1 00:00:00,000 --> 00:00:00,900 In this lesson, 2 00:00:00,900 --> 00:00:02,910 we are going to talk about data ownership 3 00:00:02,910 --> 00:00:05,760 and some of the things that are important inside of it. 4 00:00:05,760 --> 00:00:07,280 Now, when we talk about data ownership, 5 00:00:07,280 --> 00:00:10,498 this is the process of identifying the person responsible 6 00:00:10,498 --> 00:00:14,190 for the confidentiality, integrity, availability, 7 00:00:14,190 --> 00:00:16,860 and privacy of the information assets. 8 00:00:16,860 --> 00:00:18,720 Now, you might think that the data owner 9 00:00:18,720 --> 00:00:20,610 is the person who created the file 10 00:00:20,610 --> 00:00:22,440 but that's not what we're talking about. 11 00:00:22,440 --> 00:00:23,850 In an enterprise environment, 12 00:00:23,850 --> 00:00:25,059 there are different roles that fall 13 00:00:25,059 --> 00:00:28,290 under this idea of data ownership. 14 00:00:28,290 --> 00:00:30,750 These include things like the data owner themselves, 15 00:00:30,750 --> 00:00:34,290 the data controller, the data processor, the data custodian, 16 00:00:34,290 --> 00:00:37,320 the data steward, and the data privacy officer. 17 00:00:37,320 --> 00:00:39,450 Let's take a look at each of these. 18 00:00:39,450 --> 00:00:41,010 First, we have our data owner. 19 00:00:41,010 --> 00:00:43,456 This is going to be a senior executive role 20 00:00:43,456 --> 00:00:45,496 and they have the ultimate responsibility 21 00:00:45,496 --> 00:00:48,990 for maintaining the confidentiality, integrity, 22 00:00:48,990 --> 00:00:51,660 and availability of the information asset. 23 00:00:51,660 --> 00:00:55,050 So, what is the real role here as the data owner? 24 00:00:55,050 --> 00:00:57,330 It's not the person who created the file, 25 00:00:57,330 --> 00:00:59,130 it's the senior executive. 26 00:00:59,130 --> 00:01:01,316 And this data owner is going to be responsible 27 00:01:01,316 --> 00:01:03,330 for labeling the asset, 28 00:01:03,330 --> 00:01:07,380 ensuring that it's protected with the appropriate controls. 29 00:01:07,380 --> 00:01:10,306 So the data owner is going to say this type of information 30 00:01:10,306 --> 00:01:12,371 when we're dealing with it. 31 00:01:12,371 --> 00:01:15,090 Let's say, the balance sheets for the corporation, 32 00:01:15,090 --> 00:01:17,370 they should be protected as financial information. 33 00:01:17,370 --> 00:01:20,374 So, anybody who creates it will now follow my rules 34 00:01:20,374 --> 00:01:23,490 and label as financial information 35 00:01:23,490 --> 00:01:25,368 and we're going to protect financial information 36 00:01:25,368 --> 00:01:29,220 by doing X, Y, and Z, whatever those controls are. 37 00:01:29,220 --> 00:01:31,140 Next, the data controller. 38 00:01:31,140 --> 00:01:33,150 The entity that holds the responsibility 39 00:01:33,150 --> 00:01:34,376 for deciding the purposes 40 00:01:34,376 --> 00:01:37,666 and methods of data storage, collection, and usage, 41 00:01:37,666 --> 00:01:39,780 and for guaranteeing the legality 42 00:01:39,780 --> 00:01:43,110 of these processes is known as the data controller. 43 00:01:43,110 --> 00:01:46,096 The data controller holds the ultimate accountability 44 00:01:46,096 --> 00:01:48,030 for any breaches of privacy, 45 00:01:48,030 --> 00:01:51,870 cannot delegate this responsibility to another party. 46 00:01:51,870 --> 00:01:53,700 Next, the data processor. 47 00:01:53,700 --> 00:01:56,211 The data processor is a group or individual hired 48 00:01:56,211 --> 00:01:59,940 by the data controller to help with tasks like collecting, 49 00:01:59,940 --> 00:02:02,280 storing, or analyzing the data. 50 00:02:02,280 --> 00:02:04,950 They work under the direction of the data controller 51 00:02:04,950 --> 00:02:07,560 and follow their instructions for data collecting 52 00:02:07,560 --> 00:02:08,699 or processing. 53 00:02:08,699 --> 00:02:09,930 Now, the data steward 54 00:02:09,930 --> 00:02:12,150 is a role that's focused on the quality 55 00:02:12,150 --> 00:02:15,030 of the data and the associated metadata. 56 00:02:15,030 --> 00:02:16,800 The data steward is going to be somebody 57 00:02:16,800 --> 00:02:18,840 who is working for the data owner. 58 00:02:18,840 --> 00:02:20,715 They're going to be involved with making sure 59 00:02:20,715 --> 00:02:24,390 that the data is appropriately labeled and classified. 60 00:02:24,390 --> 00:02:26,280 So, we said that all financial data 61 00:02:26,280 --> 00:02:28,170 should be labeled as financial data, 62 00:02:28,170 --> 00:02:30,270 and it should be taken care of this way. 63 00:02:30,270 --> 00:02:32,460 That's going to be the role of the data steward 64 00:02:32,460 --> 00:02:35,310 to make sure that actually happens. 65 00:02:35,310 --> 00:02:38,910 Now, as we go down further, we get to our data custodian. 