I was asked to participate in a roundtable on how to make privacy stick. I’m writing this ahead of then to get my thoughts in a row, but also to reflect on my experiences across 15 years of trying to convince thousands of people that information governance is important, and that taking a little time and thought goes a long way to preventing bad things happening, with all the remedial wasted effort that follows.
I’ve already written on this blog about tips for trainers and suggestions on diverse content and these remain valid. Updating this now, I’m thinking about how to make material relevant for your audience. If you’re an information governance professional you’re probably having to train the whole organisation. This is a group of people bound by little more than the name on their payslip. How can you make material relevant for them? I trained up nearly a thousand social workers and children social care staff when working in a London local authority a few years back… this was a presentation constructed from generic content plus subject specific material. It wouldn’t have worked for finance or planning or the Elected Members. Yet we often rely on a one size fits all approach to e-Learning and other awareness raising, purely because of the logistics involved.
In some respects this is because the regulator enforces by numbers. When reporting an incident the first question will be around training – did the ‘loser’ of the data (I use the term advisedly) have training? When? What percentage of the organisation have been trained? The ICO never ask… was the training any good? Sure – they might ask for copies or a few slides, but there’s no quality threshold. So is it any wonder that when forced to get the numbers up we resort to the easiest route – a generic web-based training course.
I’d argue that an information governance manager, Data Protection Officer or whatever is – first and foremost – a communications lead. They should be able to write good quality training for a variety of audiences. Their policies should be crisp and clear, with proper briefings and summaries (for executives and non-executives!). They should promote an ongoing dialogue using Yammer and other internal communications. They should host quirky set pieces… I dressed up as a football referee for an IG quiz once… I’ve heard of phishing awareness events where the CEO stands in the middle of the office holding a rod. I’ve told my trainees about my own failings – the ill-advised click that led me to send my login credentials to Lagos…
Back up your training with policy awareness. Get people to read and sign off the policies subject to some comprehension. You can use survey tools, specific systems… just get them to understand what’s been presented to them.
How you measure cultural reach is something I still need to think about, but you want people to be talking about you, your discipline, and what it means to them. No one goes into this profession to make any friends, but you can make a difference. You are competing with other messengers, but remember your message is particularly important.