By Julie Sartain
On May 7, the IAPP launched its first Certified Information Privacy Manager (CIPM) training at the Convene Center in New York, and according to instructors and attendees, it was an incredible success.
"The response to the CIPM program has been tremendous," says IAPP President and CEO J. Trevor Hughes, CIPP. "We announced the program at our annual IAPP Global Privacy Summit in March and nearly 1,000 people flocked to receive a free copy of the CIPM textbook—enthusiastic to dive into the new content. In May, we launched our first CIPM prep class in New York City with 40 attendees, and we have more than 30 classes scheduled in 2013, with strong interest in each city."
| CIPM Training Receives Highest Praise |
|
"Overall I found the training to be most useful in terms of tying organizational objectives for privacy to actual implementation. In my role as advisor to enterprise IT organizations, I find that, too often, IT practitioners do not understand the privacy framework or business drivers or how to get started with a privacy program. This workshop ties the pieces together. In particular, the discussions around privacy metrics and sample scenarios were the most impactful. As a result, I am now better equipped to guide my clients on best practices for implementing a privacy program. Please note that this is my personal opinion and does not represent any official statement or endorsement of the IBM Corporation." "I thought the training was both practical—providing structured material for the CIPM qualification—and also helpful on a day-to-day basis, identifying effective strategies to start and manage a privacy program. It gave me good insights in planning and implementing a sustainable privacy program. As an insurer of privacy risks, the topics covered provided a great framework, which privacy managers can use to build out their programs and manage their exposures." "The CIPM training class was focused on the mechanics and knowledge required to build, run and report on an effective privacy program. The afternoon session contained some very valuable and thought-provoking, team-based scenarios that were purposely designed to stimulate conversation amongst the class. Since the class was composed of varied industries, different departments and skill levels, some of the approaches to solve the scenarios ranged from strategic to robustly detailed and were refreshingly open. This class and the scenarios were about real-world and current-day events, so they were directly applicable to our call-center business, which services millions of consumers for global clients in multiple industries." "The training was focused on how to effectively implement a privacy program within one’s organization or business entity. The two trainers, Bob Siegel and Paul Gray, are both seasoned privacy professionals and they covered a lot of material pertaining to information governance, risk management, data security, regulatory compliance and Privacy by Design. The second half of the training included group analysis and discussion of hypothetical privacy management scenarios, which I found to be very engaging and useful in putting together the ideas and principles covered during the course of the day. I think the CIPM training and subsequent certification are leading the way for professionals dealing with information privacy and the management thereof. I believe this path leads to—and is part of—so many areas of business, including security, law, ethics, compliance and marketing. I’m glad to be part of it!" "In the course of a day’s training, participants were taken through the details of each of these two components. The focus throughout the training was on making privacy practical, operational, and 'baked-into' an organization—from establishing the appropriate privacy framework and vision to managing the details of the privacy operational life-cycle…The first half of the training was focused on the principles and foundations while the afternoon was focused on examining case studies in small teams. The teams diagnosed the privacy issues present in various hypotheticals and then communicated their results to the class. The class then discussed and, in some cases, debated the team conclusions that were reached. In my opinion, the afternoon session reviewing the case studies was the most valuable portion. And, because our organization is a ‘hybrid’ privacy model, the training has been valuable in working through how I can approach various privacy situations. It has also led me to think about areas where we need to clarify the privacy strategic vision and framework and local jurisdictional rules and regulations, before trying to impose 'solutions' on the business.” |
The IAPP’s first certification program—the Certified Information Privacy Professional (CIPP)—rolled out in 2004 and covered the laws and regulations, or the “what” of privacy. As the privacy landscape evolved, the IAPP recognized a need for privacy professionals to understand how to operationalize privacy in their organizations.
"Fast-forward to 2013," says Hughes. "The profession has matured, and best practices for privacy management have emerged. The IAPP documented these practices and aggregated them into the CIPM. This new credential—the ‘how’ of privacy—is the complement to the CIPP. The CIPM is the global answer for professionals who are responsible for managing governance and operations within their organization."
