Concerns about information security and privacy continue to make headlines in the media and rate as serious issues in business and public surveys. Conventional thinking suggests that enhancements to governance models and business practices improve the performance of individual businesses. However, is this enough? Good governance is based on clear rights and responsibilities, and this panel will address the contention that such clarity is lacking in the treatment of personal information. As a result, certain types of business innovation may be constrained and good practices may remain tick box exercises, disconnected from wider business objectives. More radical thinking would go beyond incremental improvements to the status quo and recognize the profound challenges to privacy and information security created by digital technology. This panel will bring together a range of research disciplines and senior business representatives to critique current practice and develop a future research agenda.