Chapter 8
Five years after the warehouse, I became data governance manager.
Elise left for a bank.
This time, I was ready.
External search.
Interview panel.
I got the role.
My first decision was bad.
I required director approval for every vendor export containing employee data.
Every export.
Even work email addresses for an event platform.
The queue exploded.
Managers found workarounds.
That was worse.
So we created tiers.
Low-risk work contact data.
Moderate HR operational data.
High-risk identity, banking, medical, dependent, government ID.
Controls scaled.
Then people stopped bypassing.
Good systems need friction where risk is high and ease where risk is low.
Then one family office executive asked for a spreadsheet of all household staff names, home ZIP codes, tenure, and pay bands for “workforce planning.”
Maybe legitimate.
Why home ZIP?
Commute analysis.
Could use aggregated geography.
No need individual.
We provided aggregated commute zones.
Same insight.
Less exposure.
Then a security project asked for emergency dependent names.
Why?
Evacuation family support.
HR already held.
Security needed contact mechanism, not child names.
No.
Then one proposal did need more data.
A benefits audit required dependent eligibility documents.
High risk.
Limited vendor.
Encrypted transfer.
Deletion certification after audit.
Purpose clear.
Not zero sharing.
Controlled sharing.
Then the annual stale-data audit became routine.
Former employee IDs.
Old passports.
Expired emergency contacts.
Inactive vendor copies.
Each deletion logged.
No one applauded.
Good.
Then one audit found something uncomfortable.
Calder Household Services still had my old forged resignation in a legacy payroll backup.
Should it be deleted?
Legal hold had ended.
But the file was part of historical fraud evidence.
Master copy belonged in legal archive.
Payroll did not need duplicate.
Delete payroll copy.
Keep archive.
Placement.
Not erasure.
Then my physical injury records reached retention review too.
HR kept required occupational records.
Operations duplicates removed.
No general access.
Then one training team asked to use photographs of my cuts in a presentation.
No.
They did not need them.
A scenario could teach.
My body was not an institutional teaching asset.
Then another employee volunteered her own injury photo for safety training.
Her choice.
Consent can be yes.
That distinction mattered.
Then Roman became subject to the same data rules.
He asked operations where to send a staff-family holiday package for Caleb.
No.
Household did not share dependent addresses for gifts.
Employees could opt in to centralized distribution.
Roman looked surprised.
Then:
“Good.”
The rules applied upward.
Then Maya wanted staff birthdays for a surprise appreciation event.
HR provided month/day only for employees who opted in.
No birth years.
No dependent info.
Enough.
Then one executive complained privacy rules made kindness bureaucratic.
Sometimes.
But surprise kindness does not automatically outrank data minimization.
Then Caleb, now fifteen, got a summer job at a bookstore.
His employer asked for bank details through a secure payroll portal.
He called me.
“Is this fake?”
I checked the domain.
Legitimate.
Then he said:
“You made me paranoid.”
“Careful.”
“Same thing.”
Not exactly.
Then I taught him:
Verify source.
Use official portal.
Do not send ID by random email.
Not never share.
Share through right channel.
Full circle.
Then a real breach happened.
Not fraud.
A vendor accidentally emailed a spreadsheet containing twelve employee work phone numbers and shift times to the wrong client.
No bank data.
No home addresses.
Still privacy incident.
Vendor notified within an hour.
Recipient confirmed deletion.
Affected staff informed.
Risk low.
No press release.
No pretending nothing happened.
Then one employee asked:
“Why tell us if it’s low risk?”
Because the data was theirs and transparency supported trust.
Then another employee said the notice scared her more than the incident.
Fair.
We improved wording.
Plain risk level.
What happened.
What data.
What we did.
What employee needed to do.
No legal panic language.
Then metrics.
We did not reward “zero incidents.”
That could encourage silence.
We measured time to detect.
Time to contain.
Repeat causes.
Overdue deletion.
Access review completion.
Then one quarter incidents increased.
Board worried.
We explained reporting had improved after training.
More reports can mean healthier visibility.
Numbers need interpretation.
Then I visited Harborline’s warehouse eventually.
Not as exposure therapy.
As vendor manager.
Five years later.
The building had bright LEDs.
New racks.
Painted safety lines.
The steel door remained.
I recognized the spot where I had crawled.
My body went cold.
