CDO, CPO, GDPR, IAPP, Information Management and Governance, Information protection, Privacy

Data Regulation is the New Reality

On October 28th, the BBC’s Chris Baraniuk reported that recently, Tim Cook was in Brussels to address the International Conference of Data Protection and Privacy Commissioners.  In his remarks, Mr. Cook, referring to the misuse of “deeply personal” data, said data was being “weaponized against us with military efficiency”.  The BBC went on to report that Mr. Cook said “We shouldn’t sugar-coat the consequences,” and “This is surveillance.”

The speech reaffirmed Apple’s strong defense of user privacy rights, in contrast to competitors business model of driving advertising revenue by analyzing people online habits.   “The trade in personal data served only to enrich the companies that collect it, he added.”

Mr Cook also praised the EU’s new data protection regulation, the General Data Protection Regulation (GDPR), and went on to say that other countries “including my own,” should follow the EU’s lead toward protecting personal data.

To be sure, economics are at the heart of the concern.  Given the string of events that have occured, where data is mishandled or exposed, companies are at risk of losing customer and stakeholder trust, and without that trust, it not clear how they can drive or thrive in the data economy.  So coming together in support of a GDPR-like framework makes sense; it raises the conversation to a global level, and can result in a safer and more efficient environment in which to conduct business. Companies that embrace the framework will have more flexibility and resilience, while those firms paying it lip-service will eventually themselves be at the center of their own data crisis.

And therein lies the rub.  Compliance is not the same as data protection, especially when the regulation is principles-based and not prescriptive.  If the objective in implementing a framework is to comply with a regulation, one is tempted to overlay one’s current operating model with the requirements of the regulation and address gaps.  While it may reduce the risk of data incident, it will probably do so by coincidence.

On the other hand, if companies went about handling information with the strongest possible ethics, where they routinely assessed and addressed risk, recognized and avoided moral hazards, then the incidence of breach and miss-use would naturally be much lower.

The obvious competitive issue is that the second scenario is more expensive and less flexible.  Moreover, if a minority of companies took this approach, they would be less prosperous, and economic darwinism would cause them to go extinct.  And suppose there were a major data “catastrophe”, and the market environment were made up of a combination of those that embrace a high degree of data ethics and those that don’t, the market may not recognize and reward the higher resilience of the highly-ethical-but-less-profitable.  Instead, what we’ve seen is the mainstream market reacts with shock and incredulity and – at the prompting of regulators – implement newly-penned frameworks meant to avoid future occurrences of those events.

While one might argue that black swan events are by definition unforeseeable, one can equally argue that waiting for them to strike before implementing any sort of protection strategy simply opens the door to more black swans, and when events do occur, they result in unnecessarily high impact.

Apple’s Tim Cook makes clear his view that status quo is unacceptable.  As an unquestioned highly credentialed leader and insider in the technology (and information) world, his use of words like “weaponized” and “this is surveillance” should not be taken lightly — he knows what he’s talking about.  No doubt more so than the rest of us.

So as with most things, a thoughtful balance must be considered.  The dilemma is how to balance among the following:

  1. The rapid growth the volume to data aggregated by companies, across the board from business-to-consumers, to business-to-business companies, and ranging from companies providing services to those providing goods — and the increasing overlap.

  2. As a subset of that, the increase in the volume of personal data stored online, and the ability to gather even more data about individuals – habits, interests, locations, views and opinions.

  3. The rapid evolution in the science of data analytics, and the ramp-up of technology able to manipulate and compute data on a mammoth scale.

  4. Coupled with this, is the increasing ability to combine and analyze datasets in ways that allow for the creation of new and credible data and conclusions.

  5. As the size and richness of the datasets grow, so do the consequences of an event (whether a breach, misuse, abuse or exposure).  These range from a sense of creepiness when personal data is exposed, all the way to the very real consequences of insidious manipulation of our views and opinions.

In short, how can companies derive benefit from data, while managing the risks?  Neither momentum is letting up — the momentum around utilizing the expanding datasets, or the momentum around data events and subsequent responses from regulators.

One realistic way is to embrace and build a culture around managing all aspects of data, in lock step.  This is built into a data management program, led by a Chief Data Officer, comprised of three interdependent functions:

  1. Data Leverage, focussed on enabling the business use of information,

  2. Data Protection and Compliance, focussed on addressing risk resulting from data leverage, in terms of misuse, loss or non-compliance with obligations

  3. Data Quality, ensuring that the data being used retains its accuracy and integrity

This model is coupled with appropriate oversight, in the form of:

  1. A steering group with senior stakeholders from across the company,

  2. Direct oversight by CEO or COO,

  3. Connectivity into other key functions, including the CIO, CISO, HR and Legal,

  4. Active oversight by the Board of Directors, to support business initiatives and agree with risk mitigations plans.

A standing filter for any and all data initiatives needs to be ethics, and a consideration for the consequences of the genie getting out of the lamp.  Is the company willing to handle the outcome, if an initiative goes wrong? What is the risk, how is it managed, and are the right people accepting the residual risk?

