4

I work in the research department of a small company. There are two people with access to the research database, me and my colleague. The research database contains anonymized data.

My colleague is the daughter of the company's chief executive. Besides access to the research database, she also has access to another database which contains some private and identifiable information (PII).

Recently the chief executive granted me access to the PII info on a need-to-know basis. That is, I can arrange for additional data to be pushed to the research database. However, her daughter seems to be quite uncomfortable with her mom's decision. When I arranged for additional data to be sent to the research database, my colleague spoke to the database administrator, resulting me getting less data than what I had asked for. I got the bare minimum data I needed to do a reasonable project (as opposed to an excellent project). My project became much more time consuming (though it wasn't impossible). I was also able to draw less strong conclusions because I had less data to work with.

I surmise that my colleague has concerns about data security. I don't know the exact reason, but it could be that she has seen the hard work her mum has put in to build the company, and thus is super cautious about data security.

How can I win over my colleague's trust?

Improve this question
3
  • 1
    Minor detail, PII is typically read as Personally Identifiable Information. Such information is not necessarily Private. For example, someone's full name or e-mail address is definitely information that can identify them as a person (thus personally identifiable), but it's not necessarily private. It may be, but it need not be.
    – user
    Jan 6, 2019 at 18:16
  • What's the hard stop on collaborating with the colleague, or developing a robust analysis with the barebones dataset that's scalable to the larger dataset? Then you could just say "Here's the results, we could add more power with more data," and transfer the method out to person(s) with better clearance. When I was in biomedical research, I had no access to patient outcomes data and we just sent off the results we could generate to people doing the same job, but had patient outcomes data.
    – CKM
    Jan 7, 2019 at 18:19
  • Could you expand on the difference between the reasonable and excellent projects? I'm assuming this is mostly about lost statistical power, but the specific ways in which the limited data set impacted your planned project is important context.
    – Upper_Case
    Jan 7, 2019 at 18:49

6 Answers 6

Reset to default
6

From what you've written I'm going to agree with how your colleague handled/is handling things. Each request for access must clearly state:

  • what the data will be used for and what business need that fills
  • that use of the data in such a manner is compliant with relevant laws as well as any contractual obligations your company may have
  • how the data will be safeguarded

I got the bare minimum data I needed to do a reasonable project (as opposed to an excellent project). My project became much more time consuming (though it wasn't impossible).

I understand that you want to do your work well but that has to be balanced against risk and potential liability. Trust is built over time. Start small, go slowly, and show your colleague that you take privacy and security seriously and that you won't get complacent over time.

Improve this answer
4
  • 1
    It's wwl's superiors' (CEO's?) role to make sure the points you list are fulfilled. Normally you just need to sign an appropriate declaration stating how you will handle the data. "Trust is built over time" is a good piece of advice for dating or friendship, but working as a researcher or data scientist you need data and without them, your job doesn't make much sense. It's as if a truck driver, employed to work as a truck driver, wasn't given a truck to drive to drive, just a bicycle and you advised them "trust is built over time". All in all, your advice is not very helpful.
    – BigMadAndy
    Jan 6, 2019 at 7:52
  • 2
    @BigMadAndy I think it makes sense in this context and certainly worked for me more than once. Most of my new clients are very reluctant to take full advantage of what I can do for them, but over time that changes until I have almost full access to the financial information and reports that enable me to maximise my worth to their company.
    – Kilisi ♦
    Jan 6, 2019 at 14:26
  • @Kilisi, it doesn't make much sense to discuss your experiences here unless you feel like explaining exactly what your job is, etc. - and the comment section isn't meant to be a place for that AFAIK. From my experience as a consultant, our clients were normally contractually obliged to provide us all RELEVANT data - because without them we weren't able to do our job correctly. Basically, we had in writing that without the data they can't expect us to do our job. And our legal had very good reasons to have it like this.
    – BigMadAndy
    Jan 6, 2019 at 15:06
  • 2
    @BigMadAndy That's a weak parallel, because OP does have access to data, enough to do "a reasonable project". Just not all the data they might want. the parallel here would be more like "we're going to start you out in a small truck, we're not going to give you the big HAZMAT tanker until we've seen how you drive."
    – GB supports the mod strike
    Jan 6, 2019 at 22:23
6

It sounds like the first thing you need is a written and agreed upon set of standards for "need-to-know" of the data. I'm assuming you've already figured out how to make sure data in the research database is secured to a business-required standard, and is isolated from anyone else who may use that database but does not have need-to-know of the data. Ultimately, this isn't really about your colleague's trust, but about making sure that the business has properly weighed the risk and reward of granting access to subsets of sensitive data to you, and has a procedure in place that documents that access, documents how long it will last, and documents how the data is kept safe while it is in a foreign database.

