Anonymized data can be a valuable resource for advancing research and achieving socially and organizationally beneficial outcomes. Effective and responsible use of anonymized data entails the establishment of good governance practices, both before and after anonymization. Establish policies, procedures, and roles for anonymization, communicate with stakeholders, and monitor for potential breaches. With these practices in place, organizations can leverage anonymized data to drive innovation and outcomes while managing residual risks.
Before Anonymization
As you prepare to use or share data for new or innovative purposes, you can create a governance plan that supports the safe and responsible enablement of protected data. Assessing the necessity and impact of the use or sharing, as well as the legal premise, will help you determine organizational risk appetite.
Consider the following four aspects to setting up governance for anonymized data:
- Assign roles and responsibilities for the anonymization process and safe handling of data. This will provide clarity and efficiency once it is clearly defined and communicated broadly. More detailed expert training can also be provided to employees who work closely with data.
- Establish principles, policies and procedures for the anonymization process. These will serve as the foundation for your organization’s approach to handling anonymized data, from monitoring for future risks to preparing for unintended disclosures.
- Communicate with stakeholders to ensure everything is understood. Start by identifying relevant stakeholders and engaging with them to determine their needs. Emphasizing beneficial uses of the data can be important in helping to create alignment.
- Know how to identify and manage a breach so that any incidents are handled swiftly. The contextual nature of anonymized data introduces some key differences. In particular, the identifiability of the data can be compromised in multiple ways that need to be assessed to determine the likelihood and impact of a breach.
Enable the reuse and sharing of protected data
Find out how data governance can support access and effective use of valuable data assets. Read this 8-page white paper.
After Anonymization
Once anonymized data is made available to end users, data governance can support norms for the safe and responsible use of the data are respected and maintained. While the data might have been considered safe at one point in time, monitoring can support ongoing use.
Consider the following four aspects to maintaining governance for anonymized data:
- Monitor the data environment for changes in the recipient and their conditions. You can monitor several factors to ensure the identifiability assessment remains valid or whether any changes are needed.
- Scan the horizon for changes to adapt to future data environments. Changes in regulations, legal precedents, technology, and data can change the evaluation of identifiability as well as expectations around data anonymization.
- Mitigate when there is an incident to contain a potential disclosure and control the impact. In the event of a potential disclosure, immediate action can contain the incident. Determine the extent of the incident and whether it constitutes a breach.
- Review and continuously improve your governance process. Periodically review assessments and make updates as needed. Adapt your governance to evolving views on the benefits and risks of reusing and sharing data.
Conclusions
While these are only the highlights of good governance for anonymized data, they follow best practice from industry standards and guidance for data protection and privacy authorities. With these practices in place, you can leverage anonymized data to drive innovation and outcomes, while also managing residual risks. Contact us to learn more and see how our advisory or consulting services can help you enable the safe and responsible uses of protected data.