AI's impact on records standards and privacy regulations with Barbara Reed

In a world of increasing awareness of privacy, what is the opportunity for information governance and records management? Who better to ask than Barbara Reed?

She wrote the book on records—literally. She discusses how AI will impact the field, including privacy and information governance standards.

‍
Topics discussed:  

• How will privacy and records standards need to evolve in the face of AI and ML evolution?  
• How can records managers use AI? Examples: Records identification and classification, Personal Information (PI) discovery, and declassification.
• What does the future of records management look like?  
• Advice for those who are starting out in a records management or information governance role.  
• How Barbara’s work with the Royal Commission into Institutional Responses for Child Sexual Abuse, and with Indigenous Data Sovereignty, have raised questions on how to put the control of data and of records back under the control of individuals.  
• What is the sustainability of records held in the cloud? How do we build interoperability into the cloud so that data isn’t held in proprietary platforms that are difficult to leave.  

Resources:

🎧 FILED S01:E01: AI perspectives from a records commissioner | Pauline Toole, City of New York  

🎧 FILED S01:E05: Why records managers must play a key role in reducing risk | Anne Cornish, RIMPA

📨 FILED Newsletter: ChatGPT: Is this popular new technology a threat to data privacy?

📨 FILED Newsletter: Generative AI will offer up identifiable data if you ask nicely

📏 Benchmark: How much PII does the average organization store?

‍

Transcript

‍

Anthony Woodward  

Hi everybody. Welcome to FILED. FILED is a monthly conversation about the convergence of data privacy, data security, data regulations, records and governance. I'm Anthony Woodward, who's the CEO of RecordPoint, and with me today I have my FILED co-host, Kris Brown.  

Kris Brown  

Hey Anthony, how are you?  

Anthony Woodward  

Good, Kris. How are you?

Kris Brown  

Yeah, good mate. Very good.  

Anthony Woodward  

It's been a busy month since we last recorded, and I am super excited about the podcast today. We have brought along Barbara Reed, who I've known for a little while and has been a fantastic guidance counselor. It's probably the easiest way of various questions I've had around records management and pieces that are out there, but.

Anthony Woodward  

Barbara has an amazing background having worked in the records and archive industry for many years. I'm not gonna say how many years 'cos that probably dates me as well as Barbara. But I think across all tiers of government nonprofit organizations and around the Asia Pacific and, and even the globe.

Anthony Woodward  

I think at some point Barbara, we even may have worked doing some of the MORAC requirements, I dunno if you remember doing some of those reviews a little while back. But Barbara, you are currently a research fellow now working in the. Faculty of information technology at Monash, is that right?  

Barbara Reed  

Yep, that's right.

Barbara Reed  

I'm on a part-time contract there doing some stuff that's dear to my heart.  

Anthony Woodward  

And is there anything I left out on your bio that you'd love the listeners have FILED to know about?  

Barbara Reed  

Well, I guess given some of the issues we may come up against, the only thing I'd add was that I have had a long involvement with standards of various descriptions.

Barbara Reed  

That's an area that I suspect may come up in discussion.  

Anthony Woodward  

Fantastic. And, and certainly at IT 21. I think. I remember being to a couple of those committees here in Sydney and hearing some of those presentations at different times and, and certainly, an interesting set of topics and discussions going on.

Anthony Woodward  

Kris, did you wanna lead in? I know you were busting at the gate with a couple of questions for Barbara to get us started.  

Kris Brown  

Yeah, no thanks Anthony. I absolutely am interested sort of Barbara, to understand your thoughts. We've, you know, we've had a number of things change. There's a lot of talk at the moment in the press and, and obviously in the tech industry around AI and ML.

Kris Brown  

We've had chat, G P T and Open AI be picked up by Microsoft. Google's more recently released their sort of cousin to the same thing to, you know, it's a really interesting space, but I, I'm interested from your perspective to understand how are we seeing that converge, say, with the record standards and, and how are we going to keep pace with, you know, that changing evolution of AI coming into the record standards and those privacy regulations.

Barbara Reed  

Yeah, thanks Kris. And thanks too for the invitation to speak to you. And I should say that I don't consider myself to be an expert in any of these emerging technologies, so it's a conversation and I'm learning as much as anyone, so I certainly don't have the answers. There's more than one ways to answer the question as well.

Barbara Reed  

So, let's just start from the top. Record keeping standards and ai. I mean, in order to think about that one, I think we have to talk or think about. What uses recordkeeping can put AI to, now, I guess you guys are more expert in this than I, but I have seen some rudimentary, like this is so early and yet it's coming like a freight train, so it's coming really fast.

Barbara Reed  

But some early uses of AI to do things like identify and find personal information. For example, in records to look at declassification. Identify records that can be, have their security levels diminished, which is always a problem about retrospectively declassifying. I've seen emerging work in terms of using AI to assist in identifying records from an appraisal perspective, and of course the whole classification piece comes into this as well.

Barbara Reed  

So, AI has, I suspect, got a lot of uses in records. Have they? I'm not sure that we've got to the point of processing stuff using ai, but certainly identifying stuff using AI is certainly coming.  

Kris Brown  

Let me pose it this way. So, there's a bit of a fundamental assumption in our regulations that humans gonna go, you know, this document is of this particular type, either through some form of automation or just manually classifying the old way of, you know, managing physical records.