It sounds like your company has a professional DBA - the DBA should be a part of this conversation, as well as someone from your information security group if you have one. The DBA should have suggestions on how to keep the data secured while making it as available as needed.

However, based on the situation described, you'll also want to make sure that the roles of each person in the access approval process are clearly defined. What should not happen is for the process to say that you get approval from your boss, and then for your colleague to go behind your back to "fix" her decision. From what you've described, it doesn't sound like your colleague needs to be part of the process at all, or could even be revoked access to the PII database and be required to request particularized access as part of the same process.

Improve this answer
5
  • 3
    I think you missed the part where the "colleague" is the daughter of the CEO. A.K.A. his second boss.
    – Jack
    Jan 6, 2019 at 3:16
  • @Jack That's pretty much why I included the last paragraph. If the CEO wants the daughter to be the day-to-day approver for the process that's fine but it needs to be in writing what the expectation is.
    – IllusiveBrian
    Jan 6, 2019 at 4:19
  • @IllusiveBrian I think the mention of the DBA might be misleading as this is more about policy rather than implementation. It needs clarifying, but it might be that the daughter is the designated Data Owner and is responsible for ensuring that the use of PII is minimised so may not involve the DBA initially.
    – Gwyn Evans
    Jan 6, 2019 at 8:42
  • 1
    @GwynEvans Since it's a small company, I sort of assume that policy, process and implementation are all going to be linked anyway. If they are having a meeting just about defining need to know then the DBA shouldn't be a part of that, sure.
    – IllusiveBrian
    Jan 6, 2019 at 13:18
  • I think this is a great textbook-correct answer, but I wonder how it would apply in what sounds like a small and informal organization (where "trust" - to use the OP's word - is often a tradeoff for policy.) I wonder if you can address how to de-formalize your suggestion? In other words, how do you solve this besides saying "we need a policy and more formality?"
    – dwizum
    Jan 7, 2019 at 18:08
2

You need to meet with your supervisor (CEO?) and ask them for guidelines for data handling and data requests. If such guidelines don't exist, you should suggest that a coherent set of guidelines is prepared that explains what you can request and what formalities should be met.

For example the companies I know all make their employees sign a document that specifies what you can't do with data and how you should handle them.

If they protest, explain how this impacts your role and honestly, you should probably ask yourself whether working as a researcher at a company in which you need to beg for data is sustainable. Unless the data is not key to your position, but I assume, based on your post, that it is.

Improve this answer
1

Demonstrate to both your colleague and the chief executive what you have built with the data that you have been given. Show that the PII is being protected well.

The handling of PII data is no joke. The penalties for mishandling said data can sink the entire company. You colleage, the CEO's daughter, is probably right to be nervous (I cant say for certain as I dont know the exact extent of the PII data you requested.) You need to be clear about what it is being used for, and even then it may be that the company doesn't even have the required legal permissions to use the data in that manner (in some jurisdictions, such as the UK, you are required to be clear to the user about what that data may be used for. If your use case isn't covered in the Terms of Service, you may not have permission to use it).

Seek clarification from your colleague and be prepared to make a case for the extra data you are requesting. In the meantime, make do without.

Improve this answer
0

This seems to be a family business with a proprietary database.

It is not only prudent for them to control acces for security and privacy reasons but also to thwart industrial espionage and keeping ahead of competition.

When proposing future projects, list the bare minimum information you need to make an ok report and the optimum datasets needed for a great result and let them decide.

This way if they complain about lack of detail, precision or overall quality it was their choice, to which you can point as the reason.

Improve this answer
0

Figure out what data you need to complete your research. Then bring it to the attention of your boss. To the effect of,

Boss, I am attempting to access PII information consisting of X, Y, and Z. I need this to complete my research. I am wondering if you can forward this with your approval to [insert PII data person] so she can move it to the research database. Thanks.

Based on the written question, it sounds reasonable that a individual is questioning the need to access data. Simply being vague by saying you "need" some unspecified data just isn't good enough, especially with PII data. You need to specify what data you need to complete the given research. What does the research need to show? Then you can go to the person with I need this specific range of data for this specific reason, please grant me that.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .