CDO, CPO, IAPP, Information Management and Governance, Information protection, Privacy

Looking Ahead: The New Operating Model for Business

COVID-19 has had a horribly disruptive effect on almost all people and aspects of society.  This paper starts a dialog around an admittedly tiny aspect of that and a view to the future.  It in no way should be seen to marginalize or trivialize the pain and suffering endured by the millions of people directly impacted by the pandemic.

On May 1st, CNBC published this article that discusses how some businesses are re-evaluating their need for physical office space in light of their experience with a majority of their workforce working remotely.

The rapid shift to work-from-home has served as a catalyst for change.  Many years ago, when video conferencing first became available, companies started to invest in equipment that was office-bound, hoping to reduce business travel. That never happened because the technology was temperamental, brands didn’t interoperate very well, there were never enough facilities, and the equipment required expensive point-to-point T1 lines.

Since then, there were advances in the technology along many orientations, including high speed internet to homes, corporate adoption of laptops, smartphones, and importantly, audio conferencing.  This enabled a shift toward work-from-home, and corporate shared office space – “hoteling” (universally adopted by consulting firms and hated by employees), smaller offices/cubicles sold euphemistically as “open concept” workspaces.  But many were still reluctant to use video (Dilbert summed it up well with a series of comics depicting people “working from home” taking video calls wearing their bathrobes).  Workers were far more comfortable with audio conferencing than video, but it still did a lot to get companies and workers more used to remote working.

The needle moved further toward remote workforce with the dramatic increase in off-shoring, leverage of contractors which in itself lessened the feeling of permanence of employment, and perhaps contributed to workers feeling more comfortable as individual contributors working from anywhere.  Paradoxically, there was a simultaneous shift toward urban living, as the number of young people wanting to drive or commute went down, which one might have thought would shift them back to offices.

Powerful Disruptor

All these shifts were gradual, and the net result was tidal shifts in the work model.  Leave it to nature to provide a dramatic disruption, which has resulted in remote working suddenly accounting for 95+% of non-essential workers.  The points raised in the CNBC article are not at all surprising, given how the experts are bracing for periodic reemergence of Corona, but are also supported by:

  • The high cost of commercial real estate and the need to manage costs
  • The remarkable advances in technology enabling remote working
  • The quality of life impact of time-wasting commutes

A shift to predominantly remote working has immediate benefits, including the opportunity to hire the most qualified workers without regard to their physical location, which helps address challenges businesses have faced hiring the right talent.  It also has consequences, such as the inevitable glut of empty office space.  The sudden reduction in the concentration of office workers has a significant impact to businesses relying on them – restaurants, shops, laundry, shoe-shine, even metropolitan transportation – as large portions of their customers stop coming.

Opportunities

In the past, there have been dramatic disruption to business leading to the shrinkage or elimination of entire industries.  Yet over time, business comes charging back.  Before Corona, unemployment was at record lows, and companies were clamoring for skilled workers.  This is after gloomy predictions of unemployment after waves of off-shoring everything from manufacturing to call centers to highly skilled workers.

What has to happen for remote working to become as effective as working from a managed location?

Physical space: Many people don’t have home offices and take over the dining room table instead.  This isn’t sustainable, since asking people to shift from a company managed location to home involves a level of disruption and the only financial beneficiary is the employer.   Wouldn’t it make more sense for the employer to provide each employee a remodeling budget (funded by savings resulting from reduced commercial real estate costs)?  Small contractors could build-out home offices based on guidelines or specifications defined by the employer.

Technology infrastructure: When someone works in an office, the employer provides a laptop and a portfolio of business applications, but also the infrastructure to provide access to those applications – physical connectivity, wi-fi, deskside support.  They establish standards that they are able to support in a cost-effective fashion.  This needs to be replicated in some fashion at home, at least for a portion of the workforce.  It’s not realistic to expect the worker to solve all their home technology issues and not impact their efficiency.  Solution?  A ramp-up of home technology service-providers (e.g., Geek Squad) who set up and support home offices.

Improved wireless: There is a race underway to roll out 5G infrastructure and public wi-fi 6 that promise high-speed performance that rivals (or beats) home-based/cable internet access.  This may be a boon for remote workers and their employers because it simplifies the support model by eliminating the so-called “last mile” connectivity to the individual house in favor of a more controlled infrastructure using transmitters on towers in public spaces.

Comforts and conveniences: As people get used to working remotely, their appetite for convenience goods and services will likely return.  This means the retail services that had been located near office buildings will cater to home-based workers.  To be sure, it won’t look the same, given that the density of customers is different.  There will be more home delivery or curbside service.  Will it be the same in terms of volume?  Probably in an overall sense, but the concentration will differ.  But it seems reasonable that the businesses that can cater to distributed remote workers will benefit.

Challenges – Privacy and Data Protection – a tiny slice

There is no doubt that as with any fundamental disrupter, there will be challenges to be met before we move to equilibrium – the so called “new normal”.  Among many others, information protection and privacy faces challenges.  Some years ago, a colleague authored a prescient paper entitled “Privacy in a Pandemic” that explored the reasonable tradeoffs to be made when balancing individual rights against the needs of society, famously captured by Spock as he sacrificed himself believing “the needs of the many outweigh the needs of the few… or the one”.  But the new equilibrium has implications for privacy and data protection in a more corporate setting.  While privacy regulation accommodate these priorities, privacy and data protection programs will have to re-calibrate their risk assessments and place new weight on risks made more prominent by the shift away from office-based workers, to one where the line between personal life and professional activity is blurred to the point where you can hardly tell the difference.  Clear desk policies went from being a constant real and philosophical debate to now being completely unenforceable, and therefore mostly moot.  Implementing sound technical controls that don’t disproportionately interfere with the ability to work will take time, and likely require new technology deployments.

Understanding purpose: A key enabler to pivoting data privacy will be a mature data governance program.  Making assumptions around higher level enterprise controls is no longer safe.  Instead, knowing the nature and location of data is far more important in order to protect while enabling use.  Providing more discrete permissions around the use of data will help lessen the risk of loss and unauthorized disclosure.  Understanding the purpose behind proposed use of data will enable assigning more discrete permissions.  Since preserving privacy is a lot more than just ensuring protection, the philosophy of understanding purpose also helps ensure appropriate use of data.

Fundamentals: Implementing new controls will take time and carries the risk of creating more frustration and confusion that benefit until the edges are smoothed out.  Privacy leaders should step back and consider the full breadth of their programs, leveraging all techniques to manage risk while avoiding unnecessary disruption.   An effective awareness program, for example, can go a long way to encouraging people to make safe decisions when handling data.

Summary

COVID-19 has created havoc in unprecedented ways, and has affected the lives of billions of people.  The human toll cannot be measured, and the suffering by so many should not be swept aside.  Experts are working through the optimal medical strategies while economists are still trying to model the short, medium and long term impacts to business.  Entire books will be written and college classes will be structured around the Coronavirus pandemic.  This paper has taken a very narrow slice of that and will hopefully start an open-minded dialog around how to help enable the future operating model for business.  The dialog can and will continue in months and years to come.

CCPA, CPO, GDPR, IAPP, Information Management and Governance, Information protection, Privacy, Risk management

Why do we have such a hard time understanding, assessing and managing risk?

Introduction

Risk is a real concept that manifests across life.   Within a business context, risk management is a valuable tool to help improve the probability of success.  This paper explores the role of a risk manager, and is applicable across the board – whether business processes, technology, security, privacy, information or enterprise.  The reader can easily extrapolate the ideas to any aspect of life.

Definition and Reporting

Definition of risk: The probability or threat of quantifiable damage, injury, liability, loss, or any other negative occurrence that is caused by external or internal vulnerabilities, and that may be avoided through preemptive action.

The key word is “probability” – the likelihood that the event will occur.  In some instances, that can be calculated empirically, if all inputs and effects are known, where triggers can be identified – even if random (roll of the dice).  Other times, probability can be estimated based on historical data around similar conditions (50% chance of rain).

Other times, especially in business settings, there are more variables than can be practically tracked and quantified.  In those settings, Risk Managers use judgment to assess the risk of an event occurring.  The risks are usually classified in a 3 or 5 point scale – say, red, yellow, green or severe, major, moderate, minor and insignificant.   And the more knowledgeable the Risk Manager, the more insightful their assessment of risk, but it still remains a probability.

Challenges

Communicating risk gets complicated when we start factoring in risk mitigating strategies – avoid, reduce, transfer, accept—and reduction techniques – controls, TOD/TOE, residual risk, control risk, etc.

Even within the mitigating strategies there are grey areas – avoiding has consequences (lost opportunities), acceptance doesn’t mean the adverse event will occur, reduction doesn’t mean eliminate.

While some leaders claim they are comfortable navigating uncertainty, there is no question that business hates risk: markets react to uncertainty, and “punish” companies that operate with too many unknowns, and reward those that demonstrate clarity.

People publish dashboards and discuss numbers of controls, as though they were currency – more controls must be better – even though one good (strong) control could replace many poor (weak) controls.  Even auditors are reluctant to rely on process controls and would rather verify every transaction instead (assuming they could).

So what’s the issue?

To some extent, we, as Risk Managers, are the issue.  When asked about risk, we articulate it in our own language:

Risk Manager to Client (or internal business stakeholder): “there is a risk that such-and-such could happen that has these consequences”

Client: “how likely?”

RM: “moderate”

Client: (thinks: “huh?”) “what can we do about it”

RM: “implement x-y-z control”

Client: “will that make it go away”

RM: “implementing this control will reduce the risk, but it leaves a residual risk”

Client: (thinks: “huh?”) “Is that a ‘yes’?  Why wouldn’t you just do it?  And what’s that mean?”

RM: “here – sign this ‘residual risk acceptance document’”

Client: “ok – done”.  (thinks: “thank god that’s over!”) Back to business as usual.

Let’s face, this exchange isn’t very helpful.  The Client clearly doesn’t understand the risk as a potential impact to his/her business, and the “residual risk acceptance document” is a rubber-stamp.

Who owns the risk?  Risk Managers say that their business process stakeholders own the risk, and the Risk Manager’s role is to explain the risk, options for control, and residual risk.  However, it’s fair to say that the business process stakeholders often doesn’t truly accept their role, or if they did, they would engage in a more meaningful dialog.  And the residual risk acceptance document effectively nullifies the dialog.

If the controls are effective, or for whatever reason, the risk fails to manifest, then what?  How often does the client step back and acknowledge that RM did their job and issues were avoided?  Or does the client question why the risk management exercise was undertaken?  On the other hand, if an adverse event takes place, despite controls, does the client look at RM as though they failed?  The cynical reader would point out that if the on-going processes of managing risk management were part of core operations, then you wouldn’t see a spike in RM funding after an event takes place; you might see some refinement or realignment, but not a huge uptick in funding…

An alternative approach

So the challenge is how to meaningfully communicate risk to leadership in a way that puts risk in a business context.

First, one must keep clear: generally speaking, risk can’t be eliminated if the business wants to undertake the activity that introduces the risk.  That said, the Risk Manager can keep the following in mind as these points might promote meaningful communication:

  1. Articulate the risk in familiar business terms (“speak English!”). Explain what would have to happen to trigger the risk.  If you describe a chicken-little event without explaining the triggers, you might get dismissed.
  2. Be realistic when describing the risk and the likelihood. The likelihood should include realistic related events.
  3. Propose options for mitigating the risk, including avoid-reduce-transfer-accept. Bring a reasonable amount of research to present viable options, and be able to articulate the residual risk.
  4. Understand appetite for risk at an appropriate level. A mid-level manager may have a different appetite for risk than the CEO.
  5. Consider what kinds of risks needs to be escalated and to what level: Don’t present a risk to a CEO in a “Enterprise Risk Management” setting that should be addressed by a mid-level manager.
  6. Be realistic in evaluating the consequences of the risk. Walk the stakeholder through understanding the various consequential outcomes to help determine an appropriate mitigating strategy.
  7. Make clear who owns the risk. Get rid of “risk acceptance” documents – if a risk is significant enough to warrant action, it should be pursued.  Risk Acceptance documents are an attempt to shift/assign responsibility, and if they are needed, then they will also be ignored in the post-mortem.
  8. Acknowledge that business environments are dynamic, and events rarely unfold negative risks occur. People intervene.  Processes engage.  The outcome is rarely what was predicted when the risk was recorded.  And the more catastrophic the risk, the more it morphs as it unfolds.

Many of these considerations apply in the post-mortem stage.  One of the big challenges in the risk management community is one of appropriate hindsight.  When evaluating changes to make in risk management in light of an event, it’s important to remember what was known and considered at the time risks were assessed.

The overarching themes in this article is that risk managers need to be realistic when articulating risks, consequences and controls.  Risk managers must recognize they need to bridge the communications gap to their stakeholders by describing risks in business terms that will resonate.

Risk is a fact of life in every aspect of business.  Bad stuff happens, and risk management is not risk “elimination”.  Risk managers play a critical role, and by thoughtfully supporting their stakeholders, they can help business accelerate forward.

 

 

CCPA, CPO, GDPR, IAPP, Information Management and Governance, Privacy

How effective are privacy programs?

Background:

In September 2019, A group of 100 data leaders from respectable NY financial institutions were asked whether they’d heard of the General Data Protection Regulation (GDPR – the far-reaching European law governing how EU citizen’s personal information is handled around the world); 5 hands went up.  When asked a follow-up question: how many had heard of the California Consumer Privacy Act (CCPA), 2 hands went down.

On December 26, 2019, CNN published a story explaining why consumers are all of a sudden receiving so many privacy notices, which goes on to summarize CCPA, including the activity that triggered it.  The article explained – at a high level – the events that led legislators to pass the law. 

Over the summer, a small group of CFOs were interviewed and felt that GDPR is a mess, readiness was a waste of money, and that compliance is being addressed by “someone else”. 

Problem statement: 

Companies want to increase the degree to which they store and process personal information, but in an effort to protect the rights of individuals, law-makers are seeking to reduce the number and severity of incidents by imposing regulations.

Companies are making big investments in initiatives to take advantage of the transformative potential of data.  This covers an incredible array of opportunities, from simply using data and analytics to enrich their products and services, all the way to inventing algorithms to mimic human thinking to improve the lives of millions.  

The initiatives all have one thing in common: they depend of high quality data.  Vast amounts of it.  Increasingly pertaining to people.  Companies are building systems that pull together and combine data from a myriad of sources – internal and external. 

Breaches are happening – bigger and more impactful.  In 2019, records containing personal data were being stolen at a rate of over 15,000,000 per day.  The consequences to organizations are significant – financial and reputational.  Regulators are stepping up their actions, conducting investigations, and imposing fines.  Companies are having to pivot to correct issues and address new requirements reactively because many have failed to implement a data management framework efficiently adapt to regulatory changes.

Many companies don’t have a prominent leader assigned responsible for privacy – a Chief Privacy Officer (CPO) or equivalent.  Privacy is managed by legal or compliance groups as an adjunct to operations.  As a result, the people doing the day to day business of the company are not aware of their privacy responsibilities.  So is there any wonder why companies are mishandling personal data?

It’s time to act

More to the point, it has been “time to act”, but the regulatory requirements around data privacy are not going to get simpler, and companies should consider implementing an operational framework, with appropriate tools, enabling them to adopt new requirements in a time and cost effective manner.

An effective program to enable business to use data while also managing risk and ensuring compliance must reflect 3 interlocking components: Privacy, Data Governance and Risk Management.  Together, they can protect an organization while serving as a catalyst to accelerate forward.

Privacy

Most companies have a Privacy compliance program.  However, the informal poll referenced above revealed that privacy compliance is not embedded in the data programs.  This gap is very significant, since provisions of the laws speak very specifically to plans data scientists are pursuing,  The result is certain initiatives will have to slow down or get re-tooled.

And it’s not just data science teams who are dangerously disconnected.  Data science is probably a key area where data is being handled outside the boundaries set by the regulations (kept and processed for purposes beyond why it was collected, for example), but the breaches are mostly tied to weak controls on the operational side of companies – ranging from how and where it is tracked and stored, to how it is processed or disclosed for business purposes.

“Privacy by design” has eluded organizations since it was first envisioned in 1995, in part because it is frequently promoted by an under-resourced parallel organization, trying to apply one-size-fits-all techniques.  It doesn’t have to be like this.  Privacy programs can be structured to bridge to data users in an foundational sense, where privacy obligations are taken into account through-out project or operations lifecycles.  Risk goes down.  

Addressing the challenge begins by assessing the current state of the privacy program against a privacy template or framework, such as the latest draft NIST Privacy Framework, and creating a gap analysis.  The framework is useful because it breaks down the objectives of a privacy program in a way that aligns in with both regulations and the way organizations use data.  To be fair, the full Framework can be overwhelming for many companies – especially those not familiar with the NIST Security Framework, on which the Privacy Framework is based.  But this can be addressed by first distilling the NIST framework down to a more manageable version that still preserves the key elements. 

The gap analysis forms the basis for discussing how to enhance existing privacy efforts to achieve compliance, in a deliberate, sustainable, pragmatic way.  If done right, it can be scaled – whether down to a small privacy team of, say 2-3, or up to a full enterprise-level team.  This also allows a more focused approach to address specific pain points, including:

  • Compliance with GDPR or CCPA, which might range from early stage assistance, to specific process solutions (e.g., data subject access requests, data inventory upkeep, privacy-by-design, training and awareness, etc.)
  • Consideration for placement of the program, to integrate into company culture; companies are struggling with where to assign privacy, if not in Legal, and it’s landing with the CISO, who often needs help getting ramped up
  • Operationalizing Privacy, making the program resilient and sustainable, incorporating activities such as: 
    • Strategic oversight and stewardship, including obtaining executive and Board support
    • Monitoring for legislative changes, 
    • Updating and implementing policy,
    • Risk assessment, 
    • Process and control documentation and testing, 
    • Integration with business and IT change management, 
    • Incident management, escalation and resolution, 
    • Vendor management, and 
    • Contract review.

Data Management

Data programs are high priority for CEOs – over 95% believe that leveraging data is key to continued success and to defend against external disruption.  Yet Gartner concludes that 85% of data projects fail.  How is this possible?  Oftentimes, data initiatives are launched without implementing basic management and governance techniques.  Objectives are not defined at the outset, C-levels and the Board aren’t clear in what they are asking for, and may not understand the path to get there – or the cost.  

Introducing data management and governance discipline to create the data equivalent of “scientific method” can dramatically reduce risk and increase the chance of success.  Many companies – especially those in regulated industries – have records management programs that can be adapted to provide a management framework for data to be leveraged for monetization or through analytics or AI initiatives.  

The value proposition is to implement sufficient management and governance activities to

  • Provide transparency and accountability in to the program, including ethics and legality,
  • Ensure that data is handled in a way that doesn’t violate compliance obligations, whether contractual or regulatory
  • Provide shared-service capabilities, including inventory, procurement, tracking and disposition.
  • Create logical interface and touch-points into privacy, security, internal audit, compliance and legal programs
  • Triggers and objectives are to close the gap between CEO expectations and the practical success rate of data projects.
  • Expose the relative value and sensitivity of data to enable proper risk and threat management, in collaboration with others, such as a Chief Information Security Officer.

