Description

Data usage is an entitlement expressly granted to authorized users. Entitlements are controlled by rights and obligations formalized in licenses, contracts, laws and regulations, business policies, codes of data ethics and data classifications. The rights and obligations must be captured and expressed in metadata as rules. To ensure consistent and reliable usage, people and systems interacting with data must adhere to these rules.

Objectives

• Develop and adopt a taxonomy or ontology for the expression of rights and obligations.
• Ensure that the requirement to capture and record rights and obligations is supported by policy.
• Capture rights and obligations as metadata in a rules repository with traceability to their source.
• Link rights and obligations to the data assets to which they apply in the data catalog.
• Ensure rights and obligations are exposed and can be consumed to support automation of their enforcement.

Advice for Data Practitioners

There are many benefits of capturing data entitlement rights and obligations as metadata.

• Enable quick, automatic compliance determinations.
• Reduce the need for third-party audits and the associated risk of fines and other liabilities created by non-compliant data usage.
• Support innovation and the ability to scale.
• Control the security and reputational risks inherent in the data processing
• Simplify change-management tasks when modifying rights and obligations for data assets.
• Ensure compliance directives propagate across platforms and applications.
• Ensure compliance directives are understood and recognized by data supply chain stakeholders and regulators.
• Reduce the cost of managing data by enhancing rights-management process automation.

Non-compliant data usage is risky and costly. Implementing rights management into an existing data governance program can significantly improve monitoring and minimize risk and cost exposures.

A clear understanding of the data entitlement rights and obligations is the first step to ensure compliance. It is necessary to acquire knowledge of the licenses, contracts, laws and regulations, business policies, codes of data ethics and classifications that control data usage. Refer to CDMC 2.2 Data Classification are Defined and Used.

Data entitlement rights are expressed as rules informed by cross-organization control functions and established by data owners. The rules define if and when data consumers can access the data. For reference, the rules should contain links to the relevant contracts, regulations or document sources.

Clarity and precision are achieved by expressing these rules as sets of:

• Permissions – what actions can be taken, such asdisplay this data to a trader.
• Prohibitions – what actions cannot be taken, such asnot sharing this data with a customer.
• Duties – the actions that must be taken to validate permission, such as areport on usage.

It is important to use a consistent vocabulary to specify permissions, prohibitions and duties. Insistence on a limited vocabulary reduces ambiguity and supports human and system interpretation. Free-text entries should be avoided.

Entitlement rules and the data assets they control are linked by articulating those rules as metadata and recorded in the data catalog. In this form, the rules allow the data management system to trace rights and obligations directly from the data itself. The permission rules function as a semantically rich directive readily acted upon by both people and systems. These directives are readily enforceable to ensure compliance. They also cultivate a common and consistent understanding of rights metadata across platforms and applications.

Expressing rights and obligations as metadata enable the automatic determination of entitlement rights. Refer to CDMC 3.1.2 Data entitlement rights are enforced, and CDMC 3.1.3 Access and entitlement tracking is automated.

To support compliant data processing along the data supply chain and beyond organizational boundaries, articulate rules with an industry-standard Rights Expression Language (for example, the Open Digital Rights Language (ODRL) market data profile).

The life-cycle of rights metadata should be managed like all sensitive metadata. Access to such metadata must be strictly controlled, and all changes must be logged and auditable. Refer to CDMC 2.1 Data Catalogs are Implemented, Used and Interoperable.

Cloud data stores enable quick discovery and access to many data assets. Understanding the data entitlement rights and obligations is critical to effective data management. The importance increases as more data assets move to the cloud. Data practitioners must provide transparency and implement controls for these rights and obligations.

Advice for cloud service and technology providers

Capturing data entitlement rights and obligations as machine-readable metadata provide broad support for automation and rapid data processing. Cloud service and technology providers should offer tools and services that enable data consumers to verify compliance before, during and after processing. Refer to CDMC 3.1.2 Data entitlement rights are enforced, and CDMC 3.1.3 Access and entitlement tracking is automated.

Preemptive compliance verification ensures that data use cases are tested for accessing the data inventory targeted for consumption. These verifications could be automated in data marketplaces, improving discovery by ensuring data consumers only receive compliant data products. In particular, entitlement rights metadata is useful in expressing data consumer requirements and data producer restrictions in a data sharing agreement.

