Maintaining the data privacy champion function

In an orchestra, the tenors, the drummers, the flautists, and other members make up the show. Without one function the presentation will be out of sync. In data privacy also, the data privacy function can’t be solely the job of the data protection officer or the data privacy team. For any data privacy programme to work effectively, every business function needs to contribute towards building a holistic privacy approach that would make the company achieve its privacy missions. Yet, most companies are in doubt whether they need data privacy champions in their company or not. The simple answer is yes. In this article I highlight some motivations for having privacy champions in any organisation, strategies to achieve this and some challenges.

Privacy champions play a useful role in any company especially with privacy-respecting development culture. In a particular company, some stakeholders were about to launch a particular project “quickly” to meet revenue quotas. However, the data privacy champion in that department was suspicious about the new project because there seems to be large-scale monitoring and profiling of data-subjects. The data privacy champion raises questions about the process and alerts the data privacy team about this new project. In essence, one of the features of a data privacy champion is to be the eyes and ears of the data protection officer and data privacy team. Attaining such radical cultural shifts within organisations can be a gargantuan task and yet represents a level of necessity.

What motivates privacy champions within organisations to act accordingly? What motivates individuals are usually personal and organisational. On a personal level, most privacy champions draw motivations from strong personal privacy attitudes, meaning they consider the human rights and societal benefits of companies treating data privacy as a mission and show empathy towards users. Another motivation is maintaining a sense of personal responsibility to ensure that the company is building products and services that protect privacy. These motivations usually can serve as enough boost for the data privacy champions within an organisation. Other motivations might be from personal experience, big media stories, etc.

From an organisational perspective, privacy champions work in promoting user privacy as a competitive advantage or even existential requirement. They consider the business benefit of putting privacy first and how this could positively inspire an increase in the company’s revenue

There are pressing challenges for companies that decide to keep/maintain privacy champions within their company. When privacy champions perceive privacy attitudes from their teams and organisations, this usually makes them feel like their work is not appreciated. I have been in meetings where nominated privacy champions wore frustration on their faces and didn’t see the impact of their role. I think in my book this is one of the biggest challenges in maintaining that data privacy champion motivation within the business.

The best strategy toward ensuring that privacy champions are supported and motivated is usually through effectiveness of enforcement of the policies regarding data privacy. For instance, if a company maintains that they have a clear desk policy, then they must take effective steps to mesh out disciplinary actions when such policies are flouted.

This is not to say the bulk of privacy work should be dumped at the foot of privacy champions. The privacy team still needs to do the groundwork and gain the support of the privacy champions as they aim to meet their business missions, but the presence of these champions can help promote and maintain that culture.

• business a.m. commits to publishing a diversity of views, opinions and comments. It, therefore, welcomes your reaction to this and any of our articles via email: comment@businessamlive.com