Recent Research Commissioned by Microsoft on Data Governance and Role Collaboration

Microsoft Privacy Team — Mon, 26 Nov 2007 22:38:00 GMT

Hi, I am Brendon Lynch, Director of Privacy Strategy in Microsoft’s Trustworthy Computing group. Among other things, my team’s work includes engagement with external privacy stakeholders and advising Microsoft product groups on data governance strategies.

I wanted to highlight some interesting research we recently conducted which explores how different roles within organizations are collaborating to protect personal information.

As you are probably aware, there is a lot of concern about personal information today. Research, including the latest edition of Microsoft’s Security Intelligence Report, shows that criminals are increasingly targeting personal information for financial gain. Other research shows that consumers are expressing concerns about shopping and banking online. We are also observing a seemingly endless string of reports of data breaches.

In response to these concerns, many organizations in both the public and private sectors are investing in people, process and technology to better govern the data they collect and manage. Looking at the people dimension of data governance, three important roles within organizations that standout are information security professionals, the data collectors and users (e.g., marketers) and privacy professionals (the newest role to emerge). We thought it would be interesting to explore how these roles are working with each other (or not!) to address data governance.

Our survey of over 3600 professionals across these three roles, and across three countries (USA, UK and Germany), was conducted by the Ponemon Institute and provided some very interesting results, including:

· Marketers consult security and privacy professionals a lot less often than security and privacy professionals think they do

· Organizations that had better collaboration between the roles reported that they had significantly less data breaches than organizations with poor collaboration

I encourage you to take a deeper look at the research results and view two related keynote presentations from Microsoft executives last month: Scott Charney, presenting to the International Association of Privacy Professionals (IAPP) annual Privacy Academy in San Francisco; and Ben Fathi presenting to the RSA Security Conference in London.

Trevor Hughes, executive director of IAPP and Peter Cullen, chief privacy strategist for Microsoft, also recorded a video discussing the data protection research and other challenges facing privacy professionals today.

Microsoft Research Focused on Demographic Data, Not PII

Microsoft Privacy Team — Thu, 24 May 2007 23:25:00 GMT

Erik Bratt, Sr. Communications Manager, here ...

At Microsoft, we’re fortunate to have some of the world’s most renowned technology scientists working on innovative research projects based on an open academic model. Microsoft Research is dedicated to conducting both basic and applied research in computer science and software engineering.

A recent research paper published by Microsoft Research Asia focused on analyzing the ability to predict users' gender and age, referred to as demographic information, from a list of Web sites they had visited. The project is based on a well-known machine-learning algorithm that has been in general use for many years. Click here to view the actual research.

There has been some confusion lately about what this research actually involves and its implications for privacy, and we want to provide some clarity.

First, we want to be clear that no personally identifiable information was used in this research. The researchers’ analysis was based on anonymous demographic data and would not enable Microsoft to identify any specific users. While gender was something the researchers could predict somewhat through analyzing Web page views, they actually found that they could not, with a high degree of accuracy, predict age from Web browsing activity using this particular algorithm.

It’s also important to know that this was simply a research project focused on demographic information, not personal identification.

Microsoft adheres to high privacy standards and is committed to giving people control over the use of their personal information. To help protect consumers' personal information, our products and services go through extensive privacy testing and review as part of our Security Development Lifecycle (SDL). We also are committed to giving people the tools and guidance they need to make informed choices about how their personal information is collected, shared and used.

We look forward to any feedback or questions you have.

The Data Privacy Imperative : Microsoft Research

Recent Research Commissioned by Microsoft on Data Governance and Role Collaboration

Microsoft Research Focused on Demographic Data, Not PII