Exoinformation Space Audits: An Information Richness View of Privacy and Security Obligations

The privacy-security challenge for corporations is multifaceted and complex with privacy and security demands seemingly pulling in conflicting directions. In addition, the automated and often unconscious and unintentional flow of data, which Brunk (2002) describes as exoinformation, makes the traditional auditing function inadequate to fully capture the security and privacy aspects facing most corporations. This paper draws upon an existing theoretical model of privacy and security, based on the concept of information richness, to develop a practical framework for wider information audit. The proposed information space audit, a supplement to existing information audits, provides guidance on how to manage the rich set of exoinformation data that is typically unplanned and automatically collected. Collating and combining information from different sources provides further scope to reduce information collection requirements, but also raises privacy concerns.