One of the areas that I'm interested in, when my mind is not filled with privacy law stuff, is knowledge management. Luckily the blogging world is full of tremendous resources that not only provide useful news in the area, but also very insightful commentary. "Portals and KM", a blog written by Bill Ives, is one the best. His blog has gotten me thinking about KM in new ways, and I'm delighted that I've been able to return the favour by encouraging him to think about privacy aspects of knowledge management and portals: Portals and KM: Privacy Issues in Intranets - PIPEDA.

Privacy and knowledge management seem to reflect opposite philosophies of information management. Privacy usually suggests locking down data and limiting its circulation. KM, on the other hand, is usually based on notions of free flows of information, at least within an organization. Canadian companies are now having to think about how to integrate the two. It can be done, but involves some serious thinking and perhaps a few additional administrative steps. For example, prior work product and "best practice" documents need to be scrubbed of personally identifiable information before they are made widely available. Information about employees made available on intranets should be limited to that which is necessary from a business point of view and employees should know about what is put up there. Limiting access is also a good idea, because an HR intranet with employee data should not be available to the rank and file.

Anybody proposing to implement a portal or intranet with employee information would do well to consider privacy at the earliest stages, particularly in this age of identity theft (and when studies are saying most ID theft is an inside job). Of course, an experienced privacy lawyer can help you through this process ...

Labels: identity theft, information breaches, privacy