I’m writing to you as an EU Citizen who is passionate about data, is use, its quality, and its protection. I’m not writing to you as the Managing Director of a company that offers Data Protection training and consulting services, but in the interests of transparency I think it best to disclose that that is my day job.

I am writing to you about the new Data Protection Regulation. In particular I’m writing to you about the penalties contained in the current draft proposal. Frankly I think they suck. I don’t think they’ll have the effect that you think they will have. I’m basing my opinion on a number of bases:

1. I have worked in Regulatory Operations in a Regulated industry that you are familar with, telecommunications.
2. I’m a keen student of human psychology and economics, particularly the psychology and economics of risk and reward.Understanding this “theory of psychology” is important in the world of Information Quality.
3. I like to observe and learn from other industries and areas of life to see what can be applied to improving quality systems for and the governance of information.
4. I’m the parent of a toddler. This might not appear immediately relevant but, in the context of Data Protection, my immediate experiences dealing with a stubborn personality in development who is programmed to push boundaries and infuriate me with apparent disregard for the standard of behaviour expected of her all too often find their parallels in the management teams and staff of organisations I’ve worked with.

Taking these elements together I am afraid that 5% of Global turnover will not work as a penalty. It’s a great soundbite but will, in practical terms, amount to little more. There are a few reasons for this.

Firstly, no-one will believe that they and their organisation will be penalised to that level for a breach. The track record simply isn’t there for one. It is outside the normal sphere of experience. In my experience, when faced with the notional prospect of a monstrous penalty, executives start discounting down on the basis of what is likely to happen. Now, as someone with a light dusting of legal training, I know that that is just gambling. But senior executives gamble all the time. Small business owners gamble all the time. It’s called entrepreneurship though in that context, so that’s OK.

Also, humans are hardwired it seems to be really bad at assessing risks that fall outside their actual experience. So, that €2million/5% of global turnover amounts to a mountain on the horizon to most executives. Yes it’s big and impressive, but it seems so far away that it can be discounted. And hence the “So, what are we realistically going to have to pay out” conversation starts and it then becomes an NPV calculation for the bean counters to determine if there is enough revenue being generated from the breach of the rules to justify breaking the rules.

Hence telcos overcharge because the penalties levied have, by and large, been a lot less than the revenue uplift generated so the breaches became a cost of doing business and there was no incentive to improve processes and quality (which would have reduced costs to the telcos, arguably allowing them to increase profitability on a lower revenue base.. but I digress).

Similar behaviours can be seen in Financial Services, Oil and Gas exploration  – any industry where the revenue uplift of flouting regulation is greater than the likely financial penalty for breaches.

Add to this the fact that in most organisations the focus is short term, booking revenue today is a bigger driver than worrying about an as yet not crystallised penalty at some date in the future. People focus on the thing that is in front of them annoying them.

Which brings me to my toddler.

As someone who strives to be a good parent I know that I have to instil values and principles in my child so she will grow up to be able to make smart choices of her own. She acts up and answers back and does things I don’t approve of on a regular basis. She’s a toddler. That’s her job. As her parent I’ve realised that I’m more effective when I am providing regular minor ‘course corrections’ to her, gently shaping her behaviour as opposed to massive acts of discipline. And, if you can recall your childhood, being deprived of a beloved toy or being kept in when your friends play on the street outside is the toddler equivalent of a €2million fine.

My approach: smaller penalties, careful lectures, engaging on a more direct basis to develop values, reward good behaviours and discourage less desirable antics. This works more effectively I find than the approaches of other parents I might see in the supermarket engaging in “massive acts of discipline”, issuing warnings and threatened penalties, while all along their child mentally discounts the warnings and asks “So, what are you really going to do?”.

(Many of those children I fear will go on to become successful company managers).

