default, and a requirement for data protection impact assessments to be carried out where high risk data processing is being undertaken.  Australian Privacy Principle  (APP)  1.2 requires that organisationsmust take reasonable steps to implement practices, procedures and systems that will ensure it complies with the APPs.  The Australian Government Agencies Privacy Code issued in July 2018 sets out requirements of APP 1.2 for privacy management and governance, including that agencies are required to carry out privacy impact assessments in relation to all high privacy risk projects.

Boards and senior executives need to be aware that under the GDPR and APP11.2, organisations are not permitted to retain personal information for longer than the lawful purpose for which the data was collected.  It means that organisations must either destroy or de-identify data.  The touting of data analytics and data as the ‘new oil’  means that many organisations are storing vast quantities of data, including data of customers and employees both past and present.   The protection of personal information under privacy regulations requires organisations to understand and properly govern the personal information they hold, including disposing of personal information.

Drivers of IG: Requirement for government agencie

Australia’s Digital Continuity 2020 Policy, sets out as its first principle that information is valued.  It requires agencies by 2020 to manage their information as an asset, ensuring that it is created, stored and managed for as long as it is required, taking into account business requirements and other needs and risks. This recognises that information is a key strategic asset and economic resource, and that digital information management enables efficiencies in service delivery, increases opportunities for information sharing and can improve business decisions and accountability. As part of the first principle, agencies are required to implement an information governance framework and annual survey reporting on information governance.

Top-down leadership

Effective information governance requires top-down leadership from the Board to set the strategic objectives and priorities for managing information assets.  The objectives will vary according to the nature of the industry, size of the organisation, and where a particular organisation sits in relation to cybersecurity threats, the types of data collected and opportunities to extract value from data, and use of new technologies.

Effective information governance enables Boards and senior executives to be proactive in respect of the opportunities that can be derived from data and technology, and proactive in respect to potential threats.  Preventing misuse or data breach of customer personal information is key in industries such as banking and health.  For organisations in these industries that collect and store vast quantities of customer personal data there are increasing regulatory requirements, including the need to be able to quickly respond to data breaches of personal information both to comply with the requirements of the NDB Scheme as well as to manage reputation in the public domain and retain the trust of customers.

For other industries, such as mining and pharmaceutical, the primary concern may be to protect valuable intellectual property from cyberattack and theft.   Where intellectual property theft is a key concern, then in addition to cybersecurity investments to protect the IT network perimeter of the organisation there will need to be increased information security within the organisation to prevent rogue employees from accessing and/or misusing information. Information security measures will include stricter control of ‘shadow IT’ such as employees using their own devices or apps, through appropriate BYOD policies and IT auditing and surveillance, and human resource risk management.   The broad range of issues necessitate a coherent and strategic plan across organisational silos to minimise risks and costs.

A robust information governance framework that is led from the top-down and effectively implemented throughout an organisation will enable this. The Information Governance ANZ Survey 2017 found that 98% of respondents said that defining and implementing an IG framework for their organisation was important, and that should they have the budget and authority to do so, half of all respondents said they would do so as a priority.

Information governance framework

The first step to building an information governance framework is to clearly understand where information is being managed throughout the organisation and the positions of those across the silos responsible for managing the information and/or technology systems.  The next step is building an information governance framework and system to facilitate the effective interaction between the stakeholders to ensure the policies and activities undertaken for each of the information areas are aligned with each other, the overarching information governance policy and with the overall strategic goals of the organisations.

The framework includes the overarching information governance policy which:

  • sets out an overarching description of how information is governed including leadership and planning;
  • describes the factors and business drivers which determine or influence the creation, management and use of information, including legislation, regulations, compliance, risk, and business needs; and
  • documents the organisation’s commitment to information governance and provides senior management endorsement.

The Information Governance ANZ Survey 2017 found that 55% of respondents said their organisation governs IG with a formal framework with policies and procedures.

The information governance framework above demonstrates the various areas within an organisation where information is typically managed, although in some organisations there will be more areas.   It is the co-ordinating of these areas to efficiently and coherently safeguard that the organisation will deliver on its information governance objectives and support overall achievement of organisational objectives.

