Tuesday, September 14, 2004

Privacy and knoweldge management

One of the areas that I'm interested in, when my mind is not filled with privacy law stuff, is knowledge management. Luckily the blogging world is full of tremendous resources that not only provide useful news in the area, but also very insightful commentary. "Portals and KM", a blog written by Bill Ives, is one the best. His blog has gotten me thinking about KM in new ways, and I'm delighted that I've been able to return the favour by encouraging him to think about privacy aspects of knowledge management and portals: Portals and KM: Privacy Issues in Intranets - PIPEDA.

Privacy and knowledge management seem to reflect opposite philosophies of information management. Privacy usually suggests locking down data and limiting its circulation. KM, on the other hand, is usually based on notions of free flows of information, at least within an organization. Canadian companies are now having to think about how to integrate the two. It can be done, but involves some serious thinking and perhaps a few additional administrative steps. For example, prior work product and "best practice" documents need to be scrubbed of personally identifiable information before they are made widely available. Information about employees made available on intranets should be limited to that which is necessary from a business point of view and employees should know about what is put up there. Limiting access is also a good idea, because an HR intranet with employee data should not be available to the rank and file.

Anybody proposing to implement a portal or intranet with employee information would do well to consider privacy at the earliest stages, particularly in this age of identity theft (and when studies are saying most ID theft is an inside job). Of course, an experienced privacy lawyer can help you through this process ...

2 comments:

Bill said...

David

Here is a follow-on to your dialog. I learned the value of legal input and the need to consider the legal perspective several years ago when I was involved in a major KM implementation. We thought we had covered all the bases and were about to go live when the head of legal said that his staff would have to review all input. This process would have put a bottleneck on the effort that would have killed it. However, he had very real and legitimate concerns. For example, the firm had confidentiality agreements with customers that had to be honored. So we worked out a compromise by establishing a plocies aorund intellectual property and confidentiality, as well as putting in some techncial safeguards on content. We had the head of legal come to the first session introducing the new KM system and we created a videotape of his comments to be used in subsequent sessions. After this experience, I was sure to include the legal group as a key KM stakeholder, both in implementations I did and in presentations I did on success factors in KM.

David T.S. Fraser said...

Very good comment, Bill. Thanks. You may be interested in the "Privacy Impact Assessment" methodology that is discussed briefly in this blog post: http://pipeda.blogspot.com/2004/06/privacy-law-and-project-management.html. It'll work for a portal roll-out (or other KM implementation) and makes sure that privacy aspects are considered at the very beginning, before it's too late or too costly to remedy.