Recently, we watched Lee Daniels' The Butler.
This was one of those movies I knew I could not watch in a theater, so I had planned to watch it at home. It was worth the wait. Forest Whitaker was the lead playing Cecil Gaines. At a young age in the cottonfields of Mississippi (1926), he watched his mother pulled into a shed by the farm owner, a Caucasian guy. Cecil's father objected after screams were heard from the shed and was shot for his insolence. The elderly white landowner took Cecil into the house to train him as a house worker (not even for the purposes of this blog will I use the horrible word I heard so much growing up). He was told that when he was in a room, it should feel empty. After a few years, he left. He wound up working in a bar/restaurant who taught him to see what the customers want and provide it. Never be political. Never have an opinion. He then moved to a hotel in DC. Eventually, he was recruited for the White House during Eisenhower's term. He served through the Reagan term.
Throughout the movie, we also see the personal interactions with friends and family - his wife (played by Oprah Winfrey) who drank to cope, his oldest son who was a civil rights activist and often in and out of jail, and his youngest son who died in the Vietnam war.
So what lessons can we learn from the Butler?
Let's start with the premise of servants not existing - the room should feel empty. Many workers are unobtrusive. In fact, it does not even need to be a worker - people can be unobtrusive. Eventually, others forget or do not even notice they are there. It is an incredibly effective way to gain information. "Don't mind me...no one here....just discuss your deepest secrets." Can you imagine what this man learned serving the presidents, their wives, kids, the other politicians? wow.
Some people perfect the art of listening and watching. Cecil learned to identify what the customers want and provide it before they themselves knew they wanted it. Discerning based on person, activity, mood, etc.
Gaines had issues with his wife who sometimes asked just for some little tidbit of inside information, like ho many shoes Jackie Kennedy had. Gaines would not tell her. However, it came out that one of the other butlers did tell his wife small things. Gaines seemed to have an issue with that sharing, but there was no evidence that these "breaches" were reported. And later in the movie, he did tell his wife that Mrs. Kennedy had about 125 pairs of shoes.
One thing Gaines learned from the bar.restaurant was to have two faces: one you showed when at work and one for your personal life. As a butler, he was expected to show no emotion, preference, or opinion. Two faces. He came face-to-face with that effect, if you'll forgive both the pun and the redundancy, when he was a guest at a state dinner at the Reagan's behest. He was served by his co-workers and saw the face directed towards him. He did not like facing the reality of who he was and/or what others saw him as. He was forced to hide himself in order to work. Rather than a public face and a private face, he had a private face for work and a real face for private.
Gaines took pride in his work. From the shoes he polished to the people he served and protected. And he was humble as a person, proud of his work, and willing to stand up for the right thing. He made mistakes and learned from them.
So there were some lessons to learn in The Butler. Perhaps some of the greatest events of our history occurred or were made in the presence of some very discrete individuals, who might not have even been noticed or even considered persons with equal rights.
Interesting movie. Interesting times. Interesting.
Thursday, March 27, 2014
Thursday, March 13, 2014
My Privacy Heroes
I haven't written in a while, so please forgive me. Privacy issues remain daily headliners and I have no excuse for not writing. First, last week, I was at the International Association of privacy Professionals' Global Summit. It was sold out, which I think means a total of 3000 people attended. Wow.
I know, right? 3000 people from around the globe care about privacy. Yes, we are all dorks. But we're really cool dorks and have our own set of heroes and villains. Some of my own personal privacy heroes are listed below.
Dan Solove, John Marshall Harlan Research Professor of Law at the George Washington University Law School. He is a Senior Policy Advisor at Hogan Lovells. He is also the founder of TeachPrivacy, a company that provides privacy and data security training programs to businesses, schools, healthcare institutions, and other organizations. I had the privilege of getting to know Dan a little over the past two years and still have that little piece inside me that still squeals like a little girl simply because my privacy hero talks to me. The IAPP did a little blurb on me once (the link only works for those who log into IAPP, sorry) and soon thereafter, Dan sent me an email. Please understand that at the time, I probably had 5 articles and three books of his sitting on my desk. So I did a little happy dance before I calmly replied to him. I am happy to say that we have maintained a friendly relationship and I hope - I pray - to one day be on his level of competency.
Kirk Nahra a partner with Wiley Rein, LLC. Kirk has been involved with IAPP, I think since its inception. He has been on the IAPP's Board of Directors several times and currently serves as editor of the publications. I do not remember if I met him at a Blue Cross forum in Colorado or at an IAPP event, but either way, we seem to cross paths often, just not often enough. He sends out privacy law updates and observations - and frankly, is simply my most favorite U.S. privacy attorney.
Cass Sunstein is currently a professor at Harvard Law School and is a scholar beyond reproach. This is the only privacy hero I have that I do not know personally and have not met. I was supposed to hear him last year at a conference that my travel was cancelled due to weather. Oddly, I know more of him through my PhD program in Public Affairs than I do my privacy work. I would probably give my right kidney to talk with him for a hour or so (my right kidney is pretty shot, so that might not be a high enough payment).
So there is my list of heroes. I am not currently providing a list of villains, but let's just agree that most of them are corporate level, not individuals.
I know, right? 3000 people from around the globe care about privacy. Yes, we are all dorks. But we're really cool dorks and have our own set of heroes and villains. Some of my own personal privacy heroes are listed below.
