Category: Uncategorized

When I was Director of Publicity for IAIDQ I introduced a policy of writing up the events of conferences the Association ran or was taking part in. This write up was usually published in the IAIDQ journal/Newsletter. Joy Medved has asked if I could let her do the same here so she can thank the people who helped make IDQS14 happen. As she no longer has access to the IAIDQ to publish content, and given the erratic nature of IAIDQ communications, I’m delighted to oblige to let Joy say a deserved “Thank You” and an undeserved “Good Bye”.

An Overview of the International Data Quality Summit,
Richmond, VA, USA, October 6-9, 2014 (by Joy Medved)

When I was first presented with the opportunity to become Director of Events for IAIDQ, I found the challenge of chairing a conference quite exciting. I have been a conference speaker since 1993 and really liked the idea of expanding my experience in this area. Thankfully, I was working with two extremely well-organized individuals, Alex Doyle and Melissa Hildebrand. Together, the three of us plotted and planned, and were able to outline an exciting program for what was to become the first joint conference of the International Association for Information and Data Quality (IAIDQ) and the Electronic Commerce Code Management Association (ECCMA). Melissa and I decided to call this joint adventure the International Data Quality Summit (IDQSummit.org).

Alex’s main responsibilities centered on contract negotiations with the hotel (though he proved instrumental in a number of other ways!), and Melissa, being the ECCMA Associate Director, was to be my co-chair. Unfortunately, Melissa was laid off from ECCMA and was unable to continue as co-chair; but before she left, she proved most invaluable. She was a pleasure to work with, and demonstrated superb organizational skills. I also found her work to be extremely high quality (which, as a professional quality consultant, isn’t something I say about just anyone!). Thank you, both, for all your hard work; I couldn’t have done it without you!

So, almost a year ago, and with no budget to speak of, Melissa and I set out to organize the first IDQSummit. The result of our efforts finally came to fruition last week (October 6-9, 2014) in Richmond, VA, at the Wyndham Virginia Crossings Hotel and Conference Center. It was quite exciting to see a year’s worth of work unfold before my eyes. Approximately 100 attendees joined us from 11 countries around the world.

Attendees enjoyed 40 sessions, 12 tutorials, two expert panels, and four keynotes during the four-day event, covering a variety of topics within four key tracks: Data Quality, Data Governance, Data Analytics/Big Data, and Metadata. Speakers included well-known industry authors, such as: Bill Inmon (the Father of Data Warehousing), Dr. Peter Aiken, Laura Sebastian-Coleman, Danette McGilvray, Ed Lindsey, Dr. Alex Borek, Dr. John Talburt, David Marco, and Dr. Rajesh Jugulum. Other expert practitioners included: Alan Duncan, Anne Marie Smith and Sue Geuens (from DAMA International), Kelle O’Neal, Martha Dember, Michael Scofield, Nicola Askham, Ronald Damhof and Shane Downey. For a great overview of the tutorials and sessions from an attendee point of view, please read Alan Duncan’s blog post: “IDQSummit: Context is Crucial, but People are Paramount.”

We also hosted an Hawai’ian Shirt Social Monday evening, and a Vendor Expo Tuesday that included two of our top sponsors (Melissa Data and EWSolutions). The Vendor Expo also included an authors’ booth, a Civil War costume rental, a reception, and a join-in music jam with the “Porch Rockers.” It was awesome to see Pei Wang and Daniel Pullen, our two student speakers from UALR’s Ph.D. program, get up and perform. Daniel played guitar, while Pei sang a beautiful rendition of “Let it Go,” from the movie Frozen. We even heard our Closing Keynote, Dr. Alex Borek, joining us from Munich, Germany, play the guitar while singing “Stairway to Heaven,” by Led Zepplin. It was great to see so many people joining in singing, playing guitar and jamming away with the various percussion instruments brought by the Porch Rockers. Everyone rocked!

Wednesday’s events included a fiery Data Quality Expert Panel about data quality definitions, moderated by Michael Scofield and sponsored by Data Blueprint, and an insightful conversation about ethics in our Data Governance Expert Panel, moderated by Anne Marie Smith and sponsored by Castlebridge Associates. Representatives from both IAIDQ and ECCMA stressed how important ethics are, both in business and in data.

Wednesday evening saw, a number of attendees dressing up in US Civil War era (1860s) costumes. Everyone gathered on the terrace to participate in an interactive troupe show depicting life during the US Civil War. One performer, Debbie, dressed as a Southern Bell, humorously told us how embarrassed she was to see women wearing trousers, which every good Southerner of the 1860s knows are only worn by men! She educated us on the language of the fan (information quality is very important here!) and the importance of knitting matching socks for the soldiers. (Yes, even during the throes of a civil war, quality is important!).

We also enjoyed watching as Mario Cantin was “recruited” into the ranks as a soldier of the Confederate South. (The Colonel didn’t mind one bit that Mario was from Canada. He said he’d take anyone who could button at least the top button of his uniform, which Mario did, expertly.) The troupe ended with musical entertainment as a soldier musician played troop songs on his banjo, with everyone joining in, including the “Alabama Yankee,” Anne Marie Smith, who entertained dancing a jig. I was amazed to find out how many of my favorite childhood songs were really from the US Civil War. I knew them all!

But, the entertainment didn’t stop there. After the troupe gave us a taste of what it was like to live in the South, we went inside for a real taste of Southern cooking at The Banquet of 1862. We feasted on a scrumptious Southern dinner of Grilled Ham Stakes with Whiskey-Apple Cider Glaze, Brown Sugar Glazed Sweet Potatoes, Fingerling Potatoes, Slaw, Corn Bread with whipped Apple Butter, and Bourbon Pecan Pie.

