Help with 'Client Confidentiality' course

Scenario/Interview +

Why not give them information on a fictional client and then create a scenario where they are interviewed on the client by a colleague (ie. the marketing folks) or a friend from another non-competing company. Or perhaps they are answering questions that their spouse asks. Answers can be multiple choice ranging from no comment to an answer that exposes too much information.

Always answering "no comment" is frustrating to the spouse or colleague — confidentiality does not equate to anonymity. However, there is always a line one should not cross. For example, I was given the guidelines — "you can talk about the work, or you can name the client — you can’t do both."

Social situations can be tricky — that’s where it is hardest to maintain confidentiality. The key is consistency in your approach so you don’t have to remember what you’ve said to whom.

On sensitivity of data — they key is often the appearance of confidentiality. Always shred unused copies, always put client data in sealed, stamped envelopes so breach can be more easily detected. The hardest part was getting people to understand electronic confidentiality — how many times have flash drives been lost with client data on them? Or laptops stolen? or confidential word documents or PDFs passed via email? Or passwords shared amongst colleagues or spouses? or worse yet, passwords put on a laptop via post-it note? Maintaining IT confidentiality is one of the hardest things to do.

Not to mention facebook, twitter, linked-in, etc. — my rule of thumb — if you don’t want your boss to see it or your mom to read it — don’t put it up. even if you restrict to friends, networks have a way of leaking.

Back when I worked at University we used an information campaign that asked the question "Are you leaking information? Keep it confidential." (with an appropriate image of a pen leaking ink over paper).

good luck!

2 Responses

ranihgill says:

September 4, 2009 at 1:24 am

Scenario/Interview +

Why not give them information on a fictional client and then create a scenario where they are interviewed on the client by a colleague (ie. the marketing folks) or a friend from another non-competing company. Or perhaps they are answering questions that their spouse asks. Answers can be multiple choice ranging from no comment to an answer that exposes too much information.

Always answering "no comment" is frustrating to the spouse or colleague — confidentiality does not equate to anonymity. However, there is always a line one should not cross. For example, I was given the guidelines — "you can talk about the work, or you can name the client — you can’t do both."

Social situations can be tricky — that’s where it is hardest to maintain confidentiality. The key is consistency in your approach so you don’t have to remember what you’ve said to whom.

On sensitivity of data — they key is often the appearance of confidentiality. Always shred unused copies, always put client data in sealed, stamped envelopes so breach can be more easily detected. The hardest part was getting people to understand electronic confidentiality — how many times have flash drives been lost with client data on them? Or laptops stolen? or confidential word documents or PDFs passed via email? Or passwords shared amongst colleagues or spouses? or worse yet, passwords put on a laptop via post-it note? Maintaining IT confidentiality is one of the hardest things to do.

Not to mention facebook, twitter, linked-in, etc. — my rule of thumb — if you don’t want your boss to see it or your mom to read it — don’t put it up. even if you restrict to friends, networks have a way of leaking.

Back when I worked at University we used an information campaign that asked the question "Are you leaking information? Keep it confidential." (with an appropriate image of a pen leaking ink over paper).

good luck!
User deleted says:

September 7, 2009 at 1:45 pm

Handling Sensitive Data

Don’t know if this is of help – Maybe you could include relevant legislation from the data protection act and handling requests for data disclosure possibly under section 7 and 29(3), awareness of social engineering ploys, secure disposal of data and compliance with WEEE (if applicable ?).