Employees of the municipalities of Utrechtse Heuvelrug, Bunnik, De Bilt and Wijk bij Duurstede unmasked a hacker earlier this year. Not in real life but in Brooklyn Partners’ AVG Escaperoom Challenge. The four municipalities chose this serious game to make employees more aware of the topic of privacy and information security. Serena Kramer, privacy officer at the municipality of Utrechtse Heuvelrug, talks about the resounding success.
Also read the article by the VNG on the experience of the Municipality of Utrechtse Heuvelrug.
The privacy and information security project group emphasizes the pleasant and honest collaboration with Brooklyn Partners. They felt supported and also the input of their own ideas were translated in a positive way into a program which they can put out within the municipality to everyone again.
The four municipalities’ reason for deploying Brooklyn Partners’ AVG Escaperoom was twofold. On the one hand, the municipalities wanted to make it clear to their employees where to go with questions or concerns about privacy. And secondly, they wanted to teach them in a fun way the 10 most important points of the General Data Protection Regulation (AVG).
“We more than achieved both goals with the AVG Escaperoom Challenge,” Kramer says with satisfaction. ‘Colleagues I had never met before now know me and know how to find me with questions about privacy. Potential data breaches are now reported much more frequently. And the mayor and aldermen are also involved, including through their role in the introductory videos made especially for our municipality. But besides that, there has also been a lot of laughter and learning’
Fear
The challenge made the topic of privacy accessible to everyone. Kramer: “I noticed that colleagues needed that. They are not waiting for complicated legal explanations. Then they give up. They want to know in concrete terms: if we do it this way, we will do it well. There was also a lot of fear about privacy. Now that we have established the broad outlines with the Escaperoom – this is how it should be done, if there is something wrong please contact us – a lot of that fear has disappeared.’
Concrete handles
Public servants work with sensitive data, and much of their work involves privacy. Kramer: “Some felt they could no longer do their jobs. But there were also employees who felt they had nothing to do with the AVG. They thought: I’m in the field, it doesn’t affect me anyway. But meanwhile they have an iPad with a lot of personal data on it. Privacy affects everyone in the municipality. Thanks to the Escaperoom we gave the employees concrete tools.
Choices under time pressure
The Cyber Ecaperoom Challenge has created a lot of awareness, according to Kramer. Employees start thinking, knowing what to look out for, who to go to, and feeling when things get tense. And everyone knows: I shouldn’t use that unknown USB stick, but I still want to get on with my work. Once there is pressure behind something, the temptation to deviate from the rules is strong. Then people can do strange things. The Cyber Escaperoom forces employees to make choices under time pressure, just like in real life. After the sessions in the Escaperoom, a variety of discussions among colleagues also ensued. For example, about insecure passwords, some of which are traceable from social media profiles. But also AVG content: how do you safely share sensitive information with other agencies? Or very practically, how do you invite externs to an appointment without sharing personal data?
Competition
According to Kramer, the communication surrounding the project has also stirred a lot. ‘We had made our own trailer, which we ran in the cafeteria and on the intranet. That is partly the strength of this method. Making it something personal to our municipality makes it come alive even more. On the intranet we put pictures of the teams with their escaperoom scores. Other colleagues respond to that in turn. That way you got an internal competition that increased participation even more. Everyone just wanted to participate.
Best practice
Kramer looks back on the whole process with raving enthusiasm. ‘There is a lot of appreciation here for this creative way of activating the organization; such a combination of learning and a sensational activity for employees. On our internal social media, thirty percent of the organization has liked the coverage of it. Utrechtse Heuvelrug shows here in a best practice how you can activate employees for a difficult subject like privacy. I am enormously proud of that.
Escaperoom by Brooklyn Partners
Many municipalities are taking a first big step with the Escaperoom in bringing attention to privacy and, directly related to it, information security. Often organizations have already done a promotional campaign around privacy and employees have already taken an e-learning. Yet employees are often unfamiliar with the relatively new position of privacy officer and data protection officer. And they don’t know how to address issues of privacy. By actively experimenting with the material in teams, employees learn much more than through traditional channels such as e-learning and posters. Brooklyn Partners’ concepts, in which employees engage themselves in a serious game, are based on Kolb’s Experiential Learning Cycle.