We then got a taste of the North, in the form of our Celebrity Keynote, President Abraham Lincoln. (Yeah, how many data conferences can say they had a former US president as a keynote!?) President Lincoln, performed by professional celebrity impersonator, Tim Beasley, provided us a first-hand account of how the Union Army was able to beat the Confederate Army, thanks in part to their “weapon of knowledge”– namely, the telegraph. President Lincoln explained how having the ability to share information more quickly and more accurately (two data quality dimensions) by way of the telegraph, his Union Army was able to stay ahead of the Confederate troops, and ultimately win the US Civil War. It was a thought-provoking insight to how information quality played a pivotal role in shaping what is the United States of America today.

After President Lincoln departed, we raffled off 26 books, donated by our resident authors and their respective publishers. Winners were drawn from session evaluations and our Civil War Trivia Hunt, which was developed by volunteer, Ken Hansen. Ken did a fabulous job coming up with 20 questions that spurred conversation throughout the conference – Thank you, Ken! After the raffle, we finished up the Wednesday evening festivities with our Closing Keynote, Dr. Alex Borek, who presented “Cognitive, Cloud and Big Data: A New Beginning for Data Quality?,” offering insights to the future of information and data quality.

Throughout the conference attendees were provided never-ending Southern hospitality by hotel staff, not to mention the never-ending all-day snack bar. Breakfasts and lunches were also full of tasty Southern delights that changed daily. I don’t think anyone was hungry the entire week!

When all was said and done, we hosted one last event – the Friday Historical US Civil War Tour of Richmond, VA, the capital of the Confederacy. 23 people from various countries stayed an extra day to enjoy a private tour hosted by our Southern Bell from Wednesday night, Debbie. Debbie shared her passion of US Civil War history highlighting a number of historical sites along the way. Our bus driver, Bud, kindly pulled over several times so we could take pictures. The tour included stops and private tours at the Virginia State Capital building and St. John’s Church, where Patrick Henry gave his ever-famous, “Give me liberty, or give me death” speech. The tour ended with one last delicious Southern lunch at the famous Hanover Tavern, originally owned by Patrick Henry’s father-in-law.

All-in-all, it was a great conference! I would personally like to thank the Sponsors, Speakers, Keynotes, Authors, Volunteers and Staff who all helped make this conference a success. I’d also like to thank the Attendees – all of this was done for you with the hope that you would be engaged and excited about information and data quality (with a little US Civil War history thrown in). I hope you enjoyed the IDQSummit and were able to take away some great insights.

I would also like to say how thankful I am for having had the opportunity to chair the 2014 International Data Quality Summit. It was an exciting and educational challenge for me. And, although I have left IAIDQ and will not be chairing future events with the organization, I look forward to other similar opportunities already on the horizon.

Joy L. Medved, SSBB, IQCP, ADKAR
CEO / Principal Consultant
Paradata Consulting, LLC
Email: joy@paradata.us

The International Association for Information and Data Quality is dead. I just don’t think they have noticed. Perhaps they have been distracted by the critical success of their IDQS14 conference, an event that I was privileged to have been a sounding board about during planning and which my company provided “hands to the pump” for by way of sponsorship, even though we were never going to be able to attend in person.

You see, I really cared about IAIDQ. I was a Charter Member. I was present at many of the initial meetings in 2003 and 2004 in London where input from Europeans was being sought about the structure and focus of a “professional body for likeminded people working in information and data quality”.

I was the Director of Publicity (aka VP Marketing) and, for four great years, I was the face and voice of the Association at public meetings world wide. I identified World Quality Day as an event that IAIDQ could and should mark in the annual calendar as a rallying point for members internationally. I lead the “Voice of the Customer” research conducted in 2006-2007 to identify the core values of the Association, as expressed by the membership. That project involved surveying all members at the time (about 300 world wide) and having coffee and talking with as many members and prospective members as I could get in contact with at conferences or over Skype.

Customer. Community. Collaboration. Commitment. Continuous Improvement. These where the “5C’s” that the customer wanted at the heart of IAIDQ, and it’s what I and many of the Directors I served with worked hard to try to achieve.

On top of my Publicity role I jumped in to help out on other areas of the Board where input or resource was lacking. The CRM system that has just been implemented by IAIDQ was identified and prototyped by me back in 2006, but implementation to production in a secure and stable fashion was beyond my skillset at the time. I was one of the original team working on the development of IQCP and personally wrote a number of the questions that are on the exam. Heck, I think I’m responsible for Jim Harris of OCDQBLOG (who did his first podcast with me for IAIDQ many years ago).

But we have failed.

Despite having a critically successful event in Virginia this year, an event that my company was proud to be behind because it was conceived as a fun (community) event where people could let their hair down and network (collaboration), and do something that the membership and prospective membership would value and enjoy (customer), I have had to conclude that the IAIDQ is dead, but just doesn’t know it yet.

(For the avoidance of any doubt – I never held any other role on the IAIDQ Board other than Director of Publicity. I did found and lead the Irish Community of Practice and help to found the UK Community of Practice. But that’s all. )

My view is based on the following:

Bizarre Board Decisions

I’ve learned that the Board of Directors dismissed Joy Medved as Director of Events during the conference, but apparently forgot to tell her until a week later. I know Joy and work with Joy. I know she was incredibly passionate about the IAIDQ and was a strong advocate for a “get the basics right” approach to rebuilding the Association.

I know Joy had expressed frustration with the direction of the Association and was considering resigning. However, when a volunteer Director puts together an event that gets people saying positive things about the Association for the first time in a long time, any sensible Board would work to keep that volunteer engaged and listen to their concerns. Instead, the IAIDQ Board has chosen to dismiss a Director who has done incredible work rebuilding the relationships between IAIDQ and other professional bodies and conference organisers and who envisioned an event that actually met the promise of the “5C” values of the Association.

