regulated data, are more likely to simply have someone whose task is to be up to date on regulations and have a deep understanding of which ones apply to the data the company collects. Privacy tsar (governor) We chose to title this hat privacy tsar because this is a term we use internally at Goo‐ gle, but this hat has also been called governance manager, director of privacy, and director of data governance in other literature. The key tasks of this hat are those which ensure that the regulations the legal department has deemed appropriate are followed. Additionally, the privacy tsar also generally oversees the entire governance process at the company, which includes defining which governance processes should be followed and how. We will discuss other process approaches later in this chapter. It’s important to note that the privacy tsar may or may not have an extremely techni‐ cal background. On the surface it might seem that this hat would come from a techni‐ cal background, but depending on the company and the resources it has dedicated to its data governance efforts, these tasks are often performed by people who sit more on the business side of the company rather than on the technical side. Understanding the movement of people is of utmost importance when it comes to battling COVID-19. Google, a company that processes significant amounts of highly personal data that includes location information, was torn between helping health‐ care providers and authorities to battle the deadly pandemic more effectively and pre‐ serving the trust of the billions of people worldwide who use Google’s services. Privacy tsar, work example 1: Community mobility reports. The challenge of preserving privacy while at the same time providing useful, actionable data to health authorities required the full attention of Google’s privacy tsars, the people entrusted with creating the internal regulations that make sure that technology does not intrude into users’ personal data and privacy. The solution they found was to provide information in an aggregated form, based on anonymized sets of data from only those users who have turned on “location history” in Google’s services.1 This setting is off by default, and users need to “opt in” to enable it. Location information history can always be deleted by the user at any time. In addition, differential privacy (a technique covered in Chapter 7) was further used to identify small groups of users with outlier results and eliminate those groups com‐ pletely from the provided solution. Another differential privacy technique was employed to add statistical noise to the results; the noise, statistically irrelevant for aggregates, helps ensure that no individual can be tracked back through the data. 1 See Google’s “Community Mobility Reports” for more on this. The People: Roles, Responsibilities, and Hats | 59 The result is a useful set of reports tracking communities and changes in behavior over time. Health officials can then assess whether “stay at home” orders are being complied with, and trace back sources of infection due to people congregating. In Figure 3-1, we see the results of that work. A sample from the report for San Fran‐ cisco County shows increased people presence in residential areas (bottom right) but a reduced presence across the board in retail sites, grocery stores, parks, transit sta‐ tions, and workplaces. Note that no individual location is named, yet the data is use‐ ful for health officials in estimating where people congregate. For example, an order about the reopening of retail stores can be considered. Figure 3-1. Example from the Google mobility reports Privacy tsar, work example 2: Exposure notifications. An even more daunting task related to COVID-19 is how to safely (from a privacy perspective) inform people about pro‐ longed exposure to a person diagnosed with COVID-19.2 Because the virus is highly contagious and can be transmitted through the air, identifying exposures and making sure people who were inadvertently exposed to a positively diagnosed person get tes‐ ted (and isolate themselves if testing positive), is crucial to breaking infection chains and limiting outbreaks. This process is a recognized technique in battling infections 2 For more about exposure notifications, see “Exposure Notifications: Using Technology to Help Public Health Authorities Fight COVID‑19” and “Privacy: Preserving Contact Tracing”. 60 | Chapter 3: Ingredients of Data Governance: People and Processes and is otherwise known as contact tracing. Technology can augment this technique by immediately alerting the individual as an alternative to a prolonged phone investiga‐ tion in which public health authorities question a positively diagnosed individual as to their whereabouts over the incubation period. (Many people cannot accurately identify where they have been over the course of the past few days, nor can everyone easily produce a list of all the people they have interacted with over the course of the past week.) However, a positive COVID-19 diagnosis is highly personal, and having this informa‐ tion delivered to everyone that a diagnosed person came in contact with is an emo‐ tionally loaded process. Furthermore, having your technology do that for you is highly intrusive and will cause resistance to the point of not enabling this technology. So how does a privacy tsar thread the needle between preserving personal informa‐ tion and privacy and combating a deadly disease? The solution that was found maintains the principles required to ensure privacy: • It must be an “opt-in” solution—the people must enable it, and the product pro‐ vides information to ensure consent is acquired after being informed. • Since the topic is whether or not the subject was next to a diagnosed person, location information, though it might be useful to health authorities to under‐ stand where the incident occurred, is not collected. This is a decision made by the privacy tsar in favor of preserving privacy. • The information is shared only with public health authorities and not with Goo‐ gle or Apple. So how does the solution work? Every phone beams a unique yet random and fre‐ quently changing identifier to all nearby phones; the phones collect the list of bea‐ cons, and this list is matched with anyone who has reported their diagnosis. If your phone was in proximity to the phone of someone who has uploaded a positive diag‐ nosis, the match will be reported to you (see Figure 3-2). Note that the identity of the infected individual is not reported, nor is the specific time and place. Thus the crucial information (you have been near a positively diagnosed individual so get tested!) is shared without sacrificing the privacy of the infected individual. The People: Roles, Responsibilities, and Hats | 61 Figure 3-2. Excerpt from the Google/Apple guide to the exposure notification technology Data owner (approver/governor) In order for the privacy tsar’s governance strategy/process to be realized, the data owner is needed.3 The tasks of the data owner include physically implementing the 3 While “classical literature” on data governance often separates data owners and data custodians (the former residing more on the business side of things, and the latter more on the technical side), during the course of our research and interviews with many companies we found that, in practice, these two “sides of the coin” are often conflated, and the actual tasks of data ownership tend to fall on those with technical expertise. 62 | Chapter 3: Ingredients of Data Governance: People and Processes
