By: Dena Kozanas, former Chief Privacy Officer, U.S. Department of Homeland Security
Blog post from Privacy Perspectives, a newsletter of the International Association of Privacy Professionals, on January 19, 2021.
Over the past year, I had the great privilege of serving as the Chief Privacy Officer at the U.S. Department of Homeland Security (DHS). The DHS privacy program is often referred to as the “gold standard” of privacy programs in the federal government. I was proud to take over that tradition and saw an exciting opportunity to further mature its operations and expand its capacity.
Just as I joined the office, COVID changed all of our lives in profound ways. My sympathy goes out to the millions of Americans and their families who suffered the all too often devastating effects of the virus, including those who ultimately lost their lives as a result of the pandemic. Even those of us who were not infected with COVID faced unforeseen challenges – we resorted to a 100% telework posture and we took on new roles as caregivers for children and the elderly and new duties in a closed down environment. In the DHS Privacy Office and in privacy programs across the government, we faced the double challenge of unprecedented changes to our operations combined with an expanded need for us to engage our colleagues and ensure that privacy protections were a central concern as we took a leading role in launching new operations to protect community health in the wake of a global pandemic.
Leading a new organization in an entirely remote environment during such a turbulent time can often bring about uncertainty and fear for employees and supervisors alike, a situation which can often lead to a departure from established norms that protect the organization. However, during my time as the Chief Privacy Officer for DHS, we were able to protect our established processes for embedding and enforcing privacy protections and transparency by adhering to several core priorities. The three main keys to this success were: 1) maintaining communication with Department leadership to ensure privacy issues were always a priority; 2) sustaining our focus on privacy issues even while dealing with a global pandemic; and 3) keeping our workforce motivated and engaged while also recognizing the family demands of working from home.
Communication
Building and fostering relationships are important skills to have with any position but become critical in a large organization like DHS – the third largest federal agency, with approximately 250,000 employees worldwide. Creating allies among key players is vital to securing a seat at the risk-management table. Establishing and nurturing these relationships begins with reaching out and explaining that your role is an important piece of the overall team. Explaining that you are there to assist and not be “Dr. No” is key. In the privacy world, getting to “yes” does not require compromising information risk management and mitigation principles. Protecting personally identifiable information is essential to reducing risk and maintaining trust and, as we know, maintaining trust is essential for success. Emphasizing your role in balancing the mission of the organization within the confines of the privacy framework required by law and policy is the foundation of establishing these key relationships. Openness. Honesty. Trust. These principles should get you on and keep you on the team. And, during turbulent times such as with a pandemic, helping craft privacy protections at the front-end of policy making on flash decision points guarantees stronger privacy protections. Instead of being the caboose, you are there when everyone is boarding the train.
Focus
COVID uprooted everyone’s plans for 2020 – personally and professionally – and it became the focal point of most of our lives. Plans and priorities changed. Established workplans were put on hold and we pivoted our focus to being part of the COVID response effort. Reviewing compliance documents for employee safety measures, developing privacy impact assessments for new programs and technologies, and collaborating at the intra-agency and inter-agency levels became the new priorities. Despite the all-consuming efforts on being part of the pandemic response, we struck a balance on fulfilling the responsibilities of the bread-and-butter work of our office with our new responsibilities involving the pandemic. We did this by being able to determine what was need-to-do versus nice-to-do. Our office looked at projects with a 30-60-90-day perspective. Basically, classifying projects as short-term, mid-term, and long-term priorities. Interspersing these priorities with our COVID-focused duties guaranteed that we were not losing ground on advancing the non-pandemic goals of the office. Adaptability is essential during times of turbulence. The willingness to shift and be elastic with thinking makes certain an organization can not only survive the turbulent episode, but come out thriving.
Workforce
An organization’s workforce is its most important asset. Our office has a talented pool of dedicated civil servants, some of whom have been in their positions for a decade or more. However, even the most qualified and committed employee can struggle during an unprecedented global pandemic. Our workforce faced unanticipated hardships during 2020: the arrival of a new office head, a global pandemic, mandatory telework status, children homeschooled, and the constant unease of not knowing when routines would return to normal. Many of these stressors were endured by other organizations worldwide. Keeping employees motivated and engaged, while also recognizing the personal demands on each employee, became the top priorities for our management team. It is important to look at the workforce as an important asset and not a commodity, as a team (in some instances like a family) that is advancing the goals of the organization and pursuing a shared purpose. During such times, management needs to provide flexibility, compassion, and stability, while demonstrating resilience, kindheartedness, and open-mindedness. Despite the challenging environment, our office processed more privacy compliance documents and participated in greater intra-agency policy development in 2020 than in the previous several years. Work hours and family time blended together. It became acceptable for children to make guest appearances on video conferences or agreements to be made while walking the dog. But, in the end, the work was completed. When so much is at stake, you find ways to adjust – both employees and supervisors.
The experiences of the past year in our DHS Privacy Office, in the midst of a global pandemic, paved the way for a new era for our privacy program. We proved that our established norms and processes did not have to be compromised or diluted to ensure we embedded and enforced privacy protections and transparency in our programs. Focusing on relationship-building with Department leadership, rearranging our privacy goals, and listening to the needs of our workforce, our office was agile and resilient in the face of disruption. The privacy framework that led to the moniker of the “gold standard” persevered and serves as a lesson on how to proceed when a large government program is faced with adversity.