That is just bizarre.

Equally bizarre is the apparent time lag in informing Joy. First rule of business: when you’ve sacked someone, tell them. It seems like it took the IAIDQ leadership a week to pass the message on to Joy. That stinks from a governance perspective.

Furthermore, it appears that the IAIDQ Board has decided against engaging in collaboration with other organisations. My experience on the IAIDQ Board and as the founder of their first Community of Practice is that to help develop a foothold in new markets or find new ways to serve audiences, collaboration is necessary. No individual or organisation can do all things themselves.

A key problem that new entrants in to the data space have is figuring out a career and certification path. That is a key problem that needs to be solved for both individuals and employers. Right now it is not being solved. But it can only be solved through collaboration between professional bodies to educate the market.

But the IAIDQ seems content to keep building walls. That’s just nuts. As an Information Quality consultant and trainer (heck, I teach an IQCP certification syllabus) I regularly hammer people over the head with Deming’s 14 Points. One of those is the need to remove barriers and instil pride of workmanship. Building up walls and pulling up drawbridges can best be described as “odd” and counter-intuitive in an organisation that is supposed to espouse quality management principles and has “Collaboration” as a key core value.

It also makes it difficult for IAIDQ to establish a point of presence in new markets. The experience of the Irish and UK CoPs evidences what happens when the IAIDQ’s Board doesn’t engage in collaboration – both Communities relied on collaboration with national informatics societies (Irish Computer Society and British Computer Society) to grow and operate. In both cases engagement from the top was required – basic “diplomacy between Heads of State” if you will. It didn’t happen. Both CoPs died away.

At one point Ireland accounted for over 10% of the IAIDQ’s world-wide membership (approx. 40 people out of approximately 380 members in 2006/2007). Today, there is at most one paid up member here that I know of.

I hope the view from the IAIDQ’s Ivory Tower is nice.

 Absence of an IQCP ecosystem

I am a strong believer in the importance of skills certification for Information Quality. I have been a staunch advocate of IQCP and my company was the first in the world to offer IQCP training. It’s likely that I have personally trained or coached more current IQCP holders than anyone else in the world. However, it has been a constant struggle to get engagement. Key information was out of date or full of errors for over two years, despite the errors being spotted by my clients and fed back.

To an outsider trying to deal with IQCP, it appears that it appears like it is being run as a mini-fiefdom of a small group of people. That is not sustainable, and it does a disservice to the wonderful work that has been done recently by Dan Myers in particular.

I was on the Board that initiated the IQCP process. At that time the strategy was that IAIDQ would create an ecosystem within which trainers and content developers could contribute to the body of knowledge and grow the certification. That was a strategy I could get behind and sell as Director of Publicity because it aligned with the 5Cs of the core values.

It hasn’t happened. IQCP has failed to reach critical mass. But the same levers keep being pulled hoping for a different result.

No consistent product delivery in nearly 2 years

A core product of IAIDQ membership is advertised as being the Journal (originally a newsletter issued monthly it became a Journal issued quarterly). From 2005 to 2010 I was among the most frequent contributor of articles to the IAIDQ Newsletter/Journal. I was proud to contribute and it helped me stretch my thinking in the Information Quality space.

Since 2011 the Journal has appeared four times – twice in 2012, once in 2013 and once in 2014. I volunteered time from myself and one of the team in my business to look at what could be done with the tonnes of content that apparently had been submitted. Like Old Mother Hubbard we found the cupboard to be bare. Not enough content existed to produce an edition.

An Association that cannot consistently produce a single core product has a problem. Where there is an absence of volunteered content, and an absence of volunteers to package and produce the core product, then there is a problem. And the problem is not one of grand vision. It’s one of basic operations. And the answer to a problem like that is not to leap into something new and hope that that reinflates the passions of volunteers to crank out the goods.

No Volunteers

The IAIDQ is failing most of all because it cannot attract or retain volunteers. This has been an issue since 2006/2007at least. I have personally had volunteers who were working with me on Publicity activities when I was a Director walk away because of the conduct of other officers of the Association towards them. Apparently, it hasn’t improved. Those officers are still around, but the volunteers aren’t.

The lack of volunteers is not unique to IAIDQ. It is a common issue across the not-for-profit/voluntary sector. However, the consensus is that the approach to addressing that is to work the values and, in true quality management fashion, focus on the most important needs of your customers. That’s why IDQS14 was a great opportunity to reboot the Association. IAIDQ’s customers want to have fun and a sense of community because the day job is just so darned stressful. It’s an opportunity missed, I fear.

Volunteers don’t rally around a vague future strategy, and a strategy does not arise from talking within a sub-set of the leadership group about what might be done. Volunteers need something they can emote with, that taps into their intrinsic motivation to contribute, and pushes them to find the extra hours in their busy days to write articles, phone sponsors, travel to meetings, run a website, co-ordinate events,  sit on conference calls, and generally all the stuff that needs to be done to do the business of an Association.

One thing I’ve learned running my own business is that not-for-profits are in a perpetual state of “startup” – and that’s where clarity of vision, clarity of values, and prioritisation around the resources you have is essential. If you can’t answer the question “Who will do that?” with a name that is actually on-board to do that thing, it’s not going to get done!

For many years, I was that name. I was so passionate about IAIDQ that I tapped my insomnia, and my personal finances in some cases, to get things done for the Association, to design marketing materials, man stands, and communicate constantly the core values of the Association to try and attract like minded people. IAIDQ no longer has that pool of people. But it’s not because those people don’t exist. I meet them on twitter and at events all the time. I count some people I’ve never met as friends in the data community. But the IAIDQ is not engaging those passions any more. High-brow dreams of a future method of operating will remain just that. Just like the 80% of startups that fail because they lack the means to execute and the clarity of vision to know what to kill off.

