I was at a conference this week, and something that was said about behaviour modification really struck a chord. The speaker said that you can put in place all the systems you want to make people do things, in terms of education, reminders, emails, warnings, but even if they intend to comply with them, they likelihood is that some will, some won't, some will some of the time, so the average compliance won't be fantastic.
However, if you focus on systems that force compliance, such as (for e.g. in this case) having settings that hide personal data unless you enter two user's passwords, or having an obvious audit trail that is visible on the front screen, or having copy and paste either disabled, or automatically reported to an admin account, then compliance increases massively.
Examples I know of:
In Education, if files are accessed, an audit trail gets logged and an email account gets pinged to alert that personal files/details have been accessed, and the data controller (HT) has to click to say they've reviewed the access and it was legitimate.
In healthcare, every. single. time. I access a blood test record (I'm an audit nurse), I can see a hyperlink that says "audit trail". Before I was an audit nurse, and was clinical, I had never noticed it. Now I stare at the screen all the time, I got curious and clicked it. It logs every time that record is accessed, to the hour, minute, day and second, and by who. If I access my own/family/friend/colleague blood test results, I can be sacked. Same goes for anyone I know. Gross misconduct. I have to have a valid reason for logging in to a record. It's all recorded and there to see.
That should not be hard to achieve in MN and I think it is more important because, rightly or wrongly, there is a perceived anonymity here because of the freedom to namechange, which is better understood by those of us who have been here years to be no guarantee of cover.