\u00a0\u00a0\u00a0\u00a0\u00a0by Peter Sloan, Husch Blackwell LLP<\/p>\n
February 5, 2014<\/p>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/p>\n
If anything cries out for organizational governance today, surely it is information.\u00a0\u00a0 Data volumes are rising relentlessly; information is flowing in and out of organizations more pervasively than ever; and mobile computing, cloud services, big data analytics, and social networking are fundamentally transforming the organization\u2019s relationship with information.\u00a0 Meanwhile, the compliance environment grows yet more complicated, as organizations, regulators, and the courts wrestle with the repercussions of massive data breaches, the evolving scope of e-discovery, and allocation of responsibility for the retention and protection of information.\u00a0 Shortcomings of the traditional practices used by organizations to deal with information are becoming clear, as is the need for a new, comprehensive approach.\u00a0 And that fresh approach has been dubbed \u201cInformation Governance.\u201d<\/p>\n
But what exactly is Information Governance?\u00a0 Despite widespread use of the term,[1]<\/a> few definitions have been offered.\u00a0 With due deference to Shakespeare\u2019s Juliet,[2]<\/a> and also to Justice Stewart,[3]<\/a> names and definitions matter. They are particularly important when the subject, unlike roses and pornography, has not been with us for a very long time.\u00a0 And Information Governance indeed is a new approach for addressing information issues.\u00a0 To be more precise, Information Governance involves a new reconciliation of departmental interests (such as those of IT, Legal, Compliance, Records Management, and lines of business) and of traditional information disciplines (such as records & information management, privacy & data security, and litigation preservation & discovery)\u2014in essence, connecting familiar building blocks in a new, different, and more effective way, to better serve the organization as a whole.\u00a0 So, definitional clarity is essential here, precisely because Information Governance involves a fundamental change in established perspectives and practices.<\/p>\n What definitions have been proffered for Information Governance?\u00a0 According to Gartner, the global information technology research and advisory company, Information Governance is \u201cthe specification of decision rights and an accountability framework to ensure appropriate behavior in the valuation, creation, storage, use, archiving and deletion of information.\u00a0 It includes the processes, roles and policies, standards and metrics that ensure the effective and efficient use of information in enabling an organization to achieve its goals.\u201d[4]<\/a>\u00a0 ARMA International similarly defines Information Governance as \u201ca strategic framework composed of standards, processes, roles and metrics that hold organizations and individuals accountable to create, organize, secure, maintain, use, and dispose of information in ways that align and contribute to the organization\u2019s goals.\u201d[5]<\/a><\/p>\n The Compliance, Governance, and Oversight Council (\u201cCGOC\u201d) has defined Information Governance as \u201cthe discipline of managing information according to its legal obligations and its business value, which enables defensible disposal of data and lowers the cost of legal compliance.\u201d[6]<\/a>\u00a0<\/p>\n Most recently, the Sedona Conference has defined Information Governance as \u201can organization\u2019s coordinated, inter-disciplinary approach to satisfying information compliance requirements and managing information risks while optimizing information value.\u201d[7]<\/a>\u00a0<\/p>\n While each of these definitions has its strengths, here\u2019s what I like about the Sedona Conference definition:[8]<\/a>\u00a0<\/p>\n The Sedona definition does not prescribe the particulars of how Information Governance is implemented, referring instead to the organization\u2019s \u201capproach\u201d to accomplishing this coordinated, inter-disciplinary effort, and leaving the specifics of the implementation \u201chow\u201d to supporting guidance.\u00a0 I think that\u2019s prudent, because there will be various approaches for implementing Information Governance, and the definition should not be too limiting.\u00a0 Reality suggests that different organizations adopting the Information Governance approach will operate at different points on a maturity continuum.\u00a0 Some, frankly, will begin by simply getting the right people together in the room to thoroughly explore all angles to information-related decisions at the organization before they are made.\u00a0 Others will put in place elements of structure, direction, and resources to support Information Governance efforts, along with mechanisms for accountability.\u00a0 Yet others will establish robust control systems for Information Governance, based upon applicable information-related standards[9]<\/a> or modeled upon standards for internal control systems generally.[10]<\/a>\u00a0<\/p>\n Years from now, perhaps most organizations will be well along the path of this maturity continuum, and hopefully so.\u00a0 And yes, organizations certainly will need authoritative guidance on implementation frameworks, strategies, and options for building Information Governance programs. But my hunch is that, at least in the short term, different organizations will pursue Information Governance programming in a wide variety of ways.\u00a0 While I may feel strongly about the importance of conducting Information Governance assessments and setting program objectives, followed by establishing structure, direction, resources, and accountability for an effective Information Governance program, these are specifics of implementation — the How, rather than the definitional What and Why.<\/p>\n <\/p>\n [1]<\/a>\u00a0 A simple Google search for \u201cInformation Governance\u201d on February 3, 2014 yielded 1,250,000 search results.<\/p>\n<\/div>\n [2]<\/a>\u00a0 \u201cWhat\u2019s in a name?\u00a0 That which we call a rose by any other name would smell as sweet \u2026.\u201d\u00a0 Shakespeare, Romeo and Jul [3]<\/a>\u00a0 \u201cI shall not today attempt further to define the kinds of material I understand to be embraced within that shorthand description; and perhaps I could never succeed in intelligibly doing so.\u00a0 But I know it when I see it, and the motion picture involved in this case is not that.\u201d\u00a0 Jacobellis v. Ohio<\/i>, 378 U.S. 184, 197 (1964) (Stewart, J., concurring).<\/p>\n<\/div>\n [4]<\/a>\u00a0 See<\/i> Gartner IT Glossary, http:\/\/www.gartner.com\/IT-Glossary\/information\/governance<\/a> (last visited January 29, 2014).<\/p>\n<\/div>\n [5]<\/a>\u00a0 See<\/i> Glossary of Records and Information Management Terms<\/i>, 4th<\/sup> Ed. (ARMA TR 22-2012).\u00a0<\/p>\n<\/div>\n [6]<\/a>\u00a0 \u00a0 The CGOC\u2019s definition of information governance is found Information Governance Benchmark Report in Global 1000 Companies<\/i>, CGOC 1, 8 (2010).<\/p>\n<\/div>\n [7]<\/a>\u00a0 The Sedona Conference, the Sedona Conference Commentary on Information Governance<\/i> (Public Comment Version) (2013), Available at <\/i>https:\/\/thesedonaconference.org\/publications<\/i><\/a>.<\/i><\/p>\n<\/div>\n\n
\n
\niet<\/i>, Act 2, Scene 2.<\/p>\n<\/div>\n