Don’t say nothing: why privacy is so important

I’m guessing the artist intended this to mean “Don’t snitch”. But I’ve always read it to mean “If you have the option of speaking up, push yourself to say something. Don’t think you can just sit back and say nothing.” 

The principle certainly applies in innovation, activism, and organisational culture. And I think it applies to cybersecurity too. 

A leader from The Smith Family who attended the federal government’s recent cybersecurity community of practice launch told a story of cybersecurity failure the charity had faced, and he described how the organisation had grown from it. He wanted people to feel comfortable speaking up when they had made a mistake so that it could be rectified by the right people, quickly. 

He spoke about building security and password management systems not in a vacuum of theoretical best practice, but in terms of the humans who use these systems. They need to be built to suit the way humans work, he said. Otherwise, humans will come up with their own systems to manage passwords, which may in fact put the organisation at risk. When it comes to privacy and security, the weakest link is not the tech but the humans. 

Teenagers today commonly share a lot more personal information online and publicly than previous generations. As a parent of teens, I think a lot about privacy, which is one expression of cybersecurity. Recently, I was interviewed online by a writer who, out of habit, pressed “record” on the Teams meeting. As a habit of my own, I ask why meetings I attend are being recorded, because I’ve found that often they don’t need to be recorded at all. Don’t say nothing. 

When I asked the interviewer to clarify why she was recording the meeting, she explained it was so she could ensure accuracy when she used the material in her piece. Later, she sent me a draft of her story, and I could see from the litany of AI tropes that it had been written by a generative AI system. This meant she had uploaded my words to a system that may or may not be secure. (Does she pay for a licence? Does she use a free system that learns from her data, which is actually my data?) 

Don’t get me wrong, I am not an AI sceptic. But I put humans first, and I expect others to extend the same courtesy to me before I donate my thoughts and images to a monolithic, opaque AI system.  

Privacy breaches are usually silent. The person whose data is breached doesn’t immediately know it has happened, so the idea of speaking up – “Don’t say nothing” – is difficult. Privacy requires, first, a conversation about what we value and why, because not all of us value the same things.  

In my experience, different generations have different ideas of what is private. For example, a 16-year-old may find it completely acceptable and useful to have themselves and all their friends trackable by one another on Snapchat. For me, that’s just creepy, a recipe for social problems if ever I heard one. 

Privacy is not the same thing as secrecy. A secret is what you don’t want anyone to know. Privacy is when your own information moves appropriately within a specific context, and a privacy breach is what happens when information slips across into a context where it does not belong.  

It’s easy to assume that teens don’t value privacy because they share information online, but I don’t think this is true. Many teenagers care intensely about privacy even though they have drawn their information maps differently from the way I draw mine. I don’t want my whole social circle tracking me via my phone, whereas a 16-year-old may be perfectly relaxed in the knowledge that 12 of their friends know they are at a party. At the same time, they would be appalled if their school or a stranger held exactly the same information. 

Which brings me, uncomfortably, to the not-for-profit sector. If a privacy breach is information slipping into a context where it does not belong, then community organisations breach the privacy of the people they serve constantly, and almost never with any malice at all. This is not a capability issue or a capacity issue, it’s an accidental choice.  

Here’s a scenario that might sound familiar: a client tells an organisation something in the context of seeking help. That information then travels: into a funder's reporting portal, into an acquittal, into a case study in the annual report, into a photo on the socials, into a chatbot used to summarise case notes. No hacker appears in this scenario, which happens every day; no phishing email or ransomware. It just represents the ordinary flow of a busy organisation trying to have an impact. The privacy map or boundary that the client subconsciously drew when they shared their information with the organisation in the first place is not the more expansive map the organisation is working from. In this scenario, any number of staff have had the opportunity to question these everyday practices and to consider how to “not say nothing”. However, it’s very difficult to question cultural norms. 

Governance and leadership play important roles in establishing what information-sharing is acceptable, and board members must model the behaviour and culture they want to establish. If the only time a board asks about privacy is when it signs off the annual policy review, staff will read that as a compliance ritual. But if a director asks aloud who holds the administrator passwords, what happens in the first hour after somebody realises they have made a privacy mistake, and when did the organisation last check whether the people in the case studies understood where their stories would travel, then the questions may stop belonging to one anxious person who carries all the mental load, and start belonging to the organisation’s staff and board together. “Don’t say nothing” then becomes a cultural norm. 

The privacy failures I have described here might have been prevented by one person asking one awkward leadership question. Why are you recording this? Does this person know where their story is going to end up? Or making an admission: I think I clicked the wrong thing, sorry. None of these things are hard to say, but they are hard to say first. So, privacy risks are often less a digital inclusion problem, and more an accumulation of moments when no one made the brave decision to say something. 

Don’t say nothing. 

← Back to the newsletter

Improve digital access and security with our guidance

Community Directors hosts thousands of pages of free guidance, such as this help with your tech: Damned Good Advice on Cybersafety and Fraud Prevention | 10 questions every board member needs to ask about cybersecurity | Preparing a technology plan for your organisation | Cybersecurity policy | Data retention and destruction policy | More help with tech | More help with artificial intelligence

Find more resources under tools and resources on the Community Directors website.