Information Risk Management

In a metaphorical sense, data programs are taking the jewels out of the safe and passing them around.  Handling high value assets definitionally increases the risk of theft or breach, when compared to keeping them locked up.  But they must be handled in order to derive value.  Many companies have built information risk or IT risk management capabilities over the last several years; the question is how well are they tied into data initiatives or aligned with the way data is used?  Given that 15,000,000 records are breached every day, one might suggest “not very”.  

In the context of the increased use of data for market-facing benefit, Information-related risk needs to be assessed in a more focused way.  As a discipline, IT RM has created a good foundation, however it frequently aligns with core IT process like strategy, architecture, change management, and security, and not to data.  

Information risk management can provide a critical interface between a data leverage program and a privacy/compliance program.  The techniques used to assess information risk result in key insights into the nature, relative value, uses and threats to information.  This helps direct risk-mitigation resources to align with the risk.  Specifically, it helps to recognize whether risk can be mitigated through, say, security controls, or whether the employee community needs tools that better align with their jobs (obviating the need for them to find their own solutions to business problems), or whether increasing awareness can help people make better judgements.  

Companies should consider identifying, categorizing and managing risk by looking at initiatives through an information lens – as opposed to a technology lens.  This changes the dialog with business stakeholders, which increases their understanding and appreciation of what could go wrong, what is acceptable residual risk, and the steps needed to bridge the gap.  

As indicated, IT RM in the marketplace has achieved a level of maturity, and there exists opportunities to adjust the scope and approach to more effectively identify and manage information-related IT risks, which arguable, can help manage overall financial, regulatory and brand exposure for companies.

Summary

Companies are increasing their use of data at a tremendous rate – and they should.  The opportunities to gain competitive benefit are exploding.  But the risk and consequences of missteps are growing as well.  By implementing data governance and integrating risk management and compliance in a pragmatic way, organizations can continue to explore the ways data leverage can provide benefits, while taking proportional measures against events that can impede progress.  

CCPA, CPO, GDPR, IAPP, Information Management and Governance, Information protection, Privacy

Does Privacy Need Disrupting?

Executive Summary

When it comes to the use of data in a business context, there are a few absolute truths: (1) business will continue to gather and process more and more information about people to meet their goals. (2) We will continue to see larger and more far-reaching data events involving personal information.  And (3) regulators will continue to respond with increasingly complex requirements around the handling of personal information.

This paper reflects on the trajectory data-use is taking within the business environment, and explores some challenges the privacy profession is facing trying to keep pace.  The combination points to the inevitability of catastrophic data incidents.

But like so many other industries, modern technology may hold the answer to managing the risk.  This paper goes on to discuss that through the measured deployment of disruptive technologies, the privacy profession may find a way to support the acceleration of data use in the business, while managing risk and pursuing compliance.

Background

The thing about black swans is that they are both predictable and unpredictable – you know they are going to happen, you just can’t anticipate when and the form they will take.  In the period of one week in December, over 600 million records containing PII (Personally Identifiable Information) were breached. For perspective, that’s more than every man, woman and child living in the US, UK, Canada, Australia and Russia combined.  

With the increasing volume of PII being collected and processed by organizations around the world, it was inevitable that something like this was going to happen.  Moreover, it will happen again – and bigger – from triggers and vulnerabilities on which the risk community is not focusing. And no global organization wants to be named in a headline that talks about hundreds of millions of records being compromised.  

About data

We live in an age where information is emerging is a truly leverage-able resource for companies around the world, enabled by the incredible pace of change in technology and analytics capabilities.  The opportunities to improve customer experience are growing exponentially. To be sure, customers now measure their own satisfaction – and loyalty – based on capabilities offered by service-providers that were not even possible a few short years ago.  And companies are doubling-down investment to outpace their competition, or in many cases – in the face of disruptive startups – ensure their very survival.

Much of the data at the heart of the most promising innovations is in some way tied to individuals — whether traditional PII or PHI or new data around people’s movements, tastes and behaviors, spun off from IoT sensors, new analytics technologies or apps used by individual consumers where they are knowingly or inadvertently contributing data.

We also see that as some companies push the boundaries, or in the aftermath of high profile data incidents, lawmakers are reacting by implementing far-reaching legislation to protect the rights of individuals.  Complying with those is a challenge and imperative for all organizations but especially forward-looking global organizations, as they navigate uncharted waters and as regulations emanating from different jurisdictions overlap and conflict.  

Given the pace and trajectory of developments in technology and data, and the scale and frequency of data events, it’s reasonable to predict that there will be more breaches in the future – both larger in scale and more impactful.   Moreover, the increasing number and complexity of regulatory requirements – many triggered in the aftermath of data breaches – will place increasing burden on businesses, increasing internal tension between those developing new and innovative products and services, and those tasked with managing risk and ensuring compliance.  Finally, the potential ramifications of a breach, including the very significant fines, lost business or damage to the brand, can have lasting negative consequences to any organization.

