The cost side economics of records management and how to think about privacy and AI
To manage our records, there are really two things we need to do -
1. Gain knowledge about our records.
2. Take action to manage them (based on what we now know).
To understand how we can efficiently manage our records, we have to understand the options for each, and their relative costs.
This is going to vary dramatically from system to system.
In the past, we had relatively efficient ways of gaining knowledge about our records - we'd describe them at the time of capture based on the knowledge of the person who had worked on the transaction.
Description made it cheap for us to gain knowledge quickly about specific characteristics of records so that we could manage them (take action) effectively.
Over the last 15 to 20 years though, we haven't been describing adequately - because records work went to non-professionals who didn't need our form of description, and didn't understand the superpower level shortcut it provided.
So we've lost one cheap way to gain knowledge about our records.
Description as we've done it in the past though, isn't up to the task.
In the last 20 years, we've also had a massive increase in the volume of legislation that we have to deal with with (ie. privacy and information protection), and our organisations have started to understand that records create risks as well as gains.
Each new thing that we have to do, requires that we re-describe our records in new ways, to meet the new requirement.
Just think about business impact levels have evolved over the last ten years, and think about how widely content can vary in a business activity.
Lots of the things we have to deal with are reaching a point where accuracy is of supreme importance.
No privacy regulator is going to give you a pass if you spill a file full of PII because "records for that business activity shouldn't have had PII."
They're going to expect you to know that PII was there.
And if it's information of a national security type sensitive nature - critical infrastructure etc.
It's going to be worse.
What it means, is that there's now a premium for descriptive accuracy, and shortcuts like "this business activity deals with this data therefore this spot in our BCS is low risk" - aren't going to cut it.
This is where really smart search tech and AI fit.
They're part of the cost side of economics - an investment in them should make it cheaper to gain knowledge about the records we have.
Once we know our records, it's all about action, and how much action costs - but without detailed, specific knowledge of our records, action can't happen.