My approach to parenting is mirrors in part by the approach that many European governments have taken to promoting improved driver safety and improved compliance with Road Traffic laws. These schemes impose a structured sliding scale of sanctions for different categories of offence. They often go hand-in-hand with the ‘nuclear option’ penalties of substantial fines and loss of driving licenses etc. My approach also mirrors the ‘Zero Defects Policing’ that famously made New York a safer place. And penalty points systems for road safety do allow an increased discretion for law enforcement between a stern talking to and on-the-spot fines or harsher penalties.

They also allow for lesser offences to be cumulative towards a larger penalty. This means that there is suddenly a constant pressure on the motorist to change behaviour. I link here to the Penalty Points scheme that operates in France. And here is the system from Ireland. And (so they don’t feel left out) the one from the UK. All of these systems operate on the basis that drivers who commit even small offences can have penalty points levied against them which add up and which stay levied against them (often with a financial penalty as well) for a period of time after each offence. This encourages longer term thinking. Because if you are on 9 points on your license in Ireland you will think twice about using your mobile phone while driving and having your license to drive revoked for a number of years.

With my daughter, there are some offences she commits as a toddler that will stay on her record until she is a teenager.

So, what has this got to do with Data Protection and proposed penalties that suck?

Penalty points schemes in motoring allow for a low impact, high frequency penalty for repeat offenders. The days of drivers taking chances with drink driving are now, gladly, fading in the rear view mirrors of most EU member states because there is a mechanism for wider enforcement of a range of offences in a quick, easy to understand way. Drivers take more care for fear not of a massive penalty but for fear of building up an accumulation of offences that will trigger a massive penalty over time.

By extending the application of the penalty over a longer period, it encourages more long term cultural change in driver behaviour to a more compliant set of habits and behaviours. And they are relatively easy to understand and communicate. If I drive while talking on my mobile phone in Ireland I know that I will get 2 points on my license and a €60 fine. I know I can challenge that in court but if I lose, I’ll have double the points and a €120 fine and I will be on my way to being disqualified from driving.

So I don’t use my mobile phone when driving.

In a Data Protection context a similar scheme could be implemented setting out minimum applicable penalties for a range of Data Protection offences such as failing to have a Privacy Statement/Fair processing notice on a website or failing to take appropriate measures to obtain verifiable consent for direct marketing, or failure to properly outline the fact and purposes of recording CCTV images. The list could be quite long.

This standard bill of offences and penalties could be standardised across Europe and could be at a low enough level that organisations would not be put off by the fines, but equally would be cumulative in nature so that a €480 fine for failing to apply a request to opt-out of direct marketing could quickly add up to a catalogue of offences that result in a €2million fine without any discretion on the part of the Data Protection Authority.

This scheme would give decision makers and Data Protection Officers in organisations a familiar framework to operate in when engaging in mental discounting and would put a floor on the penalty for breaches, just as the Regulation has raised the ceiling. This would change the dynamics of the economic discounting that we all do when faced with the risk of a penalty.

If the list of organisations against whom penalty points was levied in a given year was published (as part of the Annual Reports of Data Protection Authorities) it would also help organisations assess risks involved in choosing suppliers or partners. If an organisation is working through a large number of penalty points then perhaps the management culture isn’t mature enough to do business with, for example. Just like ‘boy racer’ drivers often rack up penalty points (and insurance costs) through immature driving habits.

While it would not bring the mountain any closer to the Data Controllers, it may bring them closer to the mountain.

This suggestion has featured in a number of reviews of the Regulation I have been involved in in Ireland and I wrote about it first as a thought experiment back in 2010. I hope you consider this as a transparent and flexible mechanism for the operation of administrative sanctions by Data Protection Authorities in the EU as part of the development of EU standards as a benchmark approach.

Combined with the enhanced penalties at the upper end of the scale (which repeat penalty point offenders would eventually reach), I believe this would be a fair, transparent, relatively easily administered system that would be easy for even the most ardent mental discounter to get their head around.

Yours

Daragh O Brien

The 9th Doctor

BBC’s iconic series of the same name. In a genre that often falls for the easy charms of technology to drive a story, The Doctor (a 930 year old, two-hearted time travelling Time Lord from the Planet Gallifrey) invariably highlights and thrives on the Human Factor – the innate potential, ingenuity and power of the human beings (a lesser species) who he befriends, protects, and travels with.