66 00:02:38,910 --> 00:02:40,440 That is the role that is responsible 67 00:02:40,440 --> 00:02:42,570 for handling the management of the system 68 00:02:42,570 --> 00:02:44,460 which data assets are stored. 69 00:02:44,460 --> 00:02:46,650 So, who might be a data custodian? 70 00:02:46,650 --> 00:02:48,990 Well, a system administrator. 71 00:02:48,990 --> 00:02:50,490 These are the people responsible 72 00:02:50,490 --> 00:02:53,828 for enforcing the access control, the encryption, 73 00:02:53,828 --> 00:02:57,450 and the backup recovery measures that protect this data 74 00:02:57,450 --> 00:03:01,380 based on the requirements set forth by the data owner. 75 00:03:01,380 --> 00:03:04,890 And so, you can see how all of this goes upward as you go. 76 00:03:04,890 --> 00:03:06,780 Then we have our privacy officer. 77 00:03:06,780 --> 00:03:08,760 Now, this is a role that is responsible 78 00:03:08,760 --> 00:03:11,910 for the oversight of any kind of privacy related data. 79 00:03:11,910 --> 00:03:15,330 Things like PII, SPI, or PHI, 80 00:03:15,330 --> 00:03:17,018 any of those things that are managed by the company 81 00:03:17,018 --> 00:03:20,000 fall under the realm of the privacy officer. 82 00:03:20,000 --> 00:03:23,053 This is the person who's going to really be on the hook 83 00:03:23,053 --> 00:03:24,750 if you have a data breach, 84 00:03:24,750 --> 00:03:27,270 because normally, when you have a data breach, 85 00:03:27,270 --> 00:03:28,560 what people are concerned about 86 00:03:28,560 --> 00:03:31,530 is the privacy of user data that has been expelled, 87 00:03:31,530 --> 00:03:34,320 and so, that is going to be what they're focused on. 88 00:03:34,320 --> 00:03:36,256 They have to make sure that we are complying 89 00:03:36,256 --> 00:03:39,000 with legal and regulatory frameworks 90 00:03:39,000 --> 00:03:40,646 and make sure that we have the right purpose, 91 00:03:40,646 --> 00:03:43,050 limitations, and consent. 92 00:03:43,050 --> 00:03:44,670 We're doing data minimization, 93 00:03:44,670 --> 00:03:46,620 data sovereignty, data retention, 94 00:03:46,620 --> 00:03:48,900 all the stuff we've been talking about in this section 95 00:03:48,900 --> 00:03:51,300 falls under the privacy officer. 96 00:03:51,300 --> 00:03:54,000 Now, the real question is who should own the data? 97 00:03:54,000 --> 00:03:55,740 Now, in a lot of organizations, 98 00:03:55,740 --> 00:03:58,079 they try to make the CIO or the IT department 99 00:03:58,079 --> 00:04:01,500 in charge of all the information and be the data owners, 100 00:04:01,500 --> 00:04:03,690 but that is the wrong answer because, 101 00:04:03,690 --> 00:04:06,570 as the IT personnel, we don't know much about the data, 102 00:04:06,570 --> 00:04:08,160 we know about the systems. 103 00:04:08,160 --> 00:04:10,050 We should be the data custodians. 104 00:04:10,050 --> 00:04:12,450 Instead, the data owners should be somebody 105 00:04:12,450 --> 00:04:13,860 from the business side. 106 00:04:13,860 --> 00:04:16,589 People who are creating this information. 107 00:04:16,589 --> 00:04:19,410 Each data owner can actually be specified 108 00:04:19,410 --> 00:04:21,779 inside their own department. 109 00:04:21,779 --> 00:04:24,194 So, for instance, you might have the accountant department 110 00:04:24,194 --> 00:04:26,248 have their leader be the data owner, 111 00:04:26,248 --> 00:04:29,490 and they would have a data owner over their information, 112 00:04:29,490 --> 00:04:31,435 because if I, as the IT person, 113 00:04:31,435 --> 00:04:33,630 am looking at some accounting data, 114 00:04:33,630 --> 00:04:35,565 I don't know it well enough to be able to classify it 115 00:04:35,565 --> 00:04:36,990 at the right level. 116 00:04:36,990 --> 00:04:38,310 So, this is one of those things 117 00:04:38,310 --> 00:04:40,200 that I think is really important 118 00:04:40,200 --> 00:04:43,170 is that IT people should not be the data owners, 119 00:04:43,170 --> 00:04:45,390 and the data owners should really be the people 120 00:04:45,390 --> 00:04:46,643 who know more about the data 121 00:04:46,643 --> 00:04:48,900 based on the context of the company. 122 00:04:48,900 --> 00:04:51,480 So, if your company is a software development company, 123 00:04:51,480 --> 00:04:53,100 then the software design department 124 00:04:53,100 --> 00:04:54,870 should probably be the data owner. 125 00:04:54,870 --> 00:04:56,190 If you're an accountant firm, 126 00:04:56,190 --> 00:04:59,010 it should be the financial department or the CFO, 127 00:04:59,010 --> 00:05:00,720 somebody who knows about the data 128 00:05:00,720 --> 00:05:02,340 who can make the right decisions 129 00:05:02,340 --> 00:05:04,200 as far as labeling and classification. 130 00:05:04,200 --> 00:05:06,543 That is who your data owner should be.