5 ms·

As part of my work, I've had to read a fair amount of the legislation and reports coming out in this sector and also the "Consumer Data Rights" legislation (sim

by dav43 8y ago

As part of my work, I've had to read a fair amount of the legislation and reports coming out in this sector and also the "Consumer Data Rights" legislation (similar to the UK's open banking scheme. What I found was a massive difference in policy coming out from the same government but in two seperate streams of work. A) Consumer Data Right (legislation being built into Australia Privacy Act) focusing on banking, energy and then telecommunications: The user has complete control of their data. If a consumer asks a business to delete, they must do so (except for information that is legally required). B) MyHealthRecords: The government has complete control of your data. You cannot delete your account or your data. I'll add sources if I can, but its in the legislation.

auslander 8y ago
> ... focusing on banking... - yeah. Commonwealth Bank Privacy Policy: 5. Who do we share your information with? - Service providers — for example, mortgage insurers, loyalty program partners and our product distributors - Businesses who do some of our work for us — including direct marketing, statement production, debt recovery and IT - support - Organisations involved in our funding arrangements — like loan purchasers, investors, advisers, researchers, trustees - and rating agencies - Auditors, insurers and re-insurers - Current or previous employers — for example, to confirm your employment - Credit reporting bodies and credit providers https://www.commbank.com.au/security-privacy/general-security/privacy-policy-html-version.html?ei=gsa_generic_privacy https://www.commbank.com.au/security-privacy/general-securit...
- auslander 8y ago
  What's even more disturbing, is that Visa/MasterCard are possibly get itemised data from store transactions, like Milk BrandA, bread BrandB, Medicine Name, BrandC.
- TheSpiceIsLife 8y ago
  Yeah, how would they delete data they’ve already sold?
  - auslander 8y ago
    Good one :)
pjc50 8y ago
I'm trying to compare it to the UK system, with the NHS "spine" and the huge failed NPfIT: http://digitalhealthage.com/digital-health-lessons-npfit/ http://digitalhealthage.com/digital-health-lessons-npfit/ . But I don't really know enough detail.
- GlennS 8y ago
  I wasn't directly involved with NPfIT, but was working for a small healthcare IT company in the UK at the time, and did have some opportunities to talk to some of the lazy incompetents involved. I can tell you at least that Accenture were heavily involved in NPfIT too. They were forced out with the work uncompleted, although they somehow managed to dodge most of the fine. There are some obvious lessons to take away about trying to avoid projects which have massive scopes and vague, changing requirements. Also that contracting out to a consortium doesn't mitigate risk or project size, because the hardest parts of most IT projects are 1) deciding what to build and 2) dividing up the work into the correct pieces. For me, though the main lesson is that contracting IT systems is really risky if you don't have in-house engineers to vet it. Companies with no competence in delivering software will sell you the wrong things at the wrong prices, and they will do it really convincingly. For those who work in government, those companies will also have a terrible track record, but your institutional amnesia will prevent you from noticing, so you will hire them anyway. (Probably someone in your department previously attempted to get a company wiki to organise this sort of information, but ended up getting Sharepoint instead, and now no-one looks at it.)
halchion 8y ago
Although I will try to find this information myself in the meantime, I'm looking forward to you sourcing this.

by dav43 8y ago

auslander 8y ago

> ... focusing on banking... - yeah. Commonwealth Bank Privacy Policy: 5. Who do we share your information with? - Service providers — for example, mortgage insurers, loyalty program partners and our product distributors - Businesses who do some of our work for us — including direct marketing, statement production, debt recovery and IT - support - Organisations involved in our funding arrangements — like loan purchasers, investors, advisers, researchers, trustees - and rating agencies - Auditors, insurers and re-insurers - Current or previous employers — for example, to confirm your employment - Credit reporting bodies and credit providers https://www.commbank.com.au/security-privacy/general-security/privacy-policy-html-version.html?ei=gsa_generic_privacy https://www.commbank.com.au/security-privacy/general-securit...

auslander 8y ago
What's even more disturbing, is that Visa/MasterCard are possibly get itemised data from store transactions, like Milk BrandA, bread BrandB, Medicine Name, BrandC.
TheSpiceIsLife 8y ago
Yeah, how would they delete data they’ve already sold?
- auslander 8y ago
  Good one :)

pjc50 8y ago

I'm trying to compare it to the UK system, with the NHS "spine" and the huge failed NPfIT: http://digitalhealthage.com/digital-health-lessons-npfit/ http://digitalhealthage.com/digital-health-lessons-npfit/ . But I don't really know enough detail.

GlennS 8y ago
I wasn't directly involved with NPfIT, but was working for a small healthcare IT company in the UK at the time, and did have some opportunities to talk to some of the lazy incompetents involved. I can tell you at least that Accenture were heavily involved in NPfIT too. They were forced out with the work uncompleted, although they somehow managed to dodge most of the fine. There are some obvious lessons to take away about trying to avoid projects which have massive scopes and vague, changing requirements. Also that contracting out to a consortium doesn't mitigate risk or project size, because the hardest parts of most IT projects are 1) deciding what to build and 2) dividing up the work into the correct pieces. For me, though the main lesson is that contracting IT systems is really risky if you don't have in-house engineers to vet it. Companies with no competence in delivering software will sell you the wrong things at the wrong prices, and they will do it really convincingly. For those who work in government, those companies will also have a terrible track record, but your institutional amnesia will prevent you from noticing, so you will hire them anyway. (Probably someone in your department previously attempted to get a company wiki to organise this sort of information, but ended up getting Sharepoint instead, and now no-one looks at it.)

halchion 8y ago

Although I will try to find this information myself in the meantime, I'm looking forward to you sourcing this.