The Governance Crisis: The Reckoning Deepens

The Seven Pillars of Data Management, a novel in seven acts.

Chapter I, The Governance Crisis. Pillar I: Data Governance. Part 3 of 5.

The Human Cost

At 2:15 that afternoon, while the crisis team was still mapping the regulatory exposure, Nadia’s assistant forwarded an email that had been sent to the company’s general information address. It was from a woman named Margaret Whitfield, age seventy-one, a retired schoolteacher in Fredericton, New Brunswick, who had been a Northbridge policyholder for thirty-four years.

Mrs. Whitfield’s email was three paragraphs long. It was written in the careful, precise English of someone who had spent a lifetime teaching grammar to children who did not want to learn it. It did not contain a single spelling error.

She wrote that she had received a phone call that morning from someone claiming to be from Northbridge’s “special accounts department.” The caller knew her name, her address, her policy number, and, this was the part that made Nadia’s blood run cold, her prescription medication history. The caller knew that Mrs. Whitfield was taking donepezil, a medication prescribed for early-stage Alzheimer’s disease. The caller used this information to attempt to sell her a supplementary long-term care policy at what Mrs. Whitfield described as “an extraordinary premium.”

Mrs. Whitfield had not told anyone outside her family about her diagnosis. She had not disclosed it to her insurer. She had not consented to its use for marketing purposes. She had, in fact, done everything in her power to keep this information private, because she was a proud woman who had lived independently for eleven years since her husband’s death, and the idea that strangers knew about her cognitive decline, that they were using it to sell her things, made her feel, she wrote, “as though I have been undressed in public.”

Nadia read the email twice. Then she closed her laptop, walked to the window, and stood with her forehead against the glass, forty-two stories above the city, and wept.

Not because of the regulatory fines. Not because of the stock price. Not because of her career, which she could feel shifting beneath her like ice on a warming lake. She wept because Margaret Whitfield was a real person with a real disease and a real right to dignity, and the institution that Nadia served, the institution that was supposed to protect people, had failed her in the most intimate way possible.

This is what data governance failure looks like when you strip away the abstractions, the frameworks, the maturity models, and the vendor pitches. It looks like a seventy-one-year-old woman in Fredericton who can no longer trust that the company she has paid premiums to for thirty-four years will keep her secrets.

It looks like shame.

---

The Board

The emergency board meeting was called for 6:00 PM. By 5:45, every director was present, either in person or via the secure video link that the company maintained for situations exactly like this, though no one had ever imagined a situation exactly like this.

The Chairman, Douglas Firth, a former Deputy Minister of Finance who had served on more boards than he could count and who possessed the calm, unflappable demeanour of a man who had briefed prime ministers during currency crises, opened the meeting with a single sentence.

“Tell us how bad it is.”

Nadia stood. She had changed into the navy suit she kept in her office for emergencies. Her presentation was twelve slides. She had rehearsed it once, in the elevator on the way up, because there had not been time for more.

“Chairman, members of the board. At approximately 5:47 this morning, I received a courtesy call from the Deputy Commissioner of the Office of the Privacy Commissioner of Canada informing me that a formal investigation will be initiated into Northbridge Mutual’s handling of personal information. We have since confirmed that the scope of the investigation extends to the Information Commissioner’s Office in the United Kingdom and the California Privacy Protection Agency. Quebec’s Commission d’accès à l’information has also been notified.”

She paused. The room was absolutely still.

“The core finding is this: as a result of the 2016 acquisition of Commonwealth Life & Health and the subsequent data integration, approximately 62 million policyholder records: including sensitive health information governed by PIPEDA, Quebec’s Law 25, the UK GDPR, and the California Privacy Rights Act: have been stored, processed, and made accessible in a manner that does not comply with any of these regulatory frameworks. Access controls were not implemented. Data classification was not performed. Consent was not obtained or, where previously obtained, was not migrated. Retention policies were not applied. In summary: we have been processing sensitive personal information belonging to millions of people, across four jurisdictions, without lawful basis, for approximately eight years.”

Douglas Firth’s face did not change. He had survived currency crises. He had survived elections. He had survived a prostate cancer diagnosis that he had kept private for two years. He was not a man who showed shock.

But his hand, Nadia noticed, trembled as he reached for his water glass.

“What is the root cause?” he asked.

And here Nadia said the thing that she had been preparing to say all day, the thing that she knew would change the trajectory of the conversation, and possibly the company.

“The root cause is not technical. The root cause is that this organization has never established a data governance framework. We have no data ownership model. We have no data classification scheme. We have no governance council. We have no decision rights for data. We have policies on paper that have never been operationalized. We have a Chief Data Officer, me, who was hired fourteen months ago and given a mandate to ‘transform our data capabilities’ but was never given the authority, the budget, or the organizational support to address the foundational question upon which everything else depends: who is responsible for our data?”

She met Firth’s eyes.

“The answer, Chairman, has been nobody. And sixty-two million people are paying the price for it.”

← All writing