Kris Brown  

How is that going to change given we're sort of looking at, you know, the scale for one of the information management problem, but also then with that introduction and how do we. You know, I think people are always looking for the perfect answer and, and I don't think humans are the perfect answer. I've never really even, I think Anthony and I have had this discussion previously in, in FILED about, you know, the people aren't perfect, but neither is ai.

Kris Brown  

Where are your thoughts there?

Barbara Reed  

I suspect, and it's only a suspicion, I can't prove it, and I don't know when we'll get to approving it, but I think probably machines are a lot better than humans. So, generally speaking, I think that you know, we should be encouraging as much automation as possible and, and really, we shouldn't be.

Barbara Reed  

Technology's not gonna go away because we don't like it and or we feel threatened by it or whatever the particular concern is. So, I think we need to be creative about how to do it. And the handcrafted stuff is just, clearly not feasible. It's not feasible for any number of reasons, but volume being one, which is not to say that I haven't got criticisms of the technology that's around at the moment and I can go into this at great length and probably be quite boring about it, but I suspect at the moment what we're seeing is AI and human.

Barbara Reed  

To act on the ai. So, I don't think we're at the point where the AI is necessarily taking the next step in the record keeping process, but it's certainly aggregating stuff to be dealt with. So, certainly in the appraisal space, that seems to be the case in the. Personal information, identification of personal information.

Barbara Reed  

I mean, and that opens a whole thing about, well, what is personal information? Cause as we know, the current definitions in law aren't probably broad enough, and when you combine elements and put them together, you get a different answer. So, there's some pretty tricky and interesting things to be thought through there, but I don't know that I'm seeing, or I haven't seen yet.

Barbara Reed  

I'm sure they're coming to the next step, which is the processing action as a result of the AI use.  

Kris Brown  

Let me add to that, right, 'cos you did bring up that personal information piece. So, you know, again, traditionally the case was I just want the classification. That's really all I'm looking for. It's the records management outcome.

Kris Brown  

But now that I have these other, let's call them markings, that ultimately leads to additional ontologies, right? Like it's not just important that it's classified, or it's got a particular category for a retention schedule, but now it's important that. Does it have PII? Does it have particular sets of PII?

Kris Brown  

How do you see that against, say, the existing standards and how do we start to integrate that? Because that sort of starts to become really important, right? Like we've got this traditional records management platform with traditional records management regulations, and all of a sudden, we've now got the ability and the requirement because of changes to legislation to understand all of these things.

Kris Brown  

Should we start to look at how they start to come together and where's the value there? Do you think?  

Barbara Reed  

The more mechanisms we have to bring things together in multiple ways, the better. I mean, I think that's gotta be the way of the future. So, however, I'd take issue, and I go back to fundamentals all the time.

Barbara Reed  

I don't think records classification is about search. I don't think records classification is about retrieval necessarily. I don't think records classification is about disposal. I think records classification is about linking it to the context of its creation. Now, from that, you can do a whole lot of other things, but I think that remains valid regardless of the fact that we can have many, many, and yes, please more and more and more ontologies and ways of linking things.

Barbara Reed  

The other thing that I think is kind of missing sometimes in the, the rethinking of technology and records is we're not dealing with a single object. We're dealing with an object in, in a chain. So, it's needing to link that thing. So, if we retrieve and we do all this nifty stuff on multiple ways of getting, and we think about all of the classifications, if we think about them all as either fulfilling a particular function or largely fulfilling a searching function.

Barbara Reed  

We need to say, ah, yes, but when I get to that document, I need to know what came before. I need to know what came after. I need to know who created it. I need to know in what context that was, because that proves something about how you interpret that document, how you can, how. Trace the transaction, how you can go back and revisit the decision making, how you can support authenticity, actually, and that's a really big one in this world of chat, G P T, and you know, artificially generated text.

Barbara Reed  

So, all of those things are what I think linking to context is about. And that. Because we are using the same term classification. Actually, there's many, many meanings to that. I also think that although well multiple ontologies, ontologies and in fact that we're using the word ontology is interesting because I think ontology is more relational than hierarchical, and I don't think we've done a very good job in actually exploiting the relationship stuff, which is actually a fundamental of my understanding of what record keeping is.

Barbara Reed  

It's, it's about those ever. Twirling worlds of relationships. So, I think that's something we could quite happily hope that technology might do, but not if we think about classification as search and retrieve. I don't know how you guys feel about that.  

Anthony Woodward  

It's a really interesting point. It's something we bump into a lot as we talk to people.

Anthony Woodward  

This dichotomy of understanding as if there's a clash between traditional information sciences from a computing perspective versus from the library perspective. One of the things that I think Kris and I see a lot of is, Customers and people out in the community coming and talking to us about the taxonomies can only be hierarchical.

Anthony Woodward  

They can only describe structure as opposed to describing. And I, I loved your use of ontology there. It warms our hearts cause it's how we think and want to process things, but are you seeing that change in your conversations? Cause I haven't seen that move over the last 10, 15 years.

Anthony Woodward  

People even, I think I was at the last Australian Records Managers conference and particularly at the US Conference at Armor, people were, challenge me on the use of the word ontology because I refused to use the word taxonomy 'cos it doesn't mean anything in these contexts. Is that changing?  

Barbara Reed  

Look, I think it's murky ground because I think it's in broadly speaking.

Barbara Reed  

People think it sounds better than taxonomy, so the two get muddled up. Whereas there is actually a distinction to be made, I think, and no, I haven't found the sophistication. Things seem to have stalled somewhat. I would suggest, and I'm gonna put the blame right. Smack bang on bloody Microsoft. So, sorry.

