Posted on: Tuesday 18th of August 2009
How do you know if you are going in the right direction with the issue of personal information management? Here is a suggestion for a simple, practical scoring system.
It builds on the concepts of ‘weak’ and ‘strong’ personal information management (PIM). The weakest PIM scenario is where individuals have no control over how or whether their data is collected, who uses it, or for what purposes. The list broking industry is a good example of very weak PIM.
Under very strong PIM, individuals have complete control over what information they volunteer to whom, for what purposes, under what terms and conditions.
There are three factors here: control over process, control over purpose, and control over terms and conditions.
To create a VPI score for any piece of information, place it on a spectrum from zero (for no personal control at all) to 2 (for complete control). Use 1 for ‘just about acceptable’ under current norms.
Now, the trick about VPI scores is that they act as multipliers, not by mere addition. Thus, the lowest score possible is 0 and the highest 8 (2 x 2 x 2).
The interesting thing about multipliers is this. If you have a very high score on two dimensions but a very low score on the third dimension, it ruins your end score. You have to address all three dimensions.
Take Facebook. Individuals have near complete control over the process of volunteering information – so for the sake of argument let’s give it ‘2’ on that dimension. They also have near complete control over the purposes for which they use this information, so let’s give it ‘2’ on that dimension. But the terms and conditions that Facebook imposes about who owns that data and who gets the benefits of this data take the form of a super-aggressive data landgrab. So let’s give it a score of 0.1 on this front.
So what is Facebook’s final score?
2 x 2 x 0.1 = 0.4
Much less than acceptable, in other words.
What sorts of scores should organisations be looking for then?
Well, one of the difficulties with VPI is that ‘it depends’ – on the person, the subject, the context and circumstance etc. I am likely to want one score if I am sharing anonymous information about my soap powder preferences and another score if I am sharing personally identifiable information about the history and progression of my sexually transmitted disease. So that’s one use of VPI scoring: to know what sort of score you should be looking for with this bit of information, in this context.
The other factor, however, is individuals’ general desire to have more control over how their personal information is used. My guess is that a very high score of 8 will be restricted to a small minority of cases. But the trend is towards individuals wanting at least some control over what information is shared, with whom, for what purposes and for what benefits.
Remembering the above point about ‘horses for courses’, let’s give this generic ’some control’ a score of 1.5. If so, our target should be:
1.5 x 1.5 x 1.5 = 3.75 (let’s call it ‘4’ for simplicity’s sake).
This sums up the challenge for organisations in a simple metric. Over the next three to five years organisations need to move their personal data processes, policies and practices – and the relationships surrounding them – from a score of often less than 1 to a score of round about 4.
If you calculated your organisation’s VPI score, what would it be? And how can you improve it?