Certification Director Dick Soule, CIPP/US, CIPP/E, agrees. According to Soule, the CIPM is the “real world” of privacy—that is, how the privacy pro really manages personal information in an organizational setting and where laws and regulations form a backdrop—but it’s mostly about the organization’s goals and strategies. A lot of information privacy is related to compliance, but many organizations are positioning privacy as the foundation of customer trust.
"The CIPM training program is designed to be as interactive as possible," says Soule, “combining some great advice about how to promote privacy in an organization, create a privacy strategy, form a privacy team, enlist sponsors and advocates and develop approaches to maximizing the tools privacy pros use to implement a privacy program with a realistic, extended scenario during which training participants interact with each other and the IAPP Privacy Faculty trainers to analyze the situation, identify issues and devise solutions. The scenario part of the training is like a guided networking activity. With people from many backgrounds and with various privacy-related responsibilities, it’s a great opportunity to view information privacy through multiple lenses. And the training is an excellent lead-in to actually sitting for the exam, because the exam consists of both questions about the course content and a set of scenarios."
Instructor Bob Siegel, founder and CEO of Privacy Ref, explains that this was the first time for this particular class and curriculum.
"We used a half-and-half format; that is, the first half was standup training with slides, and the second half was example scenarios and case studies, plus discussions in small groups of five or six. It was a perfect balance of lecture and dialogue, which breeds a diverse environment for the participants. Plus, it was very effective for the participants to learn from their peers' experiences," says Siegel.
According to Siegel, all classes will have multiple instructors from varied backgrounds, including operations, IT and legal, so a lot of different ideas are expressed and exchanged. This means that, although each class covers the same curriculum, the variety of instructors will bring their own expertise, individually, to each class, which allows the participants to leave with a unique perspective.
Instructor Paul Gray, CIPP/US, CIPM, of information risk management company The Gray Group, adds "this new program is where the rubber hits the road." Gray explains that this class is about how to bring together the basics of the law and security that participants learned and talked about for so many years and actually implement that in a risk-based, professional approach. The content of the morning was conducted in a lecture-type session; however, the afternoon scenarios really encouraged discussion and debate—the sort of discussions that everyone has been a part of but without the concerns about some of the politics that can stifle comments when participants are actually dealing with the issues at their own organizations.
"With respect to the course delivery, I would say it is unique," says Gray. "It allows for interaction and understanding—because you have to apply what you have learned—that people don't seem to get in straight lecture delivery-type classes. You pick up a lot of the 'what' in the morning, then apply it in the afternoon. Given the 'group' participation and interaction that occurs, people can and did talk through scenarios and drew on strengths and experiences that the participants bring to the table. Then, with the faculty walking around and interacting during the scenario discussions, when there are more specific questions, we can dive into those using the scenarios."
Hughes notes that the CIPM is really for anyone who has to operationalize privacy in their organization. When the privacy field first emerged, it was primarily built by professionals who were trying to figure out how to comply with privacy laws and regulations. As the profession has grown, the privacy field has also evolved to include other disciplines such as marketing, HR, compliance and IT—professions and professionals who don’t have privacy in their title but are responsible for protecting data.
"We know that employees who understand privacy risks are the best tool for a company to navigate the ever-changing space," says Hughes. "The CIPM is the answer for them. In fact, 96 percent of the attendees at our first prep class rated the class content as relevant to their needs. The CIPM covers an entirely new body of knowledge, and the format of the prep classes are interactive with group-based exercises to help give attendees a real, hands-on learning experience."
For more information on upcoming CIPM classes, visit the IAPP website.
Julie Sartain, author of Data Networks 101 (Aegis, 2002), has been a freelance journalist for 13 years. She writes for several magazines including Network World, Computerworld, PC World, CIO and The Privacy Advisor.
Read more by Julie Sartain:
Hunters, hackers and safety crackers: One dozen privacy innovations
Analyzing FTC vs. Wyndham
The Masses As Data Controllers: What They Don't Know Could Hurt You
SMB Tips To Consider
Comments
If you want to comment on this post, you need to login.