Risk and privacy activity today

Today, risk management and privacy are heavily manual.  Risk management and privacy groups are relatively compartmentalized, often viewed as necessary but imposing layers of bureaucracy, addressed late in the process and after the business requirements are met; risk and privacy requirements are often viewed as disruptive and costly.   

Whereas “Privacy by Design” seems like an obvious enabler, and has been a holy grail of sorts, passionately embraced by privacy practitioners, it’s often down-played (or ignored) by business development groups.  

The basic process around risk and privacy include the following:

  1. Privacy Policies that reflect requirements — whether legal, contractual, ethical, professional or industry parameters.  This establishes the inward- and outward-facing posture and serves as the foundation and basis that drives every meaningful aspect of the program.
  2. Process documentation: business processes that handle PII are documented and analyzed to identify risk and to ensure that controls mitigate the risk and align with policy requirements.  
  3. Data and application inventories: as a supplement to process documentation, knowing what data is on hand and what applications process it is important to help ensure that appropriate controls are in place
  4. Trigger points within processes – IT or business processes – around changes or data events requiring action; certain activities such as developing or changing an application that stores or processes PII should trigger a Privacy Impact Assessment to determine what risks exist and what controls are needed.
  5. Consultations and approvals where SME’s respond to inquiries and use research and professional judgment to provide recommendations.
  6. Risk assessments take place periodically to determine what’s changed and whether controls are aligned with risks to PII.
  7. Controls are tested periodically to ensure they are functioning as intended
  8. Control weaknesses or failures are documented in findings reports requiring action by control owners

The process is largely manual

The key point in providing this list is to highlight the fact that all of these are manually intensive and are at best supplemented or enabled by tools such as GRC applications.  And while the enabling tools and applications help, these processes are only linearly scalable – meaning, increases in the number of in-scope processes and applications require a proportional increase in resources — people — to accomplish the risk and compliance activity.   Moreover, while the most effective privacy programs distribute the activity across the business constituents, and can gain some leverage and economies of scale, the costs fundamentally increase fairly linearly.

Most organizations face challenges in trying to increase their bench of Privacy SMEs, since they require in-depth understanding of their organizations, as well as privacy expertise, and need to exercise consistent and similar judgment.  So maintaining consistent quality around advice provided by SMEs is a risk and challenge in itself.

So in summary, the technology, data, business and regulatory environment is evolving rapidly, getting more complex, and more critical for the continuing success of the organization.  Traditional privacy risk and compliance practices are heavily manual, reactive, burdensome and difficult to scale. In combination, it’s clear that costly and damaging issues will continue to arise, and the tension between the execution of business strategy, managing risk and maintaining compliance will become even more pronounced.

What is changing…

In order to become better embedded and get ahead of business developments that leverage data, the privacy function needs to understand how the business plans to gather, manipulate and store PII, and overlay the risk and compliance requirements for its treatment and handling – which should result in certain adjustments to the business strategy.  

The privacy team has to understand all aspects of information risk management (leveraging an auditor’s playbook) to judge sufficiency of control, and be able to interface with the business, IT, IT security, legal, audit and compliance stakeholders, as well as with regulators.  

An important dimension of this is to have a framework for accepting residual risk.  This framework has to resist the “group-think” temptation to be either blinded by competitive pressure or the promise of fantastic profits, or lured into the “risk elimination” mode.  Instead, it should allow for the analysis of risk, mitigating effect of controls, and a transparent mechanism to accept residual risk that escalates upwards through leadership, depending on the overall risk/benefit balance.

But as discussed above, data “events” are bound to happen — whether breaches, losses or abuses — and privacy professionals too often are reactive.

Fundamental and disruptive change – leveraging Artificial Intelligence

Business, technology and data science will continue to accelerate, events will happen and regulations with come into effect.  The result is an increasing tension between opposing forces, where the resistant compliance side of the equation will almost always lose.

It’s time to take a fresh look at the model.  Increasingly, companies are recognizing the disruptive effect that data and analytics (including AI) will have on their business – the very action that increases the risk of privacy events discussed in this paper.

Privacy compliance can benefit from disruption.  

Ultimately, many aspects of privacy compliance will benefit from the disruptive use of AI and cognitive algorithms.   Given that privacy compliance combines documentation, analysis and judgment, there are opportunities to design and train algorithms to assist analysis, which will increase the timeliness and reach of the program.

Approach

First and foremost is the recognition that intelligent automation and leveraging AI is a journey – not a destination – and benefit is gained incrementally.  Focus begins on the more basic and mechanical aspects of the program, allowing more analyst time to focus on more sophisticated and complicated issues.

The privacy activities are then broken into categories which helps to drive priorities:

  • Routine daily tasks that need to be monitored for compliance, and where certain events trigger action, and
  • Change involving new applications, data, business ventures or data use cases
  • New requirements, such as new regulations, risk factors or data use restrictions

As the process matures, more aspects of the program can be automated, leading to a state where increasingly sophisticated tasks are processed automatically and the SME is engaged at certain thresholds where, say, more judgement or specific approval is needed.  If properly implemented, the algorithms are trained methodically (“crawl, walk, run”) and logged to ensure consistency.

