In the current data environment, organizations must employ effective and explicit data governance programs to protect individuals against the risks that these uses of information may raise. While individuals must continue to play an appropriate role in making choices about sharing their data, they cannot be held responsible for detailed decisions about vastly complex technologies and data uses. Thus, new models for data governance shift more responsibility for appropriate data controls to the organizations that derive and create value from data, and require those organizations to protect information in a manner more transparent to individuals and regulators. At the same time, organizations need to be able to process and analyze data in creative, innovative ways that enable them to respond quickly to the requirements of their customers and the marketplace. In exchange for increased corporate responsibility, accountability allows for more flexible use of data.
This paper provides an overview of accountability as an approach to data governance. It describes a model that requires organizations to adopt internal information policies based on recognized external criteria, and implement programs and procedures that ensure those policies are adhered to. The approach further calls upon organizations to assess and mitigate the risks to individuals raised by data use, and engage in review to determine whether their internal practices result in sound decisions about data. Finally, accountability necessitates that organizations remain answerable for the decisions they make about data, and stand ready to demonstrate their accountability to the appropriate third party.