UK GDPR

A critical aspect of ForHumanity’s certification scheme is robust governance, oversight and accountability at the Officer and Board of Directors level to ensure trust.  It is not sufficient to require “the organisation” to comply with aspects of this certification scheme. Simply requiring an organisation to comply with certification criteria without defining specific accountability in governance structures creates ambiguity regarding delegation of authority and/or segregation of duties. Further, organisational compliance alone does not eliminate conflicts of interest, and its general nature could offer ‘cover’ to persons designing, developing and maintaining the data controlling/joint-controlling/processing system without the requisite experience to to satisfy all  criteria.  The same ambiguity is often the excuse offered when non-compliance occurs and blame is shifted.  Clarity of responsibility and accountability are hallmarks of ForHumanity certification schemes.

The certification scheme requires the establishment of an Algorithmic Risk Committee, Ethics Committee and Children’s Data Oversight committees to ensure conflict free, objective decision-making.  This approach mitigates against any individual gaps in expertise or training.. Examples of expertise include: 1) awareness of instances of Ethical Choice 2) discipline to execute Ethical Choice 3) awareness of the special needs of children 4) bias mitigation techniques including for cognitive biases 5) establishment of Key Performance Indicators to manage Concept Drift.  This design  deals with the expanse of skills needed to effectively manage risk in data controller/joint-controller/data processing works as well as acting as a check on the analysis, outputs and/or decisions rendered including algorithmic systems, artificial intelligence or autonomous systems.

The Board endorses the formation of these committees and makes them culpable for systemic failure in the organisation, which  enhances the likelihood of robust systems of compliance.  Liability at the CEO level, where each of these committees report, ensures responsible structural compliance across the entire organisation. The result is a culture of compliance – from design to decommission – with clearly delineated responsibilities, reporting lines and final accountability that increases transparency and advances governance.

The most tangible expression of a changed culture can be measured in resource allocation.  Resource allocation (time, investment, expertise) is a strong signal to both internal and external stakeholders that a culture of governance, oversight and accountability is valued by the Board and Officers.  The committee structure, a proven model of risk management, further ensures that checks and balances exist when these critical decisions and reviews are executed. Committees are responsible for having trained members and appropriate documentation to meet the demands of the audit criteria.

Our criteria also suggests a Data Control Committee (DCC), in line with the aforementioned benefits of committees to increase accountability and mitigate risk associated with a single point of failure and excess burden of responsibility.  While this scheme recognises that the UK GDPR calls for a Data Protection Officer (DPO), we encourage a higher form of governance, represented by the DCC led by the DPO in order to comply with the law.  The designation of a DPO must be assigned to an individual and that individual may be a Chief Data Officer.