克服“如果我们需要怎么办？”的心态：构建可辩护的删除文化 | Data Xposure 第12集

欢迎各位收听Exterro的播客《数据泄露》，这是为数据风险管理者打造的节目。

Welcome everyone to Exterro's podcast, Data Exposure, the podcast for data risk leaders.

我是法哈德·迪万，今天我们将深入探讨一个困扰着各组织以及法律、隐私和安全专业人士的重要问题。

I'm Fahad Diwan, and today we're unpacking an important problem plaguing organizations and legal privacy and security professionals everywhere.

许多组织在处理数据时，都抱有‘万一需要’的心态。

Many organizations have what if we needed mindset when it comes to their data.

他们最终将数据永久囤积，并接受由此带来的风险。

They end up hoarding their data, well, forever, and they accept the risk that comes along with this.

但随着数据和AI代理的激增，这种数据囤积所带来的风险已变得过于巨大，改变了风险与收益的权衡，使删除不必要的数据成为更优选择。

But as data and AI agents proliferate, the risk from this data hoarding is becoming too great, changing the risk reward calculus and tipping it in favor of starting to delete the unnecessary data.

因此，今天我们将深入探讨这个问题。

So that's what we're gonna unpack today.

我们该如何摆脱这种状态？

How do we move away from this?

如何摆脱‘万一需要’的心态，转而建立一种可辩护的删除文化？

What if we needed mindset and start building a culture of defensible deletion?

今天加入我们的是Ryan Zilm，H2O America的信息治理总监，他带来了经过实战检验、可立即应用的经验。

Joining us today is Ryan Zilm, director of Information Governance at H2O America with field tested lessons you can use right now.

简单介绍一下Ryan。

A little bit about Ryan.

他是一位获奖的高管，拥有近二十九年专注于数据战略、风险管理与信息治理的丰富经验。

He is an award winning executive leader who brings over twenty nine years of focused experience in data strategy, risk management, and information governance.

他目前负责制定H2O America的信息合规策略，确保遵守HIPAA和CCPA等相关法规。

He currently needs information compliance strategies, ensuring adherence, policy laws on HIPAA and CCPA at H2O America.

他还是Zeeve信息生命周期管理公司的创始人兼首席执行官。

He's also the founder and CEO of Zeeve Information Lifecycle Management,

他的职业生涯，包括在美国联合服务汽车协会（USAA）担任企业与通信服务总监期间，通过优化运营和推出自动化企业保留工具，实现了数百万美元的成本节约。

who had his career, including his time as director of enterprise and communications services at USAA, has served in multimillion dollar cost savings by streamlining operations and launching automated enterprise retention tools.

他拥有独特的见解，这真是个了不起的成就，我认为这在内容领域是个很好的案例。

He has unique, that's a great job of, I don't think that's good point for content sectors.

例如，他构思了‘内容清理嘉年华’——你试着快速连说三遍看——这一活动实现了超过55%的员工参与率，整理了超过550个记录案例，并创造了近一百万美元的成本节约。

For example, he conceptualized a content cleanup carnival, try saying that three times really fast, that achieved over 55% employee participation, indexed over five fifty record cases, and generated over almost a half $1,000,000 in cost avoidance.

欢迎，瑞安。

Welcome, Ryan.

我们非常高兴有

We're so happy to have

你在这里。

you here.

最近怎么样？

How's it going?

谢谢。

Thank you.

很高兴能来到这里。

Very happy to be here.

这个介绍真是太棒了。

What a great introduction as well.

是的。

Yeah.

嗯，你的背景非常出色，我相信我们的听众一定会从你带来的经验和专业知识中受益匪浅。

Well, we're you got a great profile, and I think our audience is really gonna benefit from the experience and expertise that you bring in.

在我们深入之前，我想简单说一句。

And before we dive in, I just wanna say a quick note.

瑞安在本集中表达的观点和意见均为个人看法，不代表其当前或以往任何组织的官方政策或立场。

The views and opinions expressed by Ryan in this episode are his own and don't reflect the official policies or positions of his current or former organizations.

这一步标准声明是必须的。

Just gotta do that standard disclosure.

所以，瑞安，我就不多说了，听众们都很想听你分享。

So Ryan, enough of me monopolizing the conversation, our listeners wanna hear from you.

带我们回到起点吧。

Take us back to the beginning.

你是如何踏入信息治理领域的？

How did you find your way into information governance?

是的。

Yeah.

今年已经整整三十年了，回望过去真是令人难以置信。

It's been thirty years now this year, so it's just crazy to look back.

我从九十年代开始从事信息技术，真的很喜欢这份工作。

I started in information technology back in the nineties and just I really liked it.

它非常实事求是。

It was very it was factual.

它是非黑即白的，那些一和零，还有编程。

It was black and white, know, the ones and zeros and coding.

大约是在2005年左右。

And it was right around 2005.

我职业生涯发生了一点转变，进入了信息管理、档案和信息治理领域。

Had a a little change in career and found my way over into information management, records and information governance.

这对我来说非常有趣，因为我从信息技术领域转到了法律领域，能够成为技术端与法律端之间的桥梁，弥合两者之间的差距。

And it was a lot of fun for me because I was coming from the IT realm, was moving over into the legal space and being able to kind of be the liaison between the tech side and the the legal side and kinda bridge that gap.

我很快就爱上了这个领域，因为很早我就意识到，我们所做的事是有科学依据的，那种非黑即白的监管合规要求——这就是你必须做的事。

And, I I very quickly fell in love with the space because, you know, I I think what I learned very early on was there is a science to what we do, that black and white, the regulatory compliance, so this is what you must do.

但如何将其销售出去并让组织内部实现，这是一门艺术。

But how you sell it and how you bring it to fruition inside of organizations is the art.

而那正是有趣之处。

And that that was was the fun.

那些就是我觉得太酷了的事情。

And those were the things that I just, I thought, man, this is really cool.

让我们看看我们该如何做到。

Let's, let's see how we can do it.

从那以后，我就再也没有回头过。

And just, I haven't looked back ever since.

在过去三十年里，我很幸运地在多个组织中推行了这些项目。

And I've been fortunate enough to roll out these programs in, you know, multiple organizations over the last thirty years.

每一个项目都各不相同。

And each one of them has been different.