Example activities that are candidates for automation:

  1. Process review comparing to policy – using an algorithm to determine whether a proposed process might violate a privacy policy
  2. Access monitoring – data stores containing information pertaining to people can be monitored for access and AI can analyze access for anomalies, and trigger responses
  3. Data access requests – routine operational transactions, such as requesting access to certain data, can be vetted and handled through Intelligent Automation
  4. Transaction monitoring – AI sensors can be tuned to monitor a wide range of structured and unstructured transactions guarding against inadvertent use of private information
  5. Privacy event analysis/DLP – Data Loss Prevention (DLP) sensors can capture thousands of potential events on a daily basis.  AI can be used to risk-assess the events based on a variety of rules, and flag those exceeding a predetermined risk threshold for further investigation.  
  6. Control analysis and testing – privacy programs often include a periodic testing cycle.  AI can be used to evaluate the results of testing to assess severity
  7. Data discovery and inventory – All organizations have large volumes a unstructured data stored (and often forgotten) on network file servers.  AI can be used to traverse the file stores and build meta-data tables around the data, and can be tuned to identify sensitive data, helping to ensure compliance
  8. Data psudonymization – AI can be used to implement psudonymization techniques on a large scale, and can test whether the data can be re-identified.
  9. Contract review – often times additional specific data handling terms are embedded in contracts with large clients.  AI can be used to extract those terms and correlate them to specific data in the environment to help comply with the client’s requirements.
  10. Regulation review – AI can be used to highlight applicable sections of regulation based on ingested company policy documentation, which accelerates implementing compliance activity
  11. Risk analysis – Algorithms can be trained to detect data use-cases that are in conflict with policy.
  12. Residual risk assessment – Quantifying residual risk is very important for determining whether risks are sufficiently mitigated to meet corporate risk appetite, and whether a value proposition is still valid.  AI can help with the determination.
  13. Customer inquiries – Intelligent automation can be used to handle customer inquiries around where data is, requests for erasure or transfer.  This can be extremely burdensome for companies with large numbers of individual customers.

Benefits

All these use cases are within the capabilities of existing technology, and the decision to pursue any combination is based on specific circumstances.  However, the overriding point is that they pave the way toward much more flexibility and scalability of a privacy program that is coming under increasing pressure to perform.  So the benefits are:

  • Greater flexibility
  • More scalability and leverage of resources
  • Lower risk of non-compliance
  • Less impact and burden to the business
  • Managed cost

Risks

At a high level, the risks are that the tools fail to detect or prevent an unauthorized use or disclosure of information pertaining to individuals.  This can be because the algorithms don’t work as intended or are not properly implemented. These are project and operational risks and should be managed through normal risk management processes.

But by keeping in mind the current state and the trajectory business is on, the reality is that leveraging Intelligent Automation and Artificial Intelligence makes sense.  It’s going to happen.

Conclusion

When it comes to the use of data in a business context, there are a few absolute truths: (1) business will continue to gather and process more and more information about people to meet their goals. (2) We will continue to see larger and more far-reaching data events involving personal information.  And (3) regulators will continue to respond with increasingly complex requirements around the handling of personal information.

Many industries are being disrupted by the creative and innovative use of data.  The privacy profession — increasingly in the spotlight, yet dependent on manual processes — is quickly becoming a good candidate for reinvention.  People will benefit, as it will open avenues for business to provide new products and services designed to make their lives better, while at the same time lowering the risk to them for participating.

CDO, Information Management and Governance

When do data-dependent startups need a Chief Data Officer?

More and more startup companies are exploiting business opportunities tied to data.  Whether developing data-dependent AI, re-imagining how to conduct familiar business processes in innovative ways, or intelligently designing and building datasets drawing from a growing variety of sources.  The common theme for this class of business is the reliance on, and exploitation of, data.

In the earliest stages, startups are focusing their energy and time on creating their product or service.  As they begin to mature, they naturally start to move toward a state where they are returning value to their stakeholders – profits.  Perhaps they plan an IPO or to be sold to an investor, or some other larger entity.

This paper explores options and approaches that companies could consider to determine if and when they should appoint a Chief Data Officer (CDO), as well as their scope of responsibilities.

What kind of startups should prioritize appointment of a CDO?

At some point in their lifecycle, any company that is dependent on data will need to implement data management processes.  These include processes to acquire, ingest, catalog, track and at some point, dispose of data. If the data is licensed or belongs to others, they will need to understand and comply with applicable obligations.  They will need to create a data architecture, build repositories and apply appropriate controls to protect the data.

