Privacy & Information Security Law Blog

In conjunction with the celebration of its 10th anniversary on March 16, the International Association of Privacy Professionals is releasing a white paper on the future of the privacy profession entitled, “A Call for Agility: The Next-Generation Privacy Professional.”  When the IAPP initially was formed, the role of the chief privacy officer was newly emerging following the dot-com boom.  Over the past 10 years, the exponential increase in data collection and retention have propelled the privacy professional into senior levels of management.  Reflecting the growth of the privacy professional’s role, the IAPP’s membership has grown to include over 6,500 privacy professionals from businesses, governments and academic institutions across 50 countries.

The concept of protecting individuals’ privacy is not a new one.  In 1890, U.S. Supreme Court Justice Louis Brandeis famously wrote in the Harvard Law Review about the threats posed by “instantaneous photographs” and “numerous mechanical devices” to the private lives of individuals.  Since the 1990s, however, the ability to collect and store data electronically has led to greater regulation concerning how data are collected and used.  Such regulation has differed widely across the globe.  For example, in Europe, the focus has been on data protection and the fair processing of personal data, while in the U.S. much of the focus has been on data breach notification.  As the legal landscape continues to develop and corporations’ focus on privacy matures, privacy professionals will need to adapt.  The IAPP’s paper considers what skill set the privacy professionals of the future will need to succeed, how privacy programs will become more proactive and less reactionary, and why privacy should be viewed as an enabler rather than a hindrance.

The IAPP asserts that the privacy professionals of tomorrow will need to be more nimble:

The agile privacy professional is the next-generation privacy professional: an expert practitioner who is keenly attuned to cultural and regional distinctions as these continue to grow in an increasingly interconnected data economy; who can migrate and adapt to different roles within an organization and offer value at each; who exhibits both comfort and grasp of legal/compliance and technical disciplines; and who instills direction and leadership of privacy management within the organization.

While in the past privacy professionals have come from strict legal or information technology backgrounds, business experience appears increasingly essential.  Depending on the organization, backgrounds in marketing, customer service, compliance and communications also will be helpful.  Michelle Dennedy, Vice President of Security and Privacy Solutions at Oracle Corporation, stated: “We need two types of privacy professionals.  One, the great lawyer who is a tactical, focused specialist.  Two, the broad-thinking, strategic person who integrates technology, law, marketing, and sociology.”

Bojana Bellamy, Director of Data Privacy at Accenture (UK) Limited, believes that “the real privacy professional does both.  I think this is somebody with a legal degree or background who has transcended a pure legal-advisory role and has become a trusted business advisor, as well as a complaints ombudsman, technologist, strategist, and government-relations person, a diplomat.”  With an increasing focus on the value of data, the most agile privacy professionals also will need to have an understanding of finance and economics to be able to quantify the value of information.

As the privacy programs led by veteran privacy professionals reach maturity, how will the privacy profession develop over the next 10 years?  Many believe the privacy profession will need to become more proactive and less reactionary.  In this regard, there will be a shift from a strict focus on regulatory compliance to a focus on information governance and optimization.  Organizations, and their privacy professionals, will begin to focus on the value of information and, according to Michelle Dennedy, once they determine the value of information they will need to determine “what would be a reasonable cost to protect it.”

As the role of the privacy professional changes over the coming years, the IAPP predicts that, “[t]he path the profession chooses could well determine whether privacy will be viewed as something bad that happens to you or the enabler of new horizons.”  Nuala O’Connor Kelly, Chief Privacy Leader and Senior Counsel at General Electric Company and the President of the IAPP, identifies four success factors for tomorrow’s privacy professionals:

One, making the case for privacy in positive, measurable terms. Two, obtaining cross-functional talent beyond privacy. Three, obtaining enough knowledge about technology and data systems to ask probing questions. Four, gaining international experience and cross-cultural literacy. This will only grow over time.

“A Call for Agility: The Next-Generation Privacy Professional” is now available in pdf form.