我认为有趣的地方就在于，尝试找出组织在面对这些不断变化的规则时，如何能够蓬勃发展，并真正帮助他们的项目成长。

And I think that's the fun of it is trying to identify where organizations can thrive with these changing rules that we're experiencing and and really helping their programs grow.

所以这段经历非常宝贵，我非常感激自己所拥有的一切经历和机会。

So it's been it's been tremendous, and I'm just so appreciative of all the experiences and the exposure that I've had.

这太棒了，瑞安，我认为整个行业也十分感激你将你的经验和专业知识带入这个领域。

That's amazing, Ryan, and I think the industry is appreciative of you too for bringing all of your experience and expertise to this space.

我非常喜欢你提到的这一点，即这里既有科学的成分，也有艺术的成分。

I loved your point about how there's a component of science and art here.

我认为，在制定保留计划时，它可能非常具有规范性。

I think when it comes to creating a retention schedule, it can be very prescriptive.

我们需要遵循一些具体的规则，并且可以不断优化它们。

We have specific rules we need to follow that we can iterate upon.

但与此同时，还涉及一个非常人性化的一面，那就是如何让人们协同合作。

But then there's this whole human aspect to it of getting people to work together.

我认为，这始终更偏向于艺术，而非科学。

And I think that's always more of an art than a science.

因此，关于如何与人合作、转变思维——对于本集的法律、隐私和安全听众来说，你们可能会想‘如果我们需要它怎么办’，那么你会如何解释，这种‘如果我们需要它怎么办’的心态实际上会增加他们的风险暴露？

And so when it comes to this more, you know, getting working with people, changing mindsets, for the legal privacy and security listeners of this episode, you know, how does the what if we need it how would you say the what if we need it mindset actually increases their risk exposure?

哦，天哪。

Oh, wow.

这是一个非常复杂的问题，因为我觉得现在每个人都在囤积数据，总觉得‘如果我没保留，将来可能就需要它’。

That's that's a really loaded question because I think everybody's kind of in this data hoarding mode right now because we see this as if I don't have it, I'm gonna need it.

我们确实扩大了范围，不过让我先澄清一下。

And we've really expanded around, well, let me back that up.

在某些情况下，拥有数据并不如拥有可辩护的删除机制更有益。

Let's say I've seen in cases where having it is not as beneficial as not having it and having defensible deletion in place.

当然，不具体展开来说，有时候这些‘铁证’确实能帮上忙，但有时候却没那么大用处。

You know, without getting into specifics, sometimes those smoking guns can help us and sometimes they don't as much.

所以，当你从整体上审视保留数据所带来的风险时，这背后是一种安全感，一种保障。

So I think when you look at the overall risk of keeping things, it's that safety net, it's that security.

而且我认为，信息量的巨大也让人很难下定决心放手，尤其是在今天。

And I think also the volume of information makes it really challenging for people to feel like they can let go, especially today.

我的个人文件，比如，可能远不如我的组织文件管理得当。

I mean, I think that my personal records, for example, probably are not managed as well as my organizational records.

我认为这是因为信息量太大，而且人们不清楚自己该怎么做，比如没有人告诉我，你的财务记录该保留多久，其他记录又该保留多久；而在组织里，像我这样的人和其他同事都清楚这些要求，明白其中的风险，了解我们需要遵守哪些监管规定，并建立相应的规范和控制措施。

And I think that's because of volume and and not knowing, you know, what it is, how we should comply, because I don't have a person in my life other than myself who should be saying this is how long you keep your financial records, this is how long you keep your other records whereas in organizations we have somebody like me and others who should know what it is, should understand the risks, should understand what regulatory bodies we have to comply with and put those guardrails in place and those controls.

但我觉得挑战在于这种心态：‘我迟早会用到它’，要跨越这个障碍并不容易——你觉得自己需要它，但万一它被删了，你真需要时，重新获取它会有多难呢？

But I think the challenge is that mentality of, but I am going to need it and crossing that barrier of, well, you think you need it, but when it's gone and you don't have it, how easy would it be for you to recreate it if you truly needed it?

帮助人们跨越这个心理障碍，正是我近年来，或者说过去十到十五年里取得巨大成功的关键所在——当你让人们清楚地认识到哪些信息是真正需要保留的，哪些是可以舍弃的，这往往能带来巨大的成效，巨大的成功。

And getting people over the hump, that's kind of the art that I found some huge successes with, you know, as of late and over the last, I would say ten to fifteen years, when you make people feel comfortable with understanding what information they do need versus they don't need, it's, it can be a huge win, a huge win.

听起来确实如此。

Sounds like it can.

我特别赞同你提到的观点：当你和人们交谈时，问他们‘如果我们删除了这些数据，以后又需要它，重新获取会有多难？’

And I love, love, love your point about how when you speak to people, you ask them, well, if we got rid of this data and we needed it again, how hard would it be to get this data again?

这是一个非常有洞察力的问题，能帮助人们克服对删除可能未来会用到的数据的恐惧。

That's a really insightful question to pose to help people get over the fear of getting rid of data that they might one day need.

那我们来深入具体细节吧，因为你曾在这么多优秀的企业工作过。

And so let's let's dive into specifics because you've worked at so many great organizations.

你确实做过很多这样的项目。

You've, you know, you've done so many of these programs.

当然不提及具体组织名称，你能回顾一下，在你曾工作过的某家组织中，是什么时刻让你意识到需要开展一次数据冗余清理行动吗？

And without obviously naming the organization, can you take us back to the moment where you realized a ROT cleanup campaign was necessary at one of the organizations you worked at?

当时组织内部发生了什么？

What was happening inside the organization?

是什么让你意识到：我们需要停止这种数据囤积行为？

What led to you thinking, hey, we need to get our we need stop this data hoarding.

我们需要开始主动删除，清除一些不必要的信息。

We need to start defensively deleting, getting rid of some of this information.

是的。

Yeah.

我认为，我待过的每一个组织都需要一套数据冗余清理策略，只不过有些组织的风险程度更高，因此需求更迫切。

That's been I think every organization I've been in needed a ROT cleanup strategy, but some of them more significant than others just because of the level of risk that may be associated.

当我审视这个问题时，发现我们有这么多应用程序都没有得到妥善管理。

And so when I looked at this and I said, you know, we have these different applications that are not being managed.