Barbara Reed  

But the world seems to have pivoted to how to structure and manage in a particular environment, and that's got its problems, right? So, that environment is particularly hard. It's not very records friendly, it's US-centric. It's difficult from a local perspective to get our practices built in all of those things.

Barbara Reed  

So, that's a diversion. And I think the other thing is that because some of the regulators built their disposal authorizations onto what was a classification scheme, which was then actually a, a real taxonomy, a hierarchical taxonomy that somehow seems to have. Taken over the industry, certainly in Australia's perspective of what classification is or could be or why we do it.

Barbara Reed  

And so, Kris, I think you suggested that that isn't ellipse. I think that has taken place. I would love for it to be disentangled because we can use context so much more creatively and. Yes. Call it records classification. Yes. Call it, you know, whatever you like. Unfortunate terms, all of them really in some way or another, but we could use it so much more creatively in our practice if we disentangled it from the somewhat rigid, and I don't, I'm a bit of a critic of some of those structures as well.

Barbara Reed  

Unimplementable would be one. So, yes, some of the conflation. And I, maybe it's just lazy use of words. Maybe it's just jurisdictional practice, but it has, it's not terribly precise and I think there's a lot more possibilities that could be explored and brought into practice if we decouple some of those, or unentangled, disentangled, some of those things that have seemingly been baked in.

Kris Brown  

I agree. It's, It's interesting. Let me pose this question to you. So, imagine a world where you get to determine what's happening and, and obviously being a part of standards, there's, there's been that opportunity to at least influence that. What should the future records management look like? And then if with that piece of knowledge, and just to follow on, is it a new role?

Kris Brown  

Is it an existing role? You know, if you are starting your career, there's gonna be people listening to this who, you know, are either in or only more recently in the records management game and they're thinking, you know, I want, this is something that I'm looking to do longer term. What does that look like?

Kris Brown  

And what should they be focusing on? Because that's how we change the industry, right? Like it's, we have to start from the ground up.  

Barbara Reed  

Lots of questions in there. So, probably because I'm long in the tooth, I always go back to the fundamentals. Why are we doing this? What are we doing? What is it that's important?

Barbara Reed  

Not how are we doing it? Not in what technology are we doing Why are we doing this? And if you look at the, why are we doing this? It hasn't changed that much. Why are we doing this? To document decision making, to enable us to know where the information's come from, therefore understand authenticity and prove its context.

Barbara Reed  

We need traceability. Who changed it? When did it change? What happened to it? So, that's a whole lot of the stuff that is not the record, but it's around the record, the metadata around the record. Again, it's not single object, it's objects linked. We need permissions. Who owns the record? Where did it come from?

Barbara Reed  

What permissions, licenses, whatever you wanna call it, are associated with the either the or the structures or the whatever. Yes, we need to address retention. Retention is really important, and we know that there's massive over retention going on, particularly when you get down to the data space. I think increasingly things like consent will be important.

Barbara Reed  

That's being discussed in the privacy realm. And because it's hard. I don't believe it's as hard as it's made out to be, but because it's hard, seem to be hard, that's being dismissed quite quickly. And I think the other one that I'm really concerned about is sustainability. So, information has to last across systems and no technology that we've had yet has got a system lifecycle without significant upgrade or change for more than about five years. You know, five years. And you've got, that's a rule of thumb. So, we've got records. Paper and pen did, right? Paper and pen. Yeah. Okay. I'll, I'll grant you that. I'm thinking of IT systems and some of the records, many of the records that we have to manage, have got lifetimes in excess of a hundred years, even while you're just talking about in current use.

Barbara Reed  

So, all of our infrastructure records, all of our superannuation records, all of our personal building stuff. So, those are the things that I don't think have changed now how we then, look at how we implement them in organizations and in broader structures. So, my belief is that although the standards have been interpreted as having a paper bent, those fundamentals are in fact embedded.

Barbara Reed  

Many of them, not all of them, embedded in the standards. And as we move to a principles based standard, the principles. Should apply regardless of the technology that is used to do them. Now, the fact that people are interpreting them as paper-based is a real worry for me, because on the one hand, I've got people arguing to me, but they haven't changed.

Barbara Reed  

You know, the fundamentals are still there. And on the other hand, people saying, oh, but they're so paper-based. And certainly, the ones that were written in the 1990s were coming from that manual paper based thing. As we move to the more recent versions where there's. Principles based. I would like to think that they had more longevity in that always needs to be revised.

Barbara Reed  

Nothing stays there forever. And the other thing is I think that record keeping needs to be, so the industry as a whole, again, it's a generalization, but the industry as a whole has kind of got this notion of records as being something that needs to be protected in some way, or, I don't know, whatever. But actually, the record keeping principles that I've just.

Barbara Reed  

Talked about actually applied all levels of aggregation. So, down to the data element level, if you extract data from something, you still need to know where it came from, what authority it's got, what currency it's got, what quality it's got. That in fact is the stuff, the data is the stuff that's driving this.

Barbara Reed  

You can only learn or put a machine to use on the quality of the data that you've got. And I don't think there's been enough attention on the record keeping at data level. So, what was the other question you asked me in there?  

Kris Brown  

So, if you're gonna start out where, where would you start? What would you be focusing on now, assuming that, you know, there's this new world order where everything's principles based.