Over the years I’ve tried to adopt and adapt some of the principles of The Doctor’s approach to leading Information Quality and Governance change projects:

There is nothing that can’t be solved by confectionery

The good Doctor in a number of his incarnations (4th, 6th, 7th, and 8th as memory serves)  was renowned for, in moments of high tension, proffering some confectioneries (specifically Jelly Babies) to help lighten the mood and distract thought. They were an incredible tool that enabled him to befriend others and buy time to develop cunning plans. Doctor Who Jelly Babies (video montage)

The key lesson is that it is often useful to have a “quirky” way to break down barriers and get conversations going. The Doctor has Jelly Babies. I’ve used various props. Kathy Hunter of DQM Group made extensive use of home baked cakes and biscuits when she was in a previous role to help open conversations.

It’s Bigger on the Inside

The Doctor’s space ship/time machine is a Blue Box. It is a Blue Box because the advanced circuitry that let it change appearance to blend in in different timelines got stuck on “Blue Box” on a trip to London around 1963 (the year the series was first broadcast). The thing about the Blue Box is that it is “bigger on the inside”, a fact that The various companions’s to The Doctor remark on whenever they enter the Blue Box for the first time. Bigger on the Inside (Youtube) . Invariably, The Doctor takes the surprise in his stride, often forgetting how big a shot it is to people when they see the size of his Blue Box for the first time.

The Doctor’s Blue Box is called the TARDIS, which stands for Time and Relative Dimensions in Space. By being able to engineer time and space The Doctor’s race, the Time Lords could build infintely large space craft that could fit into a small space (like the back of a props van on a TV show).

What’s the parallel with Information Quality? Well, those of us who have worked in Information Quality often forget that it is a discipline that is very much “bigger on the inside”. When people look at Information Quality from the outside, they might be forgiven for thinking that it has the general dimensions of a Blue Box (so to speak) and it is only when they venture inside that they realise there’s more to it than meets the eye. If your perception of IQM is that it is Data Profiling and some Cleansing, it can be quite a shock when you uncover the Change Management challenges, the human psychology issues, and the legal and regulatory issues that can affect Information Quality strategies.

Often we hard-core practitioners take it for granted that its is bigger on the inside, because we’re on the inside looking out.

People First, Technology Second

Quite apart from the long running love affair The Doctor has had with the Human Race, every adventure winds up with The Doctor being outrageously brilliant as a Time Lord, but more importantly inspiring and encouraging brilliance in his Companions and others around him. Whether it is calling in favours from old enemies (in return for some jelly babies perhaps) or rallying demoralised troops in the face of battle or unnatural enemies, The Doctor puts people first, often appearing willing to sacrifice himself to protect others.

Technology is applied in innovative and outlandish ways to meet the objective of protecting people. Even The Doctor’s trusted sonic screwdriver is not used as a tool in its own right but as a means of enabling things to happen and for information to be gathered to support decision making.

From an information quality management point of view it is important that we remember this lesson – the technology should not dictate the solution and, ultimately, it is people who are the brilliant and innovative sources of solutions to problems. A Data Profiler will tell you that the data looks broken. A human being will figure out the best solution (new business rule, new tools etc).

In short, to paraphrase The Doctor: “People are FANTASTIC!!”

Conclusion

I’m very much of the view that we can learn a lot from arts and literature about ourselves and who we can aim to be in how we approach things. Science fiction TV programmes are no different to the works of Shakespeare in this regard. Perhaps we can achieve more sustainable successes in our Information Quality travels by learning some lessons from The Doctor:

1. Everybody likes Jelly babies – (what is your equivalent?)
2. Not everyone can see that this is actually Bigger on the Inside… and when they step into the world of Information Quality it can be a bit of a shock to the system.
3. Technology doesn’t fix things. People fix things, occasionally using technology to get there. Remember that people are FANTASTIC!!

