Keys for Securing Private Information in an EDMS

Information Management Journal, Mar/Apr 2008 by Mooradian, Norman

Making retention information an explicit part of the indexing or metadata set supports a number of system functions that will make this monitoring process easier for end users. At the most basic level, it makes it possible for users to perform simple queries that return all documents that have passed their destruction or removal date.

At a more advanced level, the EDMS may have automation tools that will identify these documents and take some action. The system could automatically move the expired documents to a holding place for review, send a notification to the relevant persons, and generate a report or list for review. This kind of functionality should be employed for all document types, but it is especially urgent where compliance is concerned and may merit some extra elements to reduce risk.

Documents

Document files are the center of any EDMS. They will clearly be the main source of the personal information captured and managed by a system. The majority of privacy controls will therefore focus on them. To devise effective controls, it is important to understand the main differences between document files and the data managed in traditional business applications.

Structured vs. Unstructured - Documents can differ from each other along a spectrum of what information professionals label "structured" and "unstructured" data. Structured data is data that is stored in a database; it is described this way because it is stored in fixed tables and fields. Unstructured data does not reside in fixed locations. An example is text in a word processing document. While some documents can be described as structured and others as unstructured, some fall somewhere in the middle of the spectrum.

Forms are an example of documents that fall on the structured end of the spectrum. Forms are usually broken down into fields that are filled out by a customer, employee, or some other party. The document is conceived of as being made up of predefined pieces, with (in most cases) a predictable range of values for each of the pieces. In this respect, forms resemble database records in a table. In fact, using recognition technologies, such documents are often used to generate data for a database.

On the other end of the spectrum are documents that have no predefined fields and that do not in any other way set prior constraints on what kind of information will be in the document. Correspondence is a good example of a type of unstructured document.

Employee evaluations are an example of documents that fall somewhere in the middle of the spectrum. They may be organized into forms-like areas with boxes to be filled in, as well as sections for written descriptions and comments that might vary considerably.

The distinction between structured and unstructured documents has implications for privacy controls. When evaluating structured documents for privacy risks, identify which fields on the form can contain personal information and its degree of sensitivity. Knowing the range of values a particular field will have enables one to assess the privacy risks associated with that document type. Then, appropriately classify the document type with respect to its sensitivity level. Because fields on a form will likely differ in terms of their sensitivity, privacy controls should be based on the most sensitive field, not the least.