人们不知道如何点击删除按钮，所以我们需要为他们部署一些自动化工具。

People don't know how to hit the delete button, so we need to put some automation in place for them.

我开始想到，这是他们第一次真正点击删除。

I started thinking about, well, this is the first time they'd hit delete ever.

在这家组织工作了十五年、二十年、三十年的人，普遍存在无法点击删除的问题。

People who've worked in this organization for fifteen, twenty, thirty years, there's there's this challenge with being able to hit delete.

所以，我们需要教育大家为什么执行这一策略很重要，但也不能给他们太多信息，以免造成压力。

So educating people on why it's important to do it for the, that strategy, but also not giving them too much that is overwhelming.

因为如果你想想，你在一个组织里待了三十年，突然有个策略说：嘿，任何超过X年限的东西都会被删除，只要符合特定标准，那我们真的得帮他们跨越这个心理障碍，理解背后的原因和目的。

Because if you think about, if I've been in an organization for thirty years and we're gonna put a strategy in place that says, hey, guess what, anything over X period of time is just gonna be gone because it meets said criteria, then we really have to kind of get them over that hurdle of understanding the why and the what.

每个组织的情况都不同，但我做得非常成功的一点是，把任务拆分成小块来处理。

And every organization's been different, but what I did very, I think successfully, was breaking it down into bite sizes.

于是我们采用了ROT分层策略，说：听着，我们来分三级，一级、二级和三级。

And so we did this ROT tier strategy where we said, listen, let's let's target these we'll have a tier one, a tier two, and a tier three.

我们先从三级ROT开始。

Let's start with the tier three ROT.

我们把三级ROT定义为：任何超过十年、且符合特定标准的文件，比如系统文件或其他十年内从未被访问过的文档。

Let's identify that as anything that's, let's say, over ten years old that meets said criteria like system files and other documents that just haven't been accessed in over ten years.

我们从这条路径开始。

Let's start with that path.

我们把它取出来。

Let's grab it.

我们找到它。

Let's find it.

然后我们可以做一个隔离区。

And then we can do maybe, like, a quarantine.

隔离区是一种服务，你可以把它看作一个暂存队列。

Quarantine is a service, if you will, where it goes into this holding queue.

人们可以访问它大约九十天，在此期间可以查看、处理，如果没有任何操作，它就会被删除。

People have access to it for, I don't know, say ninety days, and then they can review it, they can action it, or if they don't touch it, then it does go away.

这就是第一步，让他们熟悉这个流程以及如何跨越这个障碍。

So that's that first bite, getting them familiar with what the process is and how they can get over that hump.

然后，在ROT策略的下一阶段，就是五年。

And then after that, that next step in the phase of a ROT strategy would be five years.

所以第二层，比如说超过五年，对于一个较年轻的组织，你们可能会设定五年、两年和一年。

So that tier two, let's say it's anything over five years and whatever your organization can do if you're a younger organization, maybe you do five years, two years, and one year.

也许你们可以做得更强一些，但对这个组织来说，将会是十年、五年和两年。

Maybe you're, you know, you can go a little bit stronger than that, but for this organization, it's gonna be ten years, five years, and two years.

因为一旦你们跨越了十年的门槛，就能引导他们进入五年阶段，但这里仍然会有一些阻力，不过仍然有助于他们理解；同时你们也必须确保他们能够成功，并且有自动化机制到位，因为越手动化的操作，越难落实这些策略并加以执行。我们把这称为‘隔离即服务’，这是一项为我们清除数据的服务，但我们希望你们在需要时仍能访问这些数据，如果你们不处理，数据就会被移除。

Because when you get them over the ten year hurdle, then you can get them to the five years, but there's still a little more angst there, but still helping them understand, but you also have to make sure that they can be successful and that there's that automation in place because the more manual that we make things, the less likely we are to get the follow-up with those strategies and putting that in place and calling it like a quarantine as a service, so it's, it is a service we're providing to get rid of the stuff for you, but we do want you to have access to it in case you need it, but if you don't action it, then it would be removed.

实施这一策略意义重大。

And putting that strategy in place was significant.

我的意思是，当你想到一些组织时，我曾经在拥有120个国家、数十万员工的组织工作过。

I mean, when you think about organizations, you know, I've worked in organizations that were in 120 countries with hundreds of thousands of people.

当你想到那些十年未被访问过的数据量时，其规模可能大得惊人。

When you think about the volume of data we're talking about from something as simple as anything that hasn't been accessed over ten years, it just can be so huge.

再看看投资回报率、成本节约、存储节省，以及整体风险的降低，能实现这样的成果简直令人惊叹。

And then you look at the ROI and the cost savings and storage savings and just that risk overall being reduced, pretty incredible to to have something like that come to fruition.

谢谢，瑞安。

Thanks, Ryan.

你说话的时候，我脑子里突然灵光乍现。

As you were speaking, mind was just lighting up.

你所说的这些话让我觉得特别有道理。

Things that you were saying just made it make so much sense.

我想到的一个点是关于你的‘隔离即服务’。

And one thought that I had was about your quarantine as a service.

这让我想起一位朋友曾经给我的建议，他说：法哈德，如果你想要处理掉那些不常穿但还囤着的衣服，每年年初就把衣橱里所有衣服的衣架都反过来挂。

It reminded me of this advice that one of my friends gave me once, and he said, Fahad, if you ever wanna get rid of clothes you don't really wear, but you're still hoarding, at the start of each year, turn the hanger around for all of your clothes in the closet.

这样，所有的衣架一开始都朝向相反的方向。

So they're all the hangers are all facing the other way.

然后，每当你穿上某件衣服，就把衣架再翻回来。

And then when you do wear that piece of clothing, you turn the hanger the opposite way.

到了年底，那些仍然朝外的衣架——也就是年初时你翻过去的衣架——就是你一整年都没穿过的衣服，可以处理掉了。

And then at the end of the year, the hangers that are still facing away from you, the ones that you faced away from you at the beginning of the year, well, you know, those are clothes that you don't you didn't wear in the past year and you can get rid of.

这个方法帮助我克服了担心某天可能还需要这些衣服而不敢丢弃的恐惧。

And that was one way that I got over the fear of, you know, getting rid of clothes that I may one day need.

