The Privacy Scorecard Standoff at a Regional Health Insurer
You are the first chief privacy officer at a regional health insurer with 2.4 million members and six business units, each with its own general counsel liaison. The board audit committee has asked for a quarterly privacy risk score for every unit, rolled into one board-level number. The CIO argues that privacy metrics belong to IT security; the units argue that a single score will misrepresent their work. Your data inventory covers about 40% of systems, incident severity is recorded inconsistently across three ticketing tools, and a state regulator has scheduled a market conduct exam in 90 days. The CFO has approved only two additional FTEs. The board wants a number it can trend; your team wants to avoid false precision that could be quoted back in an enforcement action.
1. What governance structure and decision rights should you establish before publishing any privacy score?
Read the worked answer
Establish a privacy governance council before publishing a score, because a metric without assigned decision rights becomes a negotiation rather than a control. The charter should state that the CPO owns the risk methodology and the interpretation of privacy obligations; each business unit's accountable executive owns remediation and must sign residual risk acceptance in writing; the general counsel owns legal privilege and regulator strategy; the CIO supplies control evidence but does not own the privacy rating. Use a RACI to make this explicit, and give the council a defined escalation path to the audit committee for unresolved disputes.
Also approve three artifacts before the first score: a risk taxonomy, a scoring rubric, and an evidence standard. The taxonomy should separate regulatory exposure, individual harm, financial loss, and reputational impact. The rubric should define likelihood and impact levels and require evidence for each rating. The evidence standard should say what counts as proof, such as a completed DPIA, a signed contract clause, or a tested deletion job.
Reasoning: a regulator will ask who made the risk decision and on what evidence. If the score is owned by IT security, the privacy office loses independence and cannot attest that legal and individual-harm dimensions were assessed. If business units can dispute scores without a documented process, the board number becomes political. The council should approve methodology, not individual scores, so the process remains consistent across units.
2. How would you design the first scorecard to be defensible when your data inventory covers only about 40% of systems?
Read the worked answer
Publish a maturity or confidence indicator alongside the score, and disclose coverage. Do not present a single precise number as if it covered all systems. A five-level maturity scale, or a score expressed as a range with an explicit coverage percentage, is more defensible than a decimal that implies precision the evidence does not support.
Use leading indicators that do not depend on complete inventory: percentage of high-risk processing with an approved DPIA, percentage of vendors with privacy and audit terms, incident closure timeliness against severity thresholds, data subject request completion within the statutory period, training completion for staff who handle member data, and aging of open remediation items. These measures are actionable and can be trended quarterly even while inventory work continues.
Separate the score into two parts: an assessed-population score and a coverage score. For example, report that five of six units have assessed their high-risk systems, and within the assessed population the maturity is level three. That prevents a unit with 10% coverage from appearing better than a unit with 80% coverage but several open findings.
Reasoning: the board wants a trend, but the regulator wants evidence. A coverage-adjusted maturity metric gives both. It also creates an incentive for units to complete inventory rather than argue about the number.
3. The CIO argues that the privacy risk score should be owned by IT security because most controls are technical. How do you respond?
Read the worked answer
Acknowledge that IT security supplies critical control evidence, then separate ownership from input. Privacy risk is not limited to confidentiality or security controls; it includes lawful basis, purpose limitation, transparency, data subject rights, retention, cross-border transfer, and individual harm. Security can attest that encryption is enabled, but it cannot decide whether the processing purpose is lawful or whether a vendor's secondary use is acceptable.
Propose a joint operating model. Security provides control testing results on an agreed schedule and in an agreed format. The privacy office interprets those results against privacy obligations, assigns the privacy risk rating, and owns the remediation dialogue with the business. Put this in the council charter and in the metrics methodology. If the CIO continues to resist, escalate the ownership question to the audit committee with a written recommendation, because ambiguity at the top will reappear as disputes over individual unit scores.
Reasoning: placing privacy scoring inside IT security creates a self-assessment conflict when the issue is an IT-owned control failure. It also weakens the privacy office's ability to represent regulatory and individual-harm risk. A joint model preserves security's expertise while keeping accountability with the privacy function.