Kris Brown  

We, we've all decided that a record can be anything, can be from the data, the, the, the metadata is there, the authenticity is there. If you are, you are starting your career out here, what are you focusing on? What are the things that you see as, you know, these are important to that new role?  

Barbara Reed  

Well, again, I'd just reiterate my list of things, the fundamentals.

Anthony Woodward  

Can I ask the question a little bit more? Controversially? If you were restarting your career and knowing some of the things you know now around how we manage information, would you start by thinking about library sciences or would you start by thinking about information  

Anthony Woodward sciences?  

Barbara Reed  

Well, interestingly, I didn't start, I have no library qualifications, so my training is as an archivist and actually it's archival science that is the basis of a lot of the stuff that I have applied throughout my working life.

Barbara Reed  

But if I was starting out again, I was thinking maybe I also started my university life way back when I was a student in law. There's a lot of stuff in law that is really interesting, and I might go back there because I'm interested in how organizations, so this organizational culture stuff, but it's risk, it's licensing, it's permissions, it's retention, it's.

Barbara Reed  

I'm really interested in rules as code, how we can actually embed legislation and all of those things. And to automate governance. What does it mean to automate governance and how can we do that in a real-time environment so that again, the machine can somehow monitor rather than a human being having to retrospectively audit or whatever.

Barbara Reed  

So, maybe law maybe I'd go back there or maybe I'd go into digital preservation. Because again, digital preservation brings, I think a lot of those issues with a sustainability focus into focus. And I think organizations might pay more attention there because I'm not sure for all of the reasons we've discussed.

Barbara Reed  

And some of it is about the unfortunate and I think wrong dismissal of records as being paper-based, and despite having had digital records in workplaces for 20 odd years. So, I think that, and maybe it's convenient to dismiss it, maybe these things are too hard, but I think it overrides some of this. Now the other thing I think, Anthony, perhaps in one of your previous questions, you were talking about the kind of meshing of the information disciplines and depending on who you engage, Who I engage with.

Barbara Reed  

There are people who are in all types of specializations and branches who are really interested in the record keeping view because it's different and it's not the same, and it brings additional. Things to consider. Now, some accuse me of always making things more complicated than they need to be, and that's one side of it.

Barbara Reed  

But the other side of it is the deeper and the more exploratory you can be, the better answers. So, I think having a strategic view of recordkeeping. It's not a doing. It's a, a far more strategic analytic focus on what is it that we're trying to do, why are we trying to do it? And then merging that with a whole lot of other disciplines.

Barbara Reed  

My colleagues and I called it record Keeping Informatics a number of years ago, and the idea was to bring together all disciplines, not one discipline. And I think that has been seen in or manifested in organizations perhaps as information governance, but again, it's a, there's a bit of colonization that's mine now and that's dangerous 'cos it's not anyone's, it's multidisciplinary.

Barbara Reed  

So, I think record keeping needs to be a strong voice at that table. I think that we are still in siloed and probably warring packs.  

Anthony Woodward  

In the subtext of, of some of your answers there, and I might be overanalyzing your statements, but you've almost drawn a, a definitional line between data and records. Where do you see that spectrum in the debate around what is good semantically described data versus what record?

Barbara Reed  

Well, I'm sorry if I gave that impression. It's probably just terminology and convenience because I think anything can be a record, including a tree ring or a, you know, physical object or a, but I think the, the distinction that I'm trying to draw there is that in data lakes, in the kind of big mesh, meshed, meshed both sources of data.

Barbara Reed  

Often, they're extracted from either transactions or something else. They're often uncontextualized, decontextualized, and I think that there is a record keeping role to reconnect that data to its source. So, that you can always trace it back and know where it came from. So, I'm probably being a bit loose in my terminology there, but I was thinking about the distinction between the extracted data and then pulling it.

Barbara Reed  

And that is de well often, but perhaps increasingly less decontextualize data. And that's not records, but when combined with some of the data lineage, Traceability, the data provenance stuff, I think you can make it records quite easily. But I think one of the problems has been that that decontextualization, and also of course it's rapacious and it's sourced from everywhere, and you know, there's a real public kickback or reaction to that, which I think we need to take pretty seriously.

Barbara Reed  

And that gets then merged with this other stuff and then we do analytics on top of it. Well, where is that data coming from? Is it current? What's the story?  

Anthony Woodward  

It led me to bling to think again around the bleed into the privacy space. And one of the big principles rolling around the privacy community is privacy by design, and therefore bringing data ownership to the hands of both the user and the owner of the data.

Anthony Woodward  

My personal data being my own and, and I'm sharing that, and I want to have rights to revoke that. Do you see the same happening in the records landscape where there's this kind of records by design principle and we're rethinking that, and where do you see that evolving to?  

Barbara Reed  

Yes, and I think it's, so the research projects I've been involved in have been very much around this.

Barbara Reed  

So, we've been paddling around in participatory record keeping, which is where people get to actually came. My interest in it came from the work I was doing for the Royal Commission into institutional sexual responses to sexual abuse, get that right, and people had no recourse, and the records were kept by the organization, for the organization, and yet they were.

Barbara Reed  

Fundamentally about childhood. So, and I didn't have access to them, and I couldn't get to them, and I didn't agree with what's there, and it was all fragmented. And so, we have been working in that space, in the out of home care, particularly because it provides a, a lens that is really socially important and.

Barbara Reed  

And critical to life chances actually of people. So, how do you do that? And one of the issues that we were talking about is being able to share far more instead of having organizational records owned by organizations that in fact they're co-owned. That's a bit tricky because then you need to give rights to the person to control access.