当你谈到‘隔离即服务’时，我觉得这个想法太 genius 了，因为如果我们不直接删除，而是说：‘我们先把这些信息移到隔离环境，进行归档，这样如果你需要，随时可以恢复’，这或许能帮助人们克服删除不必要数据的恐惧。

And so when you were talking about quarantine as a service as a service, excuse me, I thought that it was such a genius idea, because if we don't go straight to deletion, if we say, look, we'll move this information to a quarantine environment, we'll archive it, and so you can always get it back if you need it, it might get people over the hump, over that fear of getting rid of some of that unnecessary data.

十年后，如果这个人从未回头去取回这些隔离数据，那我们就可以安全地判断：你根本不需要这些数据。

And then after ten years, that individual hasn't gone back and retrieved some of that quarantine data, then we can safely say, look, there's no way you need this data.

这个组织也根本不需要这些数据。

There's no way this organization needs this data.

我们现在也可以从归档中彻底清除这些数据了。

We can now purge this from archive as well.

我想深入探讨一下，我认为你，瑞安，拥有的一个巨大专长是：让你的团队对这个理念感到安心，因为你多年来在构建这些项目方面的经验和专业见解，你已经多次提到过这一点。

And so I wanna double click on, I think one of the great expertise that you have, Ryan, is getting people comfortable with this idea because of the experience and expertise you've had over the years building these programs, and you've touched upon it multiple times already.

但我真的想深入了解：你是如何获得大家的支持的？

But I really wanna dig into how you get buy in.

因为数据删除或归档不仅涉及组织中的信息治理专业人员，还牵涉到信息安全、隐私、法律和数据治理，我希望你能深入谈谈这些方面。

Because data deletion or archiving data touches upon the information governance professional in an organization, but also the information security and privacy and legal and data governance, which I want you to dig into.

所以你能为我们回答两个问题吗？

So can you tell me can you answer two questions for us?

第一个问题是，你能跟我们讲讲，曾经有一次，所有这些不同的数据相关方——比如法律、IT、安全和治理团队——都不一致，你是怎么让他们达成一致的吗？

One is, so now can you talk to us about a time when all of these different data stakeholders, let's call them, legal, IT, security, and governance, weren't aligned, and how you brought them all together to be aligned.

在你的回答中，你能帮我们理清一下这些常常让人困惑的术语吗？

And as a part of your answer, can you help this often confused terminology?

你能帮我们区分一下信息治理和数据治理吗？

Can you help us distinguish between information governance and data governance?

我相信我肯定不是唯一一个对这个感到困惑的人。

Because I'm sure I'm not the only one that's confused about this.

天啊。

Oh, boy.

这可是个大难题。

That's a that's a huge can of worms.

我们可以稍微谈一谈这个。

We can get into that a little bit.

但让我先回答第一个问题，因为让人们对这一点有理解真的很重要：艺术必须有心。

But let me answer the first question because it's really important for people to understand that the art has to have heart.

我的意思是，人们都是人类。

What I mean by that is people are, we're humans.

我们与不同的人互动方式也不同。

We interact differently with different people.

我们的反应也不一样。

We respond differently.

当你在战略上出现不一致，或者在流程上出现不一致，比如不知道何时该删除数据时，你就必须推动人们跨越这个障碍。我之前提到的‘艺术’部分，其实讲的就是人。

And when you have misalignment on your strategy, you have misalignment on processes or when you can get rid of data, for example, you have to bring people over the hump and the art part of what I was talking about earlier is really about people.

这意味着要与他们坐下来沟通，理解当你说‘我要拿走你的数据’时，他们哪里感到痛苦，然后帮助他们顺利渡过这个阶段。

It's about coming to the table with them, understanding, you know, where do they hurt when you say I'm going to take your data away And then helping them across that finish line.

我知道，在很多组织里，人们都非常不愿意放弃任何东西。

You know, I've been in many organizations where people are just, they're very reluctant to get rid of things.

他们也非常抗拒改变。

They're very reluctant to change.

在任何类型的项目中，尤其是信息或数据治理项目中，我们都必须让他们感到安心。

In any type of a program, especially for information or data governance programs, we have to get them comfortable.

我认为，这就是我尽最大努力先建立关系的地方，而不是直接进去说：‘我们要上线新项目，你的资料会被删除。’

And I think that's where I've I've really tried my hardest to build relationships first before I go in and just turn things up and say, oh, we're gonna roll out this new program and, you know, your stuff's gonna be deleted.

我待过的每一个组织，情况都差不多是这样。

And every organization I've been in, that has been kind of the way.

我给你举几个有趣的例子。

And I'll give you some some examples that are kind of fun.

那些人还在关注着你，依然爱你，希望你一切顺利。

Those people are watching, still love you, hope everything's good.

但有一个我曾工作过的组织，我们一开始是从架子上取文件，然后开始整理这些文件。

But there was one organization that I worked in where we we started off with, like, files on the shelf and we were pulling files.

对吧？

Right?

人们可以走进来，取出文件。

And people could walk in and pull files.

从储藏室里取出纸质文件。

Physical files out of a storage room.

那里没有任何安全措施。

There was no security.

所以我们做出了改变。

And so we make a change.

这时他们才说：等等，我不能进来拿自己的文件了？

And that's when they're like, oh wait, I can't come in and get my own files?

这算是第一步。

And that was kind of step one.

然后我们开始帮助他们使用内容管理系统，将文件存放在那里，而不是放在共享驱动器或其他类似地方。

And then it went to, alright, well now we're gonna start helping you out with a content management system where things could be placed there instead of stored on a shared drive or things of that nature.

我要告诉你，我们合作的这些人非常难搞，其中一位是工程师。我记得我当时对团队说：嘿，我们真应该拉他加入，让他成为试点小组的一员，他们却问：为什么？

And I'll tell you that the people that we were working with were very challenging and one of them was an engineer and when I remember I was saying to my team like, hey, we should really bring this person on board, let's get them in our pilot group, And they were like, oh, but why?

为什么？

Why?

这个人简直就是最糟糕的。

This one person is just the worst person.

我说，但从长远来看，这会成为你最大的支持者。

I'm like, but that's gonna be your biggest advocate in the long run.

所以我们请她加入了。

So we brought her on board.

