Privacy Perspectives

Bayne: Hello, and welcome to EDUCAUSE Exchange, where we focus on a single question from the higher ed IT community and hear advice, anecdotes, best practices and more. As institutions have moved to more remote learning and remote work due to the COVID-19 pandemic, privacy issues have been a big part of the conversation but there's more than one type of privacy and giving a clear picture of what privacy means as part of raising awareness. So today's topic is, what are privacy officers talking about when they talk about privacy? And why is it important?

Bermann: I'm going to comment about the term data privacy because it's been a bugaboo of mine since really moving into the privacy world through out these many years ago.

Bayne: That is Sol Bermann, Chief Information Security Officer and Executive Director of Information Assurance at the university of Michigan Ann Arbor. He starts to tease apart some of the various aspects of privacy, by having a bone to pick with the term data privacy.

Bermann: We keep associating privacy so heavily with data. And I get why, I mean, we think about you know, identity, we think about sensitive personal information but I think we're increasingly seeing this isn't just about data anymore. We need to think about privacy in a more multifaceted way and I think about surveillance and privacy. We need to think about observational behaviors in privacy and those observational, the behaviors can be electronic and digital app observations of our behaviors. So it really does expand the conversation beyond data privacy. California Berkeley actually helped coin a term that I've used more around autonomy and privacy. So privacy of self, not just my data, but me.

Wada: One of the things that I think works against privacy so much is it's so hard for even privacy people to pin down this crisp definition that just resonates with people.

Bayne: Kent Wada is Chief Privacy Officer and Director for Policy and Privacy at the university of California, Los Angeles. He says that we're using so many different terms for privacy, such as data, privacy, information privacy, behavioral privacy...

Wada: You know, how are all these concepts related to one another? Because I do think people mean different things with those different terms and even the single word privacy, one of the things that has come up repeatedly, when you say the word privacy people either think of it in terms of what I think of as data protection, which in the soundbite is normal breaches or people think of privacy as surveillance. You know, the big brother concept. And the two types of privacy really are related obviously, but they are also very different. You know, typically the data protection and the normal breaches from a privacy is much more related to privacy law and compliance with privacy law. The surveillance aspects though is what I think most people are concerned about. If you just ask people what concerns them.

Sytch: I would not attempt to define privacy for people at the same time I think it's important to weave privacy concepts into everyday conversations and everyday activities and keep it relevant for people.

Bayne: Svetla Sytch, Assistant Director of Privacy and IT Policy at the university of Michigan Ann Arbor says that more important than defining privacy is keeping privacy in the conversation around people and processes within the institution.

Sytch: So the pandemic has been effective, albeit quite traumatic way of bringing privacy to the forefront and from the perspective our students or the community at large, they do see the headlines and the publications. And they're starting to ask the hard questions, you know why do you need my information? How do you plan to use it? How long are you going to keep it? So I don't think there are very many of our community members, less who haven't heard about privacy or considered it just some to some level. I definitely see that as a welcome development because it means that we're succeeding in our mission to educate.

Bermann: Individual liberties, civil liberties academic freedom, autonomy, human growth and development, they all have a privacy touch to them.

Bayne: Again, Sol Bermann.

Bermann: So we've been from the moment we started we've not been so hung up on the compliance piece even though it is important, but rather, you know I would say we've used compliance sometimes as a lever to have the bigger conversations about the importance of privacy.

Sytch: We do need to educate our students and show that yeah, hopefully universities and academic institutions are making those ethical decisions and are processing their information in an ethical and responsible way that may or may not happen and be the case once they leave. So it's important to recognize that and communicate it more widely to people.

Bayne: And so we've had the pandemic bringing privacy issues into the conversation. And this has been one of the few silver linings for privacy officers during this time.

So much of what they strive toward is simply awareness of the issues and acknowledgement of the trust that privacy can build among colleagues and institutions.

Wada: At every turn in our pandemic response there's a privacy issue that comes up and a pretty complicated one usually.

Bayne: Again, Kent Wada

Wada: Just you know, thinking about how to make adoption of a contact tracing app successful means you have to make people feel comfortable and trust that the data that is being collected will not be misused or used for purposes they didn't expect. I think this is ultimately a really good thing regardless of any of the decisions that are made on any one thing. The fact of the matter is privacy is now coming up in these conversations pretty routinely and every time it does so, you know, it further socializes, the notion that that's just part of what we expect to do on an ongoing basis, privacy is just part of the conversation.

Bermann: We're not weighing the benefits of data collection or observational behavior collection against purchasing something now. We're weighing it against public health and those considerations are a lot more important and perhaps leave more room for practices that maybe less comfortable with in other times

Kelly: We talk about awareness a lot in cybersecurity and information security. And we talk about awareness of threats and teaching our faculty staff and students about those threats.

Bayne: That's Brian Kelly. He's the director of our cybersecurity program here at EDUCAUSE.

Kelly: What the pandemic has done has elevated the conversation around privacy, whether that's through contact tracing or sharing of medical information. So to some degree, you know, using that as an opportunity to engage with our communities around privacy.

Bayne: Brian shares a resource for our listeners to learn more about the privacy issues facing higher ed. It's a report entitled, "The Evolving Landscape of Data Privacy in Higher Education."

Kelly: That landscape includes everything from the role of chief privacy officer, so evolving into a position in a defined position to how our campuses are thinking about the landscape of privacy. So we always approached it from a compliance perspective, you know, is this in compliance with GDPR or CCPA or another regulation? And that landscape is changing to have conversations around the collection and the use of privacy data or private information. So we see that paper as a great resource for no matter what lens you're coming to it from. Whether you're a CIO, a faculty member, a student a staff member, there's something in it for everyone to sort of give you that perspective of how privacy is evolving on our campuses.

Bayne: You can find that report at www.educause.edu/evolvingdataprivacy that's educause.edu/evolvingdataprivacy. I'm Gerry Bayne for EDUCAUSE. Thanks for listening.