Voice of the DBA

Tag: data privacy

  • Technology and Privacy

    There can be a big divide among tech professionals on how they view data privacy. Some don’t worry too much, and some are very upset about the lack of data privacy and poor data handling practices from many organizations. Most people are probably in the middLe. I do know that every time I post about a Tesla, there are many people who mention the incredible amount of data Tesla collects, and how that makes them nervous.

    Tesla discloses that they collect, and I get copies of my data with my own logger. I find the data interesting and I glance at it over time to look for trends. I’m still happy that my top destination in the last year (after home) is the gym 😉

    Other car companies collect data on you and GM is in trouble in Texas. I suspect other companies do this, likely to learn more about how to build better cars, but also to get data they may be able to sell. The same thing likely happens with most of your data. Certainly, mobile phone companies collect lots of data, and I wouldn’t be surprised if a lot of your rentals/purchases/visits are being captured and sold to others from all sorts of vendors. Some of you might even be capturing usage data in your software that your customers might not like.

    I don’t know how I feel about this. I do think disclosure is important but not in the form of some EULA or a contract that people have to click through. I think there ought to be choice of what data is being collected and how it’s used. Or if it can be used. While I often just accept or dismiss cookie banners, I do appreciate that I can refuse cookies and still use more websites. I ought to be able to easily opt out from most data collection from most companies. It really should be optional.

    The world isn’t going back to analog devices and actions. Digital technology, with software invading most parts of your life, is here. I wouldn’t be surprised to find out most new appliances have a phone home feature that captures data and sends it back through unsecured wi-fi. A good reason to put a password on all your networks.

    In portions of the world, there are restrictions on data and privacy. They could be stronger, and the laws could limit more of what companies can do. Many companies still make money or run fine.

    They will be fine. Organizations always find ways to work within whatever system exists.

    I think that would be a good thing for most of us if more data privacy restrictions were in place. However, I don’t know how most of us would even go about helping enact them.

    Steve Jones

    Listen to the podcast at Libsyn, Spotify, or iTunes.

    Note, podcasts are only available for a limited time online.

  • A Lack of Privacy in Smart Cars

    I own a Tesla, and I love having a bunch of data about my usage of the car. I can see how much I’ve charged it, what it costs to power, where I drive, aggregates of my monthly usage, and more. It’s especially cool when my wife is coming to pick me up, and I can see where the car is, so I know when to go outside if the weather isn’t great. I also like the ability to cool or heat the car in advance of going outside in extreme temperatures.

    However, all that data also means there are potential issues with privacy and certainly security. I am well aware that location and other data are being captured by Tesla as I use the car. However, it’s not just Tesla. Lots of modern cars are collecting lots of data. Mozilla had a report on data privacy in cars, and all the manufacturers failed their data privacy test. There’s also a summary at Engadget of the results.

    Reading through the report, it seems that many of the manufacturers of cars are covering themselves from liability. Cars are sold and used in many jurisdictions and often there can be a wide variety of regulations about data, even inside of a single country. It seems that the policies are often written just in case something happens and they collect data from your use of the car (or they record you using the car).

    A point I hadn’t considered in the article dealt with the deletion of data when a car is sold. That could get tricky as not only is your usage data in the car, some data might potentially be in a manufacturer’s database. Or it might be stored in devices at a service center. Who knows what gets stored and copied in modern cars as they are serviced. Will we potentially have issues with mechanics or other workers stealing and selling data from entertainment or other information systems in cars? The possibilities make my head hurt in this modern world where everything can, and often does, collect data.

    I don’t know what data is stored inside modern vehicles or other systems. In some sense, I think that companies ought to disclose what they collect, and include examples of what this data looks like. Even when I read policies, like this one from Microsoft, I’m not completely sure if I know what data they may be collecting.

    The world of data privacy is complex, and as I’ve written before, I’m not even sure exactly how I would like my data handled. I think the GDPR is a good start, but I hope that we continue to evolve protections that ensure humans have more control over their data than the companies that collect it.