Barbara Reed  

And these things for organizations are almost. Intolerably and unspeakably challenging as systems are being rolled out. The other thing that we explored was actually depositing a copy of records particular, you know, specific records in a space that is totally controlled by that person. So, it's, it's like a two sides, two sets of records.

Barbara Reed  

What records are transactional. There are two sides, and then the person owns and completely controls the records. That has been deposited with them. We were at one stage playing with myGov being that type of or a technology like that. But again, very challenging for organizations who lose control of their information, and it skews the way records are created as well as their management.

Barbara Reed  

So, implementation is incredibly difficult in those areas. And the same in the indigenous data sovereignty space, which is the other project that I'm actually working to. Empower and set up and facilitate some work from indigenous scholars in this space. Don't accept your classifications. I want my own indigenously defined classifications, your language, the way you approach it.

Barbara Reed  

Different, different ways of searching and exploring. And I want control over that data. Don't give me the deficit data discourse. And that's again, a, a view into a completely different way of doing. Record keeping, but it, it is one that fundamentally challenges organizations and the systems that are around for organizations.

Barbara Reed  

Some were beginning to so one of the child protection systems were beginning to try and do this. Like conceptually they agreed technically they couldn't get it to work. So, the challenges to organizations to implementing it are really very large. And I think at the moment, particularly as we move into this world where technology is being globalized to an extent that we're unable to pursue local variations, we get pushed down a lowest common denominator.

Barbara Reed  

And you know, the sheer economics of things almost stifles that type of innovation. A long-winded answer, Anthony.  

Anthony Woodward  

No, but it does bring up some really interesting topics that we're certainly we're grappling with and thinking about around tokenization. So, not having the necessity, you know, providing our customers here at RecordPoint, but, but, but really even adding to the, the zeitgeist globally.

Anthony Woodward  

How do you provide. The data sets within a tokenized form so they can be shared across multiple parties and rethinking the notion of data structure and then bringing that together. One of the things that I think super interesting in the industry, and I'd love to see more debate on is that more hypothetical future where data is self-describing to the point where it describes who it can be shared with and in what contexts? Is that something you're seeing? Is a conversation happening within the records community, or is that just Anthony talking crap?  

Barbara Reed  

It's happening within the research communities. It's not happening within the implementer.

Barbara Reed  

So, again, I, I think the workplace is, yeah, being pushed down a never narrower kind of road in many ways where it's almost impossible to. Get out of that box that people have been put in. So, I'm not really hearing those conversations in implementation workplaces. I am hearing them in research and so that transition from research, I always think that's not the end of that conversation.

Barbara Reed  

It will take time. The conversation's about. Access and access is only a small part of that bigger picture, but the conversations about access, the right of reply, some of those other issues are actually being looked at with some, some greater interest on historical records rather than, so for some reason, and I don't think they're being implemented well, right?

Barbara Reed  

So, the institutional perspective is still dominant, but there, there's. There's more openness to thinking about what that means, even if the implementation is constrained by the technology that's available at the moment.  

Anthony Woodward  

Do you see a world coming out of this, you know, if you were to forecast 20, 30 years in the future where the data and records aren't hostage to those institutions or, or do you think we're gonna have to find some sort of third way?

Anthony Woodward  

What do you think that future's gonna look like?  

Barbara Reed  

Yeah, it's interesting, isn't it? That's kind of real futurist stuff. What is an organization and what is the role of an organization? I think a number of years ago, When I was doing some work for the New South Wales government, we were positing government as a platform and government as infrastructure because the siloed problems that were being sought every time we had a machine, well, this is all government.

Barbara Reed  

You know, we're all government. Maybe that's gonna come down the line. Certainly, I think. If we went down that space, there's some interesting things around resurrect notion of a, a shared, trusted repository, almost putting something in escrow, that's an analogy, not a real thing, whereby we can all access or have an accessible pull from which to check transactions and whatever.

Barbara Reed  

Again, the consent, the access, the permissions, the security stuff around that is really, really challenging. Someone's always gotta pay, right? Yeah. Well, it doesn't come easy. And the other thing is that I'm really concerned about the sustainability of some of this stuff. So, now we've moved all of the storage into the cloud, right?

Barbara Reed  

Fabulous. No, no problems. But that's the overwhelming economic thrust of where we're all going, except that the cloud has kind of consolidated into Amazon, Google, and probably one or two other players. And. Even when you say, oh no, we're in the cloud, we're in Amazon. Actually, it's not Amazon, it's Amazon Glacier, Amazon Deep Ice, Amazon, this, Amazon that.

Barbara Reed  

It's actually this bundle of stuff, which is completely, except for when you have to pay for it transparent to the organization. As to what it is, where it is, what controls, what backups, you know, so there's black box stuff going on there, and it's only been around for 15 years now. I was doing some work for a, a state archive, and I said to them, yeah, yeah, but this is the digital archive of the state, and it's only been around 15 years.

Barbara Reed  

And yes, they say they'll do it, and yes, we have no reason to. Say they won't do it, but what safeguards have we got and who goes out of business and what happens and is there an exit point and have you tested it? Can you get your metadata? You know, all of those things are kind of really worries me, that sustainability stuff.

Barbara Reed  

And I think that we are. The stuff that technology works in the short term, again, that five year cycle, it's probably too rule of thumb, but you know, but we are trying to keep some stuff for a very long period of time, and we have not, I don't think, got assurances of that long time stuff. And companies go outta business, you know, they do.