The discussion is reaching a fever pitch with leaders of the most influential technology companies adding their voices to the conversation.  Any company wanting to join the data economy should consider doing so with an appropriate data management framework. This will position them to accelerate as new opportunities present themselves, while being able to manage events as they occur and accommodate compliance requirements that arise.

 

Information Management and Governance, Information protection, Uncategorized

Data Ethics and the CDO

A wise man once told a cheeky arachnid, “With great power comes great responsibility!”

This is a particularly relevant quote in the context of the evolving data economy. CDO’s may think of themselves as caped crusaders saving mankind, and the truth is they are indeed playing an increasingly critical role to help ensure that organizations can successfully transition to their rightful place in the new data economy.

Consider the following:

  • Overwhelmingly, CEOs believe leveraging data as an asset will be more than a game-changer, and will soon become a critical differentiator to remain successful and relevant – and not all companies will make it;
  • Available data – both volume and variety – continues to grow at an impressive rate;
  • Data science and tools are moving in lock-step with the data growth, finding new ways to derive value from data, creating transformative and disruptive opportunities;
  • Data events – intrusions, breaches and exposures – are also growing at an alarming rate; in 2018 alone, hundreds of millions of people-related records have been targeted, exposed or breached (and that’s just the ones detected); and
  • Regulators – notably the EU and the State of California – are responding with complicated requirements, that will impact a great majority of organizations, and more jurisdictions will follow.

What is the role of the CDO?

The CDO’s primary responsibility is to establish the vision and execute a strategy to leverage data in a responsible way.  This ranges from monetizing data directly, through sale or licensing data, to creating new or enhancing existing products and services with data, to optimizing operations by augmenting decision-making with data.  This is a tall order, and needs to combine insights into available opportunities, maturity of the organization to embrace change, and expectations of organizational Leadership with the support they provide.  After all, if leadership isn’t on-board, a data program is not likely to be successful.

The other responsibility addresses meeting the obligations tied to the data, which starts with data ethics.   Just because we can do certain things with data, should we?  Consider some inputs to that decision:

  • Harm– As with medicine, and as the business person overseeing data initiatives, the CDO should start from the commitment to “do no harm”. The CDO should have a methodology for analyzing and socializing potential data solutions to understand the potential consequential impacts.
  • Legality– The CDO should collaborate with counsel to develop a clear understanding of where legal boundaries lie. As with “do no harm”, organizations should not break the law.  The CDO has an important role, because sometimes there is legal risk (heightened probability that a law will be – or perceived to be – broken), and analysis presented to decision-makers should be clear.  As with other cutting edge sciences, senior leadership may not be as data-literate as the CDO or the data scientists.
  • Expectations– An initiative may be “legal” – technically – and even cause no actual harm, but the organization should be comfortable that stakeholders or clients would not be so disappointed with an outcome that the organization’s brand is impacted or clients go elsewhere. A consumer-client has a different tolerance level than client-companies; consumers take reactionary queues from society, media and social-networks, often with unpredictable results.  Client companies have their own stakeholders, regulators and clients to look out for, which drive their reaction.  Moreover, an un-harmful but “creepy” initiative may draw unwanted scrutiny from a regulator, resulting in the organization expending resources to address.
  • Profit – will the initiative make money, even if risks are mitigated and obligations are met, and expectations are intact? A CDO will be presented (pitched?) with dozens of cool ideas, and has to know how to analyze them for fit within the organization. This is trickier than it seems, because data science presents data-oriented opportunities in organizations not used to the data economy.   The decision-making process around investing in a new plant or product in, say, a manufacturing company may be very different than deciding to invest in a data-driven feature or capability.  And simply “willing it to happen” isn’t enough.
  • Consequences– Suppose the organization bets wrong.  What if the initiative fails to deliver on the planned profit, or simply doesn’t work?  This is manageable through various pathways – insurance, hedges, accounting treatment, etc.  But what if the organization creates a proverbial monster?  Recent debate around AI comes to mind, with AI appearing to evolving in lab settings.  What if, in hindsight, the organization realizes they did something deeply wrong or harmful – should they have been expected to anticipate and alter course?  Recently, companies have ceased to exist because they pursued what seemed like sanctioned or low-risk data-driven initiatives, failing to anticipate social and political outrage.

The data economy presents opportunities never before available to business.  Some organizations will choose to gamble risk against profit.  Others will take a step back and forego immediate opportunities, adopting a wait-and-see attitude.  Some from each group will succeed while others fail.

Like any new science that affects humanity, data science should adopt a canon of ethics that balances achieving benefit against the risk of harm.

No doubt the CDO plays a central role in making or orchestrating decisions and administering data.  As the steward of the data vision and strategy, the CDO must be able to think through the upsides and downsides with balance and objectivity and be willing to stand behind the ethics of decisions, after the fact.