Dan Solove, John Marshall Harlan Research Professor of Law at the George Washington University Law School. He is a Senior Policy Advisor at Hogan Lovells. He is also the founder of TeachPrivacy, a company that provides privacy and data security training programs to businesses, schools, healthcare institutions, and other organizations. I had the privilege of getting to know Dan a little over the past two years and still have that little piece inside me that still squeals like a little girl simply because my privacy hero talks to me. The IAPP did a little blurb on me once (the link only works for those who log into IAPP, sorry) and soon thereafter, Dan sent me an email. Please understand that at the time, I probably had 5 articles and three books of his sitting on my desk. So I did a little happy dance before I calmly replied to him. I am happy to say that we have maintained a friendly relationship and I hope - I pray - to one day be on his level of competency.
Kirk Nahra a partner with Wiley Rein, LLC. Kirk has been involved with IAPP, I think since its inception. He has been on the IAPP's Board of Directors several times and currently serves as editor of the publications. I do not remember if I met him at a Blue Cross forum in Colorado or at an IAPP event, but either way, we seem to cross paths often, just not often enough. He sends out privacy law updates and observations - and frankly, is simply my most favorite U.S. privacy attorney.
Cass Sunstein is currently a professor at Harvard Law School and is a scholar beyond reproach. This is the only privacy hero I have that I do not know personally and have not met. I was supposed to hear him last year at a conference that my travel was cancelled due to weather. Oddly, I know more of him through my PhD program in Public Affairs than I do my privacy work. I would probably give my right kidney to talk with him for a hour or so (my right kidney is pretty shot, so that might not be a high enough payment).
So there is my list of heroes. I am not currently providing a list of villains, but let's just agree that most of them are corporate level, not individuals.
Tuesday, February 25, 2014
Cross-posted on IAPP
https://www.privacyassociation.org/publications/its_complicated_the_social_lives_of_networked_teens_does_not_shy_away_from
How often have we heard or uttered the refrain that the newer generations—“Millennials” or “Generation Zs”—have no concept of privacy, that they live a life online devoid of personal restraint? I confess I have had that thought myself. So when asked to review danah boyd’s new book It’s Complicated: The Social Lives of Networked Teens, available through Yale University Press, I was delighted to do so.
This book was 10 years in the making and is dedicated to boyd’s friend, mentor and former professor, Peter Lyman. It is obvious throughout the book that boyd discusses some technological aspects that society may consider outdated, such as the social network MySpace, but boyd addresses this upfront. She disclaims early on, “The technical shifts that have taken place since I began this project—and in the time between me writing this book and you reading it—are important, but many of the arguments made in the following pages transcend particular technical moments, even if the specific examples used to illustrate those issues are locked in time.”
Boyd does not shy away from the tough subjects. It is apparent that she observed teenagers in their natural setting over a period of time. She also observed those people around teenagers and drew observations not only on the behavior or expectations of the youths but also the behavior and expectations of other youths and adults who interact with teenagers. In this book, boyd combines her personal observations with her research into technology, the Internet and social media to present a broad and insightful view of teenagers that might clash with the generally held belief about youth.
This book contains eight chapters, along with a hearty introduction. The chapters are presented topically and boyd skillfully weaves certain characters throughout the book, which provides a stabilizing effect. The chapters, which are bold incursions into topics many shy away from truly contemplating or speak about without true knowledge, are presented in a logical order.
Boyd first discusses teens’ search for identity online, which does not differ from their need to find their identity—only nowadays, a teen’s world is technology. She draws us into a world where teens’ identities are taken out of context because they do not necessarily create identities to satisfy all possible audiences. boyd writes, “Unlike face-to-face settings in which people took their bodies for granted, people who went online had to consciously create their digital presence.” She skillfully introduces us to the world of creating identities and managing impressions.
Next, boyd tackles the topic of privacy. Adults seem dismissive of teens’ awareness of the need for privacy, and, boyd writes, teens “have little patience for adults’ simplistic views about teen privacy.” She instructs us that teens achieve privacy by controlling their social situations and describes how they have learned to live with surveillance. boyd explains the concept of “social steganography,” in which teens conduct conversations and send messages in plain sight encoded to hide from adults or other teens. This segues nicely into the next chapter on social media, which boyd titles “addiction,” yet explains it is more of a necessary outlet that adults view as an unhealthy addiction due to its time demands.
Moving beyond the first three chapters, which provide a foundation upon which to explain and explore teens and social media, boyd examines the more controversial topics of teens online: dangers of being online, bullying and social inequality. She discusses these dangers frankly, without shying from the realities. She recommends that to keep our youth safe online, society needs to patrol digital streets with the same determination that is used to patrol real streets.
The last two chapters of the book are dedicated to understanding the world that teens now live in. She starts with examining the concept of “digital natives.” Boyd exhorts us all to be media-savvy, writing, “Learning is a lifelong process.” She concludes the book with a caution that media is not bad, it is a technology. It merely “mirrors and magnifies” the world we live in; it does not create it.
It’s Complicated: The Social Lives of Networked Teens was easy to read, applicable to the privacy field and full of interesting, well-considered research. The material was presented well and would appeal not only to those of us in the privacy profession but to some of the general public. I do not feel that it would appeal to all of the public, but what book does? My perspective stems from the depth of the material into which a reader sinks until some readers may be over their heads. But the material is so smooth that some readers might not realize they are over their heads until they turn a few pages and realize how deep they have gotten. However, as a past youth counselor, mother of teens and current privacy professional, I found the book riveting. And even I had to read it twice because the material is so rich. I did find the conclusion to be a little too cavalier given the seriousness that came before it. Agreed, our world is a technological one and we should approach its dangers and its benefits with our eyes wide open, but online there are challenges that require different approaches to those dangers and benefits. Yet, it is a remarkable feat boyd accomplished to link tangible experiences to digital ones and to enable us to relate teens’ current experiences with those of our youth. This takes the book to a new level of triumph.
