Problem 04Privacy by Design
Insight Is Paid For in Personal Data.
You hold more than you should, because that appeared to be the price of knowing anything at all.
Understanding your workforce looks like it requires holding named records, so employee personal data accumulates - across systems, exports, and spreadsheets on individual laptops. Data minimisation and purpose limitation say one thing. The practical demands of analysis say another. The tension goes unresolved, exposure grows in the space between them, and every unaccounted-for copy makes a promise of confidentiality less credible to the people whose data it is.
What It Looks Like
From the inside, it looks like this
Personal data sprawl
The same employee exists in a dozen places, several of which are a spreadsheet nobody has opened since the person who made it left.
Retention by default
Records outlive their purpose because deletion is somebody's project and nobody's priority, and keeping them costs nothing visible.
Analysis as an export
Every question answered outside the system of record creates one more uncontrolled copy, and each copy is permanent in practice.
No assessment behind the analytics
Processing happens because it turned out to be useful, not because a lawful basis was established and written down first.
What It Costs
What it costs you
Exposure that scales with every copy, and questions you decline to ask.
A blast radius you cannot measure
One incident reaches as far as the copies extend, and nobody can state with confidence how far that is.
Access requests you cannot fully answer
You are obliged to disclose everything you hold about someone, which first requires knowing everything you hold.
Insight you decide not to pursue
Reasonable questions go unasked because the data handling they would imply is not something you would want to defend.
The Test
Questions you should be able to answer today
If any of these takes more than a moment, the exposure is not theoretical.
- Where does employee personal data actually live?
- Which of it are we still entitled to be holding?
- What is the lawful basis for our people analytics?
- Could we answer these questions without names at all?
- If we had a breach tomorrow, what would be in it?
“Insight and minimisation get treated as a trade-off. They only are one if you accept the terms the question was framed in.”
The Other Four