I told Elise? She was gone. My deputy Daniel? Use Nora's colleague Priya? Let's use deputy Marcus Lee.
Marcus asked:
“Want to leave?”
“Yes.”
We left.
I completed the review from documents and another manager’s site notes.
No failure.
I had gone because work required judgment.
I left because my body said enough.
Both professional.
The contract still passed.
My personal reaction did not become vendor punishment.
That was growth.
As manager, I also had to learn how to handle employees who wanted less privacy.
One analyst liked sharing her birthday, family photos, and home neighborhood with coworkers.
Fine.
Privacy is not mandatory secrecy.
The system should let people choose within safe boundaries.
So optional profile fields existed.
Opt in.
Change anytime.
No manager use for evaluations.
Then another employee said she wanted no staff directory photo.
Allowed where operationally feasible.
Security badge photo still required.
Different purpose.
Different visibility.
That distinction helped people trust the required collection more.
Then the estate introduced a personal-data request process.
Employees could ask:
What major categories do you hold?
Which vendors receive sensitive data?
How do I correct errors?
Not a perfect legal-data portal.
Practical transparency.
Then one employee found her emergency contact was an ex-partner.
Updated.
One found an old address.
Corrected.
One discovered a vendor still had a passport scan under active travel profile.
Trip canceled years ago.
Deleted.
Those ordinary corrections were exactly why access mattered.
Then I checked my own profile.
Caleb’s emergency contact status changed now that he was older? He was still minor then. Correct.
Mrs. Alvarez remained backup.
Current.
No mystery.
That felt good.
The personal-data request process later exposed one more challenge: some records belonged to more than one person.
A complaint email might contain information about the reporter, the accused person, and witnesses.
You cannot simply hand the whole file to everyone named in it.
So HR and privacy created access rules that balanced correction rights with confidentiality and due process.
Then one employee asked to see “everything anyone ever wrote about me.”
No.
Formal records where policy or law provided access.
Relevant findings.
Not every private witness statement.
Transparency is not total exposure.
Then another employee found an incorrect disciplinary code in his file.
It had been entered as “insubordination” when the actual issue was attendance.
Corrected.
That mattered because labels influence future managers.
We replaced vague personality labels with observed facts where possible.
Not:
Difficult.
Instead:
Missed three scheduled start times in March; coaching issued.
Specific records are fairer records.
Then one manager complained specific notes take longer to write.
Yes.
Accuracy costs minutes.
Bias costs more.
Then I reviewed old notes from my own housekeeping years.
One supervisor had written:
Nora is overly cautious around vendors.
I laughed.
After the warehouse, fair enough.
Still, the note had no business sitting in a current performance file years later.
Retention expired.
Deleted.
People should be allowed to outgrow descriptions too.
The data-request process also stopped managers from keeping unofficial “shadow files.”
One supervisor had a notebook with staff lateness, attitude comments, family issues, and personal impressions.
She thought it helped her remember.
Some notes were legitimate performance facts.
Others were gossip.
We transferred required records into the proper system and destroyed the notebook under HR guidance.
Then managers received a simpler rule:
If a fact matters enough to affect work, record it in the approved place with objective detail.
If it does not, do not build a private dossier.
That rule would have prevented part of my own fraud too.
My personnel image had lived in too many unofficial copies because people treated duplication as convenience.
Then one manager worried approved systems felt slow.
We improved the system.
Not the shadow file.
Good governance should fix friction rather than reward bypassing it.
The shadow-file cleanup later uncovered a manager’s habit of saving screenshots of employee chats “in case HR ever asks.”
Some screenshots documented legitimate attendance issues.
Others captured personal conversations that had nothing to do with work.
We created a cleaner rule:
If the communication is needed for a formal record, move the relevant fact into the approved system and retain the source only as policy requires.
Do not build private archives because storage is easy.
Digital clutter can become surveillance without anyone deciding to create surveillance.
Then managers received better tools for documenting facts.
Less reason to hoard screenshots.
That same principle shaped incident communications.
When something went wrong, staff needed facts quickly.
But they did not need rumors.
So notices used a simple format:
What happened.
What information may be involved.
What action is being taken.
What the employee needs to do.
Who to contact.
No speculation about blame before investigation.
That format later helped during a payroll phishing incident.
May you like
People knew what mattered within an hour.
No hallway panic.