I can do nothing less than highly recommend this book for those who have an interest in such fields—whether teens’ issues or privacy.
K Royal, CIPP/US, CIPP/E, is privacy counsel at Align Technology and has over 20 years of professional experience in the legal and health-related fields.
Read more by K Royal:
Book Review: The Future of Privacy
https://www.privacyassociation.org/publications/its_complicated_the_social_lives_of_networked_teens_does_not_shy_away_from
How often have we heard or uttered the refrain that the newer generations—“Millennials” or “Generation Zs”—have no concept of privacy, that they live a life online devoid of personal restraint? I confess I have had that thought myself. So when asked to review danah boyd’s new book It’s Complicated: The Social Lives of Networked Teens, available through Yale University Press, I was delighted to do so.
This book was 10 years in the making and is dedicated to boyd’s friend, mentor and former professor, Peter Lyman. It is obvious throughout the book that boyd discusses some technological aspects that society may consider outdated, such as the social network MySpace, but boyd addresses this upfront. She disclaims early on, “The technical shifts that have taken place since I began this project—and in the time between me writing this book and you reading it—are important, but many of the arguments made in the following pages transcend particular technical moments, even if the specific examples used to illustrate those issues are locked in time.”
Boyd does not shy away from the tough subjects. It is apparent that she observed teenagers in their natural setting over a period of time. She also observed those people around teenagers and drew observations not only on the behavior or expectations of the youths but also the behavior and expectations of other youths and adults who interact with teenagers. In this book, boyd combines her personal observations with her research into technology, the Internet and social media to present a broad and insightful view of teenagers that might clash with the generally held belief about youth.
This book contains eight chapters, along with a hearty introduction. The chapters are presented topically and boyd skillfully weaves certain characters throughout the book, which provides a stabilizing effect. The chapters, which are bold incursions into topics many shy away from truly contemplating or speak about without true knowledge, are presented in a logical order.
Boyd first discusses teens’ search for identity online, which does not differ from their need to find their identity—only nowadays, a teen’s world is technology. She draws us into a world where teens’ identities are taken out of context because they do not necessarily create identities to satisfy all possible audiences. boyd writes, “Unlike face-to-face settings in which people took their bodies for granted, people who went online had to consciously create their digital presence.” She skillfully introduces us to the world of creating identities and managing impressions.
Next, boyd tackles the topic of privacy. Adults seem dismissive of teens’ awareness of the need for privacy, and, boyd writes, teens “have little patience for adults’ simplistic views about teen privacy.” She instructs us that teens achieve privacy by controlling their social situations and describes how they have learned to live with surveillance. boyd explains the concept of “social steganography,” in which teens conduct conversations and send messages in plain sight encoded to hide from adults or other teens. This segues nicely into the next chapter on social media, which boyd titles “addiction,” yet explains it is more of a necessary outlet that adults view as an unhealthy addiction due to its time demands.
Moving beyond the first three chapters, which provide a foundation upon which to explain and explore teens and social media, boyd examines the more controversial topics of teens online: dangers of being online, bullying and social inequality. She discusses these dangers frankly, without shying from the realities. She recommends that to keep our youth safe online, society needs to patrol digital streets with the same determination that is used to patrol real streets.
The last two chapters of the book are dedicated to understanding the world that teens now live in. She starts with examining the concept of “digital natives.” Boyd exhorts us all to be media-savvy, writing, “Learning is a lifelong process.” She concludes the book with a caution that media is not bad, it is a technology. It merely “mirrors and magnifies” the world we live in; it does not create it.
It’s Complicated: The Social Lives of Networked Teens was easy to read, applicable to the privacy field and full of interesting, well-considered research. The material was presented well and would appeal not only to those of us in the privacy profession but to some of the general public. I do not feel that it would appeal to all of the public, but what book does? My perspective stems from the depth of the material into which a reader sinks until some readers may be over their heads. But the material is so smooth that some readers might not realize they are over their heads until they turn a few pages and realize how deep they have gotten. However, as a past youth counselor, mother of teens and current privacy professional, I found the book riveting. And even I had to read it twice because the material is so rich. I did find the conclusion to be a little too cavalier given the seriousness that came before it. Agreed, our world is a technological one and we should approach its dangers and its benefits with our eyes wide open, but online there are challenges that require different approaches to those dangers and benefits. Yet, it is a remarkable feat boyd accomplished to link tangible experiences to digital ones and to enable us to relate teens’ current experiences with those of our youth. This takes the book to a new level of triumph.
I can do nothing less than highly recommend this book for those who have an interest in such fields—whether teens’ issues or privacy.
K Royal, CIPP/US, CIPP/E, is privacy counsel at Align Technology and has over 20 years of professional experience in the legal and health-related fields.
