Discussion Board Peer Responses

Discussion Board Peer Responses

In responding to your peer’s posts, be sure to do the following:

• Ask at least one relevant question regarding their example scenario and the roles defined within their RACI matrix.

• Discuss similarities and differences between your approach and that of your peers; be sure to explain your line of thinking.

Peer 1:

Nathaniel

I used scenario 1 where in a healthcare organization, there is a need to manage patient data securely, but beyond HIPAA, there are no explicit regulations guiding data privacy practices. While HIPAA has regulations around what to protect and guidelines around what can be shared, the how you protect it is more open to a companies discretion.

This is where using the RACI matrix can be very useful. It structures who is responsible, accountable, consulted, and informed in the development and implementation of securing of sensitive data. From personal experience, when there is a breakdown in following RACI matrix and including all responsible parties, either a product is unable to be delivered or it does not meet the business needs. For example, in one of my roles a business analyst (responsible party) met with the customer without the developers (also responsible party). The business analyst proceeded to tell the customer how the application could be built, not realizing the data could not be brought together the way they had described to the customer. This caused multiple additional meetings and design sessions to get the customer to accept what actually could be done vs what they had initially been offered. This same scenario would apply when it comes to safeguarding data by designing the

application properly. A business analyst would not want to meet with a customer, gather requirements, and commit to the customer what can be done without including other responsible/accountable parties first. This will ensure that the data the customer wants follows security guidelines and is actually available to the customer.

For responsible parties you would have roles such as business analysts and developers, those that get the work done. For accountable parties you can have roles such as product owners and project managers, ones that make sure responsible parties are meeting deadlines and that the project is completed. For consulted parties you would have roles such as information security and cybersecurity, making sure the project meets legal/security guidelines. With how critical legal/security rules are, the consulted parties would be involved throughout the process and help avoid rework for developers. Finally you have the informed parties such as business owners and stakeholders, ones that typically see the big picture of the project and need to be kept in the loop on the milestones being met.

When there are no guiding regulations about handling sensitive data, start by questioning if just because something can be done, should it. You can use data to present the facts in a way that fits your narrative but not entirely true, which would not be ethical and can result in poor decision making. There is also the opportunity for data misuse, such as using data collected in new ways. While this may not be a legal concern, it could be an issue with how customers perceive it. Someone else had mentioned in their post a couple weeks ago about Google actually gathering data when someone is using incognito. This damaged customer trust, which is one of the hardest things to get back.

Peer 2

Dan In an e-commerce company that operates in a jurisdiction with limited regulations, accountability, and responsibility is paramount when handling customer data. The Responsible-Accountable- Consulted-Informed (RACI) matrix can be vital to keep employees informed on their roles in the data handling process from the beginning to the final task. One of the main stipulations of the RACI matrix is that “to foster accountability, tasks should not have more than one A entry in the matrix to avoid diffusion of responsibility” (Ucertify, 2023). Essentially, by keeping one person assigned to the A role for each task, the accountability lies solely on them and the blame cannot be passed around if things fail. The other 3 roles are equally as important, as R is assigned to people who will do the task, and C is for those who provide insight. I is for employees who will be informed about the task but will not participate in its completion.

For the example of an e-commerce company, a few examples of individuals/departments that may be involved in the matrix include a Data Protection Officer (DPO), Information Technology department (IT), legal counsel, and management. One common task that could be used an example as of where their RACI matrix responsibilities lie would be the collection of data. The IT department would be assigned with the R role and be responsible for ensuring the system collecting the data is secure and safe. The DPO would have the A role and be accountable for the collection of the data and whether it follows the limited regulations that are in place and that customer data is being protected. The legal counsel will be the C in the matrix as they will be consulted by the prior two groups on how to set up the data collection systems per the pre- established rules and regulations. The final part of the matrix is the I and that belongs to management who will be informed of the process and success or lack thereof by the previous three groups in regards to the task at hand.

In this example, because there are limited regulations that are currently in place, it can be helpful to look at outside resources that can help guide the handling of sensitive data. One such source is the General Data Protection Regulation (GDPR). While the GDPR may only be in place for companies residing or doing business in the EU, it provides a great framework for businesses outside of the EU to follow and build their specific regulations around it. Other industry best practices can also be followed and consultation from a legal team who specializes in such information can be invaluable.

References

Ucertify. (2023). Dat-250-14280: Certified Ethical Emerging Technologist. Lesson 8.

Ucertify. https://www.ucertify.com/app/?action=cover