Comment on Daily Discussion Thread đ đâąď¸ Sunday, 24 November 2024
Baku@aussie.zone â¨1⊠â¨month⊠agoI realise this is a controversial opinion, but tbh I reckon some of the blame for these kind of things needs to rest on the company, too. The principle of least privilege should always be used where possible. If you donât need to access information, you really shouldnât even have the option, at least not without either the client/customerâs approval, or a managers authorisation
Humans are curious things, itâs bounds to happen. Firing people after it does is a reactionary response, not a preventative one. And prevention is better than cure, especially when it comes to personal information
(My perspective comes mostly from being in care, because pretty much every single piece of information about me, including things often said in confidence, lives in a little grey box with no transparency about what goes on or who has access. And there have been data breaches in the past, where people from certain organisations managed to gain access to the files for clients within completely separate organisations, with multiple instances of support workers using that access to do terrible things. I wasnât involved in that, and have never even worked with that organisation, but itâs still something that used to play on my mind a lot and made me quite upset and worried. I realise that my views are probably a little OTT for certain industries that handle less confidential information, but that are still covered under the privacy Act. I still believe all systems handling PII should always use the principle of least privilege and fail safe, though)
StudChud@aussie.zone â¨1⊠â¨month⊠ago
Nice idea in theory, but imagine you had a bank or energy account and had to call customer service. If the agent has to get approval to access every account, that would be so, so time consuming, the company wouldnât have clients/customers. There isnât enough managers on the floor or available for that to be feasible. So they drill into us phone monkeys that we are not to access that kind of data (celebrities, people we know). The authorisation to access comes from the customer calling in, and asking for an action or info on their account. This is also why, in the back end, everything is logged: the date and time, which agent, whether a note was left, what the interaction was for, etc. We are told, over and over, not to do it, with Privacy Act citations.
Besides, there are preventions in place. Example: I was trained, at one point, to deal with only residential customers. I could not access Small-to-Medium business accounts, nor Large Business accounts. When I was promoted, thatâs when further training was provided and my access upgraded. Again, everything is logged, and every phone monkey KNOWS itâs illegal to access that info without a customer asking, or without a manager asking. I had to access Large Business accounts without a customer telling me to, because I was doing remittance. Iâm talking over $1m in one payment from one company.
The phone monkeys know itâs wrong without authorisation. I promise you they KNOW. Itâs on them at that point and they should expect at least a firing, if not legal action.
Baku@aussie.zone â¨1⊠â¨month⊠ago
Some other call centres request authorisation through the caller in the form of an OTP, which doesnât seem like a bad system. Or some banks still require phone banking passwords (although I believe theyâre mostly about protecting the bank from the liability of somebody impersonating a customer, I donât think that is required to access files. It should be though)
StudChud@aussie.zone â¨1⊠â¨month⊠ago
When you work in a call centre, let me know, and maybe we can then discuss this.
Baku@aussie.zone â¨1⊠â¨month⊠ago
Bit rude. Iâm allowed to have opinions on how I believe companies should handle my personal information. If you donât think companies should have any semblance of accountability for how they process and treat personal information because it would slightly inconvenience you, thatâs fine, but you donât get to stop me from sharing my opinions.