Anthony Woodward  

They do, but is that any different to the offsite paper storage that some of the archives have of paper sitting in Iron Mountain and other places? I think those things are quite analogous with the same tests. I agree. They need sustainability tests and those things on them.  

Barbara Reed  

They absolutely are. But so, they are analogous.

Barbara Reed  

So, you know, that's an absolutely fine analogy, but just think about how much we spend on those things and who. Manages those contracts versus an IT infrastructure, which is managed for a whole variety of different reasons. But sustainability or long term is probably not one of the criteria. And have backups been tested?

Barbara Reed  

Have we actually tried to extract what are the contractual conditions that were written in? And again, often those things aren't written to get it out. Right? So, there's a proprietary lock in stuff that's kind of almost. Why wouldn't you if you're a commercial provider? But there's a whole lot of issues that I think is, are being swept under the carpet too hard.

Barbara Reed  

Don't you worry about that, dear. It'll be all right. You know, that's so, I'm not saying don't do it. I'm just saying we need some safeguards. And again, there are standards around on trustworthy digital repositories. But they were written in the main for on-premises technology and repositories. And I don't think they translate, and we don't actually know whether they translate.

Barbara Reed  

Cause these things are not transparent from the big storage providers. In fact, they absolutely make a thing of not telling you. But at the same time, they're doing some good things. I think the authenticity, integrity, checking, all of those things are being built into that technology, which is terrific.

Barbara Reed  

That was previously a niche concern of the digital preservation lot.  

Anthony Woodward  

It's interesting. One of the things that we're seeing more recently and interested in your views on this, Kris, is that notion of sustainability from a technology perspective is becoming a standard. So, not necessarily from the data perspective that is yet to come, I think is a standards, but the.

Anthony Woodward  

Different types of interoperability are now evolving to a point where there is a level of harmonization over those processes. And I'm thinking specifically Kris around, you know, you and I both are old enough and I think both contributed to the CMMI standard around content interoperability, but we've kind of achieved some elements of that, haven't we?

Kris Brown  

Yeah, look, it's definitely getting better. I was actually gonna bring that up. Well, Barbara was talking, it's like CMIS, sort of, was that attempt effectively at this, at least a standard to allow you to interop between content solutions because of every five or 10 years or so, it's like, yep, contract comes up, we are forced to go back to market as an organization.

Kris Brown  

Let's have another look. Ooh, there's a nice widget over here. Good sales guy over there. Let's make a new choice. And then all of a sudden, that migration was not very obvious. Now, I think we'll both admit Anthony, that CMIS is not particularly widely used. It's sort of still hanging around  

Anthony Woodward  

It's crap. It doesn't work.

Anthony Woodward  

Just have, let's be honest, get more specific, but  

Barbara Reed  

A problem with standards, but...

Kris Brown  

We all had our best intent. But yeah, I think that we have gotten to a place with some of the technology stack elements of, you know, API based and the restful elements, the security built in the ability to transact between agencies, between cloud providers.

Kris Brown  

There's a lot of work heading in that direction. So, no, I agree. We are part the way there. As it relates to that interop, we obviously, I still think that there's probably room in the future that we were positing about a moment ago for some form of that data standard that Yes has all the fundamentals in it, but includes that consent, that sharing those permissions in a way that is universal.

Anthony Woodward  

And one of the biggest criticism, I'd love to get your view on this, Barbara, that I had, and I, I know many moons ago we've, we actually had this debate a little bit, was underlying for C M I S was a common data model, and when you create common data models, you define. The binding of data, and I don't know a better way, way to explain that, that causes the data to act in very strange ways, becomes unusable effectively.

Anthony Woodward  

And that was one of my core issues with C M I S, is that once you did that, you no longer could allow flexibility in the design. Of those tools. My question to you is, one of the things I still see reoccurring within the archival space and in the records space is this notion of having common data models.

Anthony Woodward  

Are we starting to evolve away from that and understanding that data is semantic, and it is self-describing and that we have to accept that it is just going to be the principles it represents.  

Barbara Reed  

I think in some places we are. So, back in the mid-nineties now, which shows you how long I've been kind of paddling around in this space, we defined metadata sets, right?

Barbara Reed  

They were unimplementable because they did those things. You know, they kind of, but the concept behind them and what they were trying to do, and the kind of conceptual models are still incredibly valid, I think, not the element level and the kind of hysteria about the sematic descriptions of what each element.

Barbara Reed  

So, I think we cannot. Move that way. And in fact, in the standard space I, we've kind of going into a process of decommissioning, if you like, some of those standards, those element level standards. And yet there's a demand for them in the industry. Cause people want someone else to tell them what they should be doing.

Barbara Reed  

But unfortunately, those standards are, well, they were either implemented as gospel, in which case you built in all of this kind of rigorous. Stuff, which then as you say, got hide bound and spent more time worrying about the construction of the whatever. But also, all of those other rich, wonderful ontologies and things we were talking about earlier.

Barbara Reed  

You lose all of that at point of migration. So, and one of the things that I've had a bit of a gripe about with archival institutions is that as they accept stuff, so we move across a notional boundary, which is kind of a little bit silly anyway, but they move stuff into their space. They leave all of the metadata behind.