我问她是否感兴趣。

I asked her if she was interested.

她回答：当然了。

She's like, absolutely.

如果事情要改变，我想参与其中。

If if things are gonna change, I wanna have a say in it.

我跟你说，她真的成了推动变革的最大支持者，因为她觉得自己是变革的一部分，并且能提前得到问题的答案。

And I kid you not, she became the biggest advocate for moving things forward because she felt like she was a part of the change and she could get her questions answered up front.

这就是实现一致认同的方式：当你争取到那个最初反对的人，而他再向团队传播，团队再向主管传播，信息就这样扩散开来——嘿，他们是在帮我们，诸如此类。

That is how you get that alignment, When you get it from that one person who's your naysayer and then they socialize it to their team, who socialize it to their supervisors and then just that information gets disseminated like, hey, they're helping us, things like that.

即使在像野外这样较小的场所，你也知道，我在石油和天然气行业工作了三十年中的二十五年，我会去一些只有500人、2000人的小镇，那里有小型办公室。

Even in smaller places like out in the field, you know, I worked in oil and gas for twenty five of my thirty years and I would go to towns of, you know, 500, 2,000 people and we'd have small offices.

我记得有一次，我在一个办公室里，本想去推动一项信息管理方面的变革，但没有一上来就强硬推进，而是先和那里的办公室助理聊天，她说：是的，公司的人来了。

And I remember one time I was in an office and I was there to try to do a, you know, information management type change, but instead of coming in guns blazing, I was talking to the the office assistant there and she's like, yeah, well, corporate's here.

我说：不好意思，你知道的，我平时穿牛仔裤，今天也穿着牛仔裤，但通常我会穿得更正式一点，她就说：哦，好吧，不过我们的打印机坏了，太好了，我们正在做一个扫描项目，我说：哦，我来帮你看看打印机。

And I'm like, I'm sorry, you know, because I tend to wear this with jeans, I have on jeans, but, you know, it's typically something like this and she's like, yeah, well, okay, but our printer's broken, like, great, we were doing a scanning project and I'm like, oh, I'll look at your printer for you.

没问题。

Not a problem.

我过去看了看，修好了打印机，让它重新工作了。

Went over there, fixed it, got the printer working.

我觉得问题很简单，就是打印机的墨盒没装好。

I think it was simple as, you know, the printer cartridge wasn't installed properly.

但这些小小的成功能帮助人们信任你。

But those small wins help people to trust you.

当你赢得了他们的信任，推动变革、实现跨层级的协同就容易多了——不仅是在一线员工层面，甚至在高层领导层面，当人们看到你正在帮助他们的团队应对运营变革时，这无疑是我认为最关键的一点，人们必须认识到并善加利用，才能在整个组织内实现协同。

And when you earn their trust, making those changes and getting that alignment across not just the levels where people are out in the field working, but even at the senior leadership level and people getting to see that you're helping their people through operational changes and things, that has been by far the most significant thing I would say that people need to take and use to their advantage to get alignment across the entire organization.

哇，瑞安，我真没想到会得到这样的回应。

Wow, Ryan, I would have never expected that response.

而且，这真的非常有洞察力。

And again, very insightful.

当我们经常谈到获得支持时，人们往往会说，法哈德，你得说明你的目标如何与他们的目标对齐，我认为这确实有道理。

I think when we often talk about getting buy in, people will come in and say, Fahad, you gotta communicate how your objectives align to their objectives, which I think there is merit to it.

我不希望贬低这个观点。

I don't wanna belittle that point.

但我喜欢你提出的观点，你说要把关系放在首位。

But what I love about your point was you said, put the relationship first.

通过任何方式建立信任。

Build trust through any means.

表明你愿意以任何方式提供帮助。

Show that you're there to help through any means.

你进来后，修好了打印机。

Like, you came in, you fixed the printer.

这 arguably 与信息治理毫无关系，但你由此建立了默契，让人觉得：我在这里是为了帮忙，你可以信任我，我不想让你们的生活更困难，然后你就能获得那些最终必须协助你推进信息治理项目的人们的配合。

It arguably has nothing to do with information governance, but then you establish that rapport, this idea that, look, I'm here to help, you can trust me, I don't wanna make your life more difficult, and then you get that type of cooperation from the people that will ultimately have to help you in that information governance program.

所以我非常、非常、非常喜欢这一点。

And so I love, love, love that.

因此，当我们试图在IT、法律、隐私、信息治理和数据治理方面获得支持时——你还没给我一个关于这两者的简要区分呢——依我理解，你应该先去和这些不同部门的利益相关者建立关系，包括那些持反对意见的人。

So when we're trying to build buy in with IT, with legal, with privacy, with information governance and data governance, which you still owe us a quick distinction between the two, From what I understood is go out and just first make a relationship with your stakeholders in those different departments, including the naysayers.

我认为，如果我理解得没错的话，这样做会非常有帮助。

And I think from if I understood you correctly, that will go a long way.

但我不会就这么放过你，瑞安。

But I'm not letting you off the hook, Ryan.

我认为我们需要弄清楚，这两者到底有什么区别？

I think you we need to know what is the difference?

什么是信息治理？

What is information governance?

什么是数据治理？

What is data governance?

我来谈谈我的看法。

I will give you my take on it.

每个人都有自己的一套理解。

Everyone kinda has their own take.

而且我认为这确实变得很有挑战性。

And I I do think that it it's become challenging.

一些界限已经变得模糊了。

Some of the lines have been blurred.

以前是记录管理，后来演变成了信息治理，现在出现了一个更广泛的学科——信息治理，它包含了记录管理和其他一些支柱。

You know, it was records management, became information governance and there's this super discipline of information governance that kinda has records management and other pillars inside of it.

但当我想到一个组织，想要向别人区分信息治理和数据治理时，我喜欢把信息治理看作是更高层面的框架：我们组织里有哪些信息？

But when I think about an organization and and I wanna communicate to somebody information governance versus data governance, I like to take a look at information governance being kind of that overarching, what information do we have in the organization?

我们需要保留它们多久？

How long do we have to keep it?

我们需要做些什么来确保合规？

What do we need to do to comply with it?

这更多是从信息层面来看，我觉得这可能稍微……我不愿说它肤浅，也许更正式、更权威，我也说不准。

Just at an information level, which I think is a little bit more, I don't wanna say superficial, maybe it's more official or super official, I don't know.