As policies are applied along the data supply chain, data consumers may create stricter versions of the rules to reflect business policies and customer relationships. These modified rules should be testable for compliance against the original policy requirement. Refer to CDMC 3.1.2 Data entitlement rights are enforced and CDMC 3.1.3 Access and entitlement tracking is automated.

Both data producers and data consumers expect all cloud service providers to respect their entitlement rights metadata. When operating from the same metadata, compliance determinations must be identical across platforms. Cloud service providers should implement common standards for expressing entitlement rights metadata.

Questions

• Has a taxonomy or ontology for the expression of rights and obligations been developed and adopted?
• Is the requirement to capture and record rights and obligations supported by policy?
• Are rights and obligations captured as metadata in a rules repository?
• Can rights and obligations be traced to their source?
• Are data assets in the data catalog linked to the rights and obligations that apply to them?
• Can rights and obligations metadata be consumed to support automation of their enforcement?

Artifacts

• Rights and Obligations Taxonomy/Ontology definition model or document
• Data Management Policy, Standard and Procedure – defining and operationalizing capturing and recording rights and obligations
• Rights and Obligations Catalog Report – including details on the source of each right and obligation
• Data Catalog Report – tracing links to the rights and obligations that apply to each data asset
• Rights and Obligations API Specification – providing detail on how to access and use rights and obligations information

Scoring

Next Sub-Capability

Description

To be effective, an organization must enforce its policies for accessing and consuming data assets according to classification metadata, including permissions of users, groups, and applications related to data assets entitlements. Additionally, the organization must ensure enforcement of transferring data asset entitlements throughout the data lifecycle.

Objectives

• Ensure the execution of data access rights by identifying, sharing, implementing consistent enforcement of data entitlements as data travels across platforms, applications and environments—throughout the data lifecycle.
• Automate policy-based rights and permission assignment—both for data access and use.
• Automate rights enforcement according to permission metadata that derives from data catalogs and classification attributes.

Advice for Data Practitioners

An organization should explore and utilize automated cloud environment capabilities for facilitating and enforcing rights management policy as data flows into, through and outward from cloud environments. Practitioners should proactively manage and enforce data asset permissions between applications and users—throughout the data supply chain and data lifecycle.

An organization should progress to fully automatic data rights enforcement over time for all data assets. The organization should establish metadata that corresponds to each data asset. Rights enforcement that uses this metadata should support the incorporation of data ownership and transparency. Rights enforcement should also align with data governance programs and be available during policy and controls reviews.

Practitioners should ensure that authentication systems conform to the business and licensing policies of the organization. Consider proactive monitoring for entitlement discrepancies, such as varying levels of application of entitlements between applications. Also, consider establishing the ability to automate up through the highest level of entitlement enforcement to ensure compliance with policies and regulations.

Consider monitoring the consistency of each entitlement as it travels into cloud environments, various platforms and applications, and the entire data supply chain. Integrate user access controls with entitlements metadata to accelerate or automate granting, revoking or modifying entitlements.

Rights enforcement granularity should correspond to the type of data asset and guidance from the data asset owner. Commonly, an on-premises solution generally provides for rights enforcement for each application. Rights enforcement granularity should also correspond to rights management policies, which should specify the rights for each type of entity (such as database, schema, table, or data element).

Advice for cloud service and technology providers

A cloud service and technology provider should provide the capability to associate access controls with specific metadata entitlement attributes. The efficient methods that result can be readily automated. A provider should also deliver capability for the organization to an identity management system to support proactive and granular enforcement of licensing, regulatory, ethical concerns for data entitlements and data consumption.

In addition, a cloud service provider (CSP) should provide the ability to monitor and transfer data entitlements as data flows into, through and outward from the cloud environment.

Questions

• Has the enforcement of data entitlements been applied consistently and accurately to data across the data lifecycle?
• Have rights and permission assignments been automated—both for data access and use?
• Has rights enforcement been automated using rights metadata that derives from data catalogs and classification attributes?

Artifacts

• Data Management Policy, Standard and Procedure –defining and operationalizing user and group entitlements aligned to the information classification scheme
• Access Logs – evidencing the enforcement of access entitlements

Scoring

Next Sub-Capability

Description

Data entitlements are controlled by rights and obligations formalized in licenses, contracts, laws and regulations, business policies, codes of data ethics and data classifications. Providing proof of authorized data usage requires evidence that demonstrates compliance with such rights and obligations. The evidence is especially important when collaborating with multiple internal or external parties.

