The most popular and comprehensive Open Source ECM platform
Let us know more
Content Management: Privacy Considerations When Managing Data
Content Management systems are typically designed and built around capabilities like categorization, search, and accessibility. These goals of openness and data sharing on the surface seem to be at odds with the ability to include and secure personally identifiable information (PII) as part of the data stored. PII includes information like Social Security Numbers, account numbers, health information, and other personal information that should be available via restricted access.
At the coarsest level, access to documents and records will be restricted by system authentication and authorization. At a finer level though, metadata associated with the records or portions of the record itself may contain pieces of PII. The repository should be able to track and identify which documents or which of their components are considered PII.
Records themselves are typically classified in a way that specifies the lifecycle of the document, which specifically includes a plan around document retention. The rules and regulations around PII and the types of documents with which the PII data is associated may be at odds. Records managers need to carefully balance both requirements to come up with a good balance for how to treat information retention.
The transmission and authentication process in handling PII should be secure. The treatment of PII requires that all or certain portions of the document be properly encrypted or redacted on transmission. Systems that contain PII information also must take the responsibility to properly delete and dispose of sensitive data.
