Why privacy will make or break records management
The thing about real fines, is that they cut through a lot of boundaries.
Under the new privacy regulations, people are going to fines that actually hurt for all kinds of reasons.
If records management steps up to the plate, it really has a chance to make records - because it's the kind of regulation that's important and will be treated as important by people with power and authority.
Organisations are going to have to do massive transformation programs focused on how they manage their information - which will mean funding, authority, power, prestige, a heap of great projects and a lot to do.
It's also a risk.
Because they're not going to tolerate the imposition of artificial boundaries around the things that they're trying to manage.
The fines are going to cut through all of that.
No one will care if the system is iso16175 compliant - they will care about not getting fined.
No one will care if it's structured data or unstructured data - they will care about not getting fined.
No one will care whether CAARA says it has to do extra things things - they will care about not getting fined.
The fines are going to reveal that a lot of our boundaries are nonsensical to our organisations.
And when the boundaries dissolve, whoever is most pragmatic about the job that has to be done is going to win.
When a boundary is going to dissolve, there are always two ways you can deal with it.
Dissolve it yourself by being proactive and just coming to terms that it was something you created - a figment of your imagination that lasts only as long as you want it to.
Wait for it to dissolve and then try and deal with it.
I'm really concerned for records management, because when I see when a new system come along that very clearly contains records - most of what I see is professional denial.
Where this has generally left us is managing one "records system" when organisations have hundreds that contain records.
If that continues, privacy will break records management because the organisation knows that most of the risk is going to come from the hundreds.
The good thing about this, is that currently, the hundreds are managed by IT - who don't generally know what to do at the content level.
We do.
All we have to do, is own that, drop the artificial barriers we've created, and do what our profession was always supposed to do - manage the records.
If we do this, it will make records management - because privacy needs a governance first approach, and no one else does that.