Narrator: Data sharing. 2 2
In this lesson, we're going to talk 3 3
about data sharing and some of the agreements you might use. 4 4
Now, one of the things I've mentioned earlier 5 5
in this class is that you can outsource a service 6 6
or an activity 7 7
but you can't outsource the legal responsibility for it. 8 8
Even if I give that job 9 9
to somebody else to do for me, I'm still responsible for it. 10 10
So, I can have somebody else do my bookkeeping 11 11
but at the end of the year, 12 12
the IRS is still going to come after me if it's done wrong. 13 13
And so, these are the things you have to think about 14 14
when you're dealing with data sharing 15 15
because this kind of stuff can come back to bite you. 16 16
Now we're going to talk about 17 17
four specific types of agreements. 18 18
We're going to talk about service level agreements or SLAs, 19 19
interconnection security agreements or ISAs, 20 20
non-disclosure agreements or NDAs, 21 21
and data sharing and use agreements. 22 22
Let's talk about each of these. 23 23
Now, a service level agreement 24 24
or an SLA is a contractual agreement. 25 25
Setting out the detailed terms 26 26
under which a service is being provided. 27 27
So I might have an SLA 28 28
between me and my ISP, my internet service provider. 29 29
It says they're going to provide me X amount of storage space, 30 30
X amount of bandwidth, X amount of uptime, 31 31
and X amount of hours a day of support. 32 32
That is all in contract, in writing 33 33
that we have both signed and we both agreed to. 34 34
Now, that means, I don't have to worry 35 35
about hosting my website, right? 36 36
Correct. 37 37
But if the site gets hacked, 38 38
guess who's still going to have to answer for it? 39 39
Me, because I'm still responsible. 40 40
My company is still responsible. 41 41
We've outsourced the task of running the web server 42 42
but we have not outsourced the responsibility. 43 43
You can't give away that responsibility. 44 44
The second one we're going to talk about 45 45
is an interconnection security agreement or ISA. 46 46
Now, an ISA is an agreement used by federal agencies. 47 47
So, we're talking about the US government here 48 48
to set out security risk awareness processes 49 49
and commit the agency 50 50
and suppliers to implementing security controls. 51 51
Now, essentially, 52 52
these are used when the federal government wants 53 53
to allow a third-party to connect into their system. 54 54
So, let's say, I got a big contract to take over 55 55
all of the IT training for the federal government. 56 56
They would want to connect 57 57
into my web server to allow all their users access. 58 58
We would have to have one of these 59 59
interconnection security agreements 60 60
and it might say 61 61
that every three months, we have to do a vulnerability scan 62 62
and give them a report. 63 63
We have to have all patches done within 30 days. 64 64
We have to have X, Y, and Z done, 65 65
whatever those requirements are to make sure 66 66
that our security requirements 67 67
meet their level of agreement. 68 68
That way, we're not just plugging bad networks 69 69
into the federal government's network. 70 70
That's what we're talking about with an ISA. 71 71
Next, we have our third one, which is an NDA 72 72
A non-disclosure agreement. 73 73
This is a contract that sets forth the legal basis 74 74
for protecting information assets between two parties. 75 75
So, I'm making a new course, for instance, 76 76
for another company. 77 77
We have an NDA that says, I can't disclose 78 78
what's in that course until it goes live and is published 79 79
because they want to make sure that their competitors 80 80
don't figure out what our table of contents 81 81
is going to look like and build a competing course. 82 82
That would be an NDA. 83 83
We can't tell other people outside of the two 84 84
of us what's going on. 85 85
I have some other partners that I work with 86 86
inside the business, and we have NDAs 87 87
with those organizations as well. 88 88
So, they can tell us things about future upcoming products 89 89
they might be working on, but I can't tell you about it 90 90
because you're not part of that NDA. 91 91
Only the two of us are. 92 92
And so we have this, basically it says, 93 93
I'm going to keep your secrets and you're going to keep mine 94 94
and neither of us will tell other people. 95 95
That's what an NDA does. 96 96
And then we have data sharing and use agreements. 97 97
Now, these are an agreement that sets forth the terms 98 98
under which personal data can be shared or used. 99 99
So, let's say, you bought this course 100 100
on some kind of a platform, and in part 101 101
of their privacy policy, it says, they can monitor your use 102 102
of the course, and they can use that to then sell that 103 103
to third parties to tell them 104 104
about e-learners in the market. 105 105
They can then say, "Well, out of all the students, 106 106
we have 50% finish all of their courses, 107 107
20% by a second course. 108 108
70% take courses in English. 109 109
Whatever those facts and figures are, 110 110
I'm just making that up. 111 111
But they can share that data with a third-party 112 112
if they have permission when they collected it from you 113 113
and they now have a data sharing agreement in place. 114 114
This is the idea of data sharing agreements. 115 115
I can take my corporate data that I've collected off 116 116
of those people that are using my service and then share it 117 117
with somebody else under the terms of that agreement. 118 118
Now, all of these things predicate themselves 119 119
on us having personal data on our users 120 120
and this becomes a large data set for us. 121 121
Now, these data sets may be subject to pseudonymization 122 122
or de-identification to remove personal data. 123 123
Now, we've talked a lot about privacy inside this course 124 124
and one of the ideas here 125 125
is that we can actually take your data 126 126
and we can de-identify you from it. 127 127
And that makes that data no longer personal data. 128 128
It just becomes big data. 129 129
And this is done a lot by a lot of different companies, 130 130
the Googles and the Facebooks and others of the world. 131 131
Even if they don't have permission, to have 132 132
your personal data, because you have opted out, 133 133
there might be information about you 134 134
at large that could be used if they de-identify you. 135 135
And what this means is we want to take out anything 136 136
that can identify you uniquely. 137 137
So, let's say, I'm an online training company 138 138
and I have lots of students in my site 139 139
but I never asked you if I could share your personal data. 140 140
Well, that means, I can't share your personal data 141 141
but I can de-identify you and then use that data. 142 142
And what I mean by this is I could say, 143 143
out of the 100,000 students who took this course, 144 144
99% passed on their first try. 145 145
Now that doesn't identify you 146 146
as one of my students in any way. 147 147
It doesn't identify you in the least. 148 148
You are just one of those 100,000. 149 149
So, that is now de-identified. 150 150
Or I can take smaller groups of information from my course. 151 151
For instance, I could say males who are 35 to 40 years old 152 152
pass at a rate of 80% or higher. 153 153
Females who are 18 to 24 pass at 99%. 154 154
And again, I'm just making up numbers. 155 155
This doesn't, these aren't real numbers 156 156
but it gives you the idea of how we can take subsets 157 157
of the larger data and it doesn't identify you uniquely. 158 158
This is the idea 159 159
of de-identification or pseudonymization, 160 160
by taking away those personal details and making it 161 161
about the larger group instead of an individual.