但说到数据治理，我想到的是主数据、参考数据以及数据元素，比如行和列这类东西。

But then data governance, when I think about data governance, you're talking about things like master data and reference data and and the data elements like rows and columns and things of that nature.

有时候我们会迷失其中，你知道，信息就是数据，但它们是两种非常不同的学科，就像知识管理是另一个独立的领域。

And I think sometimes we get lost in this, you know, well, information, but data's information, but they are two very distinct disciplines, just like knowledge management would be another one.

由于有些人专门从事这些领域，导致这些界限有时会变得模糊，而组织由于缺乏理解，往往把它们全都混在一起。

And that sometimes the lines get blurred because there are people who specialize in these disciplines, but organizations, for lack of understanding, tend to dump them all into one bucket.

嗯。

Mhmm.

我们往往忽略了应该如何分别推动数据治理、信息治理、记录管理和知识管理。

And we tend to lose sight of how we should be enabling data governance versus information governance and records management and knowledge management.

它们确实会相互整合，配合得也很好，但它们之间存在明显差异。如果不确定，我强烈建议你去了解、研究、分析，然后形成你自己的看法，明确你认为它们的区别在哪里。

Now, they all do integrate and they partner very well together, but there are distinct differences and I would say, if you are unsure, I strongly suggest that you go out there and take a look and review and understand and then make your own opinion as to what you think the differences are.

但我觉得，对于这种混杂的情况，我们确实背了不少黑锅。

But I do think we get a a bad rap for that that mix of things, if you will.

是的。

Yeah.

但这是个很好的问题。

But it's a great question.

谢谢您提出这一点。

Thanks for for bringing that up.

谢谢您的澄清。

And thanks for clarifying.

所以我有几个后续问题。

So I have a a couple of follow on questions.

我认为，这种混淆是否源于信息治理在数据爆发之前就已经是一个更古老的学科？

I think, do you think perhaps the confusion originated from the fact that information governance is an older discipline before we had this boom of data?

我的理解是，组织自上世纪七十年代甚至更早就需要管理记录了，如果我没记错的话。

I mean, from my understanding, organizations have had to manage records since maybe the seventies, even before that, if I'm not mistaken.

所以，是的。

So and yeah.

您怎么看？

So what do you think?

你觉得这其中确实存在一个因素，还是我在过度推断？

Do you think that has an element there, or am I reaching here?

我觉得确实如此。

I think it does.

我觉得它已经演变了。

I think it's evolved.

我认为记录管理已经存在了相当长的时间，这么说吧。

I think records management has been around for basically eons, if you will.

对吧？

Right?

在我看来，数据治理这个词是最近大约十年的热门话题，仅限于我个人的看法。

Data governance is the buzzword in my mind, in my opinion only, that is the hot topic for the last, let's say, ten years, roughly.

我想我年纪大一点，所以也许是十五年，或者说二十年。

I guess I'm a little older, so maybe maybe 15, we'll say, maybe 20.

但我认为，过去我们并没有像现在这样配备专门的记录管理人员。

But I think it's also, we didn't really have records managers in place like we do now.

我们当时并没有信息治理，这其实是后来发展出来的，但我们确实有数据分析师。

We didn't really have information governance, which is kind of how it evolved, but we did have data analysts.

即使在我九十年代刚工作的时候，我们的每个应用程序都有专门的数据库人员。

We did have a database person for each of our applications even when I started working in the nineties.

我回想起那时，觉得那真是一份很棒的工作。

And I remember looking back and thinking like, what a cool job.

但那时候的范围要有限得多。

But back then it was more finite.

我认为它一直在持续演变，信息量、监管要求的变化——即使是像提示词这样简单的事情，比如现在我们必须将提示词保留X年以符合加州的监管规定，当你在做决策时——我觉得这一切变化太大了，你几乎可以往里扔任何东西，但这种纪律本身，可能与组织内的角色和职责大不相同。

And I think it's just continued to evolve and the volume of information, the amount of changes in regulatory requirements around even something as simple as prompts, like, oh, we have to keep prompts now for x number of years to comply with regs in California if you're decisioning and just it's I think it has changed so much that you can throw anything at it, but I think the discipline itself can be very different than the roles and responsibilities within organizations.

而我认为，正是在这里，我们尚未找到正确的平衡点。

And that's where I think there's this intersection that we just haven't found the right balance.

因为如果我跟你说‘记录、信息治理’，你脑海中可能会想：哦，这意味着他们要处理记录，要对应用程序实施一些治理，就是这样。

Because if I say records information governance to you, you can think in your mind, oh, that means they're gonna be doing records, they're gonna be putting some governance around applications, and that's this.

但在实际操作中，在我的组织里，这可能完全不是我所做的事情。

But in practicality, inside of my organization, that may not be what I do at all.

我可能只处理纸质档案，但组织的名称可能不同。

I may only do physical records, but the name of the organization may be different.

所以这真是个有趣的问题。

So it's kind of a it's an interesting question.

我认为这个问题没有明确的答案，但我可以跟你分享我所看到的情况。

I don't think there's a finite answer to it, but I can just kinda tell you what I've seen.

每个人跟他们打交道时，都会说：‘哦，是的，我负责档案管理。’

Everybody they interact with, they're like, oh yeah, I'm records management.

而我会说：‘真的吗？’

And I'm like, oh, really?

你具体做些什么？

What are you doing?

他们说：‘哦，是的，我管理那边的系统，做企业内容管理，还做知识管理。’

They're like, oh yeah, I I manage the system over here and I do enterprise content management and I do knowledge management.

而我会说：‘哇，真厉害。’

And I'm like, oh, wow.

因为这是你在组织中的角色和职责。

Because that's your role and responsibility in your organization.

始终存在这种需求，组织的需求与我们所说的学科之间需要权衡，而这些模糊的界限确实存在，而且我认为它们将永远存在。

There's always this need, and there's a give and take of what an organization needs versus what we call the discipline, and that those blurred lines are are just they're there, and I think they will always be there.

对。

Right.

正如你所说，因为这是一个不断演变的领域。

And as you said, because it's such a an evolving space.

如果我正确理解了你的观点，我认为这取决于具体情境。

And if I understood your points correctly, I think there's a context dependency.