Read more by K Royal:
Book Review: The Future of Privacy
Thursday, February 20, 2014
How to Brew the Perfect Privacy Officer
Cross-posted to IAPP
https://www.privacyassociation.org/privacy_perspectives/post/what_makes_a_good_privacy_officer
Recently, as I was speaking to a talented group of law students, I was asked the above question. This has also been a related theme underlying some of the recent posts on the IAPP Privacy List. I’m not sure if this list is what those who want to enter the privacy field should cultivate in themselves, what current privacy officers are like or what we should be aiming for as a profession.
To build this list, I searched online for the top 10 traits or characteristics of compliance officers, salespeople, CEOs and managers. In essence, I could stop this blog entry now—that is what we are and should be: compliance officers, salespeople, CEOs, managers and let’s include janitors as well. In fact, let’s look at it that way: What job skills does one need to be an effective privacy officer? If we were to brew the perfect privacy officer, what career fields would we throw into the kettle?
Compliance Officers: In effect, this is what we are. We have a law, rule or regulation that we need to follow. We make sure the company follows this certain law, rule or regulation. We are a cost center. We do not make a profit for the company. We do, however, save the company lots of money. Please do funnel those horrible headlines past your executive committee to show them what you are worth.
Sales: We sell. We sell compliance. We sell the need to do the right thing, even if there is no law, rule or regulation stating what we should do. We sell Privacy by Design. We sell having us in the opening bid of a project. We sell our benefit to the company. We identify the needs, the underlying support, the future benefit and our allies as well as our antagonists. We bring our persuasive skills to the table and close the deal.
CEOs: I borrowed material for this one from Stephen D. Simpson’s “Top Qualities of an Effective CEO.” A good privacy officer runs the department like a successful CEO. S/he needs vision, execution, organization, candor with compassion and pragmatism. S/he needs to be in the right markets at the right time, to drive hard bargains—but not too hard—and to manage for the future, not the mirror. If we as privacy officers are not in the right market at the right time, we miss the privacy boat. We get stranded on the privacy island or get voted off it.
Managers: I borrowed this one from Jacob Morgan’s “5 Must-Have Qualities of the Modern Manager.” As privacy officers, we must be good managers. We need to follow from the front and make sure our employees succeed—when we yell jump, jump with them. We must understand technology—especially in our digital world. We must lead by example, embrace vulnerability and believe in the collective intelligence. Rarely do people comply with a mandate because it is a mandate. Foster understanding in order to foster compliance.
Social Workers: Social workers serve an incredibly valuable role in our society—often dealing with vulnerable populations. To be an effective social worker, one needs empathy, dependability, patience and a slew of efficient, effective and inexpensive resources. S/he must be creative and open-minded yet willing to take on the challenges, including the drudgery of paperwork. Know when to walk quietly, carry a big stick and know when to run in the other direction—calmly and with authority.
Investigators: Investigating is a natural fit for our job as we frequently are investigating complaints and breaches. But what traits do we need as investigators? We need to be perceptive, stubborn, questioning and detail-oriented. We need to keep good notes and be able to connect seemingly unconnected events and facts. We need to be inquisitive and not hesitate to ask the hard questions—out loud—sometimes just to hear how ridiculous they are.
Inventors: “Necessity is the mother of invention.” But it takes someone who is willing to think beyond preset boundaries and create something new. Perhaps it’s an easier way of doing something, or it involves making a program more streamlined and efficient—a little tweak that makes something much easier than it once was. Some privacy officers create a program from nothing, and others have nothing with which to run the program. Regardless, we all hope to see a return on investment.
Mechanics: Mechanics run the gamut of the shady-tree mechanic to the luxury jet mechanic, and so do privacy officers. Some have elite background and training, while others learned the trade organically and grew up with it. Neither one is better than the other. They’re just varied in credentials and background. But like me taking my car into the shop and duplicating the dinging it does when I take a left turn, colleagues don’t always know something is wrong with their data practices. It just sounds wrong. Privacy officers are left to identify what is broken, trusted to fix it and expected to keep the cost down—oh, and have it ready for pickup this afternoon with a full body detail and the tires done.
Airline attendants: Let’s be friendly, attractive and provide excellent service while keeping everyone safe. Smiling, yet firm. And yes, you have heard this a hundred times before: The plane may be different; the law is not. Just do what you need to do, correctly, when required, and we will make sure you get where you need to be. Oh, and don’t sit in the exit row unless you are willing to help everyone else. Coffee, anyone?
Janitors: Same garbage, different day. But if we weren’t here to clean it up, the world would be in a rough place.
This list is limited to 10 because 10 seems to be the magical number for such considerations, but I bet there are lots of others. What career field would you choose to compare to being a privacy officer? Picture yourself explaining your job to a bunch of six-year-olds … What do you say?
https://www.privacyassociation.org/privacy_perspectives/post/what_makes_a_good_privacy_officer
Recently, as I was speaking to a talented group of law students, I was asked the above question. This has also been a related theme underlying some of the recent posts on the IAPP Privacy List. I’m not sure if this list is what those who want to enter the privacy field should cultivate in themselves, what current privacy officers are like or what we should be aiming for as a profession.
To build this list, I searched online for the top 10 traits or characteristics of compliance officers, salespeople, CEOs and managers. In essence, I could stop this blog entry now—that is what we are and should be: compliance officers, salespeople, CEOs, managers and let’s include janitors as well. In fact, let’s look at it that way: What job skills does one need to be an effective privacy officer? If we were to brew the perfect privacy officer, what career fields would we throw into the kettle?
