On protecting our personal data

The personal data of every Chilean fits comfortably on a USB stick. Today, a standard laptop can process all of that data without any sophisticated software tools.

Information is the most valuable resource companies have today, and the need to get data about people creates strong pressure to collect as much information as possible. I have often seen information requested “just in case it’s needed later on”. The problem is that once the information is collected it sits in a database, which is normally accessible to a lot of people inside the company, who can export it to external media and release it easily. One example is the WikiLeaks leaks: even though the communication channels are encrypted and highly secure, in the end the information was accessible to thousands of people around the world, which made its release easy.

There are laws that empower state institutions to request information about people from private institutions, in order to provide some service or benefit. That, which is fine in principle, runs into the problem that when it comes to implementation, state institutions ask for more data than they need to operate, and it is not clear what they need that additional data for.

There are frameworks, best practices for handling information securely, which for many companies are mandatory, given the levels of auditing they are subject to. For example, companies listed on US stock exchanges have to comply with the rules laid down by the Sarbanes-Oxley Act (SOX), which requires implementing a series of controls over information technology. The framework adopted for handling information technology is COBIT, which requires defining and declaring information control objectives, which are reviewed and certified by external auditors, usually as part of a report such as SAS70.

But what about the state? Is there some kind of SAS70 that tells us how information is handled in the state? I don’t know; I leave the question open to the experts on these matters. Could the transparency law end up forcing the implementation of best practices for handling information, such as COBIT, across the state apparatus? We citizens need to know what is done with our information, who accesses it, and for what purposes. Transparency of processes is, in the end, the best defense of our personal data.