每个组织都有自己的情境和术语，因此他们可能会使用信息和数据。

Each organization has its own context, their own terminologies, and so perhaps they use information and data.

他们对这两个术语的定义可能与其他组织不同。

They have definitions for those two terms that differ from another organization.

但如果我正确理解了你的区分，我现在理解的是，信息治理是指管理组织内信息的生命周期。

And but if I and, again, if I understood your distinction correctly, the way I now understand it is information governance is managing the life cycle of the information within an organization.

数据治理更具体地涉及建立一个集中的数据权威来源，并管理该数据的质量以获取洞察。

Data governance is more specifically about having a centralized source of truth for data, and then managing the quality of that data to derive insights.

我知道这可能过于简化了，但这样理解是否接近90%、80%或90%的正确性？

I know it might be a gross oversimplification, but does that is that like a ninety, eighty, 90% there?

是的。

Yeah?

我喜欢这个说法。

I like it.

不。

No.

我认为你刚才的总结非常到位。

I think that was very well very well summarized.

谢谢。

Thank you.

谢谢，瑞安。

Thanks, Ryan.

我知道我们的话题有点跳跃，但我想回到你之前提到的一个观点。

So I know we're jumping around a little bit, but I wanna circle back to a point that you touched upon earlier.

在我说这个之前，我不想显得轻率。

Now before I say this, I don't wanna be flippant.

对吧？

Right?

我不想忽视组织不愿删除数据的真正原因。

I don't wanna ignore the very real reasons that organizations are reluctant to delete data.

他之前也提到过，存在证据毁损的风险。

And he talked about this earlier, there's a risk of spoilation.

组织担心可能会删除未来诉讼中需要的数据。

Organizations are worried that they might delete data that they need for litigation.

此外，还有许多保留要求规定，组织必须将数据保留特定年限，否则可能面临处罚。

And there are a multitude of retention requirements that say that organizations have to retain data for a specific number of years, and if they don't, they could be penalized.

现在我刚从你这里了解到，某些司法管辖区要求提示信息也必须保留一定年限。

And now I just learned from you that apparently prompts have to be retained for a certain number of years in certain jurisdictions.

嗯嗯。

Mhmm.

但对于担心法律可辩护性的团队来说，我认为这归根结底就是这个问题。

But for teams worried about legal defensibility, which I think is what this all boils down into.

对吧？

Right?

人们不希望出现证据破坏，因为他们不想在法律上显得无法辩护，或做出过无法辩护的行为，也不想删除最终可能需要的记录，否则可能因各种原因被起诉。

People don't want spoilation because they don't wanna be indefensible or have done something indefensible in the legal context, or they don't wanna get rid of a record that they ultimately need, which could result in them being sued for x, y, and z.

但对于真正担心法律可辩护性的团队来说，持续且最好由软件自动化的数据处置，如何真正降低数据带来的风险，而不是制造风险呢？

But for teams really worried about legal defensibility, how does a continuous and preferably software automated data disposition actually reduce the risk of of that comes from data rather than creating the risk?

好问题。

Great question.

对我而言，这归结为一个词：一致性。

It boils down to one word for me, and that's consistency.

当你考察流程、程序或删除操作中的人为因素时，人为因素会导致不一致。

When you when you look at the human element of a process or a procedure or deletion, the human element makes it inconsistent.

而如果你部署了一项技术来删除数据，即使它删错了，至少它会一致地出错。

Whereas if you put a technology in place that's going to remove it, even if it does it wrong, it's gonna be removing it wrong, we'll say consistently.

而这有助于增强你的法律可辩护性，尤其是在你面对诉讼时，可以明确说：是的，事情确实发生了，但它是一贯如此发生的。

And that then helps your defensibility, especially when you go, you know, for a case and have to say, yes, this is what happened, but it did happen consistently.

如果在删除过程中依赖人为操作，我见过好几次这种情况：有个人看到一份文件，会说，哦，不行。

If we have human element in place when it comes to deletion, and I've seen this a few times where, you know, one person will look at a document and go, oh, no.

我需要保留它。

I need that.

我必须留下它。

I have to keep that.

然后他就保留了下来，而另一个人面对完全相同的文件，却说：不，不需要。

And then they keep it, and then another person who has the exact same documents, like, oh, nope.

不需要它。

Don't need it.

删除。

Delete.

那么，为什么做出这个决定？

Well, why was that decision made?

我们如何做出这个决定？

How do we make that decision?

然后，这个决定能站得住脚吗？

And then is that defensible?

嗯，不能。

Well, no.

这是因为我们要么没有对他们进行充分培训，要么没有让他们了解需求和必要性。

It's because either we didn't train them properly, we didn't educate them on the needs and the necessities.

我们也没有给他们提供工具，让他们在某些情况下理解这一点。

We also didn't give them the tools to understand that in some cases.

所以，制定政策、制定保留时间表，这只是战斗的一半。

So having a policy, having a retention schedule, that's only half the battle.

向员工或保管你信息的人传达为什么删除某些内容很重要，为什么在需要的期限内保留某些内容很重要。

Communicating to employees or those who are holding your information about why it's important to remove things, why it's important to keep things for the duration that you needed.

而现在，像最大保留期限这样的复杂性也来了，以前只是说，这张纸必须保留七年。

And even the complexities now with, like, max retention periods, having to explain where it used to be like, oh, this this piece of paper, have to keep it for seven years.

但现在却说，你只能保留它最多三年。

Well, now it's saying, oh, you have to keep it for no more than three years.

这就让人困惑了，那我是保留一天，还是保留三十六个月后再删除呢？

And it's like, oh, so do I keep it one day or do I keep it thirty six months and then I get rid of it?

这种复杂性到底在哪里？

Like, what's that complexity?

我认为，给人们提供能够管理这些事务的技术，让系统替你做决策——虽然这么说不太准确，但保持这些流程的一致性，真的能帮助你赢得诉讼，或许还能减少因未按规定操作而产生的罚款。

I think giving people technologies to manage that to where it it is, for lack of better word, it is decisioning for you, but those processes, keeping it consistent, is really going to help, you know, win your cases, maybe reduce your fines if you do something that you should be doing.