Compliance Officers: In effect, this is what we are. We have a law, rule or regulation that we need to follow. We make sure the company follows this certain law, rule or regulation. We are a cost center. We do not make a profit for the company. We do, however, save the company lots of money. Please do funnel those horrible headlines past your executive committee to show them what you are worth.
Sales: We sell. We sell compliance. We sell the need to do the right thing, even if there is no law, rule or regulation stating what we should do. We sell Privacy by Design. We sell having us in the opening bid of a project. We sell our benefit to the company. We identify the needs, the underlying support, the future benefit and our allies as well as our antagonists. We bring our persuasive skills to the table and close the deal.
CEOs: I borrowed material for this one from Stephen D. Simpson’s “Top Qualities of an Effective CEO.” A good privacy officer runs the department like a successful CEO. S/he needs vision, execution, organization, candor with compassion and pragmatism. S/he needs to be in the right markets at the right time, to drive hard bargains—but not too hard—and to manage for the future, not the mirror. If we as privacy officers are not in the right market at the right time, we miss the privacy boat. We get stranded on the privacy island or get voted off it.
Managers: I borrowed this one from Jacob Morgan’s “5 Must-Have Qualities of the Modern Manager.” As privacy officers, we must be good managers. We need to follow from the front and make sure our employees succeed—when we yell jump, jump with them. We must understand technology—especially in our digital world. We must lead by example, embrace vulnerability and believe in the collective intelligence. Rarely do people comply with a mandate because it is a mandate. Foster understanding in order to foster compliance.
Social Workers: Social workers serve an incredibly valuable role in our society—often dealing with vulnerable populations. To be an effective social worker, one needs empathy, dependability, patience and a slew of efficient, effective and inexpensive resources. S/he must be creative and open-minded yet willing to take on the challenges, including the drudgery of paperwork. Know when to walk quietly, carry a big stick and know when to run in the other direction—calmly and with authority.
Investigators: Investigating is a natural fit for our job as we frequently are investigating complaints and breaches. But what traits do we need as investigators? We need to be perceptive, stubborn, questioning and detail-oriented. We need to keep good notes and be able to connect seemingly unconnected events and facts. We need to be inquisitive and not hesitate to ask the hard questions—out loud—sometimes just to hear how ridiculous they are.
Inventors: “Necessity is the mother of invention.” But it takes someone who is willing to think beyond preset boundaries and create something new. Perhaps it’s an easier way of doing something, or it involves making a program more streamlined and efficient—a little tweak that makes something much easier than it once was. Some privacy officers create a program from nothing, and others have nothing with which to run the program. Regardless, we all hope to see a return on investment.
Mechanics: Mechanics run the gamut of the shady-tree mechanic to the luxury jet mechanic, and so do privacy officers. Some have elite background and training, while others learned the trade organically and grew up with it. Neither one is better than the other. They’re just varied in credentials and background. But like me taking my car into the shop and duplicating the dinging it does when I take a left turn, colleagues don’t always know something is wrong with their data practices. It just sounds wrong. Privacy officers are left to identify what is broken, trusted to fix it and expected to keep the cost down—oh, and have it ready for pickup this afternoon with a full body detail and the tires done.
Airline attendants: Let’s be friendly, attractive and provide excellent service while keeping everyone safe. Smiling, yet firm. And yes, you have heard this a hundred times before: The plane may be different; the law is not. Just do what you need to do, correctly, when required, and we will make sure you get where you need to be. Oh, and don’t sit in the exit row unless you are willing to help everyone else. Coffee, anyone?
Janitors: Same garbage, different day. But if we weren’t here to clean it up, the world would be in a rough place.
This list is limited to 10 because 10 seems to be the magical number for such considerations, but I bet there are lots of others. What career field would you choose to compare to being a privacy officer? Picture yourself explaining your job to a bunch of six-year-olds … What do you say?
Saturday, February 15, 2014
HIPAA encounters of the Personal Kind
I wish today's post to be light-hearted, but realize in the end, there may be some lessons learned....be careful. You, too, may become conscious of your own privacy.
My cell phone rang the other day and I answered it "hello." What follows is the gist of the conversation. I could be partially wrong in the exact wording, but the meaning remains the same. I have changed Paul's name to protect the unknowing.
K: Hello
Bob: Hi. I'm calling to speak with K Royal about an emergency room visit to blah blah hospital on this past Saturday on February 8.
(please note - at this point, he has disclosed my protected health information if someone other than me had answered the phone).
K: this is K.
B: Hi, this is Bob, an RN at blah blah hospital. Before I go any further, I need to confirm your identity to maintain confidentiality. What is your date of birth?
K: (really?! you've already blown it, mister) Hi Bob, can you confirm your identity to me before I provide you with my date of birth?
B: Uh, no.
K: So there is nothing you can do, at all, to prove you are calling from the hospital? (I was expecting him to say - sure, call the hospital and ask for me or my extension)
B: No. can't think of anything. I just want your date of birth.
K: Okay, let's try this - tell me if you are calling to survey me on how well your service was or if you want to discuss something of a medical nature.
B: Ma'am, I can't tell you that. It violates HIPAA.
K: Actually, it does not. I am not asking you to give me any personal or protected information. I am just asking for the general nature of your call.
B: Ma'am that does violate HIPAA. HIPAA won't let me tell you the purpose of my call.
K: Bob, I am a privacy attorney and very familiar with HIPAA, I can assure you that it does not. How about this...are you calling to survey me about your service? cause if you are, it was fabulous and I felt everything went smoothly.
