Problem:
Consider the fictional case of Medical Advisors Management Services (MAMS), a small business that provides the mid-office services for three thousands medical groups (physicians' offices) in the US, Caribbean, Cayman Islands and Canada. They manage patient scheduling and provide on-line payment of bills by both insurance companies and individuals and provide tools that allow medical office managers to order common office and medical supplies through MAMS' discount while having those items delivered directly to their office. MAMS has built a wonderful database of regional buying behaviors as well as a strong dataset on the demographics of patients and their declared reason for "seeing the doctor". MAMS feels that they have an opportunity to publish this data (suitably sanitized, of course). And, of course, this report and data will not be free.
You have been tapped as the right-hand person to the CIO for this project. Your role is to pull together the team that will implement this project. Your first personal challenge will be to decide whether this project needs any oversight governance and, if so, what that will be and how to get the CIO's buy-in for it. In order to decide this, you may want to consider the ethics of selling aggregated patient information and aggregated business buying decisions.