Information governance committee

In large organisations, an information governance steering committee is the best mechanism to ensure that the overarching information governance objectives are implemented in a consistent and systematic way.   It may take different forms, to suit the needs and structure of the organisation including:  board, committee, working group, or as part of an existing governance committee.

It is important that the committee comprise all key information stakeholders to encourage collaboration and effectiveness of information governance activities.  The committee members may include – General Counsel (GC), Chief Information Security Officer (CISO), Chief Privacy Officer (CPO), Chief Data Officer (CDO), Chief Marketing Officer (CMO), Chief Data Scientist (CDS), Records & Information Manager (RIM) and others appropriate to the needs and priorities of the organisation.

The information governance steering committee should have a suitable Chair to ensure the committee:

–      is collaborative to ensure that those members of the committee lead their respective areas to break down information silos with a culture of information and data collaboration;

–      is well-structured, meets regularly, and has a clear agenda that is implemented and achieved.

Senior executive responsible for information governance

Best practice information governance includes the appointment of a dedicated senior executive responsible for leading information governance and accountable for enterprise wide information governance. This may be the included in the responsibilities of an existing senior executive, but best practice is the creation of a dedicated position – the Chief Information Governance Officer (CIGO).  The Information Governance Initiative (IGI), a US IG think-tank describes the CIGO’s role as ‘to balance the stakeholder interests from each facet of IG and develop the right operational model for the organization.’

As part of the Digital Continuity 2020 Policy, the creation of the CIGO role for Australian government agencies‘is critical for digital innovation and capability, and for championing the importance of effective information management’.   The CIGO role is also important for establishing and maintaining a culture for a more accountable and business-focused information management environment.

Information governance reporting

There should be regular information governance reporting of progress on initiatives, programs as well as evaluation and auditing.  The reporting should be to the designated C-level executive responsible for information governance, such as the CIGO and/or the information governance steering committee.

The senior executive responsible for information governance, such as the CIGO, and/or the information governance steering committee then report to the relevant Board committee.  The relevant board committee may be the audit and risk committee  or another relevant board committee.  It is critical that there is at least or more one member of the committee (and on the Board) that understand the requirements of good information governance, including privacy regulatory obligations, the role of technology and cybersecurity.

Conclusion

The growth of data breaches and privacy regulatory requirements, together with the costs and burden on institutions involved in responding to the current Hayne royal commission, should be prompting boards to review and assess whether their current information governance is adequate to manage information risks and meet legal and business requirements.

Good corporate governance requires a robust information governance framework. This will include an information governance steering committee and/or dedicated senior level executive with the responsibility and accountability for information governance.  Importantly, information governance reporting needs to feed into relevant Board committees, so that the board has appropriate oversight.

Effective information governance requires top-down board and senior executive leadership to enable the organisation to deliver continual strategic and proactive governance as digital disruption impacts the organisation and digital transformation continues.

With good leadership, a properly executed information governance framework and program should deliver effective security and control of data and information by minimising risks and reducing costs of holding information and maximising the value of information held by the organisation.

 

Professor Michael A Adams FGIA(Life) FCIS, Professor of Corporate Law & Governance, School of Law, Western Sydney University and
Susan Bennett, FGIA, CIPP/E, Principal, Sibenco Legal & Advisory, Co-founder and Director of Information Governance ANZ

 

This article was published in Governance Directions, November 2018, Vol 70, Issue 10

[1]https://financialservices.royalcommission.gov.au/Pages/interim-report.aspx

[2]Adams, M. (2018) “Three Pillars of Corporate Governance” 70(6) Governance Directions, p 302.

[3]http://www.infogovanz.com/featured-articles#iganzsurveyreport-anchor

[4]Adams, M. (2018) “Top 2018 governance concerns: #SEMTEX” 70(8) Governance Directions,p 477.

[5]Adams, M. (2012) ‘Global Trends in Corporate Governance’ 64(9) Keeping Good Companies516, 518.

[6]  See also – What is Information Governance and how does it differ from Data Governance?– Governance Directions, September 2017, Vol 69, Issue 8