This description admittedly covers a lot of scope.  So the following adds a little structure to the thought process:

Does the startup…

  1. Handle large volumes of data?
  2. Have data as core to it’s business, where completeness, accuracy and currency are critical?
  3. Have products and services that are dependent of data, but are themselves not data products?  (e.g., a website or app with data in the back-end vs. a licensed database)
  4. Need data that is licensed or procured from others?  
  5. Use personal data (PII) or health data (PHI)?
  6. Need to demonstrate data lineage or provenance?
  7. Create new data, which has intrinsic value?
  8. Live with the risk that a data incident could cause irreparable harm?

If the answer to many of these are Yes, then the company should consider appointing a CDO.  Moreover, if the company wants to go public or be bought by another company – especially a public company where the transaction is material, the startup may be expected to demonstrate discipline around the treatment and protection of data, including documented policies and procedures.  While a CDO isn’t necessary to do this, a CDO can design and implement practices and disciplines that will provide comfort in a due diligence setting, and integrate those disciplines into the daily business routine of the startup.

What value can a CDO provide to a startup?  

Removing Barriers:

A CDO can provide a range of value to a startup.  The CDO looks at a company’s business through the lens of data, and is sensitive to both the value (revenue) cycle as well as the risks and obligations, recognizing they go hand-in-hand.  From this vantage point, they can enable the business by sourcing data and removing barriers, and can implement right-sized controls, proportional to actual risks and obligations. In effect. they can enable the data scientists – who seem to always “need…more…data…” – by providing relevant data, aligned with business objectives, where obligations and risks are managed elsewhere.  Call it “unencumbered data”.

Scientific Method:

A CDO understands and recognizes the transformative potential of data, but also a balanced sense of proportion – especially when resources are scarce.  By implementing structure around the activities of data scientists, a CDO can improve the chances that research will be fruitful and aligned with business objectives – with a necessary degree of transparency for stakeholders.  

Protection and Compliance:

Most information that companies want to use will have some kind of requirements around handling.  These will emanate from one or more of the following:

  1. The data is regulated; many data projects will incorporate information about people — PII or PHI — likely controlled by one or more regulatory frameworks (e.g., GDPR, CCPA, GLBA, HIPAA/HITECH)
  2. The data belongs to others and is governed by a contract or Data Use Agreement
  3. The data is valuable and needs to be protected – these protections might be present as a result of the data being regulated.
  4. A breach of the data could result in harm or loss, either to the company or to data owners, and should cause the company to respond in a certain way.

The CDO, who should understand the nature of data, can work with the CISO and counsel to implement proper controls to protect the data and comply with requirements.

Ethics:

By understanding the business and compliance perspectives of data, the CDO can provide perspective on the ethics of data use.  So much of the new digital economy is exploring uncharted territory, where potential uses haven’t yet been imagined. There are lines not yet drawn around what industry should do, even though they can do it.  Data-driven inventions can cause real or perceived harm to consumers as they disrupt industries.  Whether its financial services, advertising/marketing, insurance, consumer electronics, or the breadth of online applications and properties.  Data is central to these and a misstep can be catastrophic.

Optics:

Transparency is a cornerstone of the capital markets.  And while data-driven startups are inventing new ways to conduct business and benefit consumers, much of it is betting on the future.  With so many unknowns, appointing a CDO can help inspire confidence that a data-dependent startup is approaching their objective with a view to managing their data assets for the longer term.

What can a CDO do?

85% of the time, “Big Data” initiatives fail to meet their objectives, and 50% of startups fail in the first year.  Start-ups relying on data can’t afford many false starts. The CDO can spearhead data management activities that can, in aggregate, reduce risk of project failure and increase the likelihood of achieving the desired outcome.  These might include

  • Vision and strategy, involving leaders across the company
  • Data inventory
  • Data architecture
  • Data acquisition
  • Data maintenance and quality
  • Data retention and disposition,
  • Risk assessments, protection and compliance processes

While these are not necessarily discrete activities, and should certainly be scaled to the situation, having a framework in place would be very useful to (1) enable growth, (2) permit introduction of different data sets, and (3) give Boards of Directors, auditors, reviewers and regulators a level of comfort that the company takes data management seriously.

Balancing cost vs value?  Alternatives…

Many early stage startups are focused on laying out the important initial groundwork to sustain themselves — developing products, recruiting talent and identifying customers.  As they move through funding stages and become established, they might be looking toward aggressive growth, IPO and engaging in discussions to be acquired. This is a sliding scale – and it may not make sense to appoint a full-time CDO initially.  Startups should consider engaging a consultant or a CDO on a contract basis to implement and appropriate framework. As time and circumstances evolve, the time commitment can be adjusted.

Who should drive the decision?

The role is so important and strategic, that the CEO should drive the decision to appoint a CDO.  The CDO should expect to work closely with the CEO, as well as the rest of the executive team. Moreover, the CDO should expect to meet with the investors and advisory board to reinforce the role and how it will help the company accelerate forward.

Conclusion

It goes without saying that startups leveraging data science are not at odds with managing data, or the scope of a CDO.  They are extremely complimentary, to the point where an CDO can dramatically improve the probability of a data program, or data-dependent startup, succeeding.