Tag: Chief Privacy Officer

Information Management and Governance, Uncategorized

Role of the CDO: Learning from the Past to Enable the Future

James Howard

The role of the Chief Data Officer is evolving quickly, and has been compared to the CIO of the early 90’s, in that the CIO role was just starting to take shape, companies were just beginning to appoint CIOs and they were struggling to define responsibilities.  The similarities don’t end there. Consider:

  • Early CIO’s had strong IT backgrounds, but often didn’t truly understand the business they were supporting.  In some other cases, it was the exact reverse – the CIO was a business person with limited (or no) understanding of IT
  • The CIO was a “second tier C-level executive”, often reporting to the CFO.  This was often because in those days, the CFO was thought of as the principal consumer of IT, and companies failed to recognize how computers – notably PCs –  were penetrating and enabling other areas of the business. This lead to frustration among users, “shadow IT” lacking formality and control, and an incomplete understanding of the overall IT portfolio and spend.
  • Every CIO was different, and every IT mission was different, and highly tailored to each company.  In hindsight, the industry was “fumbling” (a term not meant in a disparaging way) as the IT industry went through a massive evolution; some may remember Tom Watson’s prediction that there would only ever be a market for maybe five computers.
  • The CIO’s senior staff were often technically proficient in their respective areas, but not very aware of the needs of the business they were supporting – and they lacked the tools to build the necessary bridges.
  • There was very little interface with “users” (a new term at the time) because most systems under the CIO’s purview were specialized and vertical, or were infrastructure – and end-user computing was evolving on its own, outside the CIO’s scope of responsibility.
  • Numerous “disasters” have taken place tied to IT (whether failed initiatives, outages, breaches or hacks) and the post-event analysis often failed to properly address the underlying issue, perhaps due to lack of understanding, or a desire not to reveal the extent of the issue, or because the business was not fulfilling their responsibility relative to IT governance.

In 1994, Charles B. Wang published the book “Techno Vision: An Executive’s Survival Guide to Understanding and Managing Information Technology”.  In the book, Mr. Wang shines a light on the “disconnect” between IT and the business they support, as it relates to understanding the role technology can play, and he makes suggestions on how to address the gap.

Now in 2018, the CIO is a universally accepted role, but there are still plenty of examples where the CIO has limited (or no) understanding of the business, and the business leaders’ eyes glaze over when any technology topics arise.  And IT is one of the largest line items on corporate budgets.

Enter the CDO

Conservative predictions foresee a massive increase in number of information-related products and services, as well as company spend on information-related initiatives.  Not to mention the exponential growth of information itself.  It’s helpful to look at the “typical” CDO in 2018, as a way to anticipate trajectories and avoid similar pitfalls that were seen with the evolution of the CIO.  Consider for comparison:

  • Most organizations are recognizing the transformative potential that exists in leveraging information, but the majority have not appointed CDOs.  And some organizations have appointed CDOs internally who don’t have an information management background.
  • Many organizations have emphasized the technical aspects of information leverage, and have appointed Data Scientists as the top leaders in information management, who in turn have flushed out their teams with data scientists and analysts.
  • Certain segments of the market – insurance, for example – seem to view information management as an “IT thing” and often place the CDO under the CIO, which immediately limits their ability to be successful.
  • Many companies are reacting to steps taken by their peers, and have appointed “me too” CDOs with limited thought to their responsibilities, scopes and measures.  As a result, vision and strategies are incomplete or non-existent.
  • Upon arrival, many CDOs are dumped on, getting assigned responsibilities that are at best loosely tied to information, but weren’t necessarily part of the scope originally envisioned.  This immediately interferes with their ability to deliver, even if the new responsibilities are appropriate and legitimate.
  • CDO’s teams are often thinly staffed, and are expected to transform the organization by exerting political influence on other leaders, often who have conflicting agendas or are protecting their turf.
  • Many business leaders speak about, but don’t understand, the strategic role that information leverage can play in their organizations, due to a lack of data literacy.

To be sure, none of these should be seen as evidence that the CDO is a passing fad or a failure.  Quite the opposite: there is a recognized need for a CDO, who is emerging as the executive who must pull together and execute a strategy to gain benefit from leveraging information.  Unlike other trendy business fads, the CDO is tasked with making use of a resource that is already there – and growing – increasingly recognized as key to greater prosperity.  By investigating the challenges faced by many early CIOs, there are opportunities for the CDO to learn from the past, and avoid similar issues.  