B: Ma'am, I cannot answer that question because it would violate HIPAA. And if you won't give me your date of birth, we seem to have a problem. I know HIPAA very well - and it won't let me continue without it.
K: Bob, I actually seem to know HIPAA better than you do ... at least in this instance ... because HIPAA would not stop you from answering that question.
B: So what do you want to do?
K: I guess we're at an impasse, Bob. You cannot verify who you are or where you are calling from, you want me to provide you with even further personal information, and you won't tell me the purpose of your call. Sooooo, I think we're done here - and I truly hope you were not calling to tell me something popped up on the tests and I am dying. Feel free to call me back when you either learn more about what you can say under HIPAA or can provide verification of who you are. Have a good afternoon. Bye bye.
I called the privacy officer and left a message to call me. Nothing.
So what did we learn here (other than stupid stuff like this brings out my snarky side)?
1) It is a HIPAA violation for a covered entity to give out information before verifying the patient's identity - as in his opening statement.
2) When people ask for personal information, verify who they are.
3) Not all health care personnel in the US really know and understand HIPAA rules.
4) Patients need to be vigilant about their health care AND their personal information.
My cell phone rang the other day and I answered it "hello." What follows is the gist of the conversation. I could be partially wrong in the exact wording, but the meaning remains the same. I have changed Paul's name to protect the unknowing.
K: Hello
Bob: Hi. I'm calling to speak with K Royal about an emergency room visit to blah blah hospital on this past Saturday on February 8.
(please note - at this point, he has disclosed my protected health information if someone other than me had answered the phone).
K: this is K.
B: Hi, this is Bob, an RN at blah blah hospital. Before I go any further, I need to confirm your identity to maintain confidentiality. What is your date of birth?
K: (really?! you've already blown it, mister) Hi Bob, can you confirm your identity to me before I provide you with my date of birth?
B: Uh, no.
K: So there is nothing you can do, at all, to prove you are calling from the hospital? (I was expecting him to say - sure, call the hospital and ask for me or my extension)
B: No. can't think of anything. I just want your date of birth.
K: Okay, let's try this - tell me if you are calling to survey me on how well your service was or if you want to discuss something of a medical nature.
B: Ma'am, I can't tell you that. It violates HIPAA.
K: Actually, it does not. I am not asking you to give me any personal or protected information. I am just asking for the general nature of your call.
B: Ma'am that does violate HIPAA. HIPAA won't let me tell you the purpose of my call.
K: Bob, I am a privacy attorney and very familiar with HIPAA, I can assure you that it does not. How about this...are you calling to survey me about your service? cause if you are, it was fabulous and I felt everything went smoothly.
B: Ma'am, I cannot answer that question because it would violate HIPAA. And if you won't give me your date of birth, we seem to have a problem. I know HIPAA very well - and it won't let me continue without it.
K: Bob, I actually seem to know HIPAA better than you do ... at least in this instance ... because HIPAA would not stop you from answering that question.
B: So what do you want to do?
K: I guess we're at an impasse, Bob. You cannot verify who you are or where you are calling from, you want me to provide you with even further personal information, and you won't tell me the purpose of your call. Sooooo, I think we're done here - and I truly hope you were not calling to tell me something popped up on the tests and I am dying. Feel free to call me back when you either learn more about what you can say under HIPAA or can provide verification of who you are. Have a good afternoon. Bye bye.
I called the privacy officer and left a message to call me. Nothing.
So what did we learn here (other than stupid stuff like this brings out my snarky side)?
1) It is a HIPAA violation for a covered entity to give out information before verifying the patient's identity - as in his opening statement.
2) When people ask for personal information, verify who they are.
3) Not all health care personnel in the US really know and understand HIPAA rules.
4) Patients need to be vigilant about their health care AND their personal information.
Monday, February 10, 2014
Why are the people in the U.S. so blase' about Privacy?
So this was the question I received today about privacy: "Why are people in the U.S. so blase' about privacy?"
Frankly, my dear, I don't know.
I do have some theories that my mind is sorting through as I write - and if you have some thoughts (yes, you, the one person who is reading this), please do write me and let me know your opinion.
First, I do not think it is related to the fact that we do not have an explicit right to privacy guaranteed to us in the U.S. Constitution. However, I do think it is related to what rights we are guaranteed and how those rights have been enforced over the years. Most importantly, I think the freedom of speech as personified through the freedom of the press has been a huge factor in how blase' we are about privacy. As citizens, we are allowed to say what we want to say (in general), do what we want to do (shy of breaking laws), move where we want to move, live how we want to live, love as we desire - and act on that love. Freedom of speech includes our actions, our apparel, and our writings. And this freedom comes with a price - that we are ever so willing to pay - the lack of privacy.
Next, the American dream reinforces the lack of privacy. To achieve our dreams - or at least for those ridiculously mega-rich people to achieve their dreams, they take chances and go where no one has gone before, with information, brazenness, and wild willingness to use any tools at their disposal. Information is mostly free and can be used in ways that the average person would find mind-boggling.
Additionally, most Americans have not suffered atrocious crimes and deeply personal invasions like countries with currently strong privacy laws have in the past - where thousands of people were tortured and killed based on information, like their race, religion, or even just their name.
