Re: ISSUE-235 (Auditability requirement for security)

I guess it’s out for CfO so this may be pointless, but I think it’s worth pointing out that it may be immaterial what we say about auditability.

We have a clear requirement that data collected for a permitted use is only used for that use.

So, imagine a company that appears it may be mis-using the data.  Someone — a researcher, a member of government, a regulator, a court, whoever — asks “so, why should we believe that you adhere to the requirement?”.  At some point, if life gets tough enough, they’re going to have to show to that person’s satisfaction that they follow the requirement. That is, in effect, an audit. Their need to be able to show this seems entirely independent of whether or not we have language to require auditability, doesn’t it?

Dave Singer

singer@mac.com

Received on Thursday, 20 November 2014 09:55:19 UTC