To ensure compliance and enable scalable automation, it is essential to manage, enforce and track data entitlements with metadata. Moreover, it is important to record all data access events in a data access event log. Each log entry should include all users, permissions, groups, departments and applications. The level of detail must be sufficient to satisfy reporting, monitoring and compliance requirements.

Objectives

• Demonstrate adequate enforcement of entitlement rights using policy and workflow documentation.
• Record data access and track data lineage of data elements in the cloud environment.
• Support data sharing compliance, data marketplaces and data asset recommendations for analytics.
• Automate data access controls aligned with data entitlement metadata.
• Establish reporting facilities for traceability of data entitlements and data access.
• Establish outcome metrics and capture the corresponding measurements for entitlements enforcement.

Advice for data practitioners

Incorporating automated data access and data entitlement tracking can significantly reduce the ethical, business and regulatory risks of non-compliant data sharing. This tracking system must be built to minimize present and future risks by closely aligning with data privacy, ownership, sourcing, and data ethics policies. This system should provide the ability to identify all abusive patterns of data access and restrict access that is not explicitly authorized. In a cloud implementation, automatic tracking should also consider the initiation and continual evolution of data entitlements throughout the entire application lifecycle, user or departmental access to data. For example, in some circumstances, multiple data elements taken from independent sources with a lower sensitivity can—when combined—divulge sensitive personal information. In another example, a new permission scheme may enable access that violates the intent of established policies.

Explicit, deliberative and continuous tracking is essential for entitlements and access traceability. Practitioners that operate with only selective or incomplete tracking cannot rely on the sparse audit trails this produces. Such deficiencies will result in multiple data risks and security risks. Risks inevitably result in compliance failures and penalties. Organizations should implement a provider- and location-agnostic approach to data entitlement and access tracking. The approach should include the recording of all permissions changes. It should also ensure consistency in reporting across all jurisdictions, workflows, users, departments and roles.

A user access management application validates user and group permissions. It is essential to align the user access management application for permissions with access to sensitive data to maximize compliance. Access tracking should be an integral part of data lineage, and this lineage should include traceability and evolution tracking for user, departmental or role-based permissions. Refer to CDMC 3.1 Data Entitlements are Managed, Enforced and Tracked, and 6.2 Data Provenance and Lineage are Understood.

When providing evidence to demonstrate compliant data access, it is essential to have built data entitlement and access tracking into operational and compliance reporting. In addition, automation of both tracking and reporting ensures consistency and standardization.

Data entitlement and access reporting give data owners the ability to examine, assess and proactively manage risk. Reporting also provides a means to assess the value of data, verify data compliance, and consider the necessary ethical treatment of sensitive data in every context.

Advice for Cloud Service and Technology Providers

Entitlement and access tracking is important to data, policy and security management in both on-premises and cloud environments. However, the control framework may be more complex in a cloud environment, containing various hybrid and multi-cloud implementations.

Cloud environments must provide functionality for each distinct data storage entity that enables an organization and partners to:

• Manage and track the log of data entitlement classification.
• Track the evolution throughout any workflow in which sensitive data is accessed across all jurisdictions.
• Require an alert or escalation whenever logging is disabled.
• Report on data access requests in a unified, auditable, historical view, thereby detecting potential violations of organizational policies across all cloud locations and for the entire retention period.
• Run historical reports on data entitlements, access, and use compliance to support usage-based billing models.
• Integrate reporting and tracking with data marketplace environments and other mechanisms for data sharing outside the organization.

Questions

• Can enforcement of entitlement rights be demonstrated using policy and workflow documentation?
• Is data access recorded, and is the data lineage of data elements tracked in the cloud environment?
• Are data sharing compliance, data marketplaces and data asset recommendations for analytics supported with automation?
• Have automatic data access controls aligned with data entitlement metadata been implemented?
• Have reporting facilities for traceability of data entitlements and data access been implemented?
• Have outcome metrics been established that capture the corresponding measurements for entitlements enforcement?

Artifacts

• Policy, Standard and Procedure – defining and operationalizing data entitlement enforcement
• Data Access Event Log – include reporting on data access patterns, data access events and data lineage
• Functional Specifications – for automation of access controls and support of data sharing compliance, data marketplaces and data asset recommendations.
• Data Entitlement Traceability Report
• Data Access Report – including entitlements enforcement metrics

Scoring

Next Sub-Capability

Description

Managing data ethics for an organization has become a required discipline. Therefore, it is incumbent that organizations establish a formal data ethics oversight function, ensuring the acquisition, access, and use of data is conducted in an ethical manner and that the outcomes of data access and use are being monitored to ensure they fall within acceptable ethical guidelines.