Thus on one hand, we see benefits in the freedom of information and on the other hand, we see no penalties in the misuse of information. I have often been told that if a company treats personal information with the respect other nations require, the company would lose its competitive edge. So what would motivate us to care? When I posted previously questioning why we are not outraged at the NSA, one of the responses I got was that once the PATRIOT ACT was enacted, any person who read it or watched the news knew that we now had no right to privacy. In a way, I agree. Not enough people were outraged then - and you cannot let the exploding holes in the dam go unnoticed and then complain about a flooded home.
We need a fundamental shift in our thinking. Information is a power tool. And it can be dangerous in the wrong hands. It can be dangerous in the right hands - if those are not your hands holding your own information. We need to be stingy. For example, unless you are on a government health insurance program or workers' comp, your doctor does not need your social security number. Such a simple thing. But try telling your doctor he/she does not need it and they freak out - they are so used to getting it, they just want to fill the blank. So I just pretend not to know it. "Ooops sorry. Don't carry the card either, but I'll really try to remember to bring it the next time." Not.
Frankly, my dear, I don't know.
I do have some theories that my mind is sorting through as I write - and if you have some thoughts (yes, you, the one person who is reading this), please do write me and let me know your opinion.
First, I do not think it is related to the fact that we do not have an explicit right to privacy guaranteed to us in the U.S. Constitution. However, I do think it is related to what rights we are guaranteed and how those rights have been enforced over the years. Most importantly, I think the freedom of speech as personified through the freedom of the press has been a huge factor in how blase' we are about privacy. As citizens, we are allowed to say what we want to say (in general), do what we want to do (shy of breaking laws), move where we want to move, live how we want to live, love as we desire - and act on that love. Freedom of speech includes our actions, our apparel, and our writings. And this freedom comes with a price - that we are ever so willing to pay - the lack of privacy.
Next, the American dream reinforces the lack of privacy. To achieve our dreams - or at least for those ridiculously mega-rich people to achieve their dreams, they take chances and go where no one has gone before, with information, brazenness, and wild willingness to use any tools at their disposal. Information is mostly free and can be used in ways that the average person would find mind-boggling.
Additionally, most Americans have not suffered atrocious crimes and deeply personal invasions like countries with currently strong privacy laws have in the past - where thousands of people were tortured and killed based on information, like their race, religion, or even just their name.
Thus on one hand, we see benefits in the freedom of information and on the other hand, we see no penalties in the misuse of information. I have often been told that if a company treats personal information with the respect other nations require, the company would lose its competitive edge. So what would motivate us to care? When I posted previously questioning why we are not outraged at the NSA, one of the responses I got was that once the PATRIOT ACT was enacted, any person who read it or watched the news knew that we now had no right to privacy. In a way, I agree. Not enough people were outraged then - and you cannot let the exploding holes in the dam go unnoticed and then complain about a flooded home.
We need a fundamental shift in our thinking. Information is a power tool. And it can be dangerous in the wrong hands. It can be dangerous in the right hands - if those are not your hands holding your own information. We need to be stingy. For example, unless you are on a government health insurance program or workers' comp, your doctor does not need your social security number. Such a simple thing. But try telling your doctor he/she does not need it and they freak out - they are so used to getting it, they just want to fill the blank. So I just pretend not to know it. "Ooops sorry. Don't carry the card either, but I'll really try to remember to bring it the next time." Not.
My review of the book: The Future of Privacy posted on IAPP
https://www.privacyassociation.org/publications/book_review_the_future_of_privacy
January 28, 2014
By K Royal, CIPP/US, CIPP/E
Being a strong believer in taking a pragmatic approach to compliance, I was incredibly pleased to read The Future of Privacy by Eduardo Ustaran, CIPP/E, published by DataGuidance. In general, I find the books available through the IAPP to be thorough, on point and useful to privacy professionals. This book went the further step and was actually fun to read and useful to those of the general public who have an interest in privacy.
Ustaran writes in a manner that is easy to comprehend and practical, yet steeped in substantive law. It’s like sitting comfortably with an expert who shares his insight and expertise as a conversation—at times relaxed and sometimes highly animated. And the timing for this book is perfect. At no other time in recent history have privacy and its challenges been at the forefront of global news.
The Future of Privacy is divided into three parts: “Catalysts,” “Policy Making” and “Compliance.” “Catalysts” provides a simplistic yet robust summary in three chapters covering of the evolution of technology, the value of data and data globalization. We start with the terminology: Information Superhighway, the Internet of Things, the cloud, cookies, social networking and the mobile ecosystem. This foundational coverage continues with analytics, Big Data and behavioral targeting.
Part I segues into Part II, “Policy Making” with frank coverage of the globalization of data. Ustaran clearly believes that the prohibition on data exportation prevalent in many nations’ laws is exasperating. It is also naïve in the technological age in which we live and function. Part II discusses regulating technology, policy-making, interoperability and incentivizing compliance. Ustaran recommends “just in time” regulation that is lean and consistent. Within these three chapters come the concepts of Privacy by Design, a global privacy blueprint and mutual recognition.
The book concludes with Part III on “Compliance,” perhaps the most critical section for privacy professionals. In Chapter 7, we start to see more of Ustaran’s European roots. He discusses the evolution of transparency in the use of an individual’s data, recognizing the debate about whether individuals have true control over the use of said data, anonymization, privacy and security by default rather than design and finally, the role of safe processors. He continues this discussion in the next chapter from the perspective of data as an asset—which may be controversial to some privacy professionals. He is clear that irrespective of a privacy professional’s belief in the idea of data as an asset, our roles depend on managing this idea and being committed to finding the right approach. The concluding chapter of the book addresses accountability in an era of competing regimes, uncertainty of law and the cost of consistency. He supports privacy within an organization as a team effort and advocates for the use of privacy impact assessments. He tackles the topic of global privacy compliance and advocates for the EU’s Binding Corporate Rules as a corporate framework. Ustaran concludes with two sentences: “We just need to get cracking because the future is here. Now.”
