Data security & privacy (DS&P)

The senators had called Emanuel Piore on that March day in 1967 to testify about computer privacy in the wake of a proposal by the US federal government to create a centralized National Data Center. While emphasizing IBM’s efforts to ensure data privacy through security measures on its machines, he highlighted a key distinction between data security and data privacy: “Preservation of privacy rests not with machines, but with men,” he said. “The effectiveness of all protective measures, however sophisticated they may become, will still depend on people.”

Echoing Piore’s sentiment, CEO T. Vincent Learson said in 1972 that “it is the task of public policy to decide who is to have access to what. But the question of how we are to limit access to this information only to those authorized to have it clearly comes home to us.” That year he established a broad program of study on data security, in part to educate the company and industry on steps toward more comprehensive security practices.

Data security and data privacy are often used interchangeably but are in fact distinct. Data security protects information from compromise via malicious intent or operator error. Privacy, on the other hand, governs how data is collected, shared and used. While Thomas Watson Jr. had long embraced IBM’s role in data security, it wasn’t until the late 1960s that he began to articulate the responsibility he felt around privacy, both for the industry at large and for IBM employees. “For the problem of privacy in the end is nothing more and nothing less than the root problem of the relation of each one of us to our fellow men,” he told the California Commonwealth Club in 1968.

In the mid-1960s, an employee’s request to read his own personnel file had triggered Watson Jr.’s awakening on data privacy issues, a scenario that IBM CEO Frank Cary recounted in the Harvard Business Review in 1976. “After he reviewed [the request] thoroughly, his answer to the employee was ‘yes’,” Cary said. From then on, Watson Jr. mandated that every manager should approve such requests.

As computers proliferated and data collection and processing practices grew more sophisticated, public concern arose around technology’s encroachment on privacy. Under Cary, IBM would take an assertive posture on the front lines of this public conversation. The company began advocating for uniformity in privacy-related practices at the national level. IBM executives frequently appeared before Congress to shape the debate. With dozens of legislative bills focused on individual privacy pending across the US, passage of even a fraction would create a morass of disjointed, and sometimes conflicting, requirements.

In 1974, the company published its “Four Principles of Privacy,” announcing them in 15 major US newspapers. The New York Times ran a letter from Cary outlining the approach. US Senator Barry Goldwater, for one, lauded IBM for its “significant contribution to the effort to restore individual privacy to the American people.” In 1973, the company had also instituted a first-of-its-kind corporate policy that codified employees’ right to privacy, reaching well beyond any laws or regulations requiring it. “Privacy,” Cary said, “is not a passing fad.”