In March I was asked if I’d be manning an IAIDQ booth at a conference in London. I said no. For the first time in a decade. The passion to contribute is gone. Because the organisation has turned insular. And nobody says “thank you” any more.

Group Think

Worst of all I believe the Association has fallen foul of Group Think. Over the years, as a Director and then as a passionate volunteer, and most recently as a candidate for the Presidency, I’ve presented evidence of negative market sentiment, stagnant membership numbers, and the opportunities for expansion through collaboration. As Director Publicity/VP Marketing I took it on as part of my role to challenge decisions at the Board level on whether they aligned with the “5 Cs” of the core values. I was an argumentative little prick, but always accepted the final Board decision once the debate was had.

But over the years, debate has become more and more the sound of one voice. Increasingly I have found the Board dismissive of evidence and filling in optimistic assumptions where hard assed reality is required. It reminds me of the joke about how the economist was rescued from the desert island: “first assume the existence of a lifeboat”.

Last year I submitted my candidacy for President, after nearly five years of being asked by various members of the Board and various advisors to the Association and declining it because I had other priorities and wanted to avoid any implication that I’d spent four years as Director of Publicity just to be President. Don’t get me wrong, I feel that the Presidency of the Association as a great honour and a crucially important role. Which is why I didn’t want to take it on at a time when I couldn’t give it 100%.

Last year I felt it was then or never. I assessed the situation of the Association and submitted a high level strategic plan to address the issues that people I’d connected with in the community had raised with me, often in hushed tones as if they were afraid to speak truth to power.

The Board, many of whose members had personally called me and quite literally begged me to self-nominate, ultimately voted against my candidacy. I accepted their decision, and still do. But I cannot respect it any longer.

I firmly believe that the Board ultimately dismissed Joy Medved because she took on my role on the Board of argumentative pricker of consciences, the devil’s advocate against group think and Pollyanna-ish assumptions. She ran an event that was a critical success, one that I and my company were proud to be associated with, and which ticked all the boxes for alignment with the original core values of the Association.

The Group Thinkers will attempt to rationalise their decision from a number of directions and I fully expect attempts at character assassination (because that was done to me), but as an outsider with experience on the inside it looks very much like vested interests took an axe to the legs of a volunteer whose approach to delivering value to the customer was making them uncomfortable – because it was working, and because she wanted to push others to work hard on delivering core services and core values.

The Future

I fully expect the IAIDQ Board to continue to pursue a vague and uncertain strategic plan, one that assume the existence of volunteers who give a damn. But I don’t hold out hope for the future of the Association. Its heart is gone. Its values, defined by the many, have been cast aside because they have become inconvenient to a few.

From our founding vision of an International community of like-minded people who were passionate about Information and Data Quality, I fear that the IAIDQ has been hollowed out to a US-centric vipers’ nest of vested interests that has turned its back on its customers as it chases its tail, blissfully happy in the ignorance of how the world of professional associations has moved or how its actions towards volunteers, supporters, and others makes it look.

Commercially, my company will continue to provide training in IQCP to clients who request it or to whom we are currently committed, but we will be looking to the market for an alternative as soon as possible as we cannot rely on a certification provider who will likely not exist in 12 month’s time.

The idealist me of 2004 who signed on to help found IAIDQ hopes I’m wrong about the present and the future of IAIDQ and that, in this 10th anniversary year something will change. But the realistic me of 2014 fears I’m not.

To paraphrase the sci fi character Dr Who: “Does the IAIDQ look tired to you?”

Update: What can be done?

A trusted advisor suggested I make this read less like a rant (which I didn’t intend it to be) and more like constructive criticism by putting on my consultant’s hat and making some suggestions for improvement.

Looking at IAIDQ as a consultant, I would make the following recommendations:

Do this:

1. Clearly and publicly define who your customer is and what the most important needs are of that customer that the Association is going to meet – and HOW.
2. Tailor ambition to capability, at least until such time as core value proposition elements are stable and the customer can see clear value in being associated with IAIDQ.
   • Ensure that there is a value proposition for members, something that they can see is worth their dollars/euros/zloti
   • Make sure that deliverables happen regularly and as promised. Agile methods might be appropriate, but waiting for perfection in all things is worse than delivering a “beta”.
3. Create a simple vision of the future that people can get behind. And COMMUNICATE IT
4. Build bridges with other organisations. Lots of bridges. That is a collaboration and community strategy that aligns with the principles espoused by Deming, Juran, and other pioneers in Quality.
5. Develop a habit and practice of ‘inclusivity and reward’, where volunteers and contributors can feel that their voice is heard and their contributions are valued.
6. Give careful consideration to the meaning of the word “International” in the Association’s name. Use it or lose it.

Don’t do this:

1. Craft a master plan strategy for the future without being clear on what distinct need you are serving.
2. Define a vision and a plan for the future that ends with “and then we will have the volunteers come on board to do this”. Lots of non-profits make that mistake.
3. Overestimate your capacity for delivery and capability for change, based on an assumption that volunteers will appear. Assume they won’t and work from there.
4. Attempt to deliver an all encompassing “one-size-fits-all” offering without having robust alliances in place

These are basically the 10 things I’ve been saying for a number of years as a Director, volunteer, and member of the IAIDQ.

They apply to that body, but they are universally applicable to all professional membership organisations that rely on volunteers to deliver the goods. Hopefully someone will read this and learn from it. It might even be the IAIDQ.

 

Stopped to take a breather for lunch. Saw this from TJ McIntyre (a man who knows his onions when it comes to Data Protection and Privacy).