Here’s a link to the Word Cloud for this blog. I think the theme of my personal blogging is clear from this image…

Not a great post to start 2011, but there is more to come (oh yes…)

After more than a decade of falling points and expanding career options, all signs were that getting into a reasonably fulfilling college course would be just a matter of filling in the forms. But the great recession has put paid to that. Certain courses are no longer attractive at all, such as those leading towards a career in property or construction. The inevitable swing towards the sciences or any course that might feed into Brian Cowen’s beloved “smart economy” will increase competition for places. This year more people will sit the Leaving Cert than ever before. And now there’s talk of a wave of the newly unemployed going back to college.

Oh. To put that another way:

Over reliance on the benign nature of an economic model in which effectively turning up and having a pulse assured you of a foot on the entry level (at least) rungs of an asset acquisition ladder has resulted in a shock adjustment when the dynamics of that economic model change due to external factors and internal market forces.

To me, this sounds a lot like what happened in the property bubble and crash in Ireland, when lots of people chased moderate amounts of property with apparently bottomless pots of mortgage money available from banks, resulting in prices rocketing. A lot of people over stretched themselves financially to buy a property and then found themselves in a state of shock when the arse dropped out of prices and they were left paying a gallon sized mortgage on a half-pint asset value. Which is interesting, given that she is the Property Editor of the Irish Times.

The points system is a very crude mechanism for managing supply and demand in the Irish 3rd level education system. The purpose it serves is simply to set a price on a particular path of learning based on complex factors such as:

• Supply
• Demand

Other factors which historically influenced the price included the actual price of going to University. When I started in UCD back in 1994, I had to pay a few thousand pounds in fees as well as administration charges. In the late 199os the then Labour government removed fees in an effort to open up access to education. It was a flawed idea as financial ability is not the driver or motivator to going to college in areas historically affected by high unemployment. Not actually having any role models or examples of success in education and a variety of other factors are as powerful (if not more powerful) inhibitors towards someone from a poorer socio-economic area going to college (particularly where grants and scholarships might otherwise be available for the financial aspects).

So, in the absence of fees we are left with just supply and demand.

In the absence of fees, universities are struggling to provide services and have had to cut back on course numbers and on numbers of courses to manage costs. Many University heads have argued for the reintroduction of some form of fee so that they can maintain their ability to keep the lights on and the blackboards primed for action. Ultimately, this has affected the available supply of places on courses.

Ms. Mulcahy is correct to point out that the arrival of 12000 or so mature students (23 years or over, not an army of the middle aged ) into the equation has increased demand for places. But she starts to diverge from reality a little when she begins to argue that they shouldn’t be allowed to go back to college, particularly when she implies explicitly states that they are “leaving the job search” to spend time “ogling young ones”.

This phrases are pejorative and prejudiced in the extreme. It is equally as likely that, having spent a number of years working and paying taxes and developing practical skills and experience, these mature students have identified that to achieve career progression in their field they need to have some additional qualifications on their resume.  Perhaps they had finished college with an Arts degree back in the 1990s but have found that after spending 10 years working in a particular industry they want to study in that field instead? In that case they won’t qualify for free fees or maintenance grants and will be paying their way to “learn something new”.  Or perhaps (like some relatives of mine) simply decided that while they had the points to get into a good course in college back in the early 2000′s, they were much happier making money in real estate or telecommunications or any other ‘boom’ industry.

My personal experience of having mature students in my class at undergrad level in the 199os and when I was teaching at postgrad level is that they tend to be more motivated, less inclined to focus on how they will be graded and more inclined to focus on whether they actually know their stuff, and more willing to engage in discussion about topics for the benefit of the entire class.  Perhaps the fact that they have actually had to either give up work or take on a big financial commitment to come to college means that they actually don’t mind working hard. And this was not a “grey workforce”. Remember that a mature student is anyone over 23.

Ultimately, what it meant for me as an undergrad was that I had to pull my socks up as these motivated people were my competition for grades. For the Leaving Cert class of 2010 it means that that competition for grades has started a few months earlier than it would have, because Supply and Demand and market forces has meant that the price of going to college is going up.