Support and Empowerment

For most forward-looking organizations, the CDO should be a company-wide role.  The CDO should be seen as a senior executive, should report to the highest levels of the organization, and have broad authority to effect policy and influence behavior.  They should have visibility and accountability to the Board of Directors. In terms of support, the CDO should have resources to execute in a credible way, including personnel and tools.   

Scope and Responsibility

If an organization believes that information is their lifeblood, and that leveraging information is key to continued success (or relevance), then they are acknowledging the strategic importance of information.  The CDO’s scope should align with the role information plays — both in terms of opportunity and obligation. Meaning, they should be tasked with deriving benefit from information in a way reflective of their business, but should also be responsible for ensuring obligations are met and risk is managed for that data.  

Qualification

The CDO is not a technician; they are a business executive.  While it is difficult to imagine there are enough CDO’s in the market who have deep understanding of the businesses of their employers, a good CDO should be able to bridge their skills as an information leader to the businesses they are tasked with enabling.  Just as a banking or manufacturing executive knows banking and manufacturing, the CDO knows information management. And just as that banking or manufacturing executive doesn’t understand every technical nuance of their business, the CDO needs to know enough to direct and guide their specialists.

Structure

Charles Wang, in his book, discussed the disconnect between IT and the business they support, and the risk of this occurring with the CDO is just as real.  In the 24 years since he published the book, some business leaders are just as illiterate in IT as they were then, but the breadth of tools is immeasurably wider.  Data Science is maturing at an incredible pace, and businesses are struggling to understand the intersection between what they do and the potential value data can add.  To help address this, the CDO needs to establish strong relationships with the business counterparts, and help develop data strategies. They need to work with the data scientists to identify potential use cases and opportunities with data, getting the business leaders on board.  While the CDO has a high degree of responsibility for helping execute the data strategies, ultimately the business leaders are accountable to their own stakeholders for the success of the data initiatives within their areas.

One model to establish and maintain the relationships is through a governance council or steering group, chaired by the CDO and attended by senior leaders across the organization.  The members are responsible for their own information investments, and attend the council to help ensure alignment to vision and consistency of strategy.

Scientific Method

WikiPedia tells us that:

Scientific method is an empirical method of knowledge acquisition, which has characterized the development of natural science since at least the 17th century, involving careful observation, which includes rigorous skepticism about what is observed, given that cognitive assumptions about how the world works influence how one interprets a percept; formulating hypotheses, via induction, based on such observations; experimental testing and measurement of deductions drawn from the hypotheses; and refinement (or elimination) of the hypotheses based on the experimental findings.  (before the reader dismisses this for having come from Wikipedia, the definition is pretty consistent with other sources)

The adoption of Data Science in business frequently takes a very different approach, where data scientists are empowered, and ask for more and more data to “play” with to see what they can come up with.  Perhaps this was the result of companies moving directly to the technical solution without first establishing a business vision and strategy, in coordination with their own business leaders. While some very interesting discoveries were probably made, there is likely there were a high degree of false starts, or developments that served no business purpose, or instances where the obligations limiting use of data were violated.  And without an appropriate degree of skepticism, can they be certain the algorithms really work?

Perhaps a more structured approach makes sense, taking a page from Scientific Method.  The data strategy should be articulated by the business, and transformed into a series of initiatives, some of which require research and experimentations. Certain of these should be treated like research endeavours with hypotheses formed – with significant participation by both the data scientists and the business stakeholders – which are proven in a lab setting before productizing and deployment.  

Relationships

The CDO is going to have to rely on relationships to a great extent for several reasons, including (1) the role is new and evolving, (2) many of the responsibilities the CDO should take on are initially held by others, leading to political turf-wars, and (3) at least initially, the responsibility for execution of initiatives is shared with other business stakeholders.  

Certain key relationships stand out, including:

CIO: The CDO’s initial scope probably most closely overlaps with the CIO, partly because up until the CDO’s appointment, many information-related initiatives were likely assigned to the CIO by default.  It’s critical that the relationship evolve more to a service-provider/client model, where the CDO looks to the CIO to develop technology solutions to meet business requirements for information management, and the CDO has to be careful not to overstep and attempt to drive the architecture of the solutions.