Contact me at james@jhoward.us

CDO, Information Management and Governance

CDO: Leveraging AND Protecting Data

A lot is written about the important role the CDO has in promoting, monetizing and leveraging data in an organization. There is no doubt this is their primary function, and failing to fulfill the role can cost the organization in terms of revenue, competitiveness and market position. But the CDO has an equally important role in overseeing governance of data, and failing to embrace that part can lead to similarly negative outcomes.

I’m going to make a provocative statement: the data leverage market is charging ahead and the data governance disciplines are not keeping up. We will continue to see headlines describing data-related issues. Like opposite ends of a rubber band being pulled tighter and tighter, we are facing an increasing risk of a significant, potentially catastrophic, event. The risks aren’t only that data might lost or breached, but also that the organization might fail to gain full benefit from their data. The CDO plays a key role in managing the risk, avoiding issues, which in turn positions the organization to move faster and more nimbly.

Lets talk about the data:

A majority of companies are leveraging Big Data, with Financial Services and Healthcare leading the charge, and nearly 80% of executives believe that failing to embrace Big Data will cause companies to lose their competitive edge. Use cases range from customer and clickstream analysis, to fraud detection and predictive maintenance. The statistics go on and on, all pointing to an accelerating pace of growth and adoption.

  • Tools are becoming more sophisticated, and evolving to where increasingly, end-users can can pursue data tasks without involvement of IT staff. The analytics software and services market is $42B this year, expected to grow to $103B over the next 9 years.
  • And 59% of executives believe that their use of Big Data would be improved through the use of AI – often itself dependent upon the quality of data.
  • How much data? One estimate puts at 44 zettabytes by 2020 (44 TRILLION gigabytes)!

Point being, we are continuing the trajectory of very high growth in the use of data, and no end in sight as far as how much data there is to manipulate and leverage.

OK. So how is it being managed?

Increasingly, where in place, responsibility to establishing the vision and executing the strategy for data use falls to the Chief Data Officer. However, less that 20% of the top 2,500 companies have named CDOs, and they are often focused on the market-facing and revenue aspects of data. But even for those CDO’s whose responsibilities include governance (covering data protection and quality), there are no standard frameworks to employ to manage data.

By framework, I mean the mechanisms to manage data through it’s lifecycle the way one would manage any other asset. Gartner observes that while the traditional business disciplines provide some analogs to manage information as an asset, nothing has emerged tailored to information, let alone adopted as a standard. In fact, accounting standards don’t even include “information” on financial statements.

Within any governance framework should be Protection against reasonably foreseeable threats. There should be a model where protection of data is proportional to data (asset) value, relevant risks and threats, and which takes into account compliance obligations. To be sure, there are many sets of obligations, supporting methodologies with varying levels of adoption and maturity to address data protection along verticals (e.g., GDPR, HIPAA/HITECH, etc), and respectable frameworks to help ensure information security (ISO27001, for example). But these are rarely within the responsibility scope of the CDO. The CDO has to navigate different organizations to engage with one or more CIOs, CISOs and/or CPOs to help implement protections — and those other leaders’ priorities are often on other imperatives, and politics frequently interfere. So it’s difficult to see how an organization can simultaneously position itself to leverage data as a key asset, while also ensuring proper and proportional protection.

Stepping back looking at the bigger picture, I’m describing a market environment where opportunities for leveraging and profiting from data are exploding, while the mechanisms to manage and protect that data are lagging.

What can go wrong?

This pattern points to scenarios where data is breached, questionable data becomes over relied-upon, or where momentum builds to leverage and profit from data, but due to the lack of proportional governance, an event occurs (or worse, issues go undetected until outsiders raise the alarm) resulting in a loss or process failure, leading to financial and/or brand damage and regulatory intervention. A quick review of headlines reminds us this happens on an all too regular basis, leading to the inevitable questions such as, “how could this have happened?” or “you should have seen that coming”.

Is it avoidable? 

Black swan events are – by definition – unanticipated.  However, organizations can take significant steps to anticipate and either avoid or plan for these events, and prepare for potential outcomes by embracing information management and governance techniques. Remember, a data event – whether a breach or a perceived abuse of data – affects not only the organization in question, but also those around it, emanating outwards.

Data leverage and data management can be thought of as opposing forces pulling opposite ends of a rubber band — they will reach a breaking point, and the tension needs to be released in a controlled fashion. The CDO plays a key role, since they should be looking at the “big picture” of “big data”.

  • The CDO needs to be empowered and adopt a posture that balances pursuit of opportunity with proper governance – protection, quality, accuracy.
  • The CDO should be prominent in an organization, to begin addressing the many cultural barriers to information management.
  • The market needs to settle on a framework to manage information as an asset, recognizing it has value and utility to be exploited.

We are living in a world where data is everywhere and the ability to manipulate it for benefit is growing at an incredible pace. Market disruptions are occurring on a daily basis, often enabled by creative use of technologies that analyze data. Forward looking companies wanting to play in this space are looking to CDOs to help, and they need to be properly enabled. Now is the time to engage.