Because 3rd level education is not a right or an entitlement. It is an opportunity, an investment, a prize for hard work and ability. Free fees has masked this because there is no pain point before you get to college. Other than the points race.

If the offspring who inspired Ms Mulcahy’s rant  cannot motivate themselves to work for their Leaving Cert and not have to be given grinds and cramming classes, then perhaps they are not yet ready for the self-directed grown up world of 3rd level learning. My personal experience of  ’hot-housed’ students in 3rd level who lack intrinsic motivation to learn and work has been that they often wind up struggling once the stabilizers and training wheels of grinds are no longer available to them.

But I’m sure that most of the 12000 mature students who are coming in from the cold are going to be motivated and ready for self-directed learning. I’m also sure they are more than willing to take responsibility for their own learning.

Other than that, perhaps Ms Mulcahy will start arguing in favour of the development of new funding mechanisms for 3rd level institutions that will enable them to scale their available supply of places to meet demand in future, but will also allow them to avoid carrying inefficient overhangs of resources which have no work to do (e.g lecturers with no courses to teach).  Of course, that might mean her and her friend having to actually pay a bit more for junior’s University education. But then… that’s economics for you.

Dear Leaving Cert Class of 2010: 3rd level education is not a right. It is a privilege. You need to work for it. If you don’t, someone else will and it will not be Mammy’s fault, or the Government’s fault, or the CAO’s fault. 2010 is when you need to learn that you are responsible for your future. Just like all the mature students applying for the CAO are taking responsibility for theirs.

A new addition to the family and some related complications meant I had some alternate priorities during December. However, I’m making it a New Year’s Resolution to write at least 2 posts of value per month in 2010. Hopefully I will be able to keep up that writing cadence. I may do shorter sound-bite posts as well during each month, but I thought 2 a month was a good target. I’d have gone for 3 a month but I am hoping to be busy enough that I won’t have time for that level of writing.

I’m starting today with a post based on some stuff in the media and a tutorial that I’m developing… there seems to have been a synchronicity of events which is serendipitous.

It was summed up for me very well by an Irish trade union leader who I spoke with last week. In his words:

Any leader who is planning for success should really start planning for succession if they want things to be sustained 

This is the difficult challenge of leadership. Knowing when the time is right for you to pass the baton and, equally as importantly, knowing that the people you are passing the baton too will be able to build on your leadership without appearing simply to be mere managers working solely within parameters you have defined, but instead being leaders in their own right, building on the foundations you have set to create a new vision.

Knowing the time to move on is difficult. It requires the leader to be able to focus both on the problems of today and the challenges of tomorrow and to have sufficient self-awareness to let them judge how well their skills, experience, passion and energy will meet the expectations of tomorrow’s battles.

And this needs to be planned with foresight to ensure you have time to develop your people and drive leaders from the bottom up in your organisation and in your team. Often this requires developing people’s confidence in themselves as much as the confidence others have in them. Inevitably it means letting them pedal the bicycle themselves to prove they can do it.

The plan needs to cover getting the right people on your team, developing them, growing their skills and ‘battle-hardening’ them. It means having a plan to instil the same core beliefs, priorities and passion (in my case for Information Quality) into your future leaders. At the same time you must ensure that they have the ability and capability to think for themselves and build on your example effectively while ensuring continuity and consistency. Above all, to take on the mantle of leadership, and to be effective, your successor needs to have enough credentials and credibility to face down challenges while having sufficient differentiators to avoid being viewed as a puppet of the outgoing leader.

And your last act as leader is to sell your successor to your stakeholders.

While this is true of pretty much any organisation, in my experience it is especially true of an information quality team. Getting your IQ programme started is a challenge that requires certain types of leadership characteristics. Keeping it going and sustaining the gains you make can often require a different leadership style and approach. Knowing when to make the change is a skill in itself, and given the risk of ‘pigeon holing’ that any specialist faces in an organisation, it can often require a move out of the organisation you are in (to elsewhere in the larger business or on to pastures new).