CISO: A key responsibility for the CDO is information protection.  Whereas the CISO has historically been responsible for blanket IT security, the CDO should have greater insight into the relative value of information sets, as well as how they should be accessed, transmitted and processed.  Moreover, the CDO should have greater insight into unique handling obligations tied to particular information sets. Meeting those obligations and protecting the information is likely achieved by a combination of controls — administrative, technical, manual, policy, physical, etc., responsibility for which may initially be spread across the organization.  So the CDO should emerge as a stakeholder for the CISO, where the CDO provides requirements and the CISO implements controls to address those requirements.

CPO: Much of the information leveraged by an organization might be subject to regulatory requirements, and some of those my fall into the category of PII, generally managed by the CPO.  Whereas the traditional scope of the CISO overlaps with the CDO, in the case of the CPO, the CPO’s scope is entirely contained within the scope of the CDO (after all, the second “I” in “PII” stands for “Information”).  The privacy rules are only one set of obligations, and apply to only a portion of an organization’s overall information portfolio. So logically, the CPO should move into the office of the CDO — with appropriate relationships with legal counsel to ensure regulations are interpreted properly.

Regulators: In organizations beholden to regulatory oversight (banks, insurance companies, accounting firms, government contractors, healthcare institutions), analysis reveals that a key concern driving the regulations is the handling of information.  And since the CDO’s objective is to manipulate and leverage information, it follows that it’s critical for the CDO to ensure that proposed data-use initiatives conform to regulatory requirements by design. Moreover, everyone — including regulators — are grappling with the new ways information can be used, and the appropriate ways regulations apply.  So it’s critical that the CDO establish a relationship with their regulators, so the regulators see the organization’s use of data through a clear lens and react fairly. This also provides common ground and language in the event regulators identify potential issues — or if data incidents occur.

Risk Management: Most larger organizations have recognized the importance of proactively measuring, monitoring and mitigating risk along lines appropriate to their business structure and objectives.  These evolve from time to time as the business environment changes – for example, the formation of IT Risk Management functions over the last 10 years. They are very useful for a variety of reasons, including establishing a common understanding of what can go wrong, potential consequences, and agreement on appropriate mitigating steps to take.  Given the rapid emergence and evolution of data science — algorithms, AI, cognitive, etc., — the market has limited experience with assessing data risk, grappling issues, and establishing a balanced risk acceptance/mitigation model. And this evolution is taking place at a pace far greater than control and risk management techniques. In the past, implementing formal Risk Management usually follows a catastrophic event that serves as a wake-up call, and the pendulum swings hard back toward the conservative end of the spectrum.  That in itself is a risk, since organizations might overcompensate, lose momentum, give up favorable market position, and miss opportunities while the re-trench. A much better approach is for the CDO to incorporate risk management into processes, by design. Risk should be assessed during design phases and mitigated during development phases, not after the fact.  This strengthens the argument for embracing Scientific Method during the development of data initiatives.

Conclusion

These are exciting times to be involved with information management.  The science is evolving and technology is becoming powerful enough to allow organizations to do incredible things.  Companies are scrambling to invest and exploit the opportunities created by data, and are placing sizeable bets on what they hope will return profit, with some degree of luck.  But “hope” is not a business strategy, and some argue there is no such thing as “luck”. Appointing, supporting and enabling a CDO is a significant step to help ensure success of the program, and applying lessons learned from other new classes of executives can help ensure the success of the CDO.

Contact me at james@jhoward.us

Information Management and Governance, Privacy, Uncategorized

HBR and RSA’s Paper on the Impact of GDPR on Business

James Howard

Earlier this year, the Harvard Business Review published a paper prepared by RSA that discussed the impact of GDPR on business, and how companies can thrive under the rules.

The paper provides advice for companies getting started, and what needs to be in place for them to comply.  It also reflects on the “new normal”, and how companies will have to adopt new practices across the organization in order to remain compliant (e.g., Sales and Marketing will need to collect and maintain opt-in’s for the names on their mailing lists).

The final paragraph says:

Data privacy and security of personal data, then, are likely to become ever higher priorities for government as well as individual corporate customers in the years ahead. At the same time, both government and consumer demands on data—for access, mobility, and analytics—will only increase. This creates a tension, especially for large companies that manage large amounts of data, because “minimization—only collecting what you need and keeping it only as long as you have a legitimate reason—is at odds with innovation,” observes Skivington.

The route to successfully navigating between these two objectives starts with knowing the data you hold and providing notice to all EU data subjects to whom it belongs. The rest follows.