对我们来说，管理这些事务一直非常具有挑战性，但技术正在帮我们，我们仍然需要人类来协助部署技术、培训人员，并真正理解它。

It's been a very challenging space for us to manage those, but but I think the tech is helping, but we still need humans to help us with the tech to put it in place, to train people, and to really understand it.

但如今它已经发展得如此之多，回想我职业生涯初期，当时我们只有自动分类这一种手段。

But it it's evolved so much where I think about at the beginning of my career, it was just auto classification was all that we had.

但那根本不够好，而现在，随着人工智能的迅猛发展，帮助我们以不同方式处理事务，技术所能带来的稳定性，我认为提升了我们合规项目的可辩护比例，因为我们正在减少人为因素。

Well, that was not very very good, and now with, you know, AI just taking off and helping us do some things differently, the consistency in what tech can do for us has, I would say, increased our percentage of defensible programs because we are removing the human element.

当我说到人为因素时，我想说清楚一点。

And when I say human element, I wanna be clear.

这并不是说我们要把人完全移除。

It's not like we're removing the humans.

他们仍然参与其中。

They're not involved at all.

只是在决定何时保留信息、何时删除信息这一点上。

It's just the decisioning on when to keep information and when not to.

对我来说，关键是我能确信地说：是的，我们做到了。

That's that's key for me is I wanna be able to say, yes, we did it.

我们始终如一地做到了。

We did it consistently.

我们要么保留了这些信息，要么删除了这些信息，因为我们的技术已经到位，并且高效、一致地运行着。

We either held this information or we got rid of this information because our tech was in place and it was operating efficiently and consistently.

我完全同意。

I couldn't agree more.

我认为人类是这里不可或缺的一部分。

I think humans are a necessary part of the puzzle here.

我们需要人类来获得支持，与技术协作，但正如你提到的，技术能带来统一的数据保留时长标准。

We need the humans to, well, get buy in, work with the technologies, but technologies, like you mentioned, will bring in this element of consistency across the board on how long to retain data.

我们已经远远超越了自动分类的阶段。

And we've moved so far ahead from just auto classification.

现在，在Exterro，我们的解决方案不仅能精确判断特定结构化或非结构化数据应保留多久，还能将其与法律保留要求、保留政策关联起来，为组织员工承担所有繁重工作，让他们能专注于建立支持、培养关系、让员工适应删除数据的理念，并通过我们的自动化流程来清除这些数据。

Now At Exterro, our solution can not only precisely identify how long to retain a specific piece of structured or unstructured data, but link it to legal hold, link it to retention requirements, and essentially do all the heavy lifting for employees of an organization so that they can focus on the softer factors of building buy in, building those relationships, getting people comfortable with the idea of deleting data, and then working with our automated workflows to get rid of that data.

你已经分享了如此多的真知灼见，Ryan，我真希望你能将其浓缩为几条可操作的建议，让听众在未来90天内能够付诸实践。

And so now you've already been there's so much great wisdom here, Ryan, and I would love for you to boil it down into just a a few actionable items that people could take, listeners could take in the next ninety days.

如果听众想在未来三个月内实施一项改变，以减少组织内的数据囤积并建立可辩护的删除文化，那应该是什么？

So if listeners to this episode could implement one change in the next three months to reduce data hoarding in their organization and build a culture of defensible deletion, What should it be?

你有什么建议？

What do you recommend?

一件事。

One thing.

我的天啊。

My goodness.

就一个。

Just one.

就一个。

Just one.

我的意思是，这还是要回到建立关系并理解那个关键因素上。

I mean, I I think it goes back to building relationships and understanding what that factor is.

当我思考动机时，比如是什么激励了人们，就要理解这一点。

So when I think about motivation, like what what motivates people, understanding that.

在我职业生涯早期，有人告诉我：去和别人一起吃午饭，然后直接问他们。

Early in my career, was told just go to lunch and just ask people.

和他们聊聊。

Talk to them.

建立这些关系。

Build those relationships.

我认为，任何在听的人最好都弄清楚谁是最大的反对者，邀请他们吃午餐、喝咖啡，或者进行线上交流——无论你需要怎么做，花上十五分钟，问问他们：嘿，我知道你有这个应用，或者我知道你对我们即将移除你的邮箱感到非常困扰。

I think that it would behoove anyone listening to figure out who your biggest naysayers are, take them to a lunch, a coffee, a virtual, you know, whatever you need to do, and spend just fifteen minutes and ask them like, hey, so I know you have this application or I know that you're really struggling with the fact that we're removing your email pretty soon.

能跟我详细说说这对你的影响是什么吗？你愿意参与这个试点项目吗？认真倾听他们恐惧的来源，因为当我推出这些系统或进行这些变更时，经常听到这样的说法：哦，以前有一次数据被删了，所以我一直担心它会被误删。

Walk me through what that looks like for you or would you be a part of this pilot and really listen to where the fear's coming from, because a lot of times when I have rolled these systems out or these changes, it's like, oh, well, you know, one time it was deleted and I just have this fear that it's gonna be accidentally deleted.

我们会说：哦，我们其实有备份方案。

It's like, oh, well, we do have a backup plan.

我们可以进行数据恢复。

We can do recovery.

现在数据都存储在云端了，你可以慢慢了解这具体是怎么运作的。

It is now stored in the cloud onset, you know, walking them through kind of what that looks like.

我认为，最关键的建议就是：陪伴在他们身边，与他们交谈，理解他们对变化的恐惧，尤其是针对这些关键环节，这样你才能在确保他们安心的前提下按下删除键，和他们一起完成这个操作。你可以邀请他们参与试点，问：你有没有哪些数据需要删除？

I think the the one piece of advice that really boils down to that, just sitting with them, talking to people, understanding where any fear of change comes from, especially around any of those components so that you can get to a place where you can hit the delete button, but delete with them being comfortable and doing it with them You know, bring them into a pilot and say, do you have any data that you know should be deleted?

我们一起来过一遍，看看你在整个过程中感觉有多安心。

Let's just walk through it and see how comfortable you are in that process.

还有，比如离职员工的数据，有些组织根本没有处理那些已经离开十年、二十年甚至三十年的员工数据的流程，也许我们可以从这里开始。

And, you know, thinking about things like terminated user data, there are some organizations that don't have processes around a user who's been gone for ten, twenty, thirty years, maybe we start there.