The Governance Crisis: The Aftermath

The Seven Pillars of Data Management, a novel in seven acts.

Chapter I, The Governance Crisis. Pillar I: Data Governance. Part 5 of 5.

The Price

The investigation lasted nineteen months. The Office of the Privacy Commissioner of Canada issued a finding of non-compliance and referred the matter to Federal Court. Quebec’s Commission d’accès à l’information imposed administrative monetary penalties of $18.2 million, the largest penalty under Law 25 since its enactment. The UK Information Commissioner’s Office imposed a fine of £12.7 million, citing “systemic failures in data protection governance.” The California Privacy Protection Agency imposed penalties of $4.3 million and required Northbridge to submit to a three-year compliance monitoring program.

The total financial cost: fines, legal fees, remediation, technology upgrades, customer notification, credit monitoring for affected policyholders, and the eventual class action settlement, was $247 million.

But the financial cost was not the worst of it.

The worst of it was the 4,200 policyholders who cancelled their policies in the three months following the public disclosure. The worst of it was the editorial in the Toronto Star that called Northbridge “a company that asked its customers to trust it with their most personal information and then left the vault door open for eight years.” The worst of it was the Congressional hearing in Washington where a U.S. senator held up a photograph of Margaret Whitfield, who had by then become the public face of the breach, and asked, “Is this what happens when we let corporations police themselves?”

The worst of it was the look on Douglas Firth’s face when he resigned as Chairman, not because the board asked him to, but because he believed that someone should be held accountable, and the culture of accountability that Nadia was trying to build had to start at the top.

The Rebuilding

Nadia stayed.

She stayed because leaving would have been easy, and easy was not what Northbridge needed. She stayed because the governance framework she had built in the twelve months following the crisis was working: not perfectly, not completely, but working in the way that living systems work: adapting, learning, improving. She stayed because she had made a promise to Margaret Whitfield, in a letter she had written personally, that the company would earn back the trust it had lost.

Two years after the crisis, Northbridge Mutual Insurance was unrecognizable from the institution that had received Marcus Pellerin’s call on that dark November morning. Every dataset was classified. Every domain had an owner and a steward. The governance council had not missed a single weekly meeting. Access controls were enforced automatically through a role-based access management system integrated with the data classification framework. Consent was tracked at the individual level, across all jurisdictions, with automated alerts when regulatory requirements changed.

The data quality scores had improved from an enterprise average of 62 percent to 91 percent. The average time to resolve a data access request had fallen from forty-three days to four. The number of policy violations detected had, paradoxically, increased, not because violations were more common but because the monitoring systems could now detect them. And the number of violations remediated within thirty days had risen from twelve percent to ninety-four percent.

The Privacy Commissioner’s office, in a follow-up review that Nadia had voluntarily requested, noted that Northbridge’s governance framework was “among the most comprehensive in the Canadian financial services sector” and recommended it as a model for other institutions.

Nadia did not celebrate. Celebration, she believed, was for people who had done something worth celebrating. What Northbridge had done was fix something that should never have been broken.

Margaret

On a grey afternoon in March, eighteen months after the crisis, Nadia flew to Fredericton. She had not told anyone at Northbridge she was going. This was not a corporate visit. There were no communications advisors, no legal counsel, no photographers.

She drove a rental car to a modest bungalow on a tree-lined street near the Saint John River. The garden was well-tended despite the season, raised beds covered with burlap against the frost, a bird feeder freshly filled. The door was answered by a woman with white hair and clear eyes that carried both intelligence and something else, a wariness that had not been there before. The wariness of a person who has learned that trust, once broken, does not reassemble itself easily.

“Mrs. Whitfield? My name is Nadia Okafor-Tremblay. I’m the Chief Data Officer at Northbridge Mutual. I’ve come to apologize to you in person.”

Margaret Whitfield studied her for a long moment, then opened the door wider.

“You’d better come in. I’ll put the kettle on.”

They sat in Margaret’s living room for two hours. Nadia explained everything: the acquisition, the integration failure, the governance gap, the remediation. She held nothing back. She did not use corporate language or legal hedges or the carefully vague phrasings that communications teams craft to minimize liability. She spoke to Margaret the way one human being speaks to another when the stakes are too high for anything but the truth.

Margaret listened. She asked questions, sharp questions, the questions of a woman who had spent forty years teaching critical thinking to teenagers. She asked why no one had checked the data after the acquisition. She asked why a junior analyst had found the problem and not the people who were paid to look for it. She asked why it had taken a regulatory investigation to force the company to do what it should have done on its own.

Nadia answered every question honestly. Some of the answers were “I don’t know.” Some were “Because we failed.” None were excuses.

When Nadia rose to leave, Margaret walked her to the door and said something that Nadia would carry with her for the rest of her professional life.

“You know, dear,” Margaret said, “I was a teacher for forty years. And the one thing I learned is that you can forgive a mistake. You can even forgive negligence. What you cannot forgive is someone who sees the problem and does not act. You acted. It was late. It should have been sooner. But you acted. That matters.”

Nadia thanked her. She walked to her car. She sat in the driver’s seat, looking at the bungalow with its burlap-covered garden and its freshly filled bird feeder, and she understood something that no governance framework, no regulatory guidance, and no boardroom presentation could ever fully capture.

Data governance is not about data. It is about people. It is about the seventy-one-year-old woman in Fredericton and the sixty-two million others whose names are in your systems and whose trust is in your hands. It is about the promise, implicit in every privacy policy, every consent form, every customer interaction, that you will treat their information with the same care you would want for your own.

It is, in the end, about the kind of institution you choose to be.

Epilogue

The Lesson

Three years after the crisis, Nadia Okafor-Tremblay was invited to deliver the keynote address at the Canadian Privacy & Data Governance Summit in Ottawa. The audience was 800 people: chief data officers, chief privacy officers, general counsels, regulators, consultants, and a handful of journalists who covered the intersection of technology and law.

She did not use slides. She did not use notes. She stood at the podium and spoke for forty-two minutes, and when she finished, the room was silent for three full seconds before the applause began.

She told the story of Northbridge. All of it. The acquisition. The integration. The failure. The phone call at 5:47 in the morning. Margaret Whitfield. The seven steps. The fines. The resignation. The rebuilding. She told it without self-pity and without heroism, because the story was neither pitiful nor heroic. It was, she said, the story of an institution that learned the hardest possible way that you cannot govern what you do not own, you cannot protect what you have not classified, and you cannot build trust on a foundation of ignorance.

She closed with seven sentences, one for each step, one for each pillar of the framework that had saved her company:

“Governance starts at the top. If your CEO does not champion it, it will die.”

“Governance requires a council. Not an email chain. Not a quarterly update. A room full of decision-makers who show up every week.”

“Governance requires ownership. Every dataset needs a name on it. Not a team. Not a department. A human being who answers the phone when something goes wrong.”

“Governance requires policies that are short, enforceable, and tied to consequences. A policy that no one reads is worse than no policy at all, because it creates the illusion of control.”

“Governance requires clarity about who can decide what. Ambiguity is not flexibility. Ambiguity is risk.”

“Governance requires measurement. If you are not tracking it, you are not managing it. And if you are not managing it, you are hoping. Hope is not a strategy.”

“And governance requires humility. The humility to admit that it is never finished, never perfect, and never someone else’s problem.”

She stepped back from the podium.

The applause lasted a long time.

End of Chapter One