Most of us that work with data in organizations don't own the data. We're just stewards that manage, manipulate, move, protect, clean, etc. the data in a database. However we are also individuals that bear some responsibility for the data, though to what extent we are liable is unclear.

I was reading this short piece about medical patient data and a few things stood out to me. First, EHR vendors are supposed to destroy data if they lose a contract. That means that potentially a patient's records could get lost. Permanently. I'm starting to think I need to  ensure I get copies of all my EHR data and manage it myself.

Second, the ownership and liability for protecting data seems murky. The lawsuit against UCLA that is mentioned in the piece notes a juror that would likely have returned a guilty verdict if the suit had been against the individual that disclosed data.

That's scary for me as someone that manages data.

In this case, the disclosure was intentional, but what if it weren't? Would an organization stand behind an employee? I'm sure if a DBA or developer disclosed data, they might easily lose their job, but what's unclear is where the liability might lie. It's entirely possible a company would accept responsibility for the actions of its employee, but it's also possible that the employee might be separately liable.

I have wondered about this for years, and have thought that at some point a data professional might need to be bonded, just like a locksmith or other trusted individual that handles sensitive information. I suspect we may come to a time where each of us needs to carry some sort of liability insurance to protect ourselves against accidents.

However I then wonder how likely would it be that an insurance company would stand behind their policy and not deny a claim based on negligence by the policyholder? It's a murky area, and one that worries me. We have done a poor job as a society of coming to grips with ownership, responsibility, and liability for data. Unfortunately, I can't see this changing anytime soon.