Utah’s government privacy officer wants to train and certify 50 specialists

Christopher Bramwell, who last July became Utah’s inaugural government operations privacy officer, is on a mission to find and develop data security and privacy specialists across state government and even in some local agencies. His goal, he told StateScoop on Wednesday, is to find at least 50 professionals and train them up so agencies can have skilled privacy officials — a role he said has been lacking.

Bramwell said that out of 36 statewide agencies, boards and other entities he’s reviewed so far, he’s aware of just a single certified privacy professional. There are more certified cybersecurity workers, though he said that group may number just half a dozen.

But Bramwell said that with funding from the American Rescue Plan, Utah now has the resources to identify potential privacy and security professionals inside agencies, develop trainings and get people certified.

“We’ve actually been spending the last few months getting contracts in place to do statewide on-site education that would cover training for every agency to have certified professionals on staff for both privacy and security certifications,” he said. “That’s in line with what we’ve been doing at the state level, finding specific security positions and career tracks.”

In addition to state agencies, Bramwell said he’s also eying Utah’s larger cities and counties.

“I think we’ll probably wind up with 50-plus people certified on the privacy and security sides,” he said.

Bramwell had worked as the privacy director for the Utah Department of Human Services before he was named to his new position, which was created as part of a law that passed in the wake of a controversial and since-canceled contract for surveillance technology. While state chief privacy officers often focus on consumer-facing issues — Gov. Spencer Cox last week signed a privacy law that gives residents the right to opt out of some forms of commercial data collection — Bramwell is tasked with improving how state and local entities handle the revealing information they collect from Utahns.

He said Thursday that in his nine months on the job so far, he’s been meeting with agencies and setting up contracts for training and certification courses. He also said that the individual workers who will be trained could vary widely in their professional backgrounds.

“The discussion we’ve had is more about the aptitude and if we give them the knowledge, the ability to implement,” Bramwell said. “Every agency is going to be different with their complexity and the depth and breadth of their programs.”

He also said that in many agencies — as well as local governments — responsibilities pertaining to ensuring Utahns’ personal data remains private and secured often fall under “other duties as assigned.”

“For some people, it’s giving them more formal training for something they’ve been doing,” he said.

Training up local government staff may be a trickier task than at the state level, though. While Bramwell is focused on the bigger localities, he said he wasn’t aware of a single certified privacy professional working for any of them, despite the fact that local health agencies, for instance, collect data that’s covered by federal laws like the Health Insurance Portability and Accountability Act.

“You saw that a lot with COVID,” he said. “They play a huge rule in providing services.”

But, Bramwell said, there’s an eagerness to engage: “We’ve met with some of the larger cities and counties and they’re very excited about it. At a minimum we’d like the larger cities and counties have someone who’s certified.”