@ElaineEdwards @IrishWater So why does the site privacy policy say that info can be used for phone, email, sms and in person sales?

— TJ McIntyre (@tjmcintyre) September 30, 2014

I’ve covered off the issues with the marketing consents for Irish Water on my company site.  The total confusion here effectively makes any implied or explicit consent for marketing open to challenge on the grounds that it was not unambiguous. Irish Water need to step up, stop faffing around, and fix this. It is a total disaster and it is getting in the way of me doing my real job. Also, the consent Irish Water are relying on isn’t Opt-In, its Opt-out.

I’m not against Water Charges, I’m against what I see as an inevitable waste of 10%-35% of turnover in Irish Water due to poor data quality management, leading to manual work arounds and scrap and rework, and I’m against approaches to obtaining and processing personal data that frankly seem to be oblivious to the national and EU legislation that should be governing that processing.

I’m against €82.4 million being spent on consultants who don’t seem to know how to approach this kind of project correctly given the gaping issues that exist in a data management context. And I’m against me having to be the paramilitary wing of the Data Protection Commissioner’s office asking key questions in public the day before it all kicks off that should have been addressed in private months ago during the design phase. And I’m against any absence of accountability or stewardship over critical data. That just irks me.

I’ve got a day job and clients to serve. conferences to prepare keynote presentations and tutorials for, and a conference of my own to run. The mental exercise of analysing Irish Water was fun, but frankly it’s like shooting fish in an over-engineered under-designed barrel at this point.

So, for all the Irish Water people reading this:

1. Please come to IGQIE2014 in November. You will learn something you really need to know
2. Ask you boss if you can hire my company to help you figure this stuff out. We’re pretty good at it. And we’ve got friends who are good at the bits we’re not good on. We will be a rounding error on €82.4 million.
3. Please try to stop screwing up on your data management and data protection issues quite so publicly because when people ask me about a think I’m wired to look at it and figure it out. They find me on twitter and look to me for answers, and I feel obliged to try to help explain because you are doing such a crappy job of it. This stuff made me trend for Ireland. I hate trending for Ireland.

So, via Twitter I’ve learned that Irish Water don’t have a process defined yet for people moving house. Well, they have one defined but its “not signed off on yet”. This is a pretty basic process that exists in all utilities, satellite TV companies, and fixed line phone companies. Its the one you rely on to ensure that the bills are correct at the point of hand over.

@treasa @daraghobrien I rang IW about this they do have A Move in Move Out Policy that they are developing but it hasn’t be signed off on

— Antóin (@anlawlor) September 30, 2014

Given that Irish Water are billing quarterly, that means that people are inevitably moving in or out of a property during a billing period. This will lead to what is known as “broken period billing” in utilities. When I worked in telco, it was the handling of these scenarios that gave rise most often to billing errors, particularly where the broken period for billing crossed a VAT period or where the preparation of a final bill involved the calculation of and application of credits on final bills etc.

This is tricky stuff, which is why it is good they are taking their time about it. However, if true, the absence of such a process or procedure NOW means that:

1. Irish Water is in breach of the Data Protection Acts which requires Data Controllers to keep data “accurate and up to date” , at least accurate enough and up to date enough for their purposes. Having the wrong name associated as bill payer on a property is inaccurate for their purposes. They don’t need to ensure accuracy per se, but they need to have a defined process where by changes to data can be made. That’s the kernel of the obligation in the DPA and, let’s not forget it, a fundamental right under EU law under Article 8 of the Charter on Fundamental Rights.
2. Bills will inevitably be sent to the wrong people, potentially in the the wrong amounts, which will potentially affect collections processes.

It looks more and more like the data design here and attention to data changes in customer life cycle is appallingly bad. I do hope that the tweeter got the wrong end of the stick when they were talking to Irish Water, but my optimism is rapidly going down the outflow pipe.

This stuff is really, really basic. However it means having to think about your data as more than just “stuff that lives in the database” and treat it as an asset that is subject to certain fundamental governance requirements.

We’ll be touching on a lot of these topics at IGQIE2014 on the 7th of November, and I’m teaching about it at conferences in Belgium and the UK in the mean time. I was struggling for examples….

[preamble: This is a thought noodle. It’s not a solution. It just sets out possible options for an alternative approach. I fully expect issues and wrinkles to be pointed out. ]

There has been a lot of discussion about the legality of Irish Water’s use of PPS Numbers. It is correct to say that Irish Water has a legal basis f or requesting PPS Numbers under the Social Welfare & Pensions Act 2014. The Water Services Act 2013 also gives them the power to request data from the Revenue Commissioners and the Department of Social Protection (amongst others).

So, there is a legal basis for obtaining data. However, the Data Protection Acts require that the data being processed by a Data Controller be adequate, relevant and not excessive to the purpose for which it is being obtained.  Article 8 of the EU Charter of Human Rights also requires that processing be proportionate, a point that was stressed by the CJEU in the Digital Rights Ireland Data Retention case.

<update>Also, as Fred Logue points out:

@daraghobrien@dermotcasey Great article. Also note that when you see word “necessary” in DP act this is a proportionality test

— Fred Logue (@fplogue) September 25, 2014

</update>

So… is it proportionate for Irish Water to be processing PPSNs, notwithstanding the legal basis that might exist permitting it? When working with clients designing data processes, I try to encourage avoidance of excessive processing of data by looking at whether existing functions can be repurposed to minimise the number of hands data must flow through. Thinking “lean” is important. Looking at this from a Data Architecture perspective, we must first look at the purposes. There are two.

1.  To verify entitlement to a household water credit
2. To verify and validate child water allowances.

Next, we need to see if there are any similar functions currently operating in the State that might provide either a model to replicate or a function that can be extended to deliver these objectives. 

