Re: Might be of interest if you're puzzled
"There may be a cultural aspect to this -- what I'm hearing from the comments here is that people have faith that the courts act in a reasonable fashion with things like this."
Although there are comments here about the ICO not handing out big enough fines when someone is acting badly I think the tradition of the ICO has been to help do things right. Certainly that was my experience when the DPA Mk 1 came out. The then Information Commissioner was doing the rounds speaking at various events. I had a particular concern so I went along to his talk at the local University. Afterwards I was able to button hole him to ask his advice on my particular issue and found him very helpful. Your perspective might involve more than one regulator, however, and my experience is only with one. If anyone else is following this they might be able to weigh in on this if they've experienced other regulators.
Legal advice may well be part of the evaluation that's needed but I'm not sure that a lawyer is the right individual to lead it. Certainly a large part of this is being able to grasp what data you are holding and analyse how it fits against data. Perhaps a business analyst or a data analyst is the right background. It also requires a person who is used to making decisions.
From your reactions it sounds as if you weren't the right person for the job but I'm not sure that handing it over to legal is the ideal solution, or at least not the whole one; there is going to be a strong technical element to it.
You are right about there being a different cultural approach. The European approach is to take privacy as a right and that doesn't seem to be the US attitude at all. For instance one thing we've read about here is concerns of equality in US corporations and the solution, govt. mandated IIRC, is to require reports of analyses of this which, of course, requires the recording of race and gender.
That doesn't go down well here. As a straight white male I'd take great exception to being asked to fill that in on a form. I'd probably react by asking some pretty pointed questions about definitions of race (which, AFAICS are somewhat asymmetric in in the US) and if really pushed insist on being Elmetian on the basis that some research into DNA in England showed that those with roots in the area covered by the sub-Roman kingdom of Elmet showed variations from the bulk of England. I don't know how a US corporation with European employees is going to handle that situation.
Biting the hand that feeds IT