Barbara Reed  

Or most of the metadata behind. I mean, that is so crazy because you wanna be able to, again, put everything into context and use that metadata in, in a very rich way. But again, it comes down to, how are people interpreting what a standard does? So, I've moved, I'm very wary. About those very rigid structured views of data models and whatever, far more comfortable with things that say, you know what?

Barbara Reed  

We need to think about licenses. You need to think about permissions. And also try and define them in ways that or the elements in ways that have something that extends out. To a broader, perhaps more universal thing, rather than reinvent the wheel completely. I think I'm just reinforcing what you're saying rather than having any answers, but the tendency is to, for people to want the answers.

Anthony Woodward  

Switching gears slightly, do you see an opportunity when we look at the new privacy legislation that's coming into Australia and, and the US federal government is working on new legislation over there to revamp that models and allowing that to be a catalyst? Because I think, you know, out there in the public sphere, there's a greater understanding of what a record is in the context of privacy and my data and how I share that.

Anthony Woodward  

You know, particularly in light of. The Optus hacker in Australia, or the things happened with Target a few years ago in the us Is that starting to move the industry somewhat or where do you see those crossover points?  

Barbara Reed  

Yeah. Privacy and the history of privacy regulation in Australia has been a. Bit of an up and a down.

Barbara Reed  

In fact, I would suggest that it's part of broader regulatory environment that's been part of the up and down. But there was a time, and not that long ago, when the Office of the Information Commissioner was somebody's kitchen table. You know, literally one person at a kitchen table shows how much resourcing was being put there.

Barbara Reed  

And I think there's so that now we're at a very big social level conversation. I think. The consumer data, right? For example, not a consumer data, right at all. It's about this electricity company and this electricity company sharing my data and me allowing that, that's not enabling me, the person in the middle to know what is being shared or what so misleading.

Barbara Reed  

Language. Having said that, I was very interested a number of years ago in the concept of brokers, data brokers, whereby I put all of my data into something and then enable the third party, and I don't mean data brokers perhaps in the way that it's again being used in that CDR model, but the technology, there was a number of technologies coming out of the Nordic countries that were looking to reduce some really interesting things with.

Barbara Reed  

Quite granular permissions and access sets on personal data. So, records aren't just personal data, but personal records are, is a, is a pointy end. And I noticed that just this morning I read something about the new thing in Victoria, the new health record that they're trying. So, the equivalent state-based equivalent of my health record or whatever.

Barbara Reed  

But they're saying there will be no opt out. And you will not be asked permission to consent to any data sharing that we undertake. So, you think, well, that's not kind of really where we should be going on this. And I don't actually believe that things like consent are that difficult? I think they've been made to be difficult because it's convenient perhaps, or it challenges some norms or something.

Barbara Reed  

Every day we do a transaction at the shop, we get a receipt. I mean, I can't see why giving us a copy of a digital transaction should be any more complicated or you know, surely there are ways. So, privacy legislation in Australia is being overhauled. It's been much talked about and all we've seen really is the upping of the breaches penalties in the short term.

Barbara Reed  

But I think that's that the proposals are for a much broader definition of personal information, which is kind of really interesting, but it's to do with that. Put 'em together and you're no longer anonymized stuff. But if you do take that to an extreme and it goes to those large data pools where we've got data from, God only knows where in those data pools.

Barbara Reed  

Yeah. The boundaries of personal gets really interesting. I think we go with whatever is the weigh in, and if privacy is the way in, then we go with privacy. But I think there's some really interesting things in the management of. Personal information that can open some doors, but I don't see the technology yet enabled to do it well.  

Kris Brown  

Interesting comment you made there, Barbara, around the, you know, it's hard and making consent hard and I was living in the London slash Europe during the implementation of GDPR. The big uproar, especially from smaller business, I guess, was how am I going to, as an organization deal with that problem?

Kris Brown  

I don't have people to do it. I don't have technology to do it. Even the local football club where I was living, they, you know, they were like, well, we have all these email addresses. We regularly send information to people. And in the end, while it appeared hard because there was this enormous elephant in front of them and they had to work their way of where to start to chew through it, it actually became quite simple in the end because some decisions just had to be made.

Kris Brown  

And it was almost as simple in their instance of, we'll send an email out once a year with the data that we have on you, and then basically an action that you'll take. If you take no action, we'll delete it. If you take some action, we'll keep it and continue to service you. And so, people deferred on the way of, well, if you don't want the emails and you're not interested in collecting.

Kris Brown  

Yeah, just this was all very, very simple, but being close to the club, it was interesting just sort of working through that with them. And I think you're right. It. Could be just as simple as, well, you know, I performed an action, a system produced a receipt in some way, a transaction A. A, why not just send me a, you know, a link to that or gimme access to that and then I can determine what I wanna do with it.

Kris Brown  

It could be as simple as that. And if I do nothing, then action A happens if I do something, then. That action happens and for those who want to, they can take and make choices. And for those who do not, everything stays status quo for them. Right. Nothing changes.  

Barbara Reed  

There are some deeply embedded issues in that.

Barbara Reed  

Yes, I agree. Absolutely Kris. And I don't believe it's as hard as it's been made out to be. But you know what would I know really? But there are some issues around data literacy, and we've seen in other high profile instances in Australia where the onus. To correct data or to keep data or to have records going back that will refute the results of some organizational decision was put back onto the individual without, you know, and that was just fundamentally, frankly, unfair and ridiculous.