Household Water Credit

Prior to 2012, households were entitled to claim a tax credit for domestic waste services from Revenue. Each household applied and the credit was applied as an income tax benefit. PPSN information was not shared with local authorities or private bin collectors to implement the tax credit. Policing the credit was simply a matter of using existing Revenue powers to seek information into Revenue for audit purposes. While the system was retired in 2012, old code doesn’t die, it just gets commented out. Reintroducing this mechanism for the Household Water Credit likely have been simple and cost effective as the basic structures for implementing it had already been developed and worked. They were just mothballed. Therefore: in determining the proportionality of allowing a private company access to 4 million PPS numbers, did anyone examine the feasibility of reusing an existing system that would not require data to be shared outside of an organisation that already processes PPSNs? Did anyone consider reusing/recycling this processing?

The Children’s Water Allowance

Irish Water tell us that they need to have PPS numbers of children to confirm their eligibility for a water allowance.  There is an allowance. For children. A children’s allowance if you will. A benefit for children. That must only be given to children who are in receipt of Child Benefit…. So why not just either add the allowance for water to the existing Child Benefit payment, or clone the Child Benefit processing in the DSP to deliver the Child Water Allowance? This would have avoided the need to request PPS numbers of children, a sensitive matter for many. No data would be processed outside the existing state agency that deals with Child Benefit and the PPSN data of children. <update>Another tweeter raised the question of non-resident recipients of Child Benefit.

@dermotcasey @Tupp_Ed @IrishWater @daraghobrien nice try but many children living outside Ireland in receipt of child benefit from here. — orl (@cnocdua) September 25, 2014

This does not invalidate the approach outlined above. It simply adds a business rule to the data queries necessary to run the process. When working with clients on projects this kind of thing crops up a lot.  It’s one of the many reasons why, after half a life time doing this ‘data thing’ I advocate organisations invest in PLANNING and design for data before jumping into building databases.

Dermot Casey nailed the necessary business rule in “code speak”

@cnocdua @Tupp_Ed @IrishWater @daraghobrien update API query to “where child has PPS = true && resident in ireland == true”

— Dermot Casey (@dermotcasey) September 25, 2014

Translating that for humans: “IF a child has a PPSN AND is resident in Ireland THEN assign credit ELSE don’t assign credit”.

Of course, this assumes that the DSP has a data field that identifies if the country of residence is Ireland or not (and if they don’t then I would have to ask how any statistics about how many non-resident children are in receipt of Child Benefit are calculated).

</update>

Value For Money?

Given the set up costs of Irish Water, one must ask as well whether reusing/recycling or repurposing existing systems and processes to the objective of having credits and allowances might have resulted in a net saving to the exchequer, particularly in difficult economic conditions.

I cannot answer that and would suggest that is a question the C&AG should consider asking. However, from a Data Protection perspective, it would have resulted in a zero fuss outcome – “State Agencies process data the way they always have to ensure credits and benefits are applied appropriately – SHOCK!!” is not an attention grabbing headline. A private company that is processing PPSN and other personal data but is unable to give clear answers about the nature and scope of that processing IS a headline or dozen.

The Importance of the Information Asset Life Cycle

When I teach Data Governance or Information Quality or when I engage on consulting projects, I always introduce the POSMAD lifecycle of information. POSMAD is a standard model for any asset management consisting of six steps.

• Plan
• Obtain
• Store and Share
• Maintain
• Apply
• Dispose

Part of “Plan” from a Data Protection perspective is asking “Is there a less invasive/less privacy risky way of doing this?”, and from a ‘return on investment’ perspective it requires us to assess if the way we are proposing to do something is the best. Working through this life cycle allows organisations to apply “Privacy by Design” thinking earlier in the lifecycle of the data.

It appears Irish Water jumped straight to the “Obtain” phase because they had legislation that allowed them to do it, but nobody gave consideration to the PLAN stage. This is a function of effective Data Governance in an organisation and I would hope that the Government learns a valuable lesson from this as they formulate their Data Sharing and Governance Bill over the coming months.

TJ McIntyre was on Morning Ireland this morning talking about Irish Water and their use of PPSN. The Irish Water representative, Elizabeth Arnett was on a few minutes later.

In the course of the Irish Water commentary on their use of data, the question was asked about what would happen to PPSN data if Irish Water was ever sold. The assurance was given that Irish Water cannot be sold under legislation and that the reference to any such sale or transfer in the data protection notice was just the use of “standard clauses”.

And therein lies the nub of (part) of the problem – a Data Protection Notice is supposed to inform people about what YOUR organisation is going to do with the data provided to YOU. Cutting and pasting might give you a template, but you need to invest a little time and effort working through the Information Asset Life Cycle (Plan, Obtain, Store/Share, Maintain, Apply, Dispose) to ask some key questions so you can build a truly accurate and reflective Data Protection statement that is, for want of a better term, TRUE. Plagiarizing some other organisation’s policies is not a recommended practice.

(As an aside, in the day job at Castlebridge Associates I’m fortunate to have hired someone whose previous career involved them checking for academic plagarism, so when we audit data protection policies we can pretty quickly find out where the cut and paste bits were sourced from).

So, today we learned that Irish Water can’t be sold. Which means that all the guff in the Data Protection notice about the transfer of data on the sale of the business or the purchase of another business is utter claptrap.

Unless of course the situation is that Irish Water can’t be sold NOW. I started my career in Data Governance in a semi-state company that we were assured couldn’t be sold and wouldn’t be sold. That company is now heading to its second IPO, having been flipped more times than a pancake on Shrove Tuesday. So perhaps I’m a little cynical about the management of State utility companies.

