“Assess what is important” in the IDEA framework for Data Privacy

What is important is seldom urgent, and what is urgent is seldom important.

And a corollary to that – if you don’t pay enough attention to what is important when it is not urgent, it will become urgent and important. A five-alarm fire.

Did you hear about the Gimli Glider? In 1983 While refueling an Air Canada Flight 143 the ground crew filled in 22,300 lbs what was supposed to be 22,300 liters due to a “Metric Mix up”. As a result, they took off with a quarter of the fuel they were supposed to have, and the plane ran out of fuel midair. The urgency of completing refueling led to overlooking the important task of reading the documentation about fuel requirement properly led to what would have been a disaster. Not paying attention to what was important led to a situation that became urgent and important.

The Gimli Glider ended well. But not the Refinery Explosion in Texas City in 2005. And that has an almost direct relevance to what I am talking about in this blog. You will read about it in a few minutes.

I have been in countless discussions and meetings where I have been told that there is not enough budget or there is not enough time for GRC projects. I have found myself thinking so about important projects at times. Time is not the real reason. A little reflection reveals that the real reason for saying that “there isn’t enough time” is that “it is not important enough” or “it is not high enough in the list of priorities”. There is always time for what is important.

Now let me tell you about the BP refinery explosion in Texas City in 2005, which killed 15 workers, revealed a deep-seated culture of prioritizing immediate operational “urgency” over long-term “important” safety maintenance. Systemic failures occurred because the organization focused on short-term production goals and immediate fixes rather than the important, but less immediately pressing, work of upgrading aging safety systems and maintenance practices.

Every time you think of lack of time or money for an important project think of the BP Refinery in Texas City. Or of the Deepwater Horizon. Where budget cuts resulted in cuts to the important tasks of maintenance just because they were not urgent.

We are all confronted by a need to prioritize because none of us have unlimited time and money. We have to judiciously allocate our limited resources. This is true at all levels. This is true if you are running a country. Or a company. Or a department. Or a project. Or just your day.

I have talked about the Intent to maintaining Privacy of Data under our stewardship.

About the need to Design a comprehensive Compliance framework to address the multiple regulators and standards that we need to comply with.

And about the need to Evaluate how well our framework is working.

I have found the Eisenhower Urgent-Important framework a uniquely useful tool in helping prioritize my work. In helping me Assess what is important. This idea is originally attributed to Dr J. Roscoe Miller of Northwestern University and popularized by Gen Dwight Eisenhower and Stephen Covey this 2X2 Urgent-Important matrix.

It is breathtakingly simple.

We look at each task, and we place it in one of the 4 quadrants. Urgent but not Important. Important but not Urgent. Urgent and Important. Neither Important nor urgent. Let me give you an example from some tasks that have appeared on my ‘to-dos’ from time to time.