One noted Irish leader I have studied retired recently from a leadership role he had held for almost four decades. He had spent most of the last decade developing the people who are to replace him. They have a track record and credentials in the solutions of the past, have a passion for the issues that are pressing today, and have the vision and ability to lead on the challenges of tomorrow. They are different people to him and the style and approach of the organisation will shift somewhat, but the core elements of the vision this leader established over the last 40 years will remain in place.

That’s leadership.

Obsessive Blogger Award

In that time I’ve won an “attaboy” award from my peers in the Irish blogging community (but never an official Irish Blog Awards nomination… not even a mention in dispatches. Woe is me)

The DoBlog would not be what it is today without the help and support of a number of people:

• Mrs DoBlog. For putting up with me sneaking downstairs in the dead of night when an idea hits me.
• Simon and Fergal over on Tuppenceworth.ie for giving me encouragement to carve out my niche in this space, and for being quick to point out errors or opportunities to improve. And also for the Obsessive Blogger award.
• My colleagues on the Board of Directors of the IAIDQ, for their encouragement and their insights into good stories.
• My colleagues in the Irish Computer Society (ICS)
• Damien Mulley for creating the wonderful motiviator for self-expression that is the Fluffy Link  (an honour I still crave… c’mon Damien… give us a nod…please? Validate me!)
• The Irish Ministers for the Environment since 2006 (Dick Roche TD and John Gormley TD), for the original and on-going issues in the Irish Electoral Register (which got me my award)
• The Irish Ministers for Communications since 2006 (Noel Dempsey TD and Eamon Ryan TD) for the continued failure to implement a post code system in Ireland. 
• My fellow Information Quality Bloggers – of whom there were very few in 2006 but now there is a growing community. (yes, I’m sure I’ve missed some of you out… ping me a mail or a comment to get added to my list here)
  • Jim Harris (ocdqblog.com)
  • Steve Tuck (datanomic’s DQView)
  • Beth Briedenbach (DataGeekGal)
  • Steve Sarsfield (Data Governance and Data Quality Insider)
  • Vincent McBurney (Tooling Around in the IBM InfoSphere)
  • Jill Dyché (JillDyche.com)

Thanks also to everyone who has commented (either on the blog or over beers at a conference), contributed, cajoled or prodded me into writing about information quality issues. I’d particularly like to thank Tom Redman, Larry English, Danette McGilvray, Lwanga Yonke, and my IAIDQ editor-in-chief who prefers to stay in the background but has helped me hone my writing immensely.

Finally, I’d like to thank all the people who create, process or consume information in their day to day existence, and in particular I’d like to thank everyone (me included) who has had a hand in creating some IQ trainwrecks that may have inspired posts here.

If I’ve forgotten anyone… there’s always next year. 

And, to cap things off… here’s a look back at the very first post on The DoBlog on the 18th April 2006.

I’m not sure if it is the sunny weather here in Wexford but I was inspired this morning to spring clean the blog and put a new face on it. Please let me know what you think of the new look (thanks to the team at Jestro.com for the nice headstart on this theme).

I’ve tidied up the categories a bit and will be writing more regularly from here on out primarily on information quality topics and how they impact people.

He got the flyer below in to work. Commenters over at the ‘Otter have found upwards of 12 errors. So, for the next few days I’ll be running “The 12 Days of Blogger Christmas”. What I’d like commenters to do here is to suggest the festive (and appropriate) gift that would be sent to Christmastreesdirect.eu in this season of giving.

So, I’ll start the ball rolling….

“On the First day of Christmas, the Bloggers gave to me….

A brand new spell checking dictionary”….

Well, I was made a Fellow of the Irish Computer Society this evening. ’twas me and this guy. Apparently at one point in his career his OFFICIAL job title in the US government was “Expert”.

Not “Expertise Application Direction and Realisation Manager”. Just “Expert”.

Not bad for a youngfella from Limerick (him, not me).