Barbara Reed  

And similarly, the data that we've got at the moment. Reflects the social constructs we live in. So, on the one hand you can say that people who are on the edges, perhaps marginalized in some way, tagged, flagged, or whatever are overrepresented in the data. And or it's always, as I'm learning from my indigenous colleagues, it's that deficit model.

Barbara Reed  

It's always the bad stuff. It's never positive, so we don't get the positive spin. So, it's a self-fulfilling. So, there's quality issues that we have to address there as well. And I think how to. Understand that is about understanding the constitution of that data set we are using in organizations, which is always going to reflect the organization.

Barbara Reed  

Kind of sounds pretty simple, but at the same time we've got this rapacious data collection where my fridge, if I had one, Would, would be collecting, you know, untold information about mine.  

Kris Brown  

Mine does, mine's connected to the internet and it tells me when it's time to get a new filter and then it orders it for me already.

Anthony Woodward  

Well, it's possible to buy white goods that are not connected to the internet, apparently  

Barbara Reed  

Everything, and often in ways that we are never informed of leading to a whole lot of problems, you know. Right to repair issues and a whole lot of social consequences, which are probably unforeseen at the time you purchased them.

Barbara Reed  

I mean, the traceability of you as you move around the city is ridiculous. Now, in terms of cars giving the data out, you know, the traffic, I mean, you can get libertarian around this and get paranoid, but there's something there that I think people have got a concern about and it's quite a justifiable concern.

Kris Brown  

We should be, I mean the example's the perfect one, right? Like the vacuum cleaner is taking the photos as it's making its way around the house to determine how to make its way around the house. But why is that now going to a server somewhere outside of my home and why are people able to see that picture of me, you know, doing whatever it I was doing in the house while the vacuum cleaner was running?

Barbara Reed  

Yeah, I don't wanna go down conspiracy theories, but you kind of end up kind of down that path because.  

Kris Brown  

That's where the concern starts. But I, I really love your example of, well then there's the marginalization, there's the, the dataset quality you know, which, which in my example was obviously very oversimplified about, you know, they're only keeping a list of information for email purposes, but that initially seemed very, very hard to them though, like, you know, I don't know what to do and it's gonna be costly.

Kris Brown  

And, and so, you know, good decisions had to be made and they had to eat the elephant at the end of the day. They just had to work through it.  

Anthony Woodward  

Yeah, but I guess this isn't, and I probably like to draw this up a little bit, you know, this is really where the regulation and the controls, as you say about consent, but also control of data, you know, the data controllers and the data consents needs to be considered.

Anthony Woodward  

And I suppose just to kind of wrap these conversations all up together, are you seeing from your experience, either globally or locally here in Australia, the evolution of that conversation? You know, we did GDPR. It had some notions of data controllers in it, but it, it's pretty fundamentally, it doesn't really address these issues.

Anthony Woodward  

It, it really was just worried about what big tech was gonna have outside of Germany. Right. Are you seeing any other evolution of that? It's an area that we're certainly very interested in is how do you be better as an organization around process. You know, knowing what you have, knowing how you're managing it.

Anthony Woodward  

Tagging it for that management and then applying either the controls to make it not provident, 'cos it's not ours to have or to make it provident so that I can continue the, the ownership and custodianship of that.  

Barbara Reed  

Yeah. Look, this is just going back to the standard space I have written into standards.

Barbara Reed  

That all of those controls ought to be outside systems because you know things like your ontologies and your classifications and your retentions and your access permissions, because, you wanna apply them consistently and reuse them, and reuse them and reuse them, and you don't need to do it again. I think that that has not been implemented in practice.

Barbara Reed  

I think everything has been built into individual systems and its systems under X's Control. X being, in this case, the records manager. In some cases, it might go up to that larger organizational framework, but it's pretty rare. And again, the opportunity, the lost opportunity for flexible implementation of a whole lot of controls is there.

Barbara Reed  

I'm seeing innovation in patches would be what I'd say. And you know, this organization's doing that well. Oh look, there's a really good example in. Finland of registration of ai. You know, that's really interesting. How are they doing that? What types of data are they saying, you know, how do you do that?

Barbara Reed  

Cause it's the record keeping around ai. These guys are doing interesting things with data brokers, these things, but it's not, I can't find it put together. But again, I'm not sure everybody shares my view of what record keeping is or could be. So, you know, I think I'm possibly the outlier rather than the weirdo rather than whatever.

Barbara Reed  

You know, I'm not sure. So, I'm really interested in what you are seeing out there, but perhaps that's another conversation.  

Anthony Woodward  

Absolutely. When, when we get the chance to come to your podcast, we're happy to come and be a guest there and go through these processes. Look, Barbara, I really thank you for your time.

Anthony Woodward  

I have thoroughly enjoyed this conversation. I wish we could go for another two or three hours and maybe we should grab a glass of wine at some point and go do that. But thank you very much for the time today and, and I certainly appreciate it. Kris, is there anything else that you want to add to this conversation to round us out?  

Kris Brown  

No, look, I just wanna remind everybody that they can follow us at RecordPoint on Twitter and LinkedIn and any other social platform that they may be a part of. Apparently, we're not on Mastodon yet. But also, please remember to subscribe to the podcast on whatever platform you use and when you do give us a rating or a review, these things really, really help us, especially at this early stage.

Kris Brown  

Otherwise thank you very much.  

Anthony Woodward  

Thank you. And that's it from me. And that's it from Kris and, and thank you again, Barbara. Thanks everybody for listening. Catch you again next time, next month.

‍