By articulating the opposing tension between the market demands for creative use of data, against the requirements to minimize data collected and retained, RSA correctly highlights one of several ways in which the strategic direction organizations want to pursue (with respect to data use) is increasingly at odds with the rights ascribed to data owners.  They don’t recognize that reconciling these opposing forces is central to the CDO’s responsibility and demonstrates the need to closely align the CDO and CPO.  And while the RSA paper focuses on GDPR and the rights to privacy of individuals, it is clear that the obligations imposed by all data owners will follow the same trajectory – especially as data is increasingly regarded as a leverage-able asset by more and more organizations.

The proverbial trains have left the station – one on the data-as-an-asset track and the other on the data-obligations track.  Both are equally important and must be reflected in the CDO’s vision and strategy.

Contact me at james@jhoward.us

 

Information Management and Governance, Privacy, Uncategorized

Bringing the C’s Together

James Howard

The Chief Data Officer is in a unique position because they bring together the ever expanding catalog of available information and opportunities to bring value to their organizations. To be effective, they need to look at information objectively, realizing the upside potential, while managing risk and acknowledging their handling responsibilities.

An “I” in PII stands for INFORMATION

The range of information can and should include all the sources that can help achieve the desired objective, including information about people, such as Personally Identifiable Information (PII).  After all, PII is just a class of information, which in many cases can enhance the quality and value of products and services.

But PII is unique in that because it pertains to individuals, it is increasingly subject to a wide range of obligations, whether regulatory, contractual or ethical.  The Chief Privacy Officer is tasked with implementing the policies, procedures and controls around how PII is handled within an organization.

Since the scope of a CPO’s role is to manage compliance for information tied to individuals, and the CDO’s responsibility is around governing and managing the full body of enterprise information, it follows that the CPO responsibility is a subset of the CDO’s responsibility.

Bringing the CDO and CPO together

Traditionally, the CPO sits in the legal and compliance area of organizations, which positions them well to focus objectively on the treatment of the information, looking at it through a legal lense.

In last several years with the rapid growth of data science, there has been a significant refocus on how information is used in organizations, with the increased recognition of the benefit information leverage can bring. Organizations have responded by hiring data scientists and appointing CDO’s located within the business side to focus on leveraging information as an asset.

Having the CDO be organizationally separate from the CPO increases the challenges to have them collaborate, and raises compliance risk. Instead, having the CPO within the Office of the CDO — or even be the same person — provides the opportunity to leverage information with compliance built in, with clear accountability to operational leadership.

Why is this better?

Merging the CDO and the CPO roles provides organizational clarity around the commitment to pursue the opportunities data provides, while highlighting and recognizing the importance of respecting the compliance obligations.  The CDO should be equally conversant in business goals, and the data vision and strategy as they are in the data privacy program.

In addition to the positive optics around emphasizing the importance of privacy, this model embeds privacy in the fabric of operations, not as an after-thought.  It enables the goal of implementing Privacy By Design, and a Privacy Impact Assessment (PIA) becomes a “punctuation mark”, not a major activity.

Checks and balances

To be sure, colleagues (in Risk and General Counsel’s offices) would point out that a benefit of separating the CPO from core business operations is that it helps ensure organizational objectivity and independence, supposedly reducing the chances that privacy requirements can be deprioritized relative to revenue objectives.  But I would argue it happens anyway, in part because the separation raises the risk for privacy to be an afterthought. And implementing privacy requirements as an afterthought (or even just later in a project) greatly reduces the chances of success, while increasing cost and extending timelines.

So there are two key relationships that need to be in place to help ensure the effectiveness of the Privacy program:

  1. Counsel: Privacy is a legal concern, so the CPO/CDO should have a strong relationship and connection to Counsel.  Even the largest organizations rely on outside counsel to supplement the skills of in-house counsel. This is a great idea and should be formalized.
  2. Internal Audit: The CDO/CPO should work with internal audit to make sure data handling is included in the scope of the audit plan.  If there is an ERM (Enterprise Risk Management) plan, data risks and mishaps should figure prominently.

Organizations that are pursuing data leverage, whether as a source of new revenue, or a way to improve products and services or as a way to optimize management decision-making, should consider the significant benefits of merging the data management and privacy capabilities, as it may lead to a stronger – and safer – program, more aligned with the business.

Contact me at james@jhoward.us