Generally, I read privacy and/or compliance books because I must in order to do my job. It’s rarely amusing or captivating, even when the book is well-written by a noted expert in the subject matter. Yet, this book is different. And the difference is in the presentation and writing style. The law is provided through thoughtful analysis wrapped in delightful examples and honest opinions. Whether you are new to privacy law or already immersed in its depths, this book is one that you should have—and not just on the bookshelf. Take notes in the margins, because you are just as likely to find yourself disagreeing with various points, questioning their validity or simply taking a deeper look into certain elements. This is the challenge of such a book; rather than merely absorbing the law dryly and reciting it back iteratively, it initiates thinking processes. It dares you to skim across and engages you in thought-provoking analysis.
Ustaran presents his beliefs without hesitation, but in his forthrightness, the reader responds with the same honesty—whether in agreement or not. This is the power of such a book, defining one’s own professional and personal belief system about privacy and forming a foundational understanding of technology and policy-making. I do not know if a global compliance program is truly achievable, but like many other privacy professionals, I have to attempt it. I agree with Ustaran in that the future is here and we need to stop playing catch-up and develop a workable regulatory framework where there is a basic understanding of the role data plays and how to be transparent in that use. I highly recommend this book for privacy professionals and anyone else with an interest in data handling.
January 28, 2014
By K Royal, CIPP/US, CIPP/E
Being a strong believer in taking a pragmatic approach to compliance, I was incredibly pleased to read The Future of Privacy by Eduardo Ustaran, CIPP/E, published by DataGuidance. In general, I find the books available through the IAPP to be thorough, on point and useful to privacy professionals. This book went the further step and was actually fun to read and useful to those of the general public who have an interest in privacy.
Ustaran writes in a manner that is easy to comprehend and practical, yet steeped in substantive law. It’s like sitting comfortably with an expert who shares his insight and expertise as a conversation—at times relaxed and sometimes highly animated. And the timing for this book is perfect. At no other time in recent history have privacy and its challenges been at the forefront of global news.
The Future of Privacy is divided into three parts: “Catalysts,” “Policy Making” and “Compliance.” “Catalysts” provides a simplistic yet robust summary in three chapters covering of the evolution of technology, the value of data and data globalization. We start with the terminology: Information Superhighway, the Internet of Things, the cloud, cookies, social networking and the mobile ecosystem. This foundational coverage continues with analytics, Big Data and behavioral targeting.
Part I segues into Part II, “Policy Making” with frank coverage of the globalization of data. Ustaran clearly believes that the prohibition on data exportation prevalent in many nations’ laws is exasperating. It is also naïve in the technological age in which we live and function. Part II discusses regulating technology, policy-making, interoperability and incentivizing compliance. Ustaran recommends “just in time” regulation that is lean and consistent. Within these three chapters come the concepts of Privacy by Design, a global privacy blueprint and mutual recognition.
The book concludes with Part III on “Compliance,” perhaps the most critical section for privacy professionals. In Chapter 7, we start to see more of Ustaran’s European roots. He discusses the evolution of transparency in the use of an individual’s data, recognizing the debate about whether individuals have true control over the use of said data, anonymization, privacy and security by default rather than design and finally, the role of safe processors. He continues this discussion in the next chapter from the perspective of data as an asset—which may be controversial to some privacy professionals. He is clear that irrespective of a privacy professional’s belief in the idea of data as an asset, our roles depend on managing this idea and being committed to finding the right approach. The concluding chapter of the book addresses accountability in an era of competing regimes, uncertainty of law and the cost of consistency. He supports privacy within an organization as a team effort and advocates for the use of privacy impact assessments. He tackles the topic of global privacy compliance and advocates for the EU’s Binding Corporate Rules as a corporate framework. Ustaran concludes with two sentences: “We just need to get cracking because the future is here. Now.”
Generally, I read privacy and/or compliance books because I must in order to do my job. It’s rarely amusing or captivating, even when the book is well-written by a noted expert in the subject matter. Yet, this book is different. And the difference is in the presentation and writing style. The law is provided through thoughtful analysis wrapped in delightful examples and honest opinions. Whether you are new to privacy law or already immersed in its depths, this book is one that you should have—and not just on the bookshelf. Take notes in the margins, because you are just as likely to find yourself disagreeing with various points, questioning their validity or simply taking a deeper look into certain elements. This is the challenge of such a book; rather than merely absorbing the law dryly and reciting it back iteratively, it initiates thinking processes. It dares you to skim across and engages you in thought-provoking analysis.
Ustaran presents his beliefs without hesitation, but in his forthrightness, the reader responds with the same honesty—whether in agreement or not. This is the power of such a book, defining one’s own professional and personal belief system about privacy and forming a foundational understanding of technology and policy-making. I do not know if a global compliance program is truly achievable, but like many other privacy professionals, I have to attempt it. I agree with Ustaran in that the future is here and we need to stop playing catch-up and develop a workable regulatory framework where there is a basic understanding of the role data plays and how to be transparent in that use. I highly recommend this book for privacy professionals and anyone else with an interest in data handling.
Subscribe to:
Posts (Atom)