Establishing formal organizational structures to support data ethics creates a framework and ensures ethical data access and use accountability.

Formal data ethics oversight includes a governing body, a Code of Data Ethics, and senior executive accountability with defined roles and processes. Roles and responsibilities are codified through documentation, training and verification.

Objectives

• Assign overall accountability and responsibility for data ethics to a senior executive.
• Create and enact a Code of Data Ethics for the organization as directed by the senior executive.
• Define and implement governance structures for guiding and enforcing adherence to the Code of Data Ethics.
• Identify stakeholders and form working groups to implement the Code of Data Ethics.

Advice for data practitioners

To support ethical data access and use, practitioners must identify and document data subjects’ expectations for how their data is accessed and used and evaluate outcomes of the use. As necessary, establish structures within the organization's governance functions and align those functions with the Code of Data Ethics. Governance must also support processes and protections for personnel who raise concerns about ethical data access and use.

Collaborative, routine and transparent information practices are essential to ethical data management because such practices energize the interdepartmental collaboration necessary to evolve organizational culture from being merely data-driven to being driven by data ethics.

Beginning a data ethic initiative

Early efforts to cultivate data ethics awareness in an organization typically begin with the formation of a steering committee or working group. The group communicates the principles of data ethics among stakeholders through collaborating on activities that examine the importance of data ethics through the lens of the organizational mission and values. Eventually, organizations that agree on a commitment to data ethics develop a formal, chartered data ethics governance that aligns well with the general governance structure of the organization. This governance includes a formal body of diverse stakeholders (internal and external) to oversee the ethical acquisition of data, the ethical use of data and the ethical outcomes of data use.

Realignment of the organization

The working group and the diverse formal body work collaboratively to establish data ethics compliance with the Code of Data Ethics. Such compliance should be mandated by a senior executive and implemented throughout the organization. Many organizations assign overall accountability and responsibility for data ethics to the Chief Data Officer. Implementing the Code of Data Ethics with accountability distributed throughout the organization requires data ethics governance structures that align with the overall governance structure of the organization. Examples include an ethics committee that reviews and approves new use cases. These structures allow the senior officer for data ethics to remain accountable for ethical data management for the entire organization.

Ethical outcomes

Ethical outcomes result from data access and use that meet the organization's business needs without infringing on the human dignity of others. Human dignity can be considered what society tolerates—what is generally considered fair. Organizations have a moral imperative to interrogate ethical considerations for data used to develop models and analytics—and the outcomes and effects created by their use. Ignoring such impacts on society is unethical. Governing the ethical outcomes of data access and use requires long-term scenario planning and research into the societal effects of these practices. This accountability is more complex and involved than legal compliance but also links more directly with the values contained within the organization’s Code of Data Ethics.

Going beyond mere legal compliance

The role of legal and compliance in the data management initiative is to mitigate legal risk. However, laws and regulations typically lag well behind technological change. Organizations that focus only on legal compliance risks may face costly civil and criminal challenges from data ethics risks. Legal compliance is the minimum. Innovative and responsible organizations strive to be leaders in ethical data management.

Aligning data management practices with a code of ethics

Data often contains one or more meanings. Understanding how meaning changes in different contexts and cultures is vital to ethical data management. A Code of Data Ethics describes the values underpinning an organization’s data management. When structures and processes align with the Code of Data Ethics for an organization, decision-making becomes easier since data professionals have clear guidance on ethical use and outcomes expectations.

Key principles

A Code of Data Ethics typically includes these general principles:

• Do no harm.
• Interrogate outcomes to mitigate the potential for bias.
• Ensure data use is consistent with the expectations and intentions of its data subjects.
• Collect only the data that is necessary for a specific task.
• Provide transparency—data subjects have a right to know what data is collected, how it is used and how it is shared.
• Prioritize design practices that promote transparency, clarity, comprehensiveness, explainability, configurability, accountability, and proactive interrogation of training data and outcomes patterns.
• Welcome continuous internal and external ethical review.

A Code of Data Ethics cannot explain the specific expectations or requirements for every situation. Instead, a Code of Data Ethics should provide guidance so all practitioners in an organization understand the values by which they should be making decisions about data.