If Irish Water can’t be sold, that’s great. The Government and Irish Water need to make that explicitly clear and the Data Protection notice should be amended to have a positive declaration that Irish Water will not be sold. However, if there is a possibility that it might be sold then that should be clarified (even if a legislative change would be required for it to be sold) and the Data Protection notice should clarify what data would be transferred (for example, would PPS numbers be transferred, and if so why).

As I said on WLRFM earlier in the week – if a glass of water was put in front of me that was as murky and opaque as the current Data Protection notice from Irish Water I would refuse to drink it.

So, I appear to have caused some consternation with my post over the weekend. To help clarify things, I’ve put together an alternative reality version of the Irish Water Data Protection Notice based on information that has been included in recent media coverage and which is fragmented across a number of documents produced by Irish Water. This is effectively free consultancy for Irish Water and is an incomplete first pass that is intended to illustrate the benefits of layout and structure of Data Protection Notices to improve clarity and communication of purposes for processing of data.

However, the content of this post is (c) 2014 Daragh O Brien and cannot be reused for commercial purposes other than news reporting without prior written permission.

+++++++

Who we are

Irish Water is the new national water utility, which is responsible for providing and managing public water services throughout Ireland. Irish Water is a State-owned company, established under the Water Services Acts 2007–2013.

Irish Water replaces the previous system of 31 Local Authority Water Services departments.

Registered Office

Our registered office is:

 Colvill House,

24-26 Talbot Street,

Dublin 1.

Address for Data Protection Queries

Data Protection queries, such as Subject Access requests or requests for data correction, should be sent to:

Data Protection Officer

P.O. Box 860,

South City Delivery Office,

Cork City,
Cork.

You can email queries to us care of dataprotection[AT]water[dot]ie  ==>(This email address doesn’t currently exist)

What Data are we processing?

We process a range of data about customers of public water services (Customers) and other users of private water services (Non-Customers).

Data about your property and water services

If your property is connected either a Public water main supply or Public Sewer you are a customer of Irish Water. We will ask you to confirm what kind of water or sewage system you are connected to in order to identify if you are a customer of Irish Water or not.

If you are a customer, we will confirm if you are receiving a bill for a water service from your Local Authority and if the property is used as a private residence or not, and if you are a property owner or a tenant.

We will also seek information about the number of people residing in your property.

Personal Data

The personal data we process about you includes:

• Names of account holders,
• PPSN numbers for account holders and any resident children (17 years or under)
• Customer property address
• Customer preferred billing address (if different from property address)
• Home land line telephone number
• Mobile telephone number
• email address
• Billing language preference

We will also record calls between Irish Water customer service staff and customers for purposes including quality assurance and training.

Sensitive Personal Data

Irish Water processes sensitive personal data about customers who indicate they wish to avail of special and/or priority services.

This information may include data relating to physical or mental health. In these circumstances we may also process personal data relating to a nominated carer or other person who will deal with correspondence on your behalf.

Personal Financial Data

We will process bank account details for the purposes of establishing recurring direct debits for the payment of Water Services bills.

Other than data you provide to us, what other data do we process about you?

Under Section 26 of the Water Services Act 2013, Irish Water is empowered to seek data from a number of different bodies. As of September 2014, these bodies include:

• The Revenue Commissioners
• The Residential Property Tenancies Board
• The Property Services Regulatory Authority
• Local Authorities
• The Local Government Management Agency
• Electricity Service providers
• The Department of Social Protection
• Gas service providers

Other bodies or data providers may be specified by the Minister after consultation with the Data Protection Commissioner.

Irish Water may make use of data from 3rd party data service providers for some of the purposes set out below.

Why are we processing it?

Irish Water has a number of specific purposes for processing your personal and sensitive personal data, and for seeking data about you from other sources.

Confirming if you are a Customer of Irish Water

We will process information about your household, its water supply and sewage services, and other related household data to confirm if you are a customer of Irish Water.

Confirming eligibility for allowances

• To apply for the Household Water Services Allowance we process your PPS Number to verify your identity and your entitlement.
• To apply for the Children’s Water Services Allowance, we process the PPS Numbers of resident children (under the age of 17) to verify the age and identity of the children.

This is a control check process that ensures correct and appropriate allowances are claimed to help ensure accurate application of credits to customer water service bills. For more information on our processing of PPSN please see the relevant section below.

[note: This is the purpose for which PPS Numbers is being obtained. It is good to note that Irish Water are not asking for PPSN for non customers, however that assumes that people won’t fill it in in error. I assume Irish Water have a process to purge PPSN details they don’t require?]

To generate and distribute customer water service bills and collect monies owed

We will use the name of the registered account holder and the property address, or the alternative billing address, for the purposes of sending Water Service bills to customers.

This data will also be used to support our credit control processes. In the event of non-payment of bills, your data may be passed to debt collection agencies for the purposes of debt recovery, up to and including legal proceedings for non-payment.

Data about language preferences will be used to ensure you receive a bill in the language you select. Sensitive personal data will be processed to allow us to issue braille bills or to arrange for “talking bill” services to be provided to visually impaired customers.

Where a customer availing of special services or priority services has indicated that a carer or other person should receive correspondence on their behalf we will process that person’s data as required.

For Fraud Detection and Prevention and Credit Scoring

Irish Water will use data obtained from various bodies as outlined above to allow us to operate prudent fraud detection and prevention  controls.

We may also use data from data services providers for the purposes of customer credit scoring as part of our prudent management of risk.

Marketing

Subject to specific consents, Irish Water may use contact data provided by customers for the purposes of marketing products and services to customers related to their Water Service. This will be subject to specific consents which will be obtained.