    Steve Jones

    Listen to the podcast at Libsyn, Spotify, or iTunes.

  • The Challenge of Deleting Data

    We collect a lot of data in our databases. Not as much in bytes as a lot of the video/audio/TikTok/Instagram sites, but still enough that many of us are constantly adding storage to our systems. All this data is not only a challenge to manage, but it also means that we are regularly dealing with query tuning issues. Better code, indexes, and more become regular challenges with large volumes of data.

    I am a big fan of trying to reduce the data you manage where possible. Archive, delete, remove older data, do something. This not only makes your systems easier to manage and improves performance, but it reduces your risk. Any PII data you have that might store is an ongoing risk in the event of a data breach. I don’t pretend this is easy to do in any way, but it’s a good idea.

    If you can remove data (or must because of a regulation like the GDPR), how do you ensure that data is deleted? Most of us know how to submit a DELETE statement, but that just removes the data from an online system. What if you restored or recovered this database tomorrow, would you remember to delete the data again? What about losing a copy of the data or log backup? What about older dev/test systems that were refreshed from production? The data might be in there. If you work through the possible problems, deleting data from a system isn’t as simple as you might expect.

    This might be even more complex in the age of cloud computing, where we don’t control the hardware for primary systems, or for backups. There is an article on deleting data in the cloud that talks about the government standards that require that you not only delete data, but that you overwrite the physical hardware to ensure it can’t be recovered. This still doesn’t address backup systems, but it does help to clarify that many of us might start to demand cloud vendors not only de-allocate the disks we use (or the backup storage), but they also overwrite the storage with zeros.

    Data security and the risks of not taking this seriously is becoming a bigger issue all the time. I don’t know that poor security will cause your organization to fail, but there can be significant costs and possibly reduced employment opportunities. While you might not want to be overly paranoid or concerned about every possible issue, it is worth asking questions of vendors, working through likely scenarios, and trying to quantify risk.

    More and more systems are regularly under attack from malicious groups, which means we want to minimize simple mistakes, reduce human error, and limit the exposure we have from the data we have by storing only the data we need.

    Steve Jones

    Listen to the podcast at Libsyn, Stitcher, Spotify, or iTunes.

  • The Chief Data Officer

    I don’t know if I’d be a chief, but I am glad that more companies are recognizing that data is one of the most valuable assets in most companies and starting to hire Chief Data Officers (CDO) to manage governance and security projects, as well as oversee data quality and management. With Chief Information Officers (CIO) and Chief Technology Officers (CTO), it appears that technology is becoming a force in the executive ranks.

    Most of the companies I’ve worked for only had one chief-anything to do with technology. It seemed that anything to do with computing fell under that individual. Adding a CIO and, now, a CDO shows that there there is a complexity in working with computer systems. The infrastructure and architectures of systems are important, but how we capitalize on information is crucial. I see a CIO as more of a business role than a technology one.

    The CDO seems to be a specialist that owns the data and ensures that it is well cared for, protected, and more importantly, managed appropriately. That would include knowing what data we have, how it is classified, how data should be protected, when to dispose of it, and how to assess the risk of keeping data around. It seems like a mix of strategic and tactical areas that a CTO or CIO might be tempted to consider low priority issues.

    I think data is one of the most important assets in many companies. We are always searching for ways to better understand our environment and make decisions that improve the way our organization works. We depend on data, and these days data is often something we lean on heavily. We need to protect it, especially as more regulations appear all the time that require us to change how we use and handle data.

    I don’t know how many of you have a CDO in your organization, or how quickly this will become common. I do know that the growing importance of the functions of this role are impacting more and more people who deal with data. While they might feel like a pain to adjust to, the more that we pay attention to how data is handled, the better off we all will be.

    Steve Jones

    Listen to the podcast at Libsyn, Stitcher, Spotify, or iTunes.