A key principle of data ethics governance is the empowerment of all personnel in the organization to have the ability and the means to raise concerns about data access, use and outcomes. Practitioners must ensure procedures exist for addressing such ethical issues. In addition, there should be a way to field ethical concerns from external stakeholders as well.

Advice for cloud service and technology providers

Regulators hold an organization responsible for any cloud service and technology provider outcomes, so providers should anticipate the organization’s periodic testing and reporting to ensure that outcomes align with the data ethics expectations in the third-party agreement. In addition, providers should support the ability of the organization to document both the purposes and outcomes of data use.

Questions

• Has overall accountability and responsibility for data ethics been assigned to a senior executive?
• Has a Code of Data Ethics been created and enacted for the organization as directed by the senior data officer?
• Have operating governance structures for guiding and enforcing adherence to the Code of Data Ethics been defined and implemented?
• Have stakeholders been identified and working groups been formed to operationalize the Code of Data Ethics?

Artifacts

• Role Definitions Document – demonstrating assignment of data ethics accountability to a senior executive and outlining other roles and responsibilities
• Code of Data Ethics
• Data Ethics Governance Committee Charter – including roles and responsibilities
• Data Ethics Review Committee Charter – demonstrating diverse representation from across the organization

Scoring

Next Sub-Capability

Description

Operationalizing data ethics in an organization begins with a mandate from senior management, but this mandate must have broad support through specific practices and direct accountability throughout the organization. Establishing the practices and accountability is achieved through defining and operationalizing policy, standards and procedures that execute against the Code of Data Ethics established by the organization.

Objectives

• Define and approve data ethics policies for the organization.
• Deliver communication and training that reinforces the Code of Data Ethics.
• Establish a process for reviewing data acquisition, access, use and outcomes of data decisions against data ethics considerations.
• Establish a process for reporting concerns about ethical data acquisition, access, use and outcomes of data decisions.
• Establish a process for resolving ethical issues raised concerning data.
• Establish milestones, metrics and measures for quantifying the extent of adherence to the Code of Data Ethics.

Advice for data practitioners

Embedding provenance information into the metadata is one best practice that strongly supports ethical data access and appropriate data use. This approach can significantly enhance data collection and data use transparency. Another important practice is establishing tollgates in data management processes to verify adherence to the Code of Data Ethics.

It is also important that data practitioners at all levels of the organization can describe and communicate the role and responsibilities of the data ethics senior officer. Practitioners should also understand that accountability for data ethics is a data consumer responsibility throughout the organization. Understanding these responsibilities should be reinforced by investing in data ethics training and formalizing roles and responsibilities across the organization.

The organization should consider proactive measures to cultivate trust with its customers and partners. It may be necessary to provide individuals with continuous or periodic access to the data held about them beyond jurisdictions with a legal requirement. One proactive measure to reinforce a strong data ethics culture is to enhance the treatment of customer consent by collecting metadata for both legal and perceived consent. Other proactive measures include disclosing to customers the organization policy for data disposition and resolving to collect only necessary data for specific tasks.

Advice for cloud service and technology providers

Cloud service and technology providers should anticipate demand for technical solutions that help organizations and partner organizations comply with ethical obligations. Providers should also offer methods by which organizations can define, implement, and audit the purposes of data use to support ethical outcomes.

In addition, providers should have a method for documenting the outcomes of data decisions and measuring against expectations as specified in agreements. For example, proactively verifying authorized data use will strengthen relationships among the various participants in the data supply chain.

Providers should deploy automation to identify when data may be used in a new way and initiate workflows with recommendations for data owner review of new use cases.

Questions

• Have data ethics policies been defined and approved for the entire organization?
• Is there a program for communication and training that reinforces the Code of Data Ethics?
• Have processes been established for reviewing data access, data use and outcomes of data decisions against ethical considerations?
• Is there a process for reporting concerns about ethical data access, data use and outcomes of data decisions?
• Is there a process for resolving ethical issues raised concerning data?
• Have milestones, metrics and measures been established for ensuring the extent of adherence to the Code of Data Ethics?
• Have all of the above been operationalized to ‘business as usual’ for the organization?

Artifacts

• Data Management Policy, Standard and Procedure – defining and operationalizing management of data ethics
• Data Ethics Communication Plan
• Data Ethics Training Curriculum and Plan
• Data Ethics Review Process – covering ethical data access, use and outcomes
• Data Ethics Reporting Process
• Data Ethics Issue Remediation Process
• Data Ethics Metrics Report

Scoring

Next Sub-Capability