For non-customers, Irish Water may use contact data provided to send information about water service availability and to market relevant products and services. Again, this will be subject to specific consents.

Call Recordings

Calls between Irish Water Customer Service staff and customers will be recorded for quality assurance and training purposes, and to confirm details of the conversation if required.

Maintenance and Construction Activity

Irish Water may process your personal data for the purposes of conducting visits to premises, arranging for required works to be carried out at premises, and other construction and maintenance activities necessary to ensure the delivery of a public water service.

Health and Safety and Risk Assessment

Irish Water may process your personal and sensitive personal data for the purposes of ensuring compliance with Health and Safety obligations, ensuring appropriate water supplies for people with certain medical conditions, and the conducting of risk assessments associated with the management of the public water supply.

Your PPSN – what we will do with it

Irish Water is entitled to request your PPS Number and the PPS Numbers of  under Schedule 5 of the Social Welfare Consolidation Act 2005. PPS Numbers provided will be stored securely by Irish Water.

Your PPS Number will only be used to determine if you are entitled to water services allowances. PPS Numbers will be verified with the Department of Social Protection and a simple confirmation of entitlements will be received from them. No other data will be exchanged or processed for this purpose.

PPS Numbers will be retained by Irish Water for [NEEDS A RETENTION PERIOD AND PURPOSE POST VALIDATION OF DATA AT APPLICATION]

Only customers of Irish Water are required to provide us with their PPSN. Users of private water services should not submit this data to us as we do not have a purpose for processing it.

[note: I’ve flagged this already, but an exception handling process to ensure ppsn is not processed for non-customers by mistake would be a good control here.]

Sharing Data/Disclosure of Data

Irish Water may share data with companies who provide services to Irish Water for the purpose of carrying out our business functions as outlined above. Companies providing data processing services to Irish Water do so under a formal contract and are required to process data only for the purposes specified by Irish Water and must ensure they have appropriate organisational and technical measures to prevent unauthorised access to, alteration of, or disclosure of your data.

Irish Water may disclose or transfer data to a third party in the event of the business being purchased in part or entirely by that third party.

Irish Water may also disclose data if required to do so  in order to comply with a legal obligation, or to protect the rights, property, or safety of Irish Water, its customers, or other relevant third parties, or if required to do so on foot of a search warrant, court order, or where required under a Statutory duty.

Irish Water may share data with third parties for the purposes of fraud detection and prevention and as part of credit risk reduction.

Transfer of Data Outside the European Economic Area

Personal Data held by Irish Water may be transferred to or accessed from countries outside the European Economic Area. The reasons for data to be transferred may include, but are not limited to:

• Outsource Customer Support services
• IT Technical support services
• Software development and support
• Data hosting and back up services
• Fraud Detection, Prevention, and Credit risk management

Transfers to countries outside the European Economic Area will be carried out subject to specific contract terms and other relevant controls, such as transfer to appropriate countries on the European Commission Safe Countries List or alternative  appropriate mechanism under the Data Protection Acts.

[note: The original Irish Water Data Protection notice forces consent to this EEA transfer provision. The Data Protection Commissioner is clear that relying on consent in this case requires the consent to be unambiguous and freely given. In the original form, the consent was not unambiguous as it didn’t specify any purpose or what data. Also, given that Irish Water is a monopoly and we have no option but to fill out the registration form, the consent being sought was not freely given].

Data Retention

Irish Water has a defined Data Retention Policy.

[note: I assume they have a defined retention policy. What I would suggest here is that for each key purpose a time period be established]

 

Exercising your Data Protection Rights

Under the Data Protection Acts you have the right to:

1. Request a copy of personal data held about you by Irish Water (Subject Access Request)
2. Request Irish Water correct or delete incorrect or inaccurate data about you
3. Request Irish Water cease processing your data for specific purposes, such as Direct Marketing

Subject Access Requests

To request a copy of your data you should send a request in writing to:

Data Protection Officer

PO Box 860

South Delivery Office

Cork City

Cork

Irish Water may request additional proof of identity from applicants for the purposes of verification to ensure data is disclosed only to the relevant individual.

Irish Water may charge a fee of up to €6.35 for Subject Access requests.

Change Direct Marketing Preferences

To change your Direct Marketing preferences you should send your request to:

FREEPOST,

Irish Water,

Data Protection Opt-out,

PO Box 860,

South City Delivery Office,

Cork City

Alternatively you can phone Irish Water on 1890 278 278 to update your marketing communications preferences.

Other Requests

Other requests should be sent to:

Data Protection Officer

PO Box 860

South Delivery Office

Cork City

Cork

Marketing Consents & Permissions

• email:             I would like to receive marketing communications by email (YES/NO) [this is an opt-in consent]
• SMS:               I would like to receive marketing communications by Text message (YES/NO) [this is an opt-in consent]
• Mobile Call: I would like to receive marketing calls on my mobile phone (YES/NO) [needs to default to NO as this is an opt-in consent]
• Landline:      I would like to receive marketing calls on my land line phone (YES/NO) [this can be an opt-opt consent]
• Postal Mail: I would like to receive marketing material by post (YES/NO) [this can be an opt-out consent]

[note: The Article 29 Working group and the DPC have indicated that preticked boxes on web forms are not valid consent as the consent is not freely given. Including them here is possibly not ideal given that the form isn’t online. 

The application form contains only one single Opt-out tick box for both electronic and postal marketing. This does not meet the requirements of SI336. As I haven’t received my pack yet I can’t comment on the on-line application process and whether it has better compliance with the ePrivacy regulations requirements (SI336)

Also it is important to note that the application form for Irish Water does not capture any electronic contact data for non-customers, therefore non-